tls-auth key-direction: 0 iyo 1 waa inay kala duwanaadaan, ma aha inay iswaafaqaan
tls-auth waxay labada daraf u baahan yihiin jihooyin iska soo horjeeda, 0 iyo 1, ama labaduba waa inay ka tagaan dejinta. Isla lambarka ayaa fashilma, tls-crypt-na waligiis ma isticmaalo.
Hal dhinac oo tunnel-ka ayaa kanaalka kontoroolka ku saxeexa slot key ah oo dhinaca kale waligiis aan hubin, xiriirkuna wuxuu ku dhintaa khalad xaqiijin ah ka hor inta aan hal shahaado la isweydaarsan. Sidaas ayaa ismaandhaafka jihada ee tls-auth u eg yahay, waana go'aan leh: isla labadaas fayl ayaa fashilma isku day kasta, shabakad kasta. Waxba laguma magacaabo log-ka xulka aad raadinayso, sidaas darteed dadku waxay dib u dhisaan furayaasha oo dib u soo saaraan shahaadooyin aan waligood xumaan. Xalku waa in labada daraf laga dhigo kuwo isbuuxiya, ama labadaba loo daayo laba-jiho, ma aha in la daciifo xaqiijinta.
Fashilku wuxuu dhacaa shahaadooyinka ka hor
tls-auth labada dhinac waxay hayaan isla furaha la wadaago, mid kastana wuxuu isticmaalaa mid ka mid ah laba slot oo laga soo saaray: hal slot ayaa saxeexa baakadaha kontoroolka ee baxa, kan kalena wuxuu xaqiijiyaa kuwa soo gala. Jihada 0 iyo jihada 1 waxay u qoondeeyaan doorarkan si iska soo horjeeda, sidaas darteed lammaanuhu waa inuu isbuuxiyaa si hubinta HMAC ay iswaafaqdo. Marka qoondaynta dhinac ka mid ah la rogo, qaataha wuxuu raadiyaa saxeex slot khaldan wuuna diidaa baakadka. Kulanku halkaas ayuu ku dhammaadaa, sidaas darteed khaladku wuxuu khuseeyaa xaqiijinta baakadaha, ma aha wax bakhaarka shahaadooyinku soo saari lahaa.
Go'aannimadu waxay muhiim u tahay ogaanshaha, sababtoo ah dhibaatada waqti ama waddo waxay ka tagtaa calaamad kale: go'itaanno joogto ah, hal jiho oo fashilma, ama kulan ku dhinta oo kaliya shabakad gaar ah. Ismaandhaafka jihadu wuxuu fashilmaa isku day kasta marka ugu horreysa ee gacan-qabsiga, wuxuuna si isku mid ah ugu fashilmaa mashiin kale oo haysta isla labadaas fayl. Akhri log-ka --verb 4 oo raadi baakadka ugu horreeya ee la diiday halkii safka ugu dambeeya. Haddii diidmadaas dhacdo ka hor wax isweydaarsi shahaado ah, furaha la wadaago iyo jihadiisa ayaa ah labada shay ee mudan in la hubiyo.
| What you see | What it rules out | Next check |
|---|---|---|
| Authentication error before any certificate is sent | The data channel is irrelevant; the control channel never authenticated | Compare tls-auth and its direction on both ends |
| Certificate or handshake failure after the control channel authenticates | The shared key and its direction already agree | Check the CA, the certificate dates and the hostname |
| Session completes but throughput or cipher warnings appear | Direction was never the problem | Compare the data-channel cipher settings |
| Startup stops on an options error | The number itself is not the issue | Re-read the inline versus external directive syntax |
Lambarku xaggee ku nool yahay
Buug-gacmeedka OpenVPN 2.6 wuxuu diiwaangeliyaa laba meelood oo jihada ah: doodda labaad ee tls-auth marka furaha uu ku jiro fayl gaar ah, iyo safka key-direction ee gaarka ah marka furaha lagu daro borofaylka. Labaduba waxay dejiyaan isla qiimaha, sidaas darteed borofaylku waa inuu isticmaalaa hal qaab ama kan kale, waligiis labadaba ma aha. Ka-tagiduna waa ikhtiyaar, waxayna labada dhinac gelisaa habayn laba-jiho ah oo shaqeeya marka aan dhinacna jihada sheegin. Laba dhinac oo isla lambarka qaata ma ku jiraan habayntaas: mid kastaa wuxuu filayaa inuu ku saxeexo hal slot oo ku xaqiijiyo kan kale, labaduna si isku mid ah ayay u sameeyaan.
# server.conf, external key tls-auth ta.key 0 # client.ovpn, external key tls-auth ta.key 1 # client.ovpn, inline key key-direction 1
Qaabka lagu daray waa tilmaan ku qoran safkeeda, ma aha sifo ku qoran tag-ga furitaanka ee block-ka furaha, oo dood ku darista tag-gaas waa khalad, ma aha isbeddel jiho. Goobtuna sidoo kale waa muhiim: tilmaantu waxay ka baxsan tahay block-ka ay ka tirsan tahay, sidaas darteed qiimaha block-ka gudihiisa lagu qoro waxaa loo akhriyaa sida maaddada furaha. Koobi habaynta qaybiyaha borofaylku u jeediyay halkii aad lammaane alif-laha, sababtoo ah borofayl ka shaqeeya hal server waxaa laga yaabaa in horey loogu milicsaday dhinaca kale.
Waxa xulku aanu taaban
Ma sir-geliyo taraafikada abka. tls-auth wuxuu HMAC ku wareejiyaa baakadaha kanaalka kontoroolka, halka kanaalka xogta lagu ilaaliyo furayaasha kulanka ee lagu wada-hadlay gacan-qabsiga, sidaas darteed su'aasha ku saabsan xawaaraha ama sir-gelinta wax xiriir ah lama laha lambarka jihada. Dejintu sidoo kale ma daro lakab sir-gelin labaad, waana dieedkaas dadka u dira inay raadiyaan fure dheer.
Ma khuseeyo tls-crypt, hab kale oo kanaalka kontoroolka leh xulashooyin iyo maaraynta furaha u gaar ah, waxbana kama sheegto aqoonsiga shahaadada dhinac kasta. Sidaas darteed iswaafaqa jihada ee shaqeeya wuxuu kaliya caddeeyaa in labada daraf ay ku heshiiyeen sida loo xaqiijiyo kanaalka kontoroolka, ma aha in silsiladda kalsoonida la xaqiijiyay.
Toosi lammaanaha, kadib dib u xiriir
Isbarbar dhig labada habayn ka hor inta aanad mid beddelin, sababtoo ah wax ka beddelka dhinaca horey u saxnaa wuxuu labanlaabaa shaqada. Grep-ka hoose wuxuu muujinayaa habka ay fayl kastaa dooratay; socodka faahfaahsan wuxuu muujinayaa haddii kanaalka kontoroolka la xaqiijiyay. Kaydi labada wax-soo-saar, si isbeddelka xiga loo barbar dhigo xaalad la yaqaan.
grep -n -E 'tls-auth|tls-crypt|key-direction' server.conf client.ovpn openvpn --config client.ovpn --verb 4 2>&1 | grep -i -E 'hmac|tls error|control channel'
Dib u bilow labada dhinac isbeddel kasta ka dib, sababtoo ah xulashooyinkan waxaa la akhriyaa hal mar bilowga, dib u soo dejintuna hal dhinac waxay lammaanaha ka tagtaa mid aan iswaafaqsanayn inta ay socoto kulanka hore. Haddii daabacaaddu hadda shaqeyso iyada oo aan jihada la habayn, ku darista dejinta hal dhinac waxay dib u soo saartaa fashilka aad ku bilaabatay; ama labadaba daa ama labadaba habee. Beddel hal daraf markiiba oo kaydi faylka hore, si dib-u-noqoshadu noqoto laba daqiiqo oo dib-u-celin ah halkii dib-u-dhis.
Qor habka, faylka furaha iyo jihada daraf kasta oo ku qoran qoraallada daabacaadda, haddii kale qofka xiga wuxuu akhrin doonaa laba fayl oo isku mid ah oo uu u malayn doonaa in lambaradu iswaafaqaan. Jihadu waa faahfaahin isku-dubbarid, ma aha kor-u-qaadid amni: waxay kala soocdaa labada jiho ee kanaalka kontoroolka oo wax kale ma qabato.