Gazawar client-connect na OpenVPN: shin tsaftacewa a disconnect tana da tabbaci?
Abokin ciniki da aka ƙi ba ya mayar da ka’idar firewar ko rubutaccen rikodin. Kwatanta yarjejeniyar kira da juyawa baya da hook ɗinka dole ya yi da kansa.
Lokacin da rubutun client-connect ya ƙare da lambar da ba sifili ba, OpenVPN yana ƙin abokin ciniki, kuma masu gudanarwa galibi suna ɗauka cewa rubutun client-disconnect mai dacewa zai tsaftace. Sau da yawa ba ya gudana kwata-kwata, domin sarrafa disconnect ya dogara da abin da matakin connect ya sami nasarar kammalawa. Ɗaukar ƙi da juyawa baya a matsayin hanya ɗaya shine abin da ke mai da shiga da ya kasa zama ka’idar firewar da ta zube ko rikodin maraya. Waɗannan wajibai biyu ne daban, kuma ɗaya ne kawai daga cikinsu ke atomatik. Karanta hanyar fita ta hook ɗin kanta kafin ka zargi uwar garken da barin yanayi a baya.
Fitowa marar sifili tana ƙin abokin ciniki; ba ta mayar da aikinka baya
Matsayin fita na client-connect shawara ce ta shiga. Sifili yana nufin shiga, duk wani abu kuma yana nufin rushe misalin kafin a kafa shi gaba ɗaya. Babu wani abu a cikin wannan yarjejeniya da ke duba abin da rubutun ya riga ya yi ga duniyar waje. Idan rubutun ya ƙara ka’idar iptables, ya rubuta layi, ko ya ƙara ma’auni, waɗannan canje-canjen suna tsira daga ƙin.
Irin wannan rashin daidaituwa yana aiki ga ƙari, inda ayyukan connect da yawa za su iya gudana don misali ɗaya. Gazawar daga baya ba ta soke nasarar da ta gabata a baya ba, kuma aikin da ya gabata ba shi da hanyar sanin cewa wani aiki ɗan’uwa ya kasa.
Ƙin atomatik ne, tsaftacewa ba haka ba
Littafin OpenVPN 2.6 yana ɗaure sarrafa client-disconnect ga nasarar sarrafa connect da ya gabata. Wani keɓancewar da aka rubuta yana rufe sarƙoƙin cascade: idan matakin connect ɗaya ya riga ya mayar da nasara, matakan disconnect masu dacewa suna gudana duk da haka lokacin da aka rushe misalin, ko da wani matakin connect na baya ya kasa. Wannan keɓancewar ƙunci ce kuma ta dogara da yawan callbacks da aka saita, shi ya sa gwada rubutun shell ɗaya ba ya gaya maka komai game da sarƙa.
Yi taswirar ainihin tsarin kafin ka tsara kewaye da shi: wane rubutu, wace ƙari, kuma a wace oda suke gudana. Tebur da ke ƙasa ya lissafa abin da tsarin da bai cika ba ya barwa a baya.
| What the hook did before failing | What the client sees | What stays behind |
|---|---|---|
| Created a firewall entry | A rejection, with no tunnel | A rule matching an address nobody owns |
| Wrote a state row | A rejection, with no tunnel | A record of a session that never started |
| Allocated a tunnel address | A rejection, with no tunnel | An address marked busy until something releases it |
Kowace layi tana ƙarewa iri ɗaya ga abokin ciniki kuma daban ga mai masauki. Abokin ciniki ba zai iya sanin wanne daga cikinsu ya faru ba, don haka hook ɗin dole ya mayar da abin da ya yi kafin ya mayar da matsayin gazawa.
Yi diyya a cikin rubutun da ya kasa
Tabbatar da duk abin da za ka iya kafin ka taɓa yanayin da aka raba: filayen takardar shaida, samuwar adireshi, ƙungiyar da abokin ciniki yake. Ƙin mafi arha shine wanda ke faruwa kafin kowane rabo. Da zarar tsarin ya ƙunshi ayyukan waje da yawa, riƙe rikodin waɗanda suka kammala kuma mayar da su a jere na baya kafin ka mayar da matsayin gazawa.
Wani takamaiman lamari: rubutun yana ƙirƙirar shigarwar firewar ga kowane abokin ciniki, sannan ya kasa rubuta layin yanayin da ke bayyana ta. Reshen da ya kasa ya kamata ya cire shigarwar da ya ƙirƙira yanzu sannan ya fita da lambar da ba sifili ba. Jiran taron disconnect wanda watakila ba za a taɓa tsara shi ba shine yadda ka’ida ke rayuwa fiye da zaman da aka yi nufinta.
Sanya diyya ta zama mai maimaitawa kuma mai mallaka
Tsaftacewa dole ya kasance lafiya a gudana sau biyu kuma daidai game da abin da zai iya sharewa. Taron da ya yi latti daga ƙoƙari na baya bai kamata ya cire rabon sabon zaman ba don kawai duka biyun suna da suna ɗaya ko adireshin tunnel da aka sake amfani da shi. Yi rikodin takamaiman hannun ko ID ɗin aiki tare da albarkatun, kuma share ta wannan maɓalli maimakon da suna. Ma’amalolin bayanan bayanai suna taimakawa kawai da canje-canjen bayanan kansu; ka’idar firewar da ke wajen wannan iyaka tana buƙatar matakin diyya bayyananne.
Ka ɗauka cewa tsari na iya mutuwa tsakanin canji da tsaftacewa, kuma ƙara mai sasantawa wanda ke kwatanta yanayin waje da jerin abokan cinikin da aka karɓa bisa jadawali.
Gwada hanyoyi uku da suka bambanta da gaske
Yi aiki da lamurra uku: ƙin kafin a raba wani abu, ɗaya bayan rabon wani ɓangare, da kuma zaman da aka karɓa na yau da kullum wanda daga baya ya ƙare. Waɗannan uku suna samar da layukan log daban-daban da ragowar daban-daban. Tabbatar da yanayin waje bayan kowannensu, ba kawai saƙon gazawar abokin ciniki ba, domin gazawar abokin ciniki shine sakamakon da ake tsammani a biyu daga cikin uku.
Yi log matakin hook, matsayin fita da abin da aka raba ko aka saki, ba tare da bayanan shiga ba. Log ɗin hook da ke ambaton albarkatun da ya ƙirƙira shine abin da ke sa ka’idar da ta zube a iya samunta bayan wata shida.