Всем привет!
Может кто-нибудь подсказать как сейчас обстоят дела с интеграцией шифрования по отечественному ГОСТ в openvpn? Нашел, что несколько лет назад на лоре такая тема уже была, но чем закончилось дело - так и осталось неизвестно.
Сейчас актуальная версия openvpn вроде как 2.4, где-то нашел патч для версии 2.1, откатился, наложил, кое-как собрал (с забиванием костылей и шаманством над кодом), но не работает.
Конфиг сервера:
#dev tun
dev tap
#engine cryptocom
engine gost
auth gost-mac
cipher gost89
tls-cipher GOST2001-GOST89-GOST89
#comp-lzo yes
ca sample-keys/ca.crt
cert sample-keys/server.crt
key sample-keys/server.key
server 10.0.0.0 255.255.255.0
keepalive 10 120
proto tcp
socket-flags TCP_NODELAY
persist-key
persist-tun
dh sample-keys/dh2048.pem
openvpn --config /etc/openvpn/ovpn-srv
Wed Jul 19 11:26:37 2017 OpenVPN 2.3.13 armv7l-unknown-linux-gnueabi [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 28 2017
Wed Jul 19 11:26:37 2017 library versions: OpenSSL 1.0.2h-fips 3 May 2016, LZO 2.09
Wed Jul 19 11:26:37 2017 Initializing OpenSSL support for engine 'gost'
Wed Jul 19 11:26:37 2017 WARNING: file 'sample-keys/server.key' is group or others accessible
Wed Jul 19 11:26:37 2017 No valid translation found for TLS cipher 'GOST2001-GOST89-GOST89'
Wed Jul 19 11:26:37 2017 TUN/TAP device tap0 opened
Wed Jul 19 11:26:37 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jul 19 11:26:37 2017 /sbin/ip link set dev tap0 up mtu 1500
Wed Jul 19 11:26:37 2017 /sbin/ip addr add dev tap0 10.0.0.1/24 broadcast 10.0.0.255
Wed Jul 19 11:26:37 2017 Listening for incoming TCP connection on [undef]
Wed Jul 19 11:26:37 2017 TCPv4_SERVER link local (bound): [undef]
Wed Jul 19 11:26:37 2017 TCPv4_SERVER link remote: [undef]
Wed Jul 19 11:26:37 2017 Initialization Sequence Completed
Wed Jul 19 11:26:42 2017 TCP connection established with [AF_INET]10.0.0.1:42237
Wed Jul 19 11:26:42 2017 10.0.0.1:42237 OpenSSL: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher
Wed Jul 19 11:26:42 2017 10.0.0.1:42237 TLS_ERROR: BIO read tls_read_plaintext error
Wed Jul 19 11:26:42 2017 10.0.0.1:42237 TLS Error: TLS object -> incoming plaintext read error
Wed Jul 19 11:26:42 2017 10.0.0.1:42237 TLS Error: TLS handshake failed
Wed Jul 19 11:26:42 2017 10.0.0.1:42237 Fatal TLS error (check_tls_errors_co), restarting
#dev tun
dev tap
#engine cryptocom
engine gost
auth gost-mac
cipher gost89
tls-cipher GOST2001-GOST89-GOST89
#comp-lzo yes
ca sample-keys/ca.crt
cert sample-keys/client.crt
key sample-keys/client.key
client
remote 10.0.0.1
keepalive 10 120
proto tcp
socket-flags TCP_NODELAY
persist-key
persist-tun
openvpn --config /etc/openvpn/ovpn-cli
Wed Jul 19 11:26:42 2017 OpenVPN 2.3.13 armv7l-unknown-linux-gnueabi [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 28 2017
Wed Jul 19 11:26:42 2017 library versions: OpenSSL 1.0.2h-fips 3 May 2016, LZO 2.09
Wed Jul 19 11:26:42 2017 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Jul 19 11:26:42 2017 Initializing OpenSSL support for engine 'gost'
Wed Jul 19 11:26:42 2017 WARNING: file 'sample-keys/client.key' is group or others accessible
Wed Jul 19 11:26:42 2017 No valid translation found for TLS cipher 'GOST2001-GOST89-GOST89'
Wed Jul 19 11:26:42 2017 Attempting to establish TCP connection with [AF_INET]10.0.0.1:1194 [nonblock]
Wed Jul 19 11:26:42 2017 TCP connection established with [AF_INET]10.0.0.1:1194
Wed Jul 19 11:26:42 2017 TCPv4_CLIENT link local: [undef]
Wed Jul 19 11:26:42 2017 TCPv4_CLIENT link remote: [AF_INET]10.0.0.1:1194
Wed Jul 19 11:26:42 2017 Connection reset, restarting [0]
