Indlela yokufunda ukushintshana kokuqala kwe-IKEv2 ekuthwebuleni amaphakethe

Ukuthwebula okuqalwa phakathi nesikhathi seseshini yikho okuyisizathu esivamile sokuthi umkhondo we-IKEv2 ubonakale njengomsindo, ngoba izinhlangothi sezivele zivuselela okhiye noma zishintshana imithwalo ebethelwe lapho ukuqopha kuqala. Qala ngesinye isikhathi ngomzamo wokuxhumana omusha, ukuze umlayezo wokuqala kufayela kube yiwona ovula izingxoxo. Ukulandelana kokufunda ngezansi kukucabangela lokho, futhi kumaka iphuzu lapho iphakethe liyeka ukufakazela khona noma yini mayelana nomkhawulo okude. Ukweqa leso sinyathelo yikho okwenza umhubhe osebenzayo kuxilongwe njengechweba elivaliwe.

Qinisekisa ukuthi ubuka ukushintshana kokuvula

Ingxoxo ye-IKEv2 iqala nge-IKE_SA_INIT, uhlobo lokushintshana 34, i-ID yomlayezo 0. Umqalisi ukhetha i-SPI engeyona uziro, futhi i-SPI kaphenduli inguziro kuleso sicelo sokuqala futhi ayisiyo uziro empendulweni. Lezo zinto ezintathu zehlukanisa umzamo omusha ekuvuselelweni kokhiye noma kumlayezo we-IKE_AUTH ovele ube phezulu ekuthwebuleni.

Izinkambu zekhanda ziyafundeka, kanjalo nemithwalo yesiphakamiso, yokushintshana kokhiye ne-nonce. Ukufundeka akusho ukuthi kuqinisekisiwe: alukho uhlangothi olufakazele ubunikazi kuleli phuzu, futhi inani eliyimfihlo le-Diffie-Hellman alilokothi livele ocwambini.

Phrinta izinkambu njengethebula esikhundleni sokugudluza iphaneli yokuhumusha, ngoba ukuthunyelwa kabusha kanye nama-SPI angahambelani kuba sobala emakholomu.

tshark -r ike.pcapng -Y "isakmp" -T fields -e frame.number -e ip.src -e udp.srcport -e isakmp.exchangetype -e isakmp.messageid -e isakmp.initiator_spi -e isakmp.responder_spi

Funda okukhiphayo ngamapheya. Isicelo esine-ID yomlayezo 0 esilandelwa impendulo ephethe i-ID efanayo kanye ne-SPI kaphenduli engeyona uziro ukushintshana okukodwa, ngisho noma kubonakala izikhathi ezintathu ngoba isicelo sathunyelwa kabusha. Izicelo ezintathu ezifanayo akuzona ukungena kathathu, futhi ukuziphatha kanjalo yikho okwenza abantu baphethe ngokuthi iklayenti lizungeza kuyilophe kanti linokubekezela nje. Hlela nge-ID yomlayezo, bese kuba ngesigxivizo sesikhathi, futhi yonke ingxoxo izonciphala ibe uhlu olufushane lwemizamo.

Funda ukwenqaba ngaphambi kokufunda impumelelo

Impendulo ayiyona ngokuzenzakalela inqubeko. Uphenduli angaphendula ngesaziso se-cookie futhi alindele ukuthi umqalisi aphinde azame, noma nge-INVALID_KE_PAYLOAD ebiza iqembu angayamukela esikhundleni salo. Kokubili kufika njengemilayezo ye-IKE eyakhiwe kahle, futhi kokubili kubonakala njengokushintshana okuqediwe kusihlungi esibala amaphakethe kuphela.

Vula umthwalo wesaziso futhi ufunde uhlobo ngaphambi kwanoma yini enye. Inselelo ye-cookie isho ukuthi uphenduli uzivikela emakhelini omthombo angamanga, futhi iklayenti kufanele liphinde lithumele ne-cookie. Iqembu elingavumelekile lisho ukuthi iziphakamiso ezimbili azivumelani, okungeke kukushintshe ukuzama okuphindaphindiwe kuze kushintshe ukucushwa kohlangothi olulodwa.

Yi-IKE_AUTH kuphela, ukushintshana kwesibili, okuthwala ubunikazi obethelwe kanye nemithwalo yokuqinisekisa. Ngakho-ke i-IKE_SA_INIT eqediwe ikutshela ukuthi izinhlangothi zivumelana ngezindlela zokubala nangokhiye abatholiwe, futhi ayisho lutho ngokuthi izifakazelo zizokwamukelwa yini. Lindela nemilayezo emibili lapho, futhi ulindele ukuthi kokubili kube mnyama ngaphandle kokhiye beseshini.

Ichweba 4500 akulona iphrothokholi elilodwa

I-UDP 500 ivamise ukuthwala ukushintshana kokuvula. Lapho ukutholwa kwe-NAT sekwenziwe, i-IKE idlulela ku-4500 futhi ibeka uphawu lweziro lwamabhayithi amane okungelona i-ESP phambi komlayezo ngamunye. I-ESP ehlanganisiwe kulelo chweba iqala nge-SPI ye-ESP engeyona uziro, futhi i-NAT keepalive yebhayithi elilodwa iyisimo sesithathu esivela lapho kungekho okunye okwenzekayo.

Isihlungi esihambelana nechweba kuphela sihlanganisa kokuthathu, yikho "kunokuhamba ku-4500" kunquma okuncane kangako. Hlukanisa umbono ngephrothokholi ngaphambi kokuphetha noma yini mayelana nomkhawulo okude.

tshark -r ike.pcapng -Y "udp.port == 4500 && isakmp" -T fields -e frame.number -e isakmp.exchangetype
tshark -r ike.pcapng -Y "udp.port == 4500 && !isakmp" -T fields -e frame.number -e esp.spi

Ukuthula kuchaza iphuzu lokubuka

Izicelo ezingenayo impendulo zisungula into eyodwa ngqo: kulelo phuzu lokuthwebula akukho mpendulo eyavela. Ukuhlunga, umzila ohambisa impendulo kwenye indawo, uphenduli ongafinyeleleki, noma uphenduli ongayithandanga isiphakamiso konke kunikeza umphumela ongenalutho ofanayo, futhi ukuhlolwa kwe-UDP okuvamile ngeke kuhlukanise lokho.

I-ICMP engafinyeleleki iwubufakazi obunye uhlobo. Funda iphakethe elicashuniwe ngaphakathi kwayo futhi ukhombe ukuthi iyiphi idivayisi eyikhiphile, ngoba ukwenqaba kokuphatha kwerutha akulona iphutha eliqinisekisiwe elivela kumkhawulo okude.

tshark -r ike.pcapng -Y "icmp.type == 3" -T fields -e frame.number -e ip.src -e icmp.code

Hlanganisa umzamo ofanayo namalogi ohlangothi lweseva lapho uvunyelwe khona ukuwafunda. Ingabe isicelo safika, ingabe isevisi saphendula, futhi impendulo yama kuphi? Lezo zimpendulo ezintathu zikuthumela enkingeni yomzila noma enkingeni yenqubomgomo, futhi zibiza kancane kunokushintsha izifakazelo okwesine.