Estou tentando conectar um computador executando o macOS 10.12 a uma caixa do Solaris 11.3 por meio do modo de transporte IPSec. Acredito que minha negociação IKE foi bem sucedida ( fase 1 ) e que eu ' m agora na fase 2. Se eu mudar meu PSK, eu não passarei da fase 1, então parece que minhas chaves estão corretas. Os links a seguir, entre outros, não conseguiram me ajudar:
Eu tentei pesquisar a mensagem de erro "Nenhum arquivo ou diretório do PF_KEY", a mensagem "Rótulo não encontrado" e informações sobre a aquisição inversa.
Um dump de /usr/lib/inet/in.iked -d -p 2 quando tento estabelecer uma conexão entre as duas máquinas é o seguinte:
Jun 30 20:32:50: Selecting transform from inbound SA...
Jun 30 20:32:50: NAT-T state 1 (VID)
Jun 30 20:32:50: Checking P1 transform from remote initiator!
Jun 30 20:32:50: NAT-T state 1 (VID)
Jun 30 20:32:50: P1 Transform check
Rule "client", transform 0:
auth_method = 1 (Pre-shared)
hash_alg = 6 (sha512)
encr_alg = 7 (aes-cbc)
keysizes = 128..256 bits
oakley_group = 16
Jun 30 20:32:50: Peer Proposal: transform 0
auth_method = 1 (Pre-shared)
hash_alg = 6 (sha512)
encr_alg = 7 (aes-cbc)
key_length = 128 bits
oakley_group = 16
Jun 30 20:32:50: Rule "client" matches proposal.
Jun 30 20:32:50: Selected Proposal Transform 0.
Jun 30 20:32:50: Sending selected SA with transforms_index 0 to library.
Jun 30 20:32:50: Sending out Vendor IDs, if needed: NAT-T state 1 (VID)
Jun 30 20:32:50: IKE library: Using default remote port for NAT-T, if active.
Jun 30 20:32:50: IKE library: NAT-Discovery - not a NAT-T connection
Jun 30 20:32:50: Determining P1 nonce data length.
Jun 30 20:32:50: NAT-T state -1 (NEVER)
Jun 30 20:32:50: Finding preshared key...
Jun 30 20:32:50: IKE library: Using default remote port for NAT-T, if active.
Jun 30 20:32:50: IKE library: Doing port jump in case we need NAT-T. Current NAT-T state -1
Jun 30 20:32:50: Handling P1 status notification from peer.
Jun 30 20:32:50: NAT-T state -1 (NEVER)
Jun 30 20:32:50: Handling initial contact notification from peer: NAT-T state -1 (NEVER) phase2 1
Jun 30 20:32:50: Deleting SA ...
Jun 30 20:32:50: PF_KEY message contents:
Timestamp: June 30, 2017 08:32:50 PM EDT
Base message (version 2) type DELETE, SA type AH.
Message length 80 bytes, seq=0, pid=1412.
KMC: Protocol 1, cookie="<Label not found.>" (0)
DST: Destination address (proto=0)
DST: AF_INET: port 0, 192.168.0.3.
SRC: Source address (proto=0)
SRC: AF_INET: port 0, 192.168.0.2.
Jun 30 20:32:50: PF_KEY request:
queueing sequence number 5, message type 4 (DELETE),
SA type 2 (AH)
Jun 30 20:32:50: PF_KEY transmit request:
posting sequence number 5, message type 4 (DELETE),
SA type 2 (AH)
Jun 30 20:32:50: Deleting SA ...
Jun 30 20:32:50: PF_KEY message contents:
Timestamp: June 30, 2017 08:32:50 PM EDT
Base message (version 2) type DELETE, SA type AH.
Message length 80 bytes, seq=0, pid=1412.
KMC: Protocol 1, cookie="<Label not found.>" (0)
DST: Destination address (proto=0)
DST: AF_INET: port 0, 192.168.0.2.
SRC: Source address (proto=0)
SRC: AF_INET: port 0, 192.168.0.3.
Jun 30 20:32:50: PF_KEY request:
queueing sequence number 6, message type 4 (DELETE),
SA type 2 (AH)
Jun 30 20:32:50: Deleting SA ...
Jun 30 20:32:50: PF_KEY message contents:
Timestamp: June 30, 2017 08:32:50 PM EDT
Base message (version 2) type DELETE, SA type ESP.
Message length 80 bytes, seq=0, pid=1412.
KMC: Protocol 1, cookie="<Label not found.>" (0)
DST: Destination address (proto=0)
DST: AF_INET: port 0, 192.168.0.3.
SRC: Source address (proto=0)
SRC: AF_INET: port 0, 192.168.0.2.
Jun 30 20:32:50: PF_KEY request:
queueing sequence number 7, message type 4 (DELETE),
SA type 3 (ESP)
Jun 30 20:32:50: Deleting SA ...
Jun 30 20:32:50: PF_KEY message contents:
Timestamp: June 30, 2017 08:32:50 PM EDT
Base message (version 2) type DELETE, SA type ESP.
Message length 80 bytes, seq=0, pid=1412.
KMC: Protocol 1, cookie="<Label not found.>" (0)
DST: Destination address (proto=0)
DST: AF_INET: port 0, 192.168.0.2.
SRC: Source address (proto=0)
SRC: AF_INET: port 0, 192.168.0.3.
Jun 30 20:32:50: PF_KEY request:
queueing sequence number 8, message type 4 (DELETE),
SA type 3 (ESP)
Jun 30 20:32:50: Getting local id for inbound P1: NAT-T state -1 (NEVER)
Jun 30 20:32:50: Constructing local identity payload...
Jun 30 20:32:50: Local ID type: ipv4(any:0,[0..3]=192.168.0.2)
Jun 30 20:32:50: Finishing P1 negotiation: NAT-T state -1 (NEVER)
Jun 30 20:32:50: Looking for 192.168.0.2[0] in IKE daemon context...
Jun 30 20:32:50: Notifying library that P2 SA is freed.
Jun 30 20:32:50: Local IP = 192.168.0.2, Remote IP = 192.168.0.3,
Jun 30 20:32:50: Handling data on PF_KEY socket:
SADB msg: message type 4 (DELETE), SA type 2 (AH),
pid 1412, sequence number 5,
error code 0 (Error 0), diag code 0 (No diagnostic), length 10
Jun 30 20:32:50: SADB message reply handler:
got sequence number 5, message type 4 (DELETE),
SA type 2 (AH)
Jun 30 20:32:50: PF_KEY transmit request:
posting sequence number 6, message type 4 (DELETE),
SA type 2 (AH)
Jun 30 20:32:50: Handling data on PF_KEY socket:
SADB msg: message type 4 (DELETE), SA type 2 (AH),
pid 1412, sequence number 6,
error code 0 (Error 0), diag code 0 (No diagnostic), length 10
Jun 30 20:32:50: SADB message reply handler:
got sequence number 6, message type 4 (DELETE),
SA type 2 (AH)
Jun 30 20:32:50: PF_KEY transmit request:
posting sequence number 7, message type 4 (DELETE),
SA type 3 (ESP)
Jun 30 20:32:50: Handling data on PF_KEY socket:
SADB msg: message type 4 (DELETE), SA type 3 (ESP),
pid 1412, sequence number 7,
error code 0 (Error 0), diag code 0 (No diagnostic), length 10
Jun 30 20:32:50: SADB message reply handler:
got sequence number 7, message type 4 (DELETE),
SA type 3 (ESP)
Jun 30 20:32:50: PF_KEY transmit request:
posting sequence number 8, message type 4 (DELETE),
SA type 3 (ESP)
Jun 30 20:32:50: Handling data on PF_KEY socket:
SADB msg: message type 4 (DELETE), SA type 3 (ESP),
pid 1412, sequence number 8,
error code 0 (Error 0), diag code 0 (No diagnostic), length 10
Jun 30 20:32:50: SADB message reply handler:
got sequence number 8, message type 4 (DELETE),
SA type 3 (ESP)
Jun 30 20:32:51: IKE library: Using default remote port for NAT-T, if active.
Jun 30 20:32:51: New Quick Mode (QM) connection received from 192.168.0.3[500]
Jun 30 20:32:51: Selecting proposal for 1 inbound QM SA(s).
Jun 30 20:32:51: Constructing inverse ACQUIRE...
Jun 30 20:32:51: Initiator Local ID = No Id, Local IP = 192.168.0.2
Jun 30 20:32:51: Initiator Remote ID = No Id, Remote IP = 192.168.0.3
Jun 30 20:32:51: qm_id_check: Either no NAT-T using tunnel-mode.
Jun 30 20:32:51: checking local_id...
Jun 30 20:32:51: checking remote_id...
Jun 30 20:32:51: assuming transport mode.
Jun 30 20:32:51: Transport Mode [INVERSE ACQUIRE]
Jun 30 20:32:51: PF_KEY message contents:
Timestamp: June 30, 2017 08:32:51 PM EDT
Base message (version 2) type X_INVERSE_ACQUIRE, SA type <unspecified/all>.
Message length 96 bytes, seq=0, pid=1412.
SRC: Source address (proto=0)
SRC: AF_INET: port 0, 192.168.0.2.
DST: Destination address (proto=0)
DST: AF_INET: port 0, 192.168.0.3.
Jun 30 20:32:51: PF_KEY request:
queueing sequence number 9, message type 12 (X_INVERSE_ACQUIRE),
SA type 0 (UNSPEC)
Jun 30 20:32:51: PF_KEY transmit request:
posting sequence number 9, message type 12 (X_INVERSE_ACQUIRE),
SA type 0 (UNSPEC)
Jun 30 20:32:51: Handling data on PF_KEY socket:
SADB msg: message type 12 (X_INVERSE_ACQUIRE), SA type 0 (UNSPEC),
pid 1412, sequence number 9,
error code 2 (No such file or directory), diag code 0 (No diagnostic), length 2
Jun 30 20:32:51: SADB message reply handler:
got sequence number 9, message type 12 (X_INVERSE_ACQUIRE),
SA type 0 (UNSPEC)
Jun 30 20:32:51: PF_KEY message contents:
Timestamp: June 30, 2017 08:32:51 PM EDT
Base message (version 2) type X_INVERSE_ACQUIRE, SA type <unspecified/all>.
Error No such file or directory from PF_KEY.
Diagnostic code 0: No diagnostic.
Message length 16 bytes, seq=9, pid=1412.
Jun 30 20:32:51: Continuing QM SA selection...
Jun 30 20:32:51: inverse_acquire() failed.
Jun 30 20:32:51: Quick Mode negotiation failed: code 14 (No proposal chosen).
Jun 30 20:32:51: Local IP: 192.168.0.2[500], Remote IP: 192.168.0.3[500]
Jun 30 20:32:51: Initiator Local ID = No Id
Jun 30 20:32:51: Initiator Remote ID = No Id
Jun 30 20:32:51: ** Responder Local ID = No Id
Jun 30 20:32:51: ** Responder Remote ID = No Id
Jun 30 20:32:51: Notifying library that P2 SA is freed.
Jun 30 20:32:51: Local IP = 192.168.0.2, Remote IP = 192.168.0.3,
Configuração da caixa do Solaris
/etc/inet/ipsecinit.conf contém o seguinte:
{laddr 192.168.0.2 raddr 192.168.0.3} ipsec
{encr_algs aes encr_auth_algs sha512 sa shared}
/etc/inet/secret/ike.preshared contém
{ localidtype IP
localid 192.168.0.2
remoteidtype IP
remoteid 192.168.0.3
key 1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
}
/etc/inet/ike/config contém
p2_lifetime_secs 14400
p2_nonce_len 20
p1_xform
{ auth_method preshared oakley_group 16 auth_alg sha512 encr_alg aes }
p2_pfs 2
{
label "client"
local_id_type ip
local_addr 192.168.0.2
remote_addr 192.168.0.3
p1_xform { auth_method preshared auth_alg
sha512 oakley_group 16 encr_alg aes }
p2_pfs 5
}
Configuração do Mac
/etc/racoon/racoon.conf contém
path include "/etc/racoon" ;
path pre_shared_key "/etc/racoon/psk.txt" ;
path certificate "/etc/cert" ;
log debug2;
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
timer
{
# These value can be changed per remote node.
counter 10; # maximum trying count to send.
interval 3 sec; # interval to resend (retransmit)
persend 1; # the number of packets per a send.
# timer for waiting to complete each phase.
phase1 30 sec;
phase2 30 sec;
# Auto exit delay timer - for use when controlled by VPN socket
auto_exit_delay 3 sec;
}
remote 192.168.0.2 [500]
{
exchange_mode main;
doi ipsec_doi;
situation identity_only;
my_identifier address 192.168.0.3;
peers_identifier address 192.168.0.2;
lifetime time 1 hour;
passive off;
proposal_check obey;
generate_policy off;
proposal {
encryption_algorithm aes;
hash_algorithm sha512;
authentication_method pre_shared_key;
lifetime time 3600 sec;
dh_group 16;
}
}
sainfo address ::1 icmp6 address ::1 icmp6
{
pfs_group 1;
lifetime time 60 sec;
encryption_algorithm 3des, aes ;
authentication_algorithm hmac_sha1, hmac_md5 ;
compression_algorithm deflate ;
}
sainfo address 192.168.0.3 any address 192.168.0.2 any {
pfs_group 5;
encryption_algorithm aes256;
authentication_algorithm hmac_sha512;
compression_algorithm deflate;
}
/etc/racoon/psk.txt contém
192.168.0.2 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
setkey comandos
flush;
spdflush;
spdadd 192.168.0.3 192.168.0.2[22] any -P out ipsec esp/transport//use ah/transport//use;
spdadd 192.168.0.2[22] 192.168.0.3 any -P out ipsec esp/transport//use ah/transport//use;
spdadd 192.168.0.3 192.168.0.2 any -P out ipsec esp/transport//require ah/transport//use;
spdadd 192.168.0.2 192.168.0.3 any -P out ipsec esp/transport//require ah/transport//use;
Obrigado antecipadamente!
Acontece que o problema era que o comando que eu estava reutilizando para atualizar minha política de segurança,
%código%
estava limpando minha lista de SA como revelado por
svcadm restart svc:/network/ipsec/policy:default
Depois de reiniciar o daemon, precisei executar
ipsecconf -l
Eu ainda não descobri qual arquivo eu estava ostensivamente faltando, mas vou tentar a sugestão do @ AndrewHenle e descobrir (ainda é útil saber sobre) e postar de volta mais tarde!