Bayanin VPN na Android: getConnectionOwnerUid da /proc/net

A Android 10 da gaba, manhajar da ta buɗe /proc/net/tcp tana samun hana shiga maimakon teburin socket. Ƙofar VPN ba ta damu: fakiti suna zuwa har yanzu, domin tunnel shawara ce ta hanya, ba izinin fayil ba. Abin da ya canza shi ne amsar wata tambaya mafi ƙunci: “wace manhaja ce ta mallaki wannan haɗin?” Maye gurbin shi ne ConnectivityManager.getConnectionOwnerUid, binciken da aka tallafa na kowace haɗi, kuma zaɓi tsakanin tsohuwar al'ada da sabon API ya dogara da wanne cikin ayyuka uku kuke da shi da gaske: karɓar fakiti, bayyana kwarara, ko tara amfani.

Hanyoyi biyu na amsa tambayar mai shi

Kafin API 29, tsari mai gata ko root zai iya karanta teburin socket na kernel, daidaita huɗu, kuma ya san UID mai shi. Wannan yana ba da lissafin na'urar gaba ɗaya a cikin fayil ɗaya. Daga API 29, kallon tsarin fayil yana da iyaka, kuma hanyar da aka tallafa ita ce bincike na kowace haɗi da ka'ida, adireshin gida da adireshin nesa.

Kwatancen ba “tsoho da sabo” ba ne. Ayyuka uku ne daban-daban waɗanda da fayil ɗaya mai karantawa ke biyan su, kuma yanzu ƙofofi uku daban-daban da yarjejeniyoyi uku daban-daban ke biyan su.

Adireshin gida shine ƙarshen manhajar

Sa hannun hanyar yana ɗaukar ka'ida, adireshin socket na gida da adireshin socket na nesa. “Na gida” yana nufin gefen manhajar a cikin haɗin, ba ƙarshen da ya kasance tushen fakitin a lokacin binciken ba. Fakitin da ke tafiya daga uwar garken nesa zuwa manhajar yana da tushe da manufa a juya bisa ga wannan ma'anar.

ConnectivityManager cm = getSystemService(ConnectivityManager.class);
int uid = cm.getConnectionOwnerUid(
    OsConstants.IPPROTO_TCP, appLocalAddress, appRemoteAddress);

Wannan kuskuren alkibla shi ne dalilin da ya fi yawa da bincike mai aiki ke ba da amsa mara kyau, ko babu. Yi rikodin ƙarshen biyu kafin kira kuma tabbatar da biyun da haɗin da manhajar ta buɗe da gaske. Iyalin adireshi ma yana da muhimmanci: adireshin da aka tsara da IPv4 da adireshin IPv6 na asali tuples ne daban-daban, haka ma kwararar TCP da UDP a tashoshi ɗaya.

Izini da sakamakon da ba a sani ba ɓangare ne na yarjejeniya

Binciken yana iyakance ga masu kira da aka ba da izini, ciki har da manhajar VPN mai aiki ga mai amfani da abin ya shafa. Manhajar sa ido da ba ta da alaƙa ba za ta iya ɗauka cewa za ta iya lissafa haɗin wani bayanan martaba ba, kuma kira mara izini na iya jefa keɓewar tsaro maimakon mayar da kuskure mai kyau. Magance duka sakamakon biyu a bayyane.

Rashin mai shi ba sunan fakiti ba ne. Kwararar na iya rufewa tsakanin fakitin da binciken, tuple na iya zama bai cika ba, ko kuma mai kira ba a ba shi izinin sani ba. Ajiye amsar farko mai nasara da sake amfani da ita daga baya yana danganta sabon haɗi ga tsohuwar manhaja, wanda ya fi muni da bayar da rahoton ba a sani ba.

Lokacin da bayanin ya kasa, zirga-zirgar har yanzu tana buƙatar shawara: toshe ta inda manufofin ke buƙatar haka, ba da izinin iyakar da kuka fahimta kawai, ko nuna gibin. Wannan maye gurbin na cikin ƙira ne, ba a cikin sharhi ba.

Lissafi wata tambaya ce daban

NetworkStatsManager yana ba da rahoton amfani a ƙarƙashin nasa ƙa'idojin shiga. Zai iya gaya muku nawa UID ya tura a cikin wani lokaci; ba zai iya gaya muku mai wani fakitin rai ba. Ƙarfin cibiyar sadarwa yana bayyana halayen cibiyar sadarwa, ba littafin socket ba. Haɗa ukun yana samar da dashboards da suke kama da daidaito kuma ba haka suke ba.

Don yanayi mai sauƙi na yanke shawarar waɗanne manhajoji ke amfani da tunnel, jerin manhajoji da aka yarda da waɗanda aka hana na Android sun riga sun bayyana manufofin ba tare da wani scraping ba. Ajiye bayanin kowace kwarara don lokuta waɗanda da gaske suke buƙatarsa, kuma yi kasafin kuɗi don aiwatarwa mai kulawa wanda ke magance alkibla, izini da yanayin da ba a sani ba tare.

Zaɓi kayan aiki bisa aiki, sannan gwada gefuna

Idan buƙatar zaɓin tunnel ne, yi amfani da jerin dandamali. Idan bayani ne kai tsaye, yi amfani da binciken mai shi kuma ɗauki kowane tuple maras amsa a matsayin wanda ba a sani ba. Idan jimillar tarihi ne, yi amfani da stats API. Sannan gwada gefuna uku da ke karya aiwatarwa marasa hankali: fakitin alkibla akasin haka, kwarara da ke rufewa kafin ka bincika, da mai kira wanda ba shine VPN mai aiki ba.

Babu ɗaya daga cikin waɗannan da ke buƙatar kashe SELinux, yin root ɗin wayar ko sanya teburin kernel a karanta ga kowa. Iyaka shine ma'anar: dandamali ya motsa bayanin a bayan yarjejeniya domin amsar ta kasance ga ɓangaren da ke buƙatarta bisa doka, kuma ba ga kowa ba.