diff --git a/0001-Fix-logical-expression-in-eap_client_active-macro.patch b/0001-Fix-logical-expression-in-eap_client_active-macro.patch
new file mode 100644
index 0000000..a313928
--- /dev/null
+++ b/0001-Fix-logical-expression-in-eap_client_active-macro.patch
@@ -0,0 +1,34 @@
+From 164daa56d2d52cf55f9a4ab2d0308bc9834d7dab Mon Sep 17 00:00:00 2001
+From: Michal Sekletar <msekleta@redhat.com>
+Date: Wed, 10 Dec 2014 10:38:11 +0100
+Subject: [PATCH] Fix logical expression in eap_client_active macro
+
+Currently the expression always evaluates to true and gcc gives following
+warning:
+
+> eap.c:236:2: warning: logical 'or' of collectively exhaustive tests is always
+true [-Wlogical-op]
+
+Resolves: #1023620
+---
+ pppd/eap.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pppd/eap.h b/pppd/eap.h
+index 3fa5391..087baad 100644
+--- a/pppd/eap.h
++++ b/pppd/eap.h
+@@ -110,8 +110,8 @@ enum eap_state_code {
+ 	"SRP1", "SRP2", "SRP3", "MD5Chall", "Open", "SRP4", "BadAuth"
+ 
+ #ifdef USE_EAPTLS
+-#define	eap_client_active(esp)	((esp)->es_client.ea_state != eapInitial ||\
+-				 (esp)->es_client.ea_state != eapPending ||\
++#define	eap_client_active(esp)	((esp)->es_client.ea_state != eapInitial &&\
++				 (esp)->es_client.ea_state != eapPending &&\
+ 				 (esp)->es_client.ea_state != eapClosed)
+ #else
+ #define eap_client_active(esp)	((esp)->es_client.ea_state == eapListen)
+-- 
+1.8.3.1
+
diff --git a/ppp.spec b/ppp.spec
index 683e12b..9bf8156 100644
--- a/ppp.spec
+++ b/ppp.spec
@@ -39,6 +39,7 @@ Patch34: ppp-2.4.5-crypt.patch
 Patch35: ppp-2.4.5-hardened.patch
 Patch36: 0001-pppd-Eliminate-potential-integer-overflow-in-option-.patch
 Patch37: 0001-sys-linux-rework-get_first_ethernet.patch
+Patch38: 0001-Fix-logical-expression-in-eap_client_active-macro.patch
 
 BuildRequires: pam-devel, libpcap-devel, openssl-devel, systemd
 Requires: glibc >= 2.0.6, /etc/pam.d/system-auth, libpcap >= 14:0.8.3-6, systemd
@@ -93,6 +94,7 @@ This package contains the header files for building plugins for ppp.
 %patch36 -p1 -b .cve-2014-3158
 # rewritten fix for bz#682381 - hardcodes eth0
 %patch37 -p1 -b .eth
+%patch38 -p1 -b .eap-client-active
 
 rm -f scripts/*.local
 rm -f scripts/*.change_resolv_conf
@@ -173,6 +175,7 @@ getent group dip >/dev/null 2>&1 || groupadd -r -g 40 dip >/dev/null 2>&1 || :
 * Tue Dec 09 2014 Michal Sekletar <msekleta@redhat.com> - 2.4.5-35
 - replace patch implementing get_first_ethernet with F21 version (#1062419)
 - don't ship /var/run/ppp (#1053135)
+- fix logical expression in eap_client_active macro (#1023620)
 
 * Tue Aug 12 2014 Michal Sekletar <msekleta@redhat.com> - 2.4.5-34
 - Fix for CVE-2014-3158