Added OpenVPN HMAC MD5, SHA256 and SHA512 variants #71
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bbannier
approved these changes
Jul 5, 2021
| @@ -9,6 +9,6 @@ | |||
| #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents | |||
| #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] | |||
| #close XXXX-XX-XX-XX-XX-XX | |||
| XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.56.103 33198 192.168.56.102 1194 udp spicy_openvpn_udp_hmac 61.136881 10040 11479 SF - - 0 Dd 111 13148 109 14531 - | |||
| XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.56.104 35701 192.168.56.102 1194 udp spicy_openvpn_udp_hmac 59.861846 9985 11479 SF - - 0 Dd 110 13065 109 14531 - | |||
| XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.56.103 33198 192.168.56.102 1194 udp spicy_openvpn_udp_hmac_sha1 61.136881 10040 11479 SF - - 0 Dd 111 13148 109 14531 - | |||
There was a problem hiding this comment.
I think long term introducing new parsers for each new auth scheme is not good as changes to this log are from a user perspective API breaks. Ideally we'd have a single analyzer for OpenVPN.
I filed #72 to track that cleanup.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There are other HMAC sizes that I was missing. Now this will catch connections with MD5, SHA1, SHA256, and SHA512 HMAC sizes. We only supported the default (SHA1) with the original code. I made the pcap for the SHA256 test.