HTTPS a cikin kwantena a kan VPN na kamfani yana tsayawa? Gwada ƙafar DTLS

A cikin kwantena bayan VPN na kamfani, DNS yana warwarewa, shafin shiga yana lodawa, wurin duba lafiya yana amsawa, sannan buƙatar HTTPS tana tsayawa har sai lokaci ya ƙare. Sake gina hoton da canza masu canjin wakili ba su canza kome ba, domin ɓangaren da ya lalace ba ya cikin hoton. Abokin ciniki yana tabbatar da kansa ta wata hanyar jigila kuma yana motsa manyan bayanai ta wata, kuma na biyun ne kawai ya lalace.

Hanyoyin jigila biyu, alama ɗaya mai ruɗani

Abokin ciniki na kamfani mai tushe a TLS yakan tabbatar da kansa ta hanyar haɗin TLS na yau da kullum, sannan ya tattauna wata tasha biyu ta bayanai mai tushe a UDP don zaman. Sa'ad da wannan ƙafa ta biyu ke aiki, saurin wucewa da jinkiri suna inganta. Sa'ad da aka tace ta ko ba za ta iya wucewa ta hanyar ba, duk abin da ke gaban jigilar manyan bayanai yana yin nasara kuma jigilar kanta tana tsayawa, wanda shi ne ainihin tsarin da ke sama.

Kwantena ba ya canza wannan tattaunawa; yana canza hanyar da manyan fakiti ke bi. Mai masaukin yana fassara magudanar kwantena, don haka datagram na UDP suna fita daga wata tashar tushe dabam da soket na gida na abokin ciniki, kuma suna dawowa ta wani shigarwar fassara da ke ƙarewa da ɗan gajeren lokaci fiye da kafaffen magudanar TCP. Idan rami yana aiki a kan mai masauki amma ya kasa a cikin kwantena, kwatanta waɗannan magudanan biyu kafin ka zargi manhajar. Wannan kwatancen yana warware fiye da kowane sake gina hoto.

Yanke shawara ta gwaji, ba ta hankali ba

Gwajin mafi sauƙi yana kashe tashar bayanan UDP kuma ya maimaita buƙatar. Yi amfani da abokin cinikin layin umarni maimakon na'urar tebur, domin tutar ta yi aiki da gaske: openconnect vpn.example.net --user=you --interface=tun0 --no-dtls. Idan buƙatar da ta tsaya yanzu ta cika, ƙafar DTLS ce matsalar kuma sauran hayaniya ce.

Tabbatar da sakamakon a duka alkibloli daga kwantena ɗaya, buƙata ɗaya mai yawa da tutar da ɗaya ba tare da ita ba. Canjin ɗabi'a da ke bin tutar shaida ce; shafin da a ƙarshe ya loda ba shaida ba ce.

Idan tutar ta gyara shi, yanke shawara me ya sa

Yanayi uku suna haifar da alama ɗaya, kuma suna buƙatar amsoshi dabam-dabam. Hanyar na iya tace UDP gaba ɗaya, wanda ke sa tutar ta zama amsar dindindin da ta dace ga wannan hanyar sadarwa. Hanyar na iya barin UDP amma ta jefar da manyan datagram, wanda ke nuna MTU maimakon tacewa. Ko kuma hanyar na iya yin asara sosai har ƙafar UDP ta yi muni fiye da TCP, wanda shawara ce ta iya ɗauka ba ta isa ba.

Bambanta su kafin ka rubuta hanyar wucin gadi. Tacewa tana jure wa kowane girman fakiti, matsalolin MTU suna bayyana ne kawai sama da ƙofa, kuma asara tana bayyana a matsayin sake aikawa da jinkiri mai canzawa ba a matsayin tsayawa mai tsabta ba. Kowane gwaji yana taƙaita sanadin ba tare da canza tsarin abokin ciniki ba.

Duba girman fakiti kafin ka riƙe hanyar wucin gadi

Idan girma ne sanadi, ƙofar rami tana karɓar fakiti da hanyar ba za ta iya ɗauka ba, kuma matsalar tana dawowa a kowace hanyar jigila da zarar nauyin ya girma. Kwatanta ƙofofin: ip link show tun0 a kan mai masauki, sannan docker network inspect bridge don karanta MTU da aka rubuta a zaɓuɓɓukan hanyar sadarwa. Gadar kwantena da har yanzu take kan baiti 1500 a ƙarƙashin ramin da ke ɗaukar ƙasa, ita ce abin da aka saba samu.

Bincika zuwa sama daga girman da aka sani mai kyau da gwajin hana rarrabuwa a cikin rami, sannan rage MTU na hanyar sadarwar kwantena ko matse TCP MSS a kan rami. Kowace gyara daga cikinsu tana sa hanyar UDP ta sake yin amfani da ita kuma tana kawar da buƙatar tutar, wanda shine sakamako mafi kyau idan tacewa ba ita ce sanadi ba.

Yanke shawara abin da kake shirye ka musanya

Da tashar bayanai a kashe, ramin yana ɗaukar nauyinsa cikin haɗin TCP. A kan hanya mai tsabta hakan kawai ya fi jinkiri; a kan mai asara, ɓataccen yanki ɗaya yana jinkirta duk abin da ke bayansa kuma sake aikawa na waje yana fafatawa da na ciki. Wannan musanya ya dace da haɓaka mai mu'amala da ƙananan kira na API, kuma bai dace da jigilar manyan bayanai ko dogayen zama a kan hanyoyin wayar hannu ba.

Ko wane zaɓi ka zaɓa, rubuta wace hanyar jigila ramin ya yi amfani da ita a ƙarshe da me ya sa. Kwantena da ke dogaro a shiru ga tutar da wani ya ƙara watanni da suka wuce ita ce matsala ta gaba, kuma wanda zai gyara ta ba zai san ko tutar hanyar wucin gadi ce don tacewa ko ragowar gwajin MTU ba.