Swift中NEVPNProtocolIKEv2配置：.mobileconfig身份数据处理问题

尝试在iOS设备上通过NetworkExtension和NEVPNProtocolIKEv2建立VPN连接，基于test.mobileconfig完成配置后，服务器返回以下认证失败错误：

"ikev2-cp"[200] "my_ip_address" #1387: Peer attempted EAP authentication, but IKE_AUTH is required
"ikev2-cp"[200] "my_ip_address" #1387: responding to IKE_AUTH message (ID 1) from "my_ip_address" with encrypted notification AUTHENTICATION_FAILED
"ikev2-cp"[200] "my_ip_address" #1387: encountered fatal error in state STATE_V2_PARENT_R1

尝试的代码片段 #

使用.mobileconfig中首个PayloadContent值（无密码保护证书）赋值identityData，代码如下：

let p = NEVPNProtocolIKEv2()
let kcs = KeychainService()
p.certificateType = .RSA
p.authenticationMethod = .certificate

kcs.save(key: "ikev2_password", value: password as String)
p.passwordReference = kcs.load(key: "ikev2_password")

let base64String = """
MIIQ6AIBA....AggA
"""

if let certData = Data(base64Encoded: base64String) {
    p.identityData = certData
    p.authenticationMethod = .certificate
    p.identityDataPassword = "cHH...B3"
} else {
    print("decode error")
}

.mobileconfig配置疑问 #

文件中包含以下内容，是否需要调整？

<key>PayloadType</key>
<string>com.apple.vpn.managed</string>
...
<key>PayloadType</key>
<string>com.apple.security.pkcs12</string>

完整IKEv2配置代码 #

func getIKEv2Protocol(address: NSString, username: NSString, password: NSString) -> NEVPNProtocolIPSec {
        
        let p = NEVPNProtocolIKEv2()
        let kcs = KeychainService()

        p.certificateType = .RSA
        p.authenticationMethod = .certificate
    
        kcs.save(key: "ikev2_password", value: password as String)
        p.passwordReference = kcs.load(key: "ikev2_password")
        p.identityDataPassword = "cHH....B3"
        
        p.ikeSecurityAssociationParameters.encryptionAlgorithm = .algorithmAES256GCM
        p.ikeSecurityAssociationParameters.integrityAlgorithm = .SHA256
        p.ikeSecurityAssociationParameters.diffieHellmanGroup = .group19
        p.ikeSecurityAssociationParameters.lifetimeMinutes = 1410

        p.childSecurityAssociationParameters.encryptionAlgorithm = .algorithmAES256GCM
        p.childSecurityAssociationParameters.integrityAlgorithm = .SHA256
        p.childSecurityAssociationParameters.diffieHellmanGroup = .group19
        p.childSecurityAssociationParameters.lifetimeMinutes = 1410

        if let certData = Data(base64Encoded: base64String) {
            p.identityData = certData
            p.authenticationMethod = .certificate
        
        } 
        p.serverCertificateIssuerCommonName = "xxx"
        p.serverCertificateCommonName = "xxx-2"


        p.deadPeerDetectionRate = .medium
        p.disableRedirect = true
        p.enableRevocationCheck = false
        p.useExtendedAuthentication = true
        p.remoteIdentifier = address as String
        p.localIdentifier = username as String
        p.serverAddress = address as String

        p.enablePFS = false

     return p;
    }

VPN启动代码 #

let vpnManager = NEVPNManager.shared()
// inside > vpnManager.loadFromPreferences { (error) -> Void in
let p = self.getIKEv2Protocol(address: address, username: username, password: password)
vpnManager.protocolConfiguration = p
vpnManager.localizedDescription = "IKEv2 VPN"
vpnManager.isEnabled = true


vpnManager.saveToPreferences(completionHandler: { (error) -> Void in
 ...
   vpnManager.loadFromPreferences(completionHandler: { error in
    ...
    try vpnManager.connection.startVPNTunnel() 
    // And this section starts without any errors.

核心疑问 #

本人对Swift和VPN技术不熟悉，恳请详细说明：

• 如何正确设置p.identityData
• 如何处理.mobileconfig中的证书密码问题

内容的提问来源于stack exchange，提问作者muazzez