Yadda ake keɓe wani yanki na cibiyar sadarwa daga tunel ɗin VPN na Android

VpnService na Android ba shi da hanyar keɓewa, kuma babu adadin karatun API da zai samar da ita. Builder.addRoute() yana ƙara maƙasudai ne kawai cikin tunel ɗin, don haka ajiye wani yanki na LAN a matsayin na gida yana nufin wannan yankin ba zai taɓa shiga jerin hanyoyi ba. Abin da kuke ƙara maimakon haka shi ne cikakken sashin, wanda aka bayyana da ƙofofi na yau da kullum. Aikin lissafi ne, kuma yana gazawa a wurare kaɗan da za a iya tsammani.

Bi binciken da ke ƙasa bisa tsari. Kowane yana ɗauka cewa na baya ya tsaya, don haka tsaya a gazawar farko maimakon gyara alamomi a ƙasa.

Fara daga abin da tunel ɗin ke da'awa

Ba da 0.0.0.0/0 ga addRoute() yana gaya wa Android cewa kowace manufa ta IPv4 na cikin tunel ɗin. Shi ya sa abokan ciniki da yawa suke kamar ba su iya rarraba tunel: suna da'awar dukan sararin adireshi sannan su yi ƙoƙarin cirewa daga gare shi. Babu abin da ke cirewa a cikin maginin. Hanya mafi takamaiman ga cibiyar da kuke so ta kasance ta gida tana yin akasin abin da mutane suke tsammani, domin mafi tsayin ƙofa da ya dace shi ne yake cin nasara kuma wannan cibiyar tana faɗawa cikin tunel ɗin.

Jerin hanyoyi shi ne dukan manufar. Babu wani veto na kowace manufa a bayansa, kuma littafin Builder bai lissafa wata hanya da za ta bayar ba.

Ƙirƙiri cikakken sashin daga lissafin ƙofofi

Cikakken sashin ƙofar da aka keɓe shi ne tarin 'yan uwanta a kan hanya zuwa tushen bishiyar adireshi. Ga kowace tsayi daga 1 har zuwa tsayin da aka keɓe, ɗauki rukunin wannan tsayin da ya ƙunshi ƙofarka, juya bit ɗin da ke ƙasa da ƙofar kai tsaye, sannan fitar da sakamakon. Yana zama kamar ba a gani ba har sai ka gudanar da shi.

Keɓe 10.0.0.0/8 yana ba da hanyoyi takwas: 128.0.0.0/1, 64.0.0.0/2, 32.0.0.0/3, 16.0.0.0/4, 0.0.0.0/5, 12.0.0.0/6, 8.0.0.0/7, 11.0.0.0/8. Babu ɗayansu da ke ƙunshe da 10.0.0.0/8, kuma tare suna rufe duk sauran.

Layuka takwas suna ƙirƙirar wannan jerin ga kowace ƙofa:

import ipaddress
def complement(addr, length):
    base = int(ipaddress.IPv4Address(addr))
    out = []
    for k in range(1, length + 1):
        block = base & (0xFFFFFFFF << (32 - k))
        sibling = block ^ (1 << (32 - k))
        out.append(f"{ipaddress.IPv4Address(sibling)}/{k}")
    return out
print(complement("10.0.0.0", 8))

Adadin hanyoyi daidai yake da tsayin ƙofar, kuma wannan shi ne lambar da ya kamata a lura da ita. Keɓe /21 guda ɗaya yana kashe hanyoyi 21 kuma yana zama mai sauƙin karantawa. Keɓe goma na iya kashe ɗaruruwan, wanda yawanci yana nufin tsarin cibiyar yana buƙatar canzawa ba maginin ba.

Duba iyalar adireshi da iyakar tunel ɗin

Hanyoyin IPv4 ba sa yin komai ga IPv6. Idan tunel ɗin yana da'awar adireshin IPv6, ƙofar LAN ta IPv6 tana buƙatar nata cikakken sashin, wanda aka ƙirƙira da wannan lissafi bisa gaɓoɓi 128 na bit. Wani sanannen dalilin da ke sa keɓewar yin aiki a takarda yayin da na'urar gida ta kasance ba a iya isa ba shi ne wannan: an isa ga mai masaukin ta IPv6, kuma IPv4 kaɗai aka yanka. Duba duka iyalai biyu kafin ka yanke shawarar cewa lissafin ba daidai ba ne.

Iyaka ita ce rabin biyu na binciken. Android yana bibiyar tuƙi ta kowace cibiya da kowace manhaja, don haka wannan ƙofar za ta iya shiga tunel ga manhaja ɗaya kuma ta kasance kai tsaye ga wata, dangane da yadda aka ayyana VPN ɗin.

Sanya ka'idojin DNS da na kowace manhaja a inda suka dace

Keɓewar hanyoyi ba ya canza mai warwarewa. Sunan mai masauki na gida zai iya samun amsa daga uwar garken DNS na tunel ɗin yayin da ake tuƙa adireshinsa a gida, kuma rashin daidaito yana bayyana a matsayin suna da ke warwarewa zuwa wani abu da LAN ba za ta iya isa ba. Sanya manufar mai warwarewa da gangan, da yankin bincike ko ka'idar DNS mai rarrabuwa. Kada ka ɗauka cewa hanyoyin sun yanke shawarar haka dominka.

addDisallowedApplication() yana ajiye manhaja ɗaya a wajen tunel ɗin; ba ya ajiye manufa a waje ga manhajojin da suka rage a ciki. protect() yana barin soket ɗin da ka buɗe ya tsallake tunel ɗin, kuma haka tunel ke guje wa kama nasa jigilar. Babu ɗayansu da ya maye gurbin cikakken sashin.

Tabbatar da bincike, ba da jerinka ba

Da zarar tunel ɗin ya tashi, tambayi na'urar inda adireshi yake zuwa da gaske maimakon sake karanta jerin da ka gina. A kan gin da ke ɗauke da iproute2, adb shell ip route get 10.1.2.3 yana ambaton hanyar da kernel ya zaɓa. Gudanar da wannan umarni ga adireshin jama'a kuma tabbatar ya ambaci tunel ɗin.

Ƙarin bincike biyu suna rufe da'irar. Da farko warware sunan gida, sannan gudanar da adb shell ip route get a kan adireshin da aka warware kuma nemi hanyar da ba tunel ɗin ba, domin nasarar adb shell ping -c 1 host.lan tana tabbatar da isarsu ba hanya ba. Maimaita gwajin iyalar adireshi bisa IPv6 idan tunel ɗin yana da'awar ɗaya. Gwada a matakin API da kuke jigawa, domin yadda ake bayyana cibiyoyin VPN ga allon tuƙi ya canza a tsakanin sifofi. Jerin hanyoyi da ke kama da daidai a takarda da binciken da ke zaɓar hanyar da ba daidai ba kurakurai ne daban-daban, kuma na biyu kaɗai ke isa ga masu amfani.

Idan jerin keɓewa ya ci gaba da girma, daina ƙirƙirar hanyoyi kuma sake lambar da nisa cibiyar ko ƙunsa tunel ɗin maimakon haka. Maginin hanya ce ta wucin gadi don API ɗin da ya ɓace, ba kayan aikin ƙira ba.