MITMVpn/selftest_passive_detection.sh at main · vektort13/MITMVpn · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
#!/usr/bin/env bash
set -euo pipefail

cleanup() {
  truncate -s 0 /var/log/openvpn/dnsmasq.log \
    /var/log/openvpn/p0f.log \
    /var/log/suricata-openvpn/eve.json \
    /var/log/openvpn/session-events.log || true
  /usr/local/bin/openvpn-passive-detect || true
  systemctl start suricata-openvpn.service p0f-openvpn.service openvpn-passive-detect.service || true
}
trap cleanup EXIT

systemctl stop openvpn-passive-detect.service suricata-openvpn.service p0f-openvpn.service

cat >> /var/log/openvpn/dnsmasq.log <<'EOF'
May 27 18:56:00 dnsmasq[1]: 10 10.8.0.10/53000 query[A] update.googleapis.com from 10.8.0.10
May 27 18:56:01 dnsmasq[1]: 11 10.8.0.11/53001 query[A] web.telegram.org from 10.8.0.11
EOF

cat >> /var/log/suricata-openvpn/eve.json <<'EOF'
{"timestamp":"2026-05-27T18:56:02.000000+0400","event_type":"tls","src_ip":"10.8.0.10","src_port":51000,"dest_ip":"13.107.21.200","dest_port":443,"tls":{"sni":"msedge.api.cdp.microsoft.com","version":"TLS 1.3","ja3":"771,4865-4866-4867,0-11-10,29-23-24,0","ja3s":"771,4865,0","alpn":"h2"}}
{"timestamp":"2026-05-27T18:56:03.000000+0400","event_type":"flow","src_ip":"10.8.0.11","src_port":51001,"dest_ip":"149.154.167.50","dest_port":443,"proto":"TCP"}
{"timestamp":"2026-05-27T18:56:04.000000+0400","event_type":"http","src_ip":"10.8.0.12","src_port":51002,"dest_ip":"93.184.216.34","dest_port":80,"http":{"hostname":"detectportal.firefox.com","url":"/canonical.html","http_user_agent":"Mozilla/5.0 Firefox/126.0"}}
EOF

cat >> /var/log/openvpn/p0f.log <<'EOF'
.-[ 10.8.0.10/51000 -> 93.184.216.34/443 (syn) ]-
os = Windows 10 or newer; dist = 12; params = none
EOF

/usr/local/bin/openvpn-passive-detect
jq -r '.clients[] | [.client, (.apps | map(.app + ":" + (.score|tostring)) | join(", ")), (.os.guess // "")] | @tsv' /var/lib/openvpn-lab/passive-summary.json

grep -q 'Google Chrome / Chromium' /var/lib/openvpn-lab/passive-summary.json
grep -q 'Microsoft Edge' /var/lib/openvpn-lab/passive-summary.json
grep -q 'Telegram' /var/lib/openvpn-lab/passive-summary.json
grep -q 'Mozilla Firefox' /var/lib/openvpn-lab/passive-summary.json
grep -q 'Windows 10 or newer' /var/lib/openvpn-lab/passive-summary.json

echo "passive_selftest_ok"