[strongSwan] Strongswan + Mac OSX
Claude Tompers
claude.tompers at restena.lu
Thu Jan 10 14:02:07 CET 2013
Hello,
Being back on the topic of making Mac OSX work with strongswan using
certificates, I found something interesting.
It seems that 'ipsec pki' generated certificates work whereas my
'home-grown' certificates do not work, simply because the first ones are
much smaller.
In fact, up to a client certificate size of 1200 bytes, OSX sends the
certificate in one packet and everything works fine.
If the client certificate is any bigger, OSX splits it up into two
packets and this is where things start to go wrong.
Strongswan then logs :
Jan 10 13:31:57 vpn charon: 06[ENC] decryption failed, invalid length
Jan 10 13:31:57 vpn charon: 06[ENC] could not decrypt payloads
Jan 10 13:31:57 vpn charon: 06[IKE] integrity check failed
Jan 10 13:31:57 vpn charon: 06[ENC] generating INFORMATIONAL_V1 request
1242058962 [ HASH N(INVAL_HASH) ]
Jan 10 13:31:57 vpn charon: 06[IKE] ID_PROT request with message ID 0
processing failed
Is this a known issue ? Is there a workaround to this so I can be
independent of the certificates size ?
kind regards,
Claude
On 09/10/2012 01:47 PM, Claude Tompers wrote:
> Hi Martin,
>
> I'm still under the impression that Mac OSX does not like my client
> certificate.
> Are there any special extensions that need to be set or that can not be
> set ?
> I've noticed that my certificate has some more attributes than yours,
>
> Here's a copy of my client certificate:
>
> Certificate:
> Data:
> Version: 3 (0x2)
> Serial Number: 17 (0x11)
> Signature Algorithm: sha1WithRSAEncryption
> Issuer: C=LU, ST=n/a, L=Luxembourg, O=Fondation RESTENA,
> CN=RESTENA VPN CA/emailAddress=admin at restena.lu
> Validity
> Not Before: Sep 7 07:26:06 2012 GMT
> Not After : Sep 6 07:26:06 2017 GMT
> Subject: C=LU, L=Luxembourg, O=Fondation RESTENA,
> CN=ctompers/emailAddress=claude.tompers at restena.lu
> Subject Public Key Info:
> Public Key Algorithm: rsaEncryption
> Public-Key: (4096 bit)
> Modulus:
> 00:e6:be:81:bd:a6:a4:3a:22:38:e1:11:4d:ef:c6:
> 04:eb:04:af:9e:4d:0a:c3:d0:0c:3a:02:97:00:92:
> 82:80:8e:d2:46:e6:3d:36:6e:4a:00:ee:93:d9:30:
> 92:22:66:ed:68:e8:6f:1d:c0:1c:57:3d:b3:8d:74:
> c4:27:c2:5e:9a:dd:61:ed:ec:1c:2c:b0:d3:87:9b:
> 8a:f3:22:a8:34:49:21:f5:a9:7b:78:a9:66:78:d0:
> a6:ca:a7:16:1e:53:72:34:c0:d5:c6:e2:48:78:41:
> 40:b5:55:1b:ce:f0:a3:fd:0e:9f:98:1f:36:fc:a2:
> e1:96:92:d1:7b:db:7a:29:5f:8a:c3:c3:01:54:7e:
> 48:23:78:85:bb:f0:87:86:3f:2d:f1:a6:fb:1d:0d:
> d0:29:ba:58:6f:88:4d:3f:7a:f0:25:26:44:b6:c7:
> e8:b0:17:01:b5:12:d0:d0:8b:58:04:6a:77:da:c5:
> e9:c0:2d:3b:5e:27:47:19:63:ae:74:8c:e8:b3:9c:
> d5:88:23:dc:cf:6c:f9:e8:b6:a1:8c:88:ca:1d:10:
> 8d:fd:80:66:61:20:d0:28:64:ff:e1:2b:07:8b:91:
> 7a:fb:8f:a1:dc:b7:8c:2e:d2:6a:7c:d8:57:30:8e:
> 3a:2d:93:ed:6d:e4:6b:91:70:10:ad:82:df:c5:7b:
> 09:08:0a:6a:64:d5:2c:e8:58:3e:73:31:c5:e0:9c:
> 6b:33:d1:19:7f:d8:6c:e6:5d:22:d1:ff:ec:3c:7f:
> 60:9b:1d:ad:91:8e:5d:5e:99:87:4e:60:71:cc:7d:
> 48:62:38:1f:d0:13:5d:f2:6d:97:91:17:81:fe:fc:
> a1:85:e1:97:36:a4:7e:b3:8b:42:0b:11:dc:2a:6c:
> 7a:70:5c:72:f7:cd:57:a1:15:dc:04:f5:26:f3:1f:
> 59:07:2c:08:da:c2:5c:fb:24:13:85:1b:ba:9f:c2:
> 98:90:9b:3d:86:6a:e7:65:8d:9d:a9:ed:95:dd:21:
> 4c:bc:95:7f:1a:af:2e:73:dc:99:73:87:2d:57:5f:
> 57:35:31:72:09:2f:f2:51:af:92:68:dd:26:b3:73:
> d9:d8:c2:ab:68:e9:77:13:6b:4b:62:01:3e:e5:b9:
> 52:05:a3:ff:f1:bc:28:d2:2a:e5:40:78:d4:a4:03:
> 1e:9f:1f:3b:a1:7f:16:c7:8b:52:c1:45:86:6e:16:
> 11:34:8c:b7:12:db:4a:94:0f:dc:89:31:73:be:f2:
> 00:7c:77:ce:a6:08:12:af:32:38:69:35:60:95:82:
> 82:fd:e4:0c:ee:3c:94:02:e2:05:44:64:c3:eb:6c:
> 73:2e:78:70:a7:fb:84:69:92:33:b0:11:10:a9:eb:
> 65:34:0d
> Exponent: 65537 (0x10001)
> X509v3 extensions:
> X509v3 Basic Constraints:
> CA:FALSE
> Netscape Cert Type:
> SSL Client, S/MIME, Object Signing
> Netscape Comment:
> RESTENA VPN Client Certificate
> X509v3 Subject Key Identifier:
> 57:50:91:24:6B:0F:19:9A:76:78:B1:5E:6F:8B:D0:D4:93:A8:1A:16
> X509v3 Authority Key Identifier:
>
> keyid:F8:FD:2F:DA:23:BE:EE:8B:B4:FD:2B:D0:98:5C:C1:5F:1E:5B:74:AC
> DirName:/C=LU/ST=n/a/L=Luxembourg/O=Fondation
> RESTENA/CN=RESTENA VPN CA/emailAddress=admin at restena.lu
> serial:8D:CC:1F:4A:8D:C6:FA:CE
>
> X509v3 Issuer Alternative Name:
> <EMPTY>
>
> X509v3 Subject Alternative Name:
> email:claude.tompers at restena.lu
> X509v3 Key Usage: critical
> Digital Signature, Key Encipherment
> X509v3 Extended Key Usage: critical
> TLS Web Client Authentication
> Signature Algorithm: sha1WithRSAEncryption
> 78:bb:29:50:16:75:bb:e4:af:a5:10:ad:81:e8:b4:57:cb:fe:
> 22:16:c0:35:eb:85:a1:ca:a4:f4:51:68:3b:42:9b:16:93:4a:
> af:b8:11:32:13:cb:4e:08:f9:3f:25:80:76:9c:7f:30:17:d8:
> 46:28:76:43:7e:c1:28:9f:e5:c6:ac:3a:65:c6:c0:34:1a:18:
> 88:1f:14:82:53:a2:aa:9b:de:68:25:05:4d:13:fa:60:ef:38:
> 33:b2:0c:b0:65:b2:c5:a3:34:2d:a6:c8:5a:e5:26:12:79:a2:
> a1:5e:3e:16:b0:f4:15:6f:f7:ce:79:47:be:24:35:c6:d9:da:
> ed:b5:ab:1e:c4:51:f5:f3:5e:5f:fe:7f:d9:59:98:69:bc:e5:
> 55:5b:76:00:f6:49:b1:fc:ce:6e:0f:1e:bd:b7:2c:f9:8d:7b:
> 83:d1:86:64:24:a4:97:d2:55:c9:f7:7e:bf:b8:47:0b:93:eb:
> 4b:7e:8d:67:ea:ca:4c:30:57:e8:01:79:d5:aa:33:45:e1:ca:
> 40:34:69:e9:a1:42:24:2a:5b:73:83:de:f8:55:8f:20:94:cd:
> 6f:a9:c8:44:5f:3b:59:18:8f:e4:d0:1a:ac:01:d0:37:c6:ea:
> 9d:da:81:fe:8e:33:f7:58:95:68:cf:de:6e:df:26:3a:07:2e:
> b0:33:95:68:4b:c5:38:0f:a0:8c:65:71:1c:04:f8:5c:dd:88:
> ca:67:1a:3a:5d:69:24:e8:f8:65:f1:38:02:c9:57:1f:e2:8d:
> e0:09:6e:11:cd:31:e3:40:7d:2f:4c:2b:c3:51:72:d2:93:73:
> 46:5a:01:f6:fa:28:e8:1c:86:73:71:de:fa:12:16:7e:e1:b7:
> 2a:34:a8:07:da:5d:33:83:16:c6:09:10:31:79:21:2d:54:f0:
> da:8b:bf:d0:50:4b:a1:5b:3e:ec:4a:01:fe:fb:b5:59:eb:d4:
> 53:1d:67:0a:81:ff:97:31:90:fe:cd:74:b3:2a:59:b4:80:75:
> 52:2a:a9:2f:fe:1d:41:2e:1c:ec:99:4c:c0:6c:22:a6:63:be:
> b5:98:48:a5:5e:61:3c:65:d7:1a:ab:56:5a:07:49:b5:5c:5a:
> b6:b1:80:a1:f7:3b:fe:df:4a:48:ba:44:40:a7:7e:cd:46:98:
> a9:b1:2a:98:91:7d:24:88:6f:23:cc:ba:1b:91:24:61:6b:7a:
> 46:89:64:9d:24:af:f8:4e:83:d7:b5:3c:67:cb:5a:d0:42:a5:
> a6:b7:f1:0d:a5:27:f9:ce:d8:26:49:a1:0a:22:77:a0:b1:d8:
> 73:c7:96:23:09:82:e0:e9:ef:4f:d4:55:92:e0:98:9f:60:9b:
> 7e:77:05:8d:4d:a6:68:f2
>
>
> kind regards,
> Claude
>
>
> On 09/06/2012 12:20 PM, Martin Willi wrote:
>> Claude,
>>
>>> The other Mountain Lion had the exact same behaviour as mine (also
>>> 10.8.1),
>> Strange, as my 10.8.1 works just fine.
>>
>>> the one with Lion installed 'only' complained about not being
>>> able to verify the server certificate.
>> Please be aware that Hybrid authentication did not work correctly in
>> Lion, failing with a certificate validation error. You'll have to use a
>> client certificate on Lion.
>>
>>> I also found this topic in an Apple Forum [...] I'm wondering if that
>>> problem is related.
>> Hard to say. One thing to consider with Mountain Lion is that
>> certificates now need a proper ACL on the private key for authentication
>> (set to racoon). This might be the problem with that L2TP/IPsec issue,
>> but not with Hybrid authenticated clients (and your error, the profile
>> installer sets ACLs just fine).
>>
>> You may try to test against our revobox demo setup [1] that uses
>> strongSwan and works fine here. An iOS / OS X profile is available at
>> [2], after installation you should be able to connect with "tester" /
>> "test". If this works, something is wrong with your setup, if not,
>> something with your Mac.
>>
>> Regards
>> Martin
>>
>> [1]http://demo.revosec.ch/
>> [2]https://master.revosec.net/device/mobileconfig/62IUAFQH/62IUAFQH.mobileconfig
>>
>
>
>
> _______________________________________________
> Users mailing list
> Users at lists.strongswan.org
> https://lists.strongswan.org/mailman/listinfo/users
--
Claude Tompers
Ingénieur réseau et système
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
Tel: +352 424409 1
Fax: +352 422473
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 261 bytes
Desc: OpenPGP digital signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20130110/cde9edd9/attachment.pgp>
More information about the Users
mailing list