Inferring OpenVPN State Machines Using Protocol State Fuzzing

Abstract

The reliability of a security protocol is of the utmost importance but can easily be compromised by a vulnerability in the implementation. A crucial aspect of an implementation is the protocol's state machine. The state machine of an implementation can be inferred by black box testing using regular inference. These inferred state machines provide a good insight into implementations and can be used to detect any spurious behavior. We apply this technique to different implementations of OpenVPN: the standard OpenVPN and the OpenVPN-NL implementations. Although OpenVPN is a widely used TLS-based VPN solution, there is no official specification of the protocol, which makes it a particularly interesting target to analyze. We infer state machines of the server-side implementation and focus on particular phases of the protocol. Finally we analyze those state machines, show that they can reveal a lot of information about the implementation which is missing from the documentation, and discuss the possibility to include state machines in a formal specification.

Implementasi Keamanan Jalur Internet Menggunakan IP Tunneling pada OpenVPN Access Server dengan Protokol OpenVPN dan Protokol DNS Over HTTPS

“…Open Virtual Private Network (OpenVPN) (Daniel et al, 2018). Sebuah VPN memanfaatkan jaringan publik untuk menghubungkan beberapa lokasi jarak jauh.…”

Evaluating Susceptibility of VPN Implementations to DoS Attacks Using Adversarial Testing

“…Attacks are performed over the first 25 seconds of a measurement, which stops after 85 seconds if no connection has been established. 2 GNU/Linux 5.10.11-051011-generic x86 64 3 Intel® Xeon® CPU E5-2695 v4 4 Intel® Ethernet Controller XL710 for 40 GbE QSFP+ 5 GNU/Linux 5.4.0 x86 64 6 Intel® Xeon® Gold 6242 CPU 7 Mellanox MT27800 ConnectX-5 Measurements are taken across five runs. The plots in the following sections show mean and standard deviation values across these runs.…”

“…This approach is related to fuzzing, a common software testing technique that explores a large domain of possible inputs to provoke edge cases and reveal implementation bugs [18]. This technique has been applied to OpenVPN to find logical flaws in the state machine of implementations [2]. Similar to our approach, some fuzzing tools also apply evolutionary algorithms to effectively explore the input space of a given black-box application [20].…”

The Closer You Look, The More You Learn: A Grey-box Approach to Protocol State Machine Learning

“…The release of this library sparked a number of efforts to deploy model learning for applications such as conformance testing, legacy system inference, and most relevantly, security protocol analysis. In the security domain, it has been applied to various protocols, including TLS [17,18], SSH [22], Wi-Fi [36], TCP [20], OpenVPN [16], and many others [2,3,37].…”