Azure VPN Client a Linux: ba a iya saita yankunan DNS ba

Tunel ɗin yana tashi, takardar shaidar tana tabbatarwa, sannan wata tattaunawa ta ce ba a iya saita uwar garken DNS ko yankunan ba. A Linux wannan tattaunawa yawanci ba ta game da ƙofar ba: abokin ciniki yana miƙa saitin suna ga systemd-resolved ta D-Bus, kuma miƙawa da aka ƙi yana barin muƙunshi a buɗe tare da warwarewa har yanzu tana nuni ga tsohuwar hanyar haɗi. Kwamfutar ɗaya tana warware sunaye lafiya kafin bayanin ya sami ƙari, kuma wannan ita ce alamar da ta cancanci bi. Babu abin da ya canza a tunel ɗin a lokacin da tattaunawar ta bayyana.

Ba tare da ƙari ba abokin ciniki yana tura sabar suna kawai. Ƙara yankin bincike kuma kira na biyu yana haɗuwa da shi, SetLinkDomains, tare da nasa binciken izini, shi ya sa wannan bayanin yake aiki a Windows kuma yana gazawa a nan. Ƙofar tana tura saitin ɗaya a kowane hali, kuma sashin da ke ƙin su na gida ne.

Tabbatar cewa systemd-resolved shine mai warware sunaye

Wannan abokin ciniki yana magana da systemd-resolved kuma ba da wani ba. Arch da wasu rarrabawa da yawa suna kawo shi a kashe, kuma /etc/resolv.conf na iya kasancewa na wani mai warwarewa daban gaba ɗaya, don haka tabbatar da mai shi kafin ka duba izini.

Umarni uku suna warware haka:

systemctl status systemd-resolved
ls -l /etc/resolv.conf
resolvectl status

Kana neman sabis mai aiki, mahaɗin alama da ke nuni ga /run/systemd/resolve/stub-resolv.conf, da DNS na kowace hanyar haɗi a cikin resolvectl. Lokacin da NetworkManager ke riƙe da mallaka maimakon haka, matsar da ita zuwa resolved maimakon yin gwagwarmaya da abokin ciniki; drop-in da ke ƙasa yana saita maɓallan biyu:

[main]
dns=systemd-resolved
systemd-resolved=true

Sake kunna NetworkManager da zarar wannan fayil ɗin ya kasance. Mai warwarewa mara aiki tare da abokin ciniki da ke ci gaba da kiran sunansa na D-Bus suna haifar da kuskure wanda bai ambaci ɗayansu ba.

Kalli kiran D-Bus da ke gazawa

Wannan matakin yana mai da tattaunawar amsa takamaimai. Kalli muƙunshin mai warwarewa a wata tasha kuma ka kalli jarida a wata, sannan ka sake haɗawa:

sudo dbus-monitor --system "interface='org.freedesktop.resolve1.Manager'"
journalctl -fu systemd-resolved

Kira uku ya kamata su bayyana: SetLinkDNS, SetLinkDomains da SetLinkDefaultRoute. Wanda ya dawo a matsayin amsar kuskure shine wanda za a gyara. Wannan amsar yawanci tana ambaton dalilinta, misali org.freedesktop.DBus.Error.AccessDenied a kan SetLinkDomains. Rubuta wane kira ne, domin sashe na gaba yana magana ne kan barin wannan kiran ya wuce.

Ba wa abokin ciniki ayyukan polkit da yake buƙata

Karanta manufar kafin rubuta doka. Abokin ciniki da ke gudana a matsayin sabis ba zai iya amsa tambaya ta hulɗa ba, don haka auth_admin_keep na ɓoye hanya ce marar fita.

pkaction --verbose --action-id org.freedesktop.resolve1.set-domains
pkaction --action-id org.freedesktop.resolve1.set-dns-servers --verbose

Idan amsar ita ce auth_admin_keep, abokin ciniki yana buƙatar doka bayyananna. Gwajin da ke ƙasa yana ba da izinin ayyukan resolve1 huɗu da abokin ciniki na VPN ke amfani da su yayin haɗi kuma yana barin komai a polkit.Result.NOT_HANDLED:

polkit.addRule(function(action, subject) {
  var allowed = [
    "org.freedesktop.resolve1.set-dns-servers",
    "org.freedesktop.resolve1.set-domains",
    "org.freedesktop.resolve1.set-default-route",
    "org.freedesktop.resolve1.revert"
  ];
  if (allowed.indexOf(action.id) !== -1 &&
      subject.isInGroup("wheel")) {
    return polkit.Result.YES;
  }
  return polkit.Result.NOT_HANDLED;
});

Saka shi a /etc/polkit-1/rules.d/ a matsayin fayil da za ka gane daga baya, misali 50-azurevpn.rules, kuma maye gurbin sunan rukuni a cikin gwajin da naka kafin ka fita ka sake shiga. Riƙe shi kunkuntar, domin barin kowane aikin resolve1 ga kowane asusu ya fi abin da wannan abokin ciniki ke buƙata kuma ya fi wuya a duba shi daga baya.

Duba XML na bayanin kafin ka gyara polkit

Bayanin da aka gyara da hannu ana iya watsi da shi ba tare da kalma ba. Microsoft yana rubuta shimfida mai lebur wanda a ciki dnsserver shigarwar suna zaune kai tsaye cikin dnsservers kuma ƙari cikin dnssuffixes. Wani ƙarin muƙunshin nade a kowace adireshin ba wannan siffa ba ce, kuma abokin ciniki yana faɗuwa shiru zuwa abin da ƙofar ke turawa.

Yi gwajin cirewa kafin ka taɓa polkit. Cire shingen ƙari, sake haɗawa, ka duba ko tattaunawar ta canza. Idan ta canza, kiran da ya gaza shine miƙawar yankin, kuma gyaran shine izini ba wani gyaran XML ba.

Tabbatar da yankin a hanyar haɗin tunel

Sake haɗawa ka karanta resolvectl status kuma, ka duba cewa hanyar haɗin tunel ɗin tana ɗauke da uwar garken suna da yankin bincike tare. Warware ɗan gajeren suna na sirri maimakon na jama'a. Lokacin da sunan ya warware amma sabis ɗin da ke bayansa bai amsa ba, miƙawar DNS ta yi aiki kuma sauran matsalar ita ce turawa.

Rubuta mai warwarewa, kiran D-Bus da ya gaza, fayil ɗin doka da sigar bayanin a cikin tikitin. Waɗannan layuka huɗu suna mai da kwamfutar Linux ta gaba gyara mai sauƙi maimakon bincike mai maimaitawa.