LoginSignup
1
1
CloudflareAdvent Calendar 2023Day 9
@khayama(Kyouhei Hayama)inCloudflare Japan 株式会社

Cloudflare Zero Trust で Managed network が動かないときのトラブルシュート

Posted at

目的

Cloudflare Zero Trust で Managed network 機能を試そうとしたときに何が原因で動かなかったのか、トラブルシュートした際のメモです。

Managed network とは

以下のように Managed network 内の TLS エンドポイントに対して SHA256 フィンガープリントのチェックを自動的に行い、 WARP プロファイルを動的に変える仕組みです。

  • Network detection and settings profiles for the Cloudflare One agent
    ユーザーのネットワークに応じて、どのトラフィックをCloudflareに送信し、どのトラフィックをローカルに残すかを柔軟に決定できるようになりました。エンドユーザーは、マネージドネットワークに出入りする際に設定を変更する必要はありません。Cloudflare Oneのデバイスエージェントが自動的に検出し、変更を行います。

例えば、自宅ではフィルタリングを適用する一方で、社内ネットワークでは社内プロキシから出ていくようなネットワークロケーションごとにプロファイルを変える構成が考えられます。

参考 : Managed network 設定

image.png

cfssl certinfo -domain 192.168.1.1 | jq -r .pem | openssl x509 -noout -fingerprint -sha256 -inform pem | tr -d :
result
sha256 Fingerprint=A3D48B68966ADFCCC9AD0E29D135E99174DA6CEF4AECB648DB758ACFB7AEEA90

% curl https://192.168.1.1:443 -vvvk -IXGET
*   Trying 192.168.1.1:443...
* Connected to 192.168.1.1 (192.168.1.1) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / AES256-GCM-SHA384 / [blank] / UNDEF
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
*  subject: C=CN; ST=JiangSu; L=NanJing; O=ZTE; CN=192.168.1.1; emailAddress=xiaoming@zte.com
*  start date: Nov 15 01:57:17 2019 GMT
*  expire date: Apr 19 01:57:17 2036 GMT
*  issuer: C=CN; ST=JiangSu; L=NanJing; O=ZTE; emailAddress=xiaoming@zte.com
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha512WithRSAEncryption
* using HTTP/1.x
> GET / HTTP/1.1
> Host: 192.168.1.1
> User-Agent: curl/8.5.0
> Accept: */*
> 
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Server: Mini web server 1.0 ZTE corp 2005.
Server: Mini web server 1.0 ZTE corp 2005.
< Content-Type: text/html; charset=UTF-8
Content-Type: text/html; charset=UTF-8
< Accept-Ranges: bytes
Accept-Ranges: bytes
< Connection: close
Connection: close
< Cache-Control: no-cache,no-store
Cache-Control: no-cache,no-store
< Content-Length: 8018
Content-Length: 8018
< Set-Cookie: _TESTCOOKIESUPPORT=1; PATH=/; HttpOnly; Secure
Set-Cookie: _TESTCOOKIESUPPORT=1; PATH=/; HttpOnly; Secure
< X-Frame-Options: SAMEORIGIN
X-Frame-Options: SAMEORIGIN
< X-XSS-Protection: 1; mode=block
X-XSS-Protection: 1; mode=block

< 
* Closing connection
* TLSv1.2 (OUT), TLS alert, close notify (256):

動かないときは

warp-diag コマンドで出力できるログを見ましょう。

warp-diag
result
warp_diag: Gathering data from WARP service...
warp_diag: Gathering system info and log files (this may take a couple minutes)...
warp_diag: Debugging information stored in: ~/Desktop/warp-debugging-info-20240226-033821.zip

zip 内の daemon.log ファイルで alternate_networks としてログが確認できます。

daemon.log : デバイスとCloudflareのグローバルネットワーク間のすべての通信を含む、WARPクライアントが実行したすべてのアクションの詳細ログ。注：これは最も有用なデバッグログです。

unzip -o ~/Desktop/warp-debugging-info-20240226-033821.zip -d ~/Desktop "daemon.log"
cat ~/Desktop/daemon.log | grep alternate
result
Archive:  ~/Desktop/warp-debugging-info-20240220-005555.zip
  inflating: ~/Desktop/daemon.log  
2024-02-20T00:15:36.779Z DEBUG warp::warp_service::alternate_networks: Running alternate network detection check alternate_networks=[AlternateNetwork { name: "My Office Network", check: Tls { tls_sockaddr: "192.168.1.1:443", sha256: Some([163, 212, 139, 104, 150, 106, 223, 204, 201, 173, 14, 41, 209, 53, 233, 145, 116, 218, 108, 239, 74, 236, 182, 72, 219, 117, 138, 207, 183, 174, 234, 144]) } }]
2024-02-20T00:15:36.780Z DEBUG warp::warp_service::alternate_networks: Did not detect alternate network name=My Office Network reason=FailedToGetFingerprint(FailedToConnect(TcpConnectionFailed(Os { code: 61, kind: ConnectionRefused, message: "Connection refused" })))
2024-02-20T00:15:37.852Z DEBUG warp::warp_service::alternate_networks: Running alternate network detection check alternate_networks=[AlternateNetwork { name: "My Office Network", check: Tls { tls_sockaddr: "192.168.1.1:443", sha256: Some([163, 212, 139, 104, 150, 106, 223, 204, 201, 173, 14, 41, 209, 53, 233, 145, 116, 218, 108, 239, 74, 236, 182, 72, 219, 117, 138, 207, 183, 174, 234, 144]) } }]
2024-02-20T00:15:37.860Z DEBUG warp::warp_service::alternate_networks: Did not detect alternate network name=My Office Network reason=FailedToGetFingerprint(FailedToConnect(TlsHandshakeFailed(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) })))
2024-02-20T00:29:47.737Z DEBUG warp::warp_service::alternate_networks: Running alternate network detection check alternate_networks=[AlternateNetwork { name: "My Office Network", check: Tls { tls_sockaddr: "192.168.1.1:443", sha256: Some([163, 212, 139, 104, 150, 106, 223, 204, 201, 173, 14, 41, 209, 53, 233, 145, 116, 218, 108, 239, 74, 236, 182, 72, 219, 117, 138, 207, 183, 174, 234, 144]) } }]
2024-02-20T00:29:47.738Z DEBUG warp::warp_service::alternate_networks: Did not detect alternate network name=My Office Network reason=FailedToGetFingerprint(FailedToConnect(TcpConnectionFailed(Os { code: 61, kind: ConnectionRefused, message: "Connection refused" })))
2024-02-20T00:29:49.509Z DEBUG warp::warp_service::alternate_networks: Running alternate network detection check alternate_networks=[AlternateNetwork { name: "My Office Network", check: Tls { tls_sockaddr: "192.168.1.1:443", sha256: Some([163, 212, 139, 104, 150, 106, 223, 204, 201, 173, 14, 41, 209, 53, 233, 145, 116, 218, 108, 239, 74, 236, 182, 72, 219, 117, 138, 207, 183, 174, 234, 144]) } }]
2024-02-20T00:29:49.515Z DEBUG warp::warp_service::alternate_networks: Did not detect alternate network name=My Office Network reason=FailedToGetFingerprint(FailedToConnect(TlsHandshakeFailed(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) })))
2024-02-20T00:32:46.560Z DEBUG warp::warp_service::alternate_networks: Running alternate network detection check alternate_networks=[AlternateNetwork { name: "My Office Network", check: Tls { tls_sockaddr: "192.168.1.1:443", sha256: Some([163, 212, 139, 104, 150, 106, 223, 204, 201, 173, 14, 41, 209, 53, 233, 145, 116, 218, 108, 239, 74, 236, 182, 72, 219, 117, 138, 207, 183, 174, 234, 144]) } }]
2024-02-20T00:32:46.567Z DEBUG warp::warp_service::alternate_networks: Did not detect alternate network name=My Office Network reason=FailedToGetFingerprint(FailedToConnect(TlsHandshakeFailed(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) })))
2024-02-20T00:55:28.578Z DEBUG warp::warp_service::alternate_networks: Running alternate network detection check alternate_networks=[AlternateNetwork { name: "My Office Network", check: Tls { tls_sockaddr: "192.168.1.1:443", sha256: Some([163, 212, 139, 104, 150, 106, 223, 204, 201, 173, 14, 41, 209, 53, 233, 145, 116, 218, 108, 239, 74, 236, 182, 72, 219, 117, 138, 207, 183, 174, 234, 144]) } }]
2024-02-20T00:55:28.584Z DEBUG warp::warp_service::alternate_networks: Did not detect alternate network name=My Office Network reason=FailedToGetFingerprint(FailedToConnect(TlsHandshakeFailed(Custom { kind: InvalidData, error: AlertReceived(HandshakeFailure) })))

ConnectionRefused , TlsHandshakeFailed は暗号スイート（Cipher suite）を確認

TLS ハンドシェイクにて接続が失敗しているため、 Managed network で使用されている接続ライブラリの暗号スイート(Cipher suite)が対応していない可能性があります。

実際に rustls を使って確認すると、同様のエラーが確認できます。

rustls % cargo run --bin tlsclient-mio -- --http 192.168.1.1
    Finished dev [unoptimized + debuginfo] target(s) in 0.44s
     Running `target/debug/tlsclient-mio --http 192.168.1.1`
TLS error: AlertReceived(HandshakeFailure)
Connection closed

以下の暗号スイート(Cipher suite)がサポート対象になります。

TLS IANA 表記 OpenSSL 表記
1.3 TLS13_AES_256_GCM_SHA384 TLS_AES_256_GCM_SHA384
1.3 TLS13_AES_128_GCM_SHA256 TLS_AES_128_GCM_SHA256
1.3 TLS13_CHACHA20_POLY1305_SHA256 TLS_CHACHA20_POLY1305_SHA256
1.2 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ECDHE-ECDSA-AES256-GCM-SHA384
1.2 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256
1.2 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE-ECDSA-CHACHA20-POLY1305
1.2 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ECDHE-RSA-AES256-GCM-SHA384
1.2 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256
1.2 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE-RSA-CHACHA20-POLY1305

以下の sslscan を使って暗号スイート(Cipher suite)の対応状況を確認できます。

Install
brew install sslscan

sslscan \
--iana-names \
--no-cipher-details \
--no-compression \
--no-fallback \
--no-groups \
--no-renegotiation \
--no-heartbleed \
--no-check-certificate \
192.168.1.1

結果としては、サポートされる暗号スイートが含まれていなかったため、TLS ハンドシェイクにて接続が失敗したとわかります。

result
Version: 2.1.3
OpenSSL 3.2.0 23 Nov 2023

Connected to 192.168.1.1

Testing SSL server 192.168.1.1 on port 443 using SNI name 192.168.1.1

  SSL/TLS Protocols:
SSLv2     disabled
SSLv3     disabled
TLSv1.0   disabled
TLSv1.1   disabled
TLSv1.2   enabled
TLSv1.3   disabled

  Supported Server Cipher(s):
Preferred TLSv1.2  256 bits  TLS_RSA_WITH_AES_256_GCM_SHA384              
Accepted  TLSv1.2  128 bits  TLS_RSA_WITH_AES_128_GCM_SHA256              
Accepted  TLSv1.2  256 bits  TLS_RSA_WITH_AES_256_CBC_SHA256              
Accepted  TLSv1.2  128 bits  TLS_RSA_WITH_AES_128_CBC_SHA256              
Accepted  TLSv1.2  256 bits  TLS_RSA_WITH_AES_256_CBC_SHA                 
Accepted  TLSv1.2  128 bits  TLS_RSA_WITH_AES_128_CBC_SHA

まとめ

Zero Trust ソリューションでは、さまざまなコンポーネントが関係することがありますが、問題切り分けとしては、まずログを見て適切な窓口に問い合わせる、デバッグ目的のコマンド結果を確認することで、具体的にどこでエラーが発生しているかがわかります。

参考 : openssl コマンドで確認

openssl s_client -cipher TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305 \
-connect 192.168.1.1:443
つながらない例
Connecting to 192.168.1.1
CONNECTED(00000003)
C0270E44F87F0000:error:0A000410:SSL routines:ssl3_read_bytes:ssl/tls alert handshake failure:ssl/record/rec_layer_s3.c:861:SSL alert number 40
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 257 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
1
1
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
1
1