SSTP yana kasawa inda HTTPS na mai bincike ke yin nasara: me ya sa
SSTP yana gudana cikin TLS a tashar 443, amma ba buƙatar yanar gizo ba ce. Gwada TCP, asalin TLS, musayar SSTP da tabbatarwar PPP a matsayin matakai daban.
Mai bincike yana buɗe sunan mahauci VPN ta HTTPS ba tare da korafi ba, kuma SSTP abokin ciniki har yanzu ya ƙi haɗawa. Babu wani abu mai sabani a cikin wannan biyun. SSTP yana amfani da TLS a matsayin jigilar waje sannan yana gudanar da buƙatarsa da kayan PPP a cikin wannan haɗin, don haka loda shafi cikin nasara yana tabbatar da abu ɗaya kawai: mahaucin yana amsa GET a tashar 443. Abokin ciniki yana yin wata tambaya, kuma uwar garken na iya amsa ta da kyau.
Shafin yana lodawa kuma ramin ba ya
Mutane suna neman gwajin mai bincike saboda yana da sauri, sannan suna ɗaukar sakamakon a matsayin hujja cewa uwar garken ana iya isa gare ta kuma an daidaita ta. Hujja ce kan GET zuwa hanyar da sandar adireshi ta buɗe, ba wani abu ba. Tattaunawar VPN tana farawa bayan musafaha ɗaya na TLS, amma tana aika hanyar aiki da hanya da shafin yanar gizo bai taɓa amfani da su ba. Don haka amsar 200 ga mai bincike ba ta ce komai game da ko wurin ƙarshen SSTP yana nan.
Raba biyun kallo kuma binciken yana raguwa. Jigila da sarkar takardar shaida suna aiki, kuma wani abu a musayar ka'ida a sama ba ya aiki. Wannan bincike ne daban da tashar da ta karye ko takardar shaida da ta ƙare, kuma yana buƙatar hujjoi daban.
Abin da abokin ciniki SSTP ke aikawa da gaske
Abokin ciniki yana aika buƙatar HTTP da hanyar SSTP_DUPLEX_POST zuwa hanyar /sra_{GUID}/, sannan yana barin jikin haɗin a buɗe a matsayin rafi mai alkibla biyu da ke ɗaukar firam ɗin PPP. Uwar garke mai bin ka'ida tana amsa HTTP/1.1 200 kuma ta daina zama kamar uwar garken yanar gizo. Duk wani abu daban alama ce: 405 ko 404 na nufin wurin ƙarshen babu shi, 301 ko 302 na nufin wani abu yana juya hanyar buƙatar, kuma FIN nan take na nufin wakili ko uwar garke ya rufe rafin.
Shi ya sa makasudin dole ya zama uwar garken SSTP ba uwar garken yanar gizo da aka maƙala mata takardar shaidar TLS ba. Hanya, hanya da dogon jiki buƙatun ka'ida ne, don haka wakilin juyi ba zai iya ƙara su da tsarin kawai ba. Wakilin da ke tura HTTPS na yau da kullum daidai zai iya ƙin hanyar da bai gane ba.
Inda wakili ko uwar garken yanar gizo ke karya rafin
Mai shiga tsakani yana duba layin buƙatar HTTP kafin ya tura wani abu, kuma hanyar da aka keɓe da hanya mara kyau na iya kasawa a dokokinsa. Wasu na'urori suna ba da shafi na yau da kullum yayin da suke ƙin ko katse ramin, don haka abokin ciniki yana ba da rahoton haɗin da ya fara sannan ya mutu maimakon ƙin tsafta. Wasu suna karɓar buƙatar, sannan suna amfani da lokacin jiki ko zaman banza wanda keepalive na PPP ba zai iya tsira ba. Dukansu suna kama da juna daga gefen abokin ciniki, shi ya sa matakin da ya kasawa ya fi rubutun kuskure muhimmanci.
Raba tashar 443 tsakanin gidan yanar gizo da SSTP zaɓin turawa ne, ba alkawarin cewa kowane tsalle zai kula da tattaunawar biyu iri ɗaya ba. Idan mai daidaita lodi, bangon wuta ko mai ƙarewar TLS yana kan hanya, ƙara shi cikin jerin waɗanda ake zargi kafin ka taɓa tsarin VPN.
Gwada matakan daban
Gudanar da binciken a jere kuma tsaya a kasawar farko, domin kowane mataki yana kawar da wani sashe na daban. Binciken TLS da ke ƙasa yana raba asalin takardar shaida daga duk abin da SSTP ke yi. Musanya sunan mahauci da wurin ƙarshenka kuma karanta batun da sarkar da yake bugawa.
openssl s_client -connect vpn.example.com:443 -servername vpn.example.comSannan ka daidaita sauran hujjoi da matakan maimakon yin hasashe daga kuskuren abokin ciniki. Teburin da ke ƙasa shine jerin dubawa da za a ambata a tikit, tare da alamar da ke raba kasawa ɗaya daga ta gaba.
| Stage | What it proves | Failure signature |
|---|---|---|
| TCP to 443 | A listener exists and the path is open | Timeout or connection refused |
| TLS with SNI | The certificate matches the name you use | Name mismatch or untrusted chain |
| SSTP_DUPLEX_POST exchange | The endpoint is an SSTP server | 405, 404, 301 or an early FIN |
| PPP authentication | The user credential was accepted | Auth failure after a 200 response |
| Inner routing | A permitted destination is reachable | Tunnel up, no reply from the target |
Rubuta matakin ƙarshe da ya yi nasara a tikit maimakon rubuta "ba za a iya haɗawa ba". Ƙayyadaddun MS-SSTP yana rubuta buƙatar da musayar PPP da ke biyo bayan musafaha TLS, kuma shine tushen dalilin da ya sa gwajin mai bincike ba zai iya wakiltar ko ɗaya daga cikinsu ba.
Asali da farko, sannan PPP
Asalin TLS da tabbatarwar PPP suna jere, ba madadi ba, kuma rikita su yana tura mutane zuwa tsarin uwar garke mara kyau. Abokin ciniki yana tabbatar da takardar shaidar uwar garke da manufarta da farko, sannan PPP yana tattaunawa kan yanayinsa kuma yana tabbatar da mai amfani da hanyar ƙalubale-amsa ko EAP. Matsalar takardar shaida tana haifar da kuskure daban da kalmar sirri da aka ƙi, kuma babu ɗayan kuskuren da ke bayyana matakin da ɗayan ke ɗauka.
Maye gurbin sunan mahauci da adireshi, ko danna wuce gargaɗin takardar shaida, yana cire binciken da zai gano matakin da ya gaza maimakon gyara shi. Riƙe gargaɗin kuma karanta shi. Kada ka sake saita kalmar sirri ta PPP lokacin da musayar HTTP ba ta taɓa isa halin SSTP ba, domin ba a taɓa neman shaidar shiga ba.