OpenVPN ta hanyar wakilin HTTP: fara karanta amsar CONNECT

Juya abokin ciniki na VPN zuwa wakilin HTTP na kamfani, kuma gaskiya ta farko mai amfani ita ce wakilin ba ya magana da ka’idar VPN. Yana buɗe haɗin TCP na yau da kullum zuwa adireshin da ka ambata sannan ya koma gefe, yana barin abokin cinikinka da uwar garke su yi musayar nasu ta wannan rafi. Duk abin da abokin ciniki ke buƙata, daga nau’in jigila har zuwa mai saurare na uwar garke, dole ne ya dace da wannan tsari. Rashin daidaituwa biyu ne ke bayyana yawancin gazawa: bayanin martaba na UDP da aka nufa zuwa wakilin CONNECT, da amsar wakili da aka ɗauka a matsayin kuskuren VPN.

Abin da wakili ke ɗauka, da abin da ba ya ɗauka

Wakili matakin jigila ne kawai. Ba ya zama wakilin burauzarka, ba ya adana shafukan da ka ziyarta ta hanyar rami, kuma ba ya ganin zirga-zirgar ciki sai dai idan wani ya tsara dubawa da gangan. Ramin da yake buɗewa a gare shi ba shi da bayyana ta hanyar ƙira.

Wannan kuma yana nufin wakilin ba zai iya gyara uwar garke da ba ta da mai saurare daidai ba. Izinin isa ga wata manufa da sabis da ke saurare a wannan manufar abubuwa biyu ne daban, kuma na farko ne kawai ya ke hannun mai kula da wakilin.

Dole ne mai ɗauka ya kasance TCP a ɓangarorin biyu

Wakilin CONNECT na al’ada yana aika rafin bytes kawai , don haka abokin ciniki dole ne ya yi amfani da jigilar rafi. Guntun abokin ciniki na wannan yanayin yana kama da haka:

proto tcp-client
remote vpn.example.net 1194
http-proxy proxy.corp.example 3128

Ɓangaren uwar garke yana buƙatar ainihin mai saurare na TCP a tashar da aka ambata a layin remote. Canza proto udp zuwa proto tcp-client a cikin bayanin martaba yana ƙirƙirar abokin ciniki da ke tsammanin rafi; ba ya ƙirƙirar rafin a wancan ɓangaren. Idan wannan uwar garke ɗaya tana amsawa ta UDP kuma a wannan tashar, wannan wani mai saurare ne, ba yanayi na biyu na ɗaya ba.

Inda akwai wani nau’i na TCP daban, na’urar raminsa, tafkin adireshi da tuƙi nasa albarkatu ne. Kwafin tsari mai aiki da canza kalmar jigila yana barin waɗannan albarkatu suna nuni ga ainihin nau’in, wanda ke haifar da haɗin da ke tabbatarwa sannan ba ya tuƙa komai.

Karanta amsar wakili kafin sakamakon VPN

Musayar farko ta abokin ciniki layin buƙata ne da ke ambaton masaukin manufa da tasha. Amsar wannan layin tana gaya maka ko akwai rafin bytes kwata-kwata, kuma tana zuwa kafin a duba kowace takarda shaida ko bayanan shiga:

CONNECT vpn.example.net:1194 HTTP/1.1
Host: vpn.example.net:1194

Amsa ta aji 200 ga CONNECT tana nufin rafin yana nan. Ba ta faɗin komai game da ko an amince da takardar shaidar ƙofa, ko maɓallin da aka raba ya dace, ko asusun mai amfani yana aiki. Waɗannan dubawa suna faruwa daga baya, a cikin rafin, kuma suna gazawa da saƙonnin abokin ciniki kansa maimakon layin matsayi na HTTP. Karanta log ɗin abokin ciniki don farkon OpenVPN abin da ya faru bayan musafaha da wakilin, ba layin ƙarshe kafin taga ya rufe ba.

Bayanan shiga na wakili da na VPN sau da yawa su ne asali daban-daban da ƙungiyoyi daban-daban ke riƙe. 407 ba kalmar sirri mara kyau ba ce a asusun VPN, kuma ƙin takarda shaida ba matsalar izinin wakili ba ce.

Abin da CONNECT ba ya bayyanawa

Ramin CONNECT bayyananne ba saɓo ba ne. Wakili yana aika bytes kuma ba ya ƙare zaman TLS na VPN, don haka tabbatar da takardar shaidar uwar garke daga abokin ciniki yana da ma’ana kuma ya kamata ya kasance a kunne. Kashe tabbatarwa don wucewa ta wakili yana magance wata matsala dabam da naka.

Akwai wasu tsare-tsare daban inda ƙungiya ke ƙarewa da duba TLS da gangan. Waɗannan suna buƙatar nasu tsarin amincewa da nasu shawarar manufa, kuma ba su ne abin da layin http-proxy na yau da kullum ke nema ba.

Farashin TCP a cikin TCP

Ɗaukar rami a kan TCP yana kiyaye rafin waje cikin tsari da sake aikawa, kuma zirga-zirgar ciki galibi TCP ne ma. Waɗannan hanyoyin dawo da biyu ba sa haɗa kai, don haka ɓataccen yanki ɗaya na iya tsayar da duk abin da ke raba wannan rafin waje har sai an sake aika shi. Wannan ainihin musanya ne don dacewa, ba haɓaka kyauta ba.

Yi amfani da hanyar wakili lokacin da hanyar sadarwa ba ta bar maka wata hanya ba, kuma ka fifita hanyar UDP kai tsaye inda manufa ta yarda. Ko ta yaya, bayan canji tabbatar da cewa wakili ɗaya, manufa da bayanin martaba sun isa mataki na gaba; burauza da ke loda shafi a wannan adireshin yana amfani da wata ka’ida kuma ba ya tabbatar da komai game da ramin.