sftf
I have "HMAC firewall" enabled with "tls-auth" option on Debian server (ovpn-2.1.3-2) and windows client (openvpn-2.2.2-install.exe).
I decided to check if "HMAC firewall" works - I change one byte in third line of client key like this:
5d98fba9c8a072cd2a0097de9cf07afe to
5d98fba9c8a073cd2a0097de9cf07afe
wich corresponds in bin format to
101110110011000111110111010100111001000101000000111001111001101...
101110110011000111110111010100111001000101000000111001011001101...
But I noticed that even with this modified HMAC key, client still may connect.
Then I tried to change two bytes instead of one byte, in line 6:
060b57d9316284b97e1b97e00a598014 to
060b57d9316284b97e1c97e00a598014
and in line 11:
47da7f0fa952b4111e82a8d766e5524f to
47da7f0fa952b4111e83a8d766e5524f
and client still may connect.
And only when changed one more byte in line 5 (3 changed bytes totally):
a2b1f73419dacd7e710729ec5276c487 to
a3b1f73419dacd7e710729ec5276c487
the client could not connect.
For me, this behavior is suspicious, because I expected that even a one mismatched bit should cause the server to discard such packets.
Am I right?
