WireGuard cikin sararin sunan cibiyar sadarwa: me ya sa soket ɗin ya tsaya a baya

An jera hanyar shiga a cikin sararin sunan da kake so, aikace-aikacen yana da alaƙa da ita, amma ba a taɓa ganin zirga-zirgar rami ba. Wannan shine alamar na'urar WireGuard a cikin kernel na Linux da aka ƙirƙira a wani sararin suna sannan aka matsar da ita zuwa wani: hanyar shiga ta motsa amma soket ɗin UDP ɗinta da aka ɓoye bai motsa ba. Dole ne duka biyu su kasance a wurin da ya dace kafin zirga-zirgar ciki ta yi muhimmanci. Binciken yana da sauri da zarar ka san cewa dole ne a duba mahallin biyu maimakon ɗaya.

Alamar cutar: daidai sararin suna, amma babu fakiti

A cikin sararin suna, ramin yana da lafiya. Na'urar tana nan, an ba da adireshi, kuma tsarin abokin aiki yana nan. A waje, musayar UDP da ake tsammani ba ta taɓa bayyana a hanyar shigar da kake kallo ba, kuma ɗayan gefen yana bayar da rahoton cewa babu musafaha.

Dalilin shine fakiti na cikin aikace-aikacen suna isa ga na'urar da aka matsar, kuma na'urar tana ƙoƙarin aika su ta soket da ke cikin wani mahallin cibiyar sadarwa daban. Hanyar da yake amfani da ita, da kowace ƙa'idar wutar bango da ta shafe ta, sune na cikin sararin sunan da aka ƙirƙiri na'urar.

Wannan ba kuskure ba ne a cikin matsawa, kuma ba kuskuren tsari ba ne na abokin aiki. Haka aiwatar da kernel yake yi, kuma takardun sararin suna na WireGuard sun bayyana ƙa'idar ƙirƙira kai tsaye.

Me ya sa soket ɗin yana da wurin haihuwa

Na'urar WireGuard tana da soket ɗin UDP ɗaya don jigilar da aka ɓoye, kuma ana buɗe wannan soket a cikin sararin sunan da aka ƙirƙiri na'urar. Matsar da hanyar shiga da umarnin haɗi yana matsar da na'urar da ake gani amma yana barin jigilar a inda ta fara. Sannan abubuwa biyu suna da masu mallaka daban-daban.

Sakamakon yana da sauƙin tsallakewa saboda ana duba rabi biyu a wurare daban-daban. Ana yanke shawarar hanyar ciki a cikin sararin sunan da aikace-aikacen ke gudana, kuma ana yanke shawarar hanyar waje a inda soket ɗin yake. Duba ɗaya kawai yana ba da tabbaci, amma ƙarshe mara kyau. Duba duka biyu yawanci yana ƙare binciken a zagaye ɗaya.

Ƙirƙira shi a inda kake son soket ɗin

Magani shine a ƙirƙiri na'urar a cikin sararin sunan manufa maimakon ƙirƙira ta a waje sannan a matsar da ita. Muna ɗauka cewa an riga an sami sararin sunan da aka amince da shi kuma ba a amfani da sunan:

ip netns exec vpn-apps ip link add wg-demo type wireguard
ip netns exec vpn-apps wg show

Yanzu duka hanyar shiga da soket ɗinta suna cikin wannan mahallin, don haka hanyar da ke ƙasa da ƙa'idodin tacewa da suka dace sune waɗanda aka tsara a can. Idan tsarin yana buƙatar gefen bayyananne a wani wuri, saka hanyar shigar da ke ƙasa a cikin sararin suna da farko sannan ka ƙirƙiri ramin bayan haka. Tsari wani ɓangare ne na zane, ba dalla-dalla na aiwatarwa ba.

Ɗauki waɗannan a matsayin umarnin gudanar da cibiyar sadarwa, ba a matsayin girke-girke ba. Suna ƙirƙirar na'ura kuma suna nuna yanayi; makullai, abokan aiki, adireshi da hanyoyi dole ne su fito daga tsarin da aka amince da shi, kuma ba za a taɓa maye gurbin hanyar shiga ta samarwa da ke akwai a cikin misali ba.

Karanta ɓangarorin biyu na hanyar

Da zarar na'urar tana wurin da ya dace, tabbatar da shawarwari biyu daban. Fara da binciken ciki daga mahallin aikace-aikacen, sannan duba hanyar waje daga mahallin da ya mallaki soket ɗin:

ip netns exec vpn-apps ip route get 10.30.0.9
ip netns exec vpn-apps wg show
tcpdump -ni any udp port 51820

Idan binciken ciki ya warware ta cikin ramin kuma ɗaukar waje ya nuna musayar da aka ɓoye, rabin biyu sun yarda. Idan ɗaukar ba komai, soket ɗin yana wani wuri, ko hanyar da ke ƙasa a cikin sararin sunansa ba ta isa ƙarshen ba.

Wani bincike kuma ya kamata ya kasance cikin rikodin: yadda ake ƙirƙirar na'urar bayan sake kunnawa. Manajan da ya sake ƙirƙirar hanyar shiga da wani mahallin ƙirƙira yana canza wurin haihuwar soket ɗin. Matsar da hannu da ta yi aiki sau ɗaya ba shaida ba ce game da hanyar da ake sarrafawa.