Khalad kalsooni Android IKEv2: dir CA dhexe, ma aha xidid
Telefoonku wuu diidayaa gateway-ga sababtoo ah silsiladda la helay goor hore ayay joogsataa. Go'aanso: dir dhexe, hagaaji aqoonsiga, ama beddel nooca furaha.
Telefoonku wuu diidayaa inuu xirmo oo wuxuu daabacaa No trusted RSA public key found for vpn.example.net, halka isla shahaadada gateway-ga ay ka shaqeyso laptop ku yaal isla shabakadda. Tallaabada soo jiidashada leh waa in shahaadada dib loo soo saaro. Ka hor intaadan sidaas yeelin, go'aanso mid ka mid ah saddexda guuldarrood ee aad haysato, sababtoo ah mid kaliya ayaa ku saabsan nuxurka shahaadada. Farriintu waxay ka hadashaa silsilad aan dhamaystirnayn, isku mid ahayn aqoonsiga, iyo fure ama saxe aan la taageerin, mid kastana hagaajin gaar ah ayuu leeyahay.
Saddex guuldarrood oo ka dambeeya hal farriin
Android wuxuu silsilad ka dhisaa shahaadada gateway-ga ilaa CA lagu doortay profile-ka VPN, ka dibna wuxuu isbarbardhigaa magaca server-ka iyo profile-ka. Ogeysiisku wuxuu sheegaa natiijada, ma aha marxaladda. Guuldarro kalsooni macneheedu waa silsiladda lama dhammayn karin shahaadada la bixiyay isdhaafsiga; guuldarro aqoonsi macneheedu waa silsiladda la xaqiijiyay laakiin magacu ma aha mid u dhigma; guuldarro algorithm macneheedu waa qalabka ama profile-ku ma aqbalo nooca furaha ama saxe.
| What you see | What it points to | First move |
|---|---|---|
| Chain stops after the leaf in the daemon log | intermediate not loaded or not sent | load the intermediate as CA material |
| Chain validates, name differs from the profile | identity mismatch | fix the profile name or the certificate SAN |
| Chain validates, handshake still fails | key or signature not accepted | compare key type against the device |
Ku go'aanso caddayn halkii aad isku dayi lahayd hagaajin si isdaba joog ah. Hal isku day heer log 2 ah oo ka hortimaada daemon-ka ayaa kuu sheegaya safka aad ku jirto, waana ka jaban tahay dib u soo saarista shahaadada aan waligeed khalad ahayn.
Marka hore go'aanso: silsiladda oo dhan ma timid?
strongSwan wuxuu diraa shahaadada loo habeeyay xiriirkaas, shahaadada dhexena waa aqoonsiyo gaar ah. Waa in loo raro sida shahaadada CA ka hor inta daemon-ku uusan gelin karin payload, sidaas darteed qaab ay shahaadada server-ka ku saxeexan tahay mid dhexe, xididku yahay bar-ka kalsoonida, oo dhexe kaliya ku noolaado galka dhisidda CA waxay soo saartaa isla guuldarradan: caleen kaliya oo ku taal xarigga, silsiladda goor hore ayay ku dhammaataa telefoonka.
Hubi waxa daemon-ku hayo iyadoo la isticmaalayo swanctl --list-certs rakibaadda swanctl, ama ipsec listcerts starter-kii hore. Dhexe waa inuu u muuqdaa sida shahaadada CA oo xididku ka sarreeyo. Haddii ay maqan tahay, wax ikhtiyaar macmiil ah ma caawin karo; haddii ay jirto, u gudub su'aasha xigta.
Ka dib hubi in la dirayo iyo in kale. Tixraaca swanctl.conf wuxuu qeexayaa send_cert, kaas oo caadiga ah ifasked dira shahaadada kaliya marka dhinaca kale uu codsaday; always had iyo jeer wuu diraa. Waxa u dhigma ee hore waa leftsendcert=always gudaha ipsec.conf. Dejintaas waxay xakameynaysaa dirista, ma aha helitaanka, sidaas darteed ma magdhabi karto dhexe aan daemon-ku waligiis rarin.
Haddii silsiladdu gaaban tahay, ku rar dhexe meesha daemon-ku ka raadiyo
Dhexe geli galka CA halkii aad ka geli lahayd caleenta: /etc/ipsec.d/cacerts habaynta ipsec.conf, /etc/swanctl/x509ca swanctl, ama waddada ay beddesho xidhmadaada. Dib u rar habaynta oo liis shahaadada mar kale. Noocyada qaar waxay sidoo kale diraan xidhmo silsiladda ku jirta faylka caleenta, laakiin galka CA waa qaab la qaadi karo noocyada iyo xidhmada.
Sidoo kale ka xaqiiji dhinaca macmiilka. Telefoonku wuxuu arkaa kaliya waxa isdhaafsigu qaaday, sidaas darteed log-ga daemon-ka heer 2 waa inuu muujiyaa dhexe shahaadada la diray. Haddii log-ku muujiyo isla markaana telefoonku wali guuldarraysto, waxaad ku jirtaa saf kale oo shaxda, oo sii hagaajinta faylasha CA natiijada ma beddeli doonto.
Haddii silsiladdu dhamaystiran tahay, jooji tafatirka shahaadada
Guuldarro aqoonsi waa isku mid ahayn u dhaxaysa magaca profile-ka VPN iyo magaca shahaadada. Android wuxuu isbarbardhigaa aqoonsiga server-ka aad habaysay iyo shahaadada uu xaqiijiyay, sidaas darteed profile tilmaamaya ciwaan halka shahaadadu magac martigeliye sheegayso, ama profile sheegaya magac martigeliye aan shahaadadu daboolin, wuu guuldarraystaa ka dib xaqiijin silsilad guul leh. Hagaaji dhinaca khaldan, oo profile-ka iyo shahaadada is waafaji marka midkood beddelmo.
Guuldarro algorithm waxay u muuqataa silsilad ansax ah iyo magac u dhigma. Noocyada Android way ku kala duwan yihiin nooca furaha iyo qaabka saxe ee ay aqbalaan, oo nooca profile-ka laftiisu wuxuu xaddidaa ikhtiyaarada. Haddii gateway-ku isticmaalo isku dhaf duug ah ama aan caadi ahayn, isbarbardhig waxa qalabku taageero ka hor intaadan u qaadan in shahaadadu xumaatay. Log-ga daemon-ku wuxuu muujin doonaa gacan-qabsiga oo sii socda meel ka fog marka loo eego kiiska kalsoonida, taasina waa calaamadda ah in silsiladdu aanay hadda dhibaatada ahayn.
Ha ku rakibin dhexe sida xidid isticmaale telefoonka
Ku rakibidda dhexe ee maqan sida shahaadada isticmaale telefoonka waxay meesha ka saartaa digniinta waxayna beddelaa qaabka kalsoonida telefoonka ee app kasta oo aqbala xididdada isticmaaluhu rakibay. Sidoo kale waxay qarinaysaa cilad gaarsiineed oo ku dhici doonta macmiilka xiga, waxayna u ogolaataa gateway-ku inuu u diro silsilad aan dhamaystirnayn qalab kasta oo mustaqbalka. Hagaajinta waarta waxay ku taal server-ka, hal mar, dhammaan macmiilka.
Saddexda go'aan ku hay kala duwan diiwaanka isbeddelka: shahaadada la diray, aqoonsiga la isbarbardhigay, iyo algorithm-ka la wada xaajooday. Gateway had iyo jeer dira silsiladdiisa buuxda, profile si sax ah u magacaaba shahaadada, iyo nooca furaha ay kooxdu taageerto waa saddex xaqiiqooyin yar, oo waa guuldarradan oo dhan.