OpenVPN Connectivität testen mit PowerShell

function Send-OpenVPNClientResetMessage {
    param(
        [Parameter(mandatory=$true)][string]$hostname,
        [Parameter(mandatory=$false)][int]$port = 1194,
        [Parameter(mandatory=$true)][string]$authfile,
        [Parameter(mandatory=$false)][int]$timeout = 5000,
        [Parameter(mandatory=$false)][ValidateSet('HMACSHA1','HMACSHA256','HMACSHA384','HMACSHA512')][string]$hashalgorithm = 'HMACSHA1'  
    )

    # load secret key from file
    $ta_bytes = [regex]::matches(([regex]::match((gc $authfile -raw),'(?ism)(?<=-$).*?(?=^-)').Value.trim() -replace '[^\da-f]'),'.{2}').Value | %{[byte][convert]::ToUInt32($_,16)}  
    
    #$serverkey = $ta_bytes[64..127]
    
    # create HMAC with secret client key
    $hmac = [System.Security.Cryptography.HMAC]::Create($hashalgorithm)
    # set clientkey for HMAC
    $hmac.Key = $ta_bytes[192..(192+($hmac.HashSize / 8)-1)]
    
    # create random 8 byte session id
    [byte[]]$sid = 1..255 | get-random -Count 8 | %{[byte]$_}
    # generate unix time in 4 bytes
    [byte[]]$time = [System.BitConverter]::GetBytes([uint32][double]::Parse((Get-Date (get-date).ToUniversalTime() -UFormat %s)))

    # convert time to big endian
    [array]::Reverse($time)
    
    # create HMAC header
    [byte[]]$hmac_payload = 0,0,0,1 + $time + 56 + $sid + 0,0,0,0,0

    # create final packet
    [byte[]]$payload = (,56) + $sid + $hmac.ComputeHash($hmac_payload) + 0,0,0,1 + $time + 0,0,0,0,0

    $result = $null, $udpobject = $null
    try{
        # create udp client
        $udpobject = new-Object system.Net.Sockets.Udpclient
        # set client timeout
        $udpobject.Client.ReceiveTimeout = $timeout
        # create local udp endpoint
        $remoteendpoint = New-Object system.net.ipendpoint([system.net.ipaddress]::Any,0)
        # send udp payload
        [void]$udpobject.Send($payload,$payload.Length,$hostname,$port)
        # receive response bytes
        $buffer = $udpobject.Receive([ref]$remoteendpoint)

        return [pscustomobject]@{
            Sid = $sid
            KeyData = $ta_bytes[64..(64+($hmac.HashSize/8)-1)]
            ResponseBuffer = $buffer
            HashAlgorithm = $hashalgorithm
        }
    }catch{
        write-host $_.Exception.Message -F Red
    }finally{
        if ($udpobject) {$udpobject.Close();$udpobject.Dispose()}
    }
}

# Validate Server response function
function Validate-OpenVPNServerResponse {
    [cmdletbinding()]
    param(
        [Parameter(mandatory=$true, ValueFromPipelineByPropertyName=$true)][ValidateNotNullOrEmpty()][byte[]]$ResponseBuffer,
        [Parameter(mandatory=$true, ValueFromPipelineByPropertyName=$true)][ValidateNotNullOrEmpty()][Alias('Sid')][byte[]]$QuerySid,  
        [Parameter(mandatory=$true, ValueFromPipelineByPropertyName=$true)][ValidateNotNullOrEmpty()][byte[]]$KeyData,
        [Parameter(mandatory=$true, ValueFromPipelineByPropertyName=$true)][ValidateNotNullOrEmpty()][string]$HashAlgorithm
    )

    process{
        $digest_size = $KeyData.Length

        # identify packet
        $ident = $ResponseBuffer.Length - $ResponseBuffer[9] * 4
        if ($ident -eq 14){
            $plen = 0
        }elseif($ident -eq 22){
            $plen = 1
        }elseif(($ResponseBuffer.Length - $ResponseBuffer[(17 + $digest_size)] * 4) -eq (30+$digest_size)){
            $plen = 2
        }else{
            write-error -Message "Packet could not be identified!"  
            return $null
        }

        # parse packet
        $ptype = $ResponseBuffer # packet type
        $sid = $ResponseBuffer[1..8] # sessionid
    
        if ($plen -ge 2){
            $phmac = $ResponseBuffer[9..(9+$digest_size-1)]
            $_pid = $ResponseBuffer[($digest_size+12)]
            $time = $ResponseBuffer[($digest_size+13)..($digest_size+16)]
        }

        $mpidlen = $ResponseBuffer[($digest_size+17)] # message packet id array length
        $mpidarray = 0..$midplen | %{$ResponseBuffer[($digest_size+18+$_)..($digest_size+21+$_)]}

        $cpos = $digest_size+18+($midplen * 4)

        if ($plen -ge 1){
            $rsid = $ResponseBuffer[$cpos..($cpos + 7)] # remote session id
        }
        $mpid = $ResponseBuffer[($cpos + 12)] # message packet id

       # validate packet
        if ($ptype -ne 64) {
            write-error -Message "Wrong packet type."  
            return $null
        }
        if ($mpid -ne 0){
            write-error -Message "Wrong message packet id."  
            return $null
        }
        if($plen -ge 1 -and (!(compare $rsid $QuerySid))){
            write-error -Message "Wrong session id."  
            return $null
        }
        if ($plen -ge 2 -and $KeyData){
            if ($_pid -ne 1){
                write-error -Message "Wrong pid."  
                return $null
            }
            # generate hmac
            # create HMAC with secret server key
            $hmac = [System.Security.Cryptography.HMAC]::Create($HashAlgorithm)
            $hmac.Key = $KeyData

            [byte[]]$payload = (0,0,0,$_pid) + $time + $ptype + $sid + $mpidlen + 0,0,0,0 + $rsid + $mpid

            if (!(Compare $phmac $hmac.ComputeHash($payload))){
                Write-Error -Message "Invalid HMAC"  
                return $null
            }

            write-host "Response validated - checked HMAC!" -F Green  
            return $true
         }
         write-host "Response validated!" -F Green  
         return $true
    }
}

Send-OpenVPNClientResetMessage -hostname "openvpn.server.tld" -port 1194 -authfile 'D:\openvpn\ta.key' -hashalgorithm HMACSHA1 -timeout 4000 | Validate-OpenVPNServerResponse