SWAN之ikev2协议multi-level-ca配置测试

IPSecurity 专栏收录该内容
89 篇文章 4 订阅

本测试主要验证多级CA证书验证的功能,远程用户carol,dave与网关moon建立连接时,分别使用中间CA证书所签发的实体证书,分配给carol的证书仅可访问moon网关之后的alice主机;dave的证书仅可访问venus主机。两个中间CA证书的名称CN分别为"Research CA"和"Sales CA"。本次测试拓扑如下:

在这里插入图片描述

carol主机配置

carol的配置文件:ikev2/multi-level-ca/hosts/carol/etc/ipsec.conf,内容如下。字段rightca的值为"C=CH, O=Linux strongSwan, CN=strongSwan Root CA",即要求对端的CA证书名称CN为:“strongSwan Root CA”。此外,定义了两个子连接alice和venus,字段rightsubnet分别对应主机alice(10.1.0.10)和主机venus(10.10.20)。

conn %default
        left=PH_IP_CAROL
        leftcert=carolCert.pem
        leftsendcert=ifasked
        right=PH_IP_MOON
        rightid=@moon.strongswan.org
        rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"

conn alice
        rightsubnet=PH_IP_ALICE/32
        auto=add

conn venus
        rightsubnet=PH_IP_VENUS/32
        auto=add

carol主机的证书文件carolCert.pem内容如下,其签发者Issuer的信息为:C = CH, O = strongSwan Project, OU = Research, CN = Research CA。

$ openssl x509 -in ikev2/multi-level-ca/hosts/carol/etc/ipsec.d/certs/carolCert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = strongSwan Project, OU = Research, CN = Research CA
        Validity
            Not Before: Sep 14 08:37:52 2019 GMT
            Not After : Sep 14 08:37:52 2027 GMT
        Subject: C = CH, O = strongSwan Project, OU = Research, CN = carol@strongswan.org

dave主机配置

dave的配置文件:ikev2/multi-level-ca/hosts/dave/etc/ipsec.conf,内容如下。字段rightca的值为"C=CH, O=Linux strongSwan, CN=strongSwan Root CA",即要求对端的CA证书名称CN为:“strongSwan Root CA”。此外,定义了两个子连接alice和venus,字段rightsubnet分别对应主机alice(10.1.0.10)和主机venus(10.10.20)。

conn %default
        left=PH_IP_DAVE
        leftcert=daveCert.pem
        leftsendcert=ifasked
        right=PH_IP_MOON
        rightid=@moon.strongswan.org
        rightca="C=CH, O=Linux strongSwan, CN=strongSwan Root CA"

conn alice
        rightsubnet=PH_IP_ALICE/32
        auto=add

conn venus
        rightsubnet=PH_IP_VENUS/32
        auto=add

dave主机的证书文件daveCert.pem内容如下,其签发者Issuer的信息为:C = CH, O = strongSwan Project, OU = Sales, CN = Sales CA。

$ openssl x509 -in ikev2/multi-level-ca/hosts/dave/etc/ipsec.d/certs/daveCert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = strongSwan Project, OU = Sales, CN = Sales CA
        Validity
            Not Before: Sep 14 08:37:52 2019 GMT
            Not After : Sep 14 08:37:52 2027 GMT
        Subject: C = CH, O = strongSwan Project, OU = Sales, CN = dave@strongswan.org

网关配置

moon网关的配置文件:ikev2/multi-level-ca/hosts/moon/etc/ipsec.conf,内容如下。连接alice配置中,rightca字段为"C=CH, O=strongSwan Project, OU=Research, CN=Research CA",要求对端的CA名称CN为:“Research CA”。远程客户carol使用的证书满足此要求。

连接venus配置中,rightca字段为"C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA",要求对端的CA名称CN为:“Sales CA”。远程客户dave使用的证书满足此要求。

conn %default
        left=PH_IP_MOON
        leftcert=moonCert.pem
        leftsendcert=ifasked
        leftid=@moon.strongswan.org

conn alice
        leftsubnet=PH_IP_ALICE/32
        right=%any
        rightca="C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
        auto=add

conn venus
        leftsubnet=PH_IP_VENUS/32
        right=%any
        rightca="C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
        auto=add

moon网关的CA证书researchCert.pem,由根CA:strongSwan Root CA所签发,签发给Research部门(OU),名称(CN)为:Research CA。

$ openssl x509 -in ikev2/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/researchCert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 11 (0xb)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = strongSwan Project, CN = strongSwan Root CA
        Validity
            Not Before: Sep 14 08:37:52 2019 GMT
            Not After : Sep 14 08:37:52 2028 GMT
        Subject: C = CH, O = strongSwan Project, OU = Research, CN = Research CA

moon网关的CA证书salesCert.pem,由根CA:strongSwan Root CA所签发,签发给Sales部门(OU),名称(CN)为:Sales CA。

$ openssl x509 -in ikev2/multi-level-ca/hosts/moon/etc/ipsec.d/cacerts/salesCert.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 12 (0xc)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = CH, O = strongSwan Project, CN = strongSwan Root CA
        Validity
            Not Before: Sep 14 08:37:52 2019 GMT
            Not After : Sep 14 08:37:52 2028 GMT
        Subject: C = CH, O = strongSwan Project, OU = Sales, CN = Sales CA

测试准备阶段

配置文件:ikev2/multi-level-ca/pretest.dat,内容为通常的ipsec连接的启动语句。本次测试中,在carol和dave主机上都会启动名称为alice和venus的两个连接。不过,在carol主机上首先启动alice连接,在dave主机上首先启动venus连接,这两个连接都可成功。相反,carol上的子连接venus和dave上的子连接alice,都会失败,放后执行。

moon::ipsec start
carol::ipsec start
dave::ipsec start
moon::expect-connection alice
moon::expect-connection venus
carol::expect-connection alice
carol::expect-connection venus
carol::ipsec up alice
carol::ipsec up venus
dave::expect-connection alice
dave::expect-connection venus
dave::ipsec up venus
dave::ipsec up alice

测试阶段

配置文件:ikev2/multi-level-ca/evaltest.dat内容如下。在moon网关的strongswan日志文件中,确认carol和dave证书的验证,以及中间CA证书的验证。

moon:: cat /var/log/daemon.log::fetching crl from.*http.*research.crl::YES
moon:: cat /var/log/daemon.log::crl correctly signed by.*Research CA::YES
moon:: cat /var/log/daemon.log::fetching crl from.*http.*sales.crl::YES
moon:: cat /var/log/daemon.log::crl correctly signed by.*Sales CA::YES
moon:: cat /var/log/daemon.log::fetching crl from.*http.*strongswan.crl::YES
moon:: cat /var/log/daemon.log::crl correctly signed by.*strongSwan Root CA::YES

以下为moon网关上strongswan进程验证证书的日志信息。在IKE_SA_INIT响应消息中,CERTREQ载荷中包含三个证书请求,CN分别为:“Research CA”、“Sales CA"和"strongSwan Root CA”,其中前两个为中间证书,第三个为根证书。

在随后carol的报文IKE_AUTH中,提供了一个end entity证书:“C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org”,据此在moon网关的配置中匹配到名称为alice的连接,以及对应的中间CA文件:moon/etc/ipsec.d/cacerts/researchCert.pem。接下来获取CRL文件:research.crl,验证carol证书的状态,先使用中间CA证书ResearchCert.pem验证crl文件的有效性,在根据CRL验证carol证书有效性。

之后,获取strongswan.crl证书,以验证中间CA证书:"C=CH, O=strongSwan Project, OU=Research, CN=Research CA"的有效性。整个证书链验证完成之后,认证成功。

moon charon: 13[IKE] sending cert request for "C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
moon charon: 13[IKE] sending cert request for "C=CH, O=strongSwan Project, OU=Sales, CN=Sales CA"
moon charon: 13[IKE] sending cert request for "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
moon charon: 13[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
moon charon: 14[NET] received packet: from 192.168.0.100[4500] to 192.168.0.1[4500] (1236 bytes)
moon charon: 15[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
moon charon: 15[IKE] received cert request for "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
moon charon: 15[IKE] received end entity cert "C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org"
moon charon: 15[CFG] looking for peer configs matching 192.168.0.1[moon.strongswan.org]...192.168.0.100[C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org]
moon charon: 15[CFG] selected peer config 'alice'
moon charon: 15[CFG]   using certificate "C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org"
moon charon: 15[CFG]   using trusted intermediate ca certificate "C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
moon charon: 15[CFG] checking certificate status of "C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org"
moon charon: 15[CFG]   fetching crl from 'http://crl.strongswan.org/research.crl' ...
moon charon: 15[CFG]   using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
moon charon: 15[CFG]   reached self-signed root ca with a path length of 0
moon charon: 15[CFG]   using trusted certificate "C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
moon charon: 15[CFG]   crl correctly signed by "C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
moon charon: 15[CFG]   crl is valid: until Nov 15 03:32:58 2019
moon charon: 15[CFG] certificate status is good
moon charon: 15[CFG]   using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
moon charon: 15[CFG] checking certificate status of "C=CH, O=strongSwan Project, OU=Research, CN=Research CA"
moon charon: 15[CFG]   fetching crl from 'http://crl.strongswan.org/strongswan.crl' ...
moon charon: 15[CFG]   using trusted certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
moon charon: 15[CFG]   crl correctly signed by "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
moon charon: 15[CFG]   crl is valid: until Nov 15 03:32:58 2019
moon charon: 15[CFG] certificate status is good
moon charon: 15[CFG]   reached self-signed root ca with a path length of 1
moon charon: 15[IKE] authentication of 'C=CH, O=strongSwan Project, OU=Research, CN=carol@strongswan.org' with RSA_EMSA_PKCS1_SHA2_256 successful

以下测试语句,在carol和moon上确认名称为alice的连接的建立,并且在carol主机的strongswan进程日志中将检查到TS_UNACCEPTABLE的通知,这是由于在carol上建立子连接venus失败所导致的。

carol::ipsec status 2> /dev/null::alice.*INSTALLED, TUNNEL::YES
moon:: ipsec status 2> /dev/null::alice.*ESTABLISHED.*carol@strongswan.org::YES
carol::cat /var/log/daemon.log::received TS_UNACCEPTABLE notify, no CHILD_SA built::YES
carol::ipsec status 2> /dev/null::venus.*INSTALLED::NO

看一下carol主机上strongswan进程的日志,子连接venus未能创建成功,在报文CREATE_CHILD_SA request 2中,载荷TSr的值为:10.1.0.20(venus主机),但是在moon网关上定义到venus的连接需要具有"Sales CA"签发的证书,carol的证书为"Research CA"所签发。

carol charon: 05[CFG] received stroke: initiate 'venus'
carol charon: 09[IKE] establishing CHILD_SA venus{2}
carol charon: 09[ENC] generating CREATE_CHILD_SA request 2 [ SA No TSi TSr ]
carol charon: 09[NET] sending packet: from 192.168.0.100[4500] to 192.168.0.1[4500] (256 bytes)
carol charon: 12[NET] received packet: from 192.168.0.1[4500] to 192.168.0.100[4500] (80 bytes)
carol charon: 12[ENC] parsed CREATE_CHILD_SA response 2 [ N(TS_UNACCEPT) ]
carol charon: 12[IKE] received TS_UNACCEPTABLE notify, no CHILD_SA built
carol charon: 12[IKE] failed to establish CHILD_SA, keeping IKE_SA

moon网关上strongwan进程的日志中,显示了拒绝carol主机此TSr的信息。

moon charon: 16[ENC] parsed CREATE_CHILD_SA request 2 [ SA No TSi TSr ]
moon charon: 16[IKE] traffic selectors 10.1.0.20/32 === 192.168.0.100/32 unacceptable
moon charon: 16[IKE] failed to establish CHILD_SA, keeping IKE_SA
moon charon: 16[ENC] generating CREATE_CHILD_SA response 2 [ N(TS_UNACCEPT) ]

对于主机dave的认证过程与以上carol相似,以下为moon网关上strongswan进程日志中与dave相关的部分信息。由于在moon网关上,名称为alice连接排在前面,dave的连接首先匹配alice,在相关的证书验证完成之后,将会产生:constraint check failed错误,因为alice连接要求"Research CA"签发的证书,而dave的证书由"Sales CA"签发。此时将匹配moon网关上的配置venus。

moon charon: 07[IKE] authentication of 'C=CH, O=strongSwan Project, OU=Sales, CN=dave@strongswan.org' with RSA_EMSA_PKCS1_SHA2_256 successful
moon charon: 07[CFG] constraint check failed: peer not authenticated by CA 'C=CH, O=strongSwan Project, OU=Research, CN=Research CA'
moon charon: 07[CFG] selected peer config 'alice' unacceptable: non-matching authentication done
moon charon: 07[CFG] switching to peer config 'venus'
moon charon: 07[IKE] peer supports MOBIKE
moon charon: 07[IKE] authentication of 'moon.strongswan.org' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful
moon charon: 07[IKE] IKE_SA venus[2] established between 192.168.0.1[moon.strongswan.org]...192.168.0.200[C=CH, O=strongSwan Project, OU=Sales, CN=dave@strongswan.org]

strongswan测试版本: 5.8.1

END

  • 0
    点赞
  • 0
    评论
  • 0
    收藏
  • 一键三连
    一键三连
  • 扫一扫,分享海报

相关推荐
©️2020 CSDN 皮肤主题: 编程工作室 设计师:CSDN官方博客 返回首页
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、C币套餐、付费专栏及课程。

余额充值