Kungani i-tcpdump ikhombisa umbhalo ocacile we-IPsec ohlangothini olulodwa kuphela

Ugijima i-tcpdump kusixhumanisi sangaphandle sesango le-IPsec le-Linux futhi ubona izinto ezimbili ngesikhathi esisodwa: amafreyimu e-ESP angenayo futhi, ngokushesha ngemva kwawo, amaphakethe angaphakathi asetshenzisiwe. Ngokuphuma, i-ESP kuphela ebonakalayo. Isiphetho esingokwemvelo ukuthi izimpendulo azithunyelwa noma ukuthi i-IPsec ibhala uhlangothi olulodwa bese ikhohlwa olunye. Akukho kokubili okulungile.

Lokho okubukayo yindawo yokubamba. I-kernel iguqula amaphakethe aphumayo ngaphambi kokuba indlela yokudlulisa yedivayisi iwanikeze isokhethi yamaphakethe, ngakho isokhethi ayiboni neze isimo sangaphakathi lapho kuphuma. Ekungeneni, iphakethe libanjwa kuqala njenge-ESP futhi ikhophi ekhishwe embozweni iyabonakala lapho iphinda ingene esiteki. Ukuhamba okufanayo, amawindi amabili ahlukene okubuka.

Indawo yokubamba inquma ukuthi ubona ini

Kusixhumanisi esijwayelekile, isokhethi ye-AF_PACKET ihlezi eduze kwengqimba yedivayisi. Amaphakethe ashiya umhambukeli aqala adlule ekucubunguleni okuphumayo kwe-IPsec, okuguqula ingxenye ye-TCP yangaphakathi ibe idathagramu ye-ESP noma ye-UDP-4500, bese kuba ngemva kwalokho afinyelela kuleyo ngqimba. Amaphakethe angenayo akopishwa esokhethini njengoba ephuma ocingweni, esabhalwe ngemfihlo, futhi umphumela okhishiwe embozweni uyabonakala kamuva lapho isiteki iwuletha endaweni noma iwudlulisela phambili.

Lokho kuhleleka kuchaza ngokuphelele ukungalingani. Akubona ubufakazi mayelana nendlela, inqubomgomo noma ukuziphatha kohlelo lokusebenza, futhi ukukuthatha kanjalo kuxosha abantu ukuthi balandele impendulo eyayithunyelwa ngendlela efanele ngaso sonke isikhathi. Lena ingenye yezimfumbe zenethiwekhi ezimbalwa lapho ithuluzi, hhayi inethiwekhi, lidala okungajwayelekile.

Hlanganisa isihlungi nengqimba oyishoyo

Isisho esifana ne-tcp port 443 sikhetha uxhumano lwe-TCP lwangaphakathi. Ngokuphuma, lolo xhumano selusuphenduke i-ESP ngesikhathi isokhethi ibuzwa, ngakho isihlungi asihambisani nalutho. Uma ufuna ukubala ukuhamba okuvikelwe, hlunga ngendlela yangaphandle esikhundleni salokho: iphrothokholi engu-50 ye-ESP eluhlaza, noma imbobo ye-UDP engu-4500 uma kusetshenziswa ukuwela kwe-NAT. Zombili izihlungi zinikeza inani lamaphakethe elingaqhathaniswa phakathi kwezinhlangothi ezimbili, okuvamise ukuba yisizathu sokubala. Akukho kuzo okutshela ukuthi isicelo sangaphakathi saphendulwa yini.

Ungayithathi inani le-UDP 4500 njengenani lamaphakethe e-ESP. I-IKE nayo isebenzisa leyo mbobo yemiyalezo yokugcina i-NAT-T iphila nokushintshana okufakwe embozweni, ngakho inani lifaka ukuhamba okungeyona idatha obufuna ukuyikala. Ukushintshana kokuqala kwe-IKE ku-UDP 500 kudinga isihlungi saso uma lowo kuwumbuzo. Inani elihlanganisa ukuhamba kokulawula nedatha lenza nazo zonke izilinganiso zomkhawulokudonsa zibe nephutha elingaziwa. Izibalo ezihlukene ziphendula imibuzo ehlukene.

Bhala isihlungi eceleni kombuzo esiwuphendulayo. «Kungakanani i-ESP esaphuma ebhokisini» kanye «ingabe isicelo sewebhu saphuma ebhokisini» izilinganiso ezihlukene ngezihlungi ezihlukene, futhi ukubamba okukodwa akukwazi ukuxazulula kokubili. Ngaphandle kwalowo mbhalo, abantu ababili bazokuqhathanisa izinamba abangakaze bazibale into efanayo.

Bukisisa ngaphambi kokuguqulwa, hhayi ngemva

Uma udinga ukubona umbhalo ocacile ophumayo, hamba indawo yokubuka isikhathi sangaphambili, ngaphambi kokucubungula okuphumayo kwe-IPsec. I-NFLOG ikunikeza ingwegwe ye-Netfilter lapho umthetho ungakopisha khona amaphakethe akhethiwe esokhethini endaweni yomsebenzisi, i-tcpdump engayifunda. Umhlahlandlela we-strongSwan wokukhipha ukuhamba ubhala le ndlela ngenxa yalesi sizathu.

Ukuhambisana kwenqubomgomo kukhawulela umthetho ekuhambeni osekuza kungena kuthaneli. I--m policy --pol ipsec --dir out iyona eyenza umthetho ube oqondile esikhundleni sokuloga yonke iphakethe elithunyelwa ibhokisi. Bese ufunda iqembu lelogi ngokubamba okulinganiselwe: inani elincane lezithombe zesikhashana nomkhawulo wosayizi kuvimbela ukuxilonga ukuthi kungabi yingobo yokugcina ukuhamba. Ukubamba okulinganiselwe futhi kulula ukukunikeza umhloli ngaphandle kokuhudula umthwalo ongenamsebenzi. Nquma inani ngaphambi kokuqala, hhayi ngemva kokubona ukuthi kufike okungakanani.

iptables -I OUTPUT 1 -d 10.83.0.44/32 -p tcp --dport 8443 -m policy --pol ipsec --dir out -j NFLOG --nflog-group 5
tcpdump -ni nflog:5 -s 128 -c 20 'host 10.83.0.44 and tcp port 8443'

Khetha ingwegwe ehambisana nokugeleza. I-OUTPUT ihlanganisa ukuhamba okukhiqizwa isango ngokwalo; ukudlula okuvela kuklayenti ye-LAN kudlula ochungechungeni lwe-FORWARD esikhundleni salokho, futhi umthetho ku-OUTPUT awusoze wakubona. Ikheli nembobo okungenhla kuyizindawo zokubamba zendawo yokuhlola evunyelwe.

Ukubuka kufakazelani

I-NFLOG iwumgomo wokuloga, hhayi isinqumo sokwamukela. Iphakethe elivela lapho likhombisa ukuthi lafinyelela ingwegwe futhi lahambisana nomthetho. Alikhombisi ukuthi isihlungi sakamuva salivumela, ukuthi idivayisi yalidlulisa noma ukuthi uhlangothi lwamukele okuthile.

Ilogi elingenalutho nalo alicaci. Hlola isibali samaphakethe somthetho, qinisekisa indlela, qinisekisa ukuthi ukugeleza kwahambisana neqiniso nenqubomgomo ye-IPsec, futhi uqinisekise indawo ekuyiwa kuyo. Isibali esihambisanayo ezinhlangothini zombili kuphela esiguqula ukubuka kube yisiphetho. Bese uqhathanisa izibali zenhlangano yezokuphepha ezinhlangothini zombili zomzamo ofanayo olawulwayo, ngoba izibali ze-SA ziwumbhalo ogunyaziwe walokho okuvikelwe nokuthunyelwe.

Elinye igibe: «umbhalo ocacile» kulesi simo sisho ngaphandle kwengqimba yokubhala ngemfihlo ye-IPsec. Isikhathi se-HTTPS sangaphakathi sisene-TLS yaso. Ukubamba iphakethe elikhishwe embozweni akukhululi i-TLS yohlelo lokusebenza, futhi ukubona i-HTTP efundekayo lapho kusho ukuthi uhlelo lokusebenza lwalungakaze lusebenzise i-HTTPS.

Hlanza futhi uqhathanise iziphetho zombili

Susa umthetho oqondile owufakile, ngokomnikazi wawo, ngokushesha lapho ukubuka kuphela. Ukushiya umthetho wokuloga endaweni kudla i-CPU kuwo wonke iphakethe elihambisanayo futhi ngokuthula kudala inkinga yokugcinwa kwedatha. Susa ngokuphinda umthetho nge--D esikhundleni sokukhipha uchungechunge okungewakho.

iptables -D OUTPUT -d 10.83.0.44/32 -p tcp --dport 8443 -m policy --pol ipsec --dir out -j NFLOG --nflog-group 5

Uma ukusetshenziswa kusebenzisa i-IPsec yendaweni yomsebenzisi, isixhumanisi se-XFRM noma ukwehliswa kwemithwalo ngezingxenyekazi, izindawo zokubuka ziyasuka futhi le ndlela yokupheka ingase ingasebenzi nhlobo. Nge-libipsec, indawo ebhalisiwe yokubuka ukuhamba kwangaphakathi idivayisi ye-TUN. Qala ukhiqize indlela, bese ukhetha indawo ephendula umbuzo, futhi ulindele ukuthi izinhlangothi ezimbili zibonakale zihlukile kuphela uma ubheka ohlangothini olungalungile lokuguqulwa.