Gano VPN a Android: me ya sa tun0 da ping suke ɓatarwa

Binciken da yawancin manhajojin Android suke amfani da shi don gano VPN sunan mu'amala ne, kuma bai taɓa zama binciken VPN ba. Yana bayar da rahoton cewa akwai wata mu'amala da igiyar da mai haɓakawa ya yi tsammani, wanda a wata na'ura yana nufin OpenVPN kuma a wata yana nufin wani abu da ba shi da alaƙa kwata-kwata. Ping irin wannan shaida ce: yana tabbatar da cewa wata manufa ta amsa, ba cewa wani rami ya ɗauki fakitin ba. Abin da dandamali ke bayyanawa a zahiri shine tarin cibiyoyin sadarwa da jigilar da kowannensu ke bayyanawa, kuma wannan wata tambaya ce da wata amsa.

Tatsuniya: idan tun0 ya wanzu, VPN yana aiki

Manhajojin VPN na Android aiwatar da VpnService ne waɗanda ke ba da kwafin fayil ɗin tun ga tsarin. Sunan mu'amala ya fito daga wanda ya ƙirƙira shi: OpenVPN yakan samar da tun0, PPTP da L2TP suna samar da ppp0, WireGuard yana kiran mu'amalarsa da sunan ramin, kuma ramin IPsec na iya zama ba ya nuna wani suna na al'ada kwata-kwata. Don haka karanta /proc/net/dev ko lissafin abubuwan NetworkInterface yana neman al'ada, ba gaskiya ba.

Dukansu hanyoyin kuskure suna raye. Na'ura na iya samun tun0 don ramin gida wanda ba shi da alaƙa da VPN na mai amfani, kuma ramin WireGuard mai cikakkiyar lafiya na iya zama ganuwa ga binciken da ya san igiyar tun0 kawai. Sakamakon karya na gaskiya da na ƙarya a cikin aiki ɗaya suna sa ya zama mara amfani a matsayin bincike, domin tikitin tallafi da ya ce «ba a gano VPN ba» ba za a amince da shi a kowace hanya ba.

Hanyar shiga kuma ta ƙunƙunce. Sabbin sakin Android suna iyakance abin da talakawan manhaja zai iya karantawa daga /proc, don haka binciken da ya dogara da suna wanda ya yi aiki a Android 8 na iya mayar da jerin fanko a na'ura ta baya ba tare da wani canjin lamba ba. Lokacin da binciken ya gaza a ɓoye a gefen buɗe, manhajar ta kammala cewa babu VPN a kan kayan aikin da ramin ke da kyau.

Tatsuniya: ping mai nasara yana nufin ramin yana ɗaukar zirga-zirga

Ping zuwa masaukin ciki yana yin nasara a duk lokacin da akwai hanya zuwa wannan masauki. Tare da raba rami, masaukin na iya isa ta Wi-Fi yayin da ramin yake aiki kuma yana yin wani abu daban. Tare da VPN ta kowace manhaja, manhajar da ke yin ping na iya zama an cire ta daga ramin, don haka amsar ICMP tana fita waje da shi kuma ta dawo, wanda ke tabbatar da akasin abin da binciken ke tsammani.

ICMP da TCP kuma ana tace su daban. Ramin da ke ba da izinin buƙatun amsa amma ya watsar da tashar TCP da sabis ke buƙata zai wuce gwajin ping kuma ya gaza a manhajar, kuma wannan ƙa'idar katangar wuta ce a wancan gefen ba halin na'ura ba. Karatun gaskiya ɗaya tilo na ping mai nasara shine cewa wannan manufa ta amsa wannan yarjejeniya a wannan lokacin.

Abin da dandamali ke bayar da rahoto a zahiri

Daga API 21 zuwa gaba, ConnectivityManager.getAllNetworks() yana mayar da kowace cibiyar sadarwa da tsarin ya sani, kuma getNetworkCapabilities(network) yana bayar da rahoton abin da wannan cibiyar sadarwa ke bayyanawa. Cibiyar sadarwar VPN tana ɗauke da TRANSPORT_VPN. Yin madauki a kan duk cibiyoyin sadarwa yana amsa tambaya ɗaya: shin akwai wata VPN da ke aiki a wannan na'ura a yanzu?

Tambaya ta biyu, mafi ƙunci tana buƙatar wani kira daban. getActiveNetwork() yana mayar da cibiyar sadarwar da zirga-zirgar manhajar za ta yi amfani da ita a yanzu, kuma duba wannan iyawa a kanta yana amsa: shin zirga-zirgata za ta bi ta VPN? Su biyun na iya rashin jituwa, kuma rashin jituwar yana da labari. VPN da ke aiki amma ba ta yanzu ba yana nuni ga tuƙi ta kowace manhaja ko tsarin raba rami, ba ga rami da ya ɓace ba.

Network active = cm.getActiveNetwork();
NetworkCapabilities caps = cm.getNetworkCapabilities(active);
boolean viaVpn = caps != null
    && caps.hasTransport(NetworkCapabilities.TRANSPORT_VPN);

Kare duka kira biyu. Iyawa na iya zama null ga cibiyar sadarwar da ta ɓace tsakanin lissafi da tambaya, kuma cibiyar sadarwar da ke aiki na iya zama null yayin miƙa. NET_CAPABILITY_NOT_VPN tana da amfani a wata hanya, don tabbatar da cewa cibiyar sadarwa tabbas ba rami ba ce maimakon kawai ta rasa tutar jigilar VPN.

NetworkInfo ya kasance wannan tatsuniya tare da API

ConnectivityManager.TYPE_VPN tare da NetworkInfo shine ƙarni na biyu na wannan bincike, kuma an soke shi saboda dalili. A sabbin sakanni abin da aka mayar wa VPN na iya zama null yayin da ramin ke haɗe, don haka lambar da ke ɗaukar null a matsayin «babu VPN» tana bayar da rahoton ƙarya a ɓoye a na'urorin da amsar ta fi muhimmanci.

Watsa shirye-shiryen da yakan raka shi ma bai fi kyau ba. CONNECTIVITY_CHANGE yana da tarihin da aka rubuta na rasa sauye-sauyen VPN, gami da ginannun da ya kan kunna kawai lokacin da VPN ya haɗu ko ya rabu maimakon a kowane canjin cibiyar sadarwa. Mai sauraro da aka gina a kansa yana samar da mai canza yanayi wanda ke nisanta daga ra'ayin dandamali har zuwa cikakkiyar sake haɗawa ta gaba.

Mayar da martani ga kira maimakon yin tambaya akai-akai

Yi rijistar NetworkRequest wanda ke buƙatar TRANSPORT_VPN kuma yana cire NET_CAPABILITY_NOT_VPN, sannan ka kira registerNetworkCallback da wannan buƙatar. Sannan onAvailable da onLost suna gaya maka lokacin da sanarwar ta canza, kuma wannan shine abin da ya faru da kake da sha'awa da gaske. Cire rijistar kiran dawo da martani lokacin da ɓangaren ya tsaya, in ba haka ba manhajar tana riƙe da magana ga allon da ya mutu kuma kiran dawo da martani yana ci gaba da kunna.

NetworkRequest req = new NetworkRequest.Builder()
    .addTransportType(NetworkCapabilities.TRANSPORT_VPN)
    .removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
    .build();
cm.registerNetworkCallback(req, callback);

Wannan yana buƙatar ACCESS_NETWORK_STATE, wanda izini ne na al'ada: babu root, babu maganar yardar mai amfani, babu izinin VPN. Yin tambaya akai-akai da agogon lokaci shine madadin da mutane ke komawa zuwa gare shi, kuma yana cinye baturi yayin da har yanzu yana rasa sauyi da ya fi guntu fiye da tazarar, wanda shine ainihin sauyin da mai amfani ke bayar da rahoto.

Abin da amsar har yanzu ba za ta iya gaya maka ba

Babu ɗaya daga cikin waɗannan API da ke bayar da rahoton ko ramin yana da lafiya, a wace uwar garke yake ƙarewa, ko zirga-zirgar wata manhaja tana cikinsa. Cibiyar sadarwar VPN na iya wanzuwa ba tare da hanyoyi masu amfani ba, kuma ramin kowace manhaja na iya cire manhajar da ke yin tambayar.

Don haka rubuta abin da binciken ya gani, ba kawai boolean ba. Rubuta gano cibiyar sadarwa, jigilar da aka bayyana da ko wannan cibiyar sadarwa tana aiki. Rahoton da ya ce «ba a gano VPN ba» ba shi da amfani, yayin da wanda ya ce wata cibiyar sadarwa ta bayyana TRANSPORT_VPN amma getActiveNetwork() ya mayar da Wi-Fi yana nuni kai tsaye ga tuƙi ko ga jerin cirewa, kuma wannan gyara ne da wani zai iya yin aiki a kansa.