Azure VPN Client Linux: domain-yada DNS lama dejin karin

Tunnel-ku wuu soo baxaa, shahaadada waa la xaqiijiyaa, ka dibna wadahadal wuxuu sheegayaa in server-ka DNS ama domain-yada lama dejin karin. Linux dhexdiisa wadahadalkaas badanaa kuma saabsana gateway-ga: macmiilku wuxuu u gudbiyaa habaynta magacyada systemd-resolved iyada oo loo marayo D-Bus, gudbin la diidayna waxay interface-ka uga tagtaa kor, xallinta weli u jeedda xiriirka hore. Isla laptop-kaas ayaa magacyada si fiican u xalliya ka hor inta uusan profile-ku helin suffix, oo waa tilmaanta mudan in la raaco. Waxba tunnel-ka kama beddelmin la-shiga ahaanshaha wadahadalka.

Suffix la'aan macmiilku wuxuu riixaa kaliya server-yada magacyada. Ku dar domain raadin oo wicitaan labaad ayaa ku biiraa, SetLinkDomains, oo leh hubintiisa ogolaansho, taas ayaa sababta isla profile-ku uga shaqeeyo Windows halkan-na ugu guuldarraysto. Gateway-ga labada xaaladoodba wuxuu riixaa isla goobahaas, qaybta diiddana waa mid maxalli ah.

Xaqiiji in systemd-resolved uu yahay xalliyaha

Macmiilkan wuxuu la hadlaa kaliya systemd-resolved oo cid kale lama hadlo. Arch iyo dhowr qaybood oo kale waxay soo bandhigaan isagoo damis ah, /etc/resolv.conf wuxuu ka tirsanaan karaa xalliye kale gebi ahaan, sidaas darteed go'aanso milkiilaha ka hor inta aadan fiirin ogolaanshaha.

Saddex amar ayaa tan caddeeya:

systemctl status systemd-resolved
ls -l /etc/resolv.conf
resolvectl status

Waxaad raadinaysaa adeeg firfircoon, xiriir calaamadeed oo u jeeda /run/systemd/resolve/stub-resolv.conf, iyo DNS xiriir kasta gudihiisa resolvectl. Marka NetworkManager uu hayo lahaanshaha, u rar resolved halkii aad la dagaallami lahayd macmiilka; drop-in-ka hoose wuxuu dejiyaa labada fure:

[main]
dns=systemd-resolved
systemd-resolved=true

Dib u bilow NetworkManager isla marka faylkaas jiro. Xalliye aan firfircoonayn iyo macmiil si joogto ah u waca magaciisa D-Bus waxay wada keenaan khalad aan midkoodna magacaabin.

Fiiri wicitaanka D-Bus ee guuldarraysta

Tallaabadan waxay wadahadalka u rogtay jawaab cad. Fiiri interface-ka xalliyaha hal terminal iyo journal-ka mid kale, ka dibna dib u xiriir:

sudo dbus-monitor --system "interface='org.freedesktop.resolve1.Manager'"
journalctl -fu systemd-resolved

Saddex wicitaan waa inay soo baxaan: SetLinkDNS, SetLinkDomains iyo SetLinkDefaultRoute. Kan ku soo noqda jawaab khalad ah ayaa ah kan la hagaajinayo. Jawaabtaas badanaa waxay sheegtaa sababteeda, tusaale ahaan org.freedesktop.DBus.Error.AccessDenied ka soo horjeeda SetLinkDomains. Qor wicitaankee ayay ahayd, sababtoo ah qaybta xigta waxay ku saabsan tahay fasixinta wicitaankaas.

Siin macmiilka ficillada polkit ee uu u baahan yahay

Akhri siyaasadda ka hor inta aadan qorin qaacido. Macmiil ku shaqeeya adeeg ahaan ma jawaabi karo codsi is-dhexgal, sidaas darteed auth_admin_keep qarsoon waa waddo xiran.

pkaction --verbose --action-id org.freedesktop.resolve1.set-domains
pkaction --action-id org.freedesktop.resolve1.set-dns-servers --verbose

Haddii jawaabtu tahay auth_admin_keep, macmiilku wuxuu u baahan yahay qaacido cad. Qaybta hoose waxay ogolaataa afarta ficil ee resolve1 ee macmiilka VPN isticmaalo inta uu xiriirka ku jiro waxayna wax kasta oo kale ku reebtaa polkit.Result.NOT_HANDLED:

polkit.addRule(function(action, subject) {
  var allowed = [
    "org.freedesktop.resolve1.set-dns-servers",
    "org.freedesktop.resolve1.set-domains",
    "org.freedesktop.resolve1.set-default-route",
    "org.freedesktop.resolve1.revert"
  ];
  if (allowed.indexOf(action.id) !== -1 &&
      subject.isInGroup("wheel")) {
    return polkit.Result.YES;
  }
  return polkit.Result.NOT_HANDLED;
});

Ku dheji /etc/polkit-1/rules.d/ sidii fayl aad mar dambe aqoonsan doonto, tusaale ahaan 50-azurevpn.rules, oo beddel magaca kooxda qaybta midkaaga ka hor inta aadan ka bixin oo dib u gelin. Ku hay si dhuudhuuban, sababtoo ah ogolaanshaha ficil kasta oo resolve1 ee akoon kasta waa ka ballaaran yahay wixii macmiilkan u baahan yahay oo aad uga adag in la hubiyo mar dambe.

Hubi XML-ka profile-ka ka hor inta aadan beddelin polkit

Profile gacan lagu beddelay ayaa la iska indhatiri karaa iyada oo aan eray la sheegin. Microsoft waxay diiwaangelisaa qaab fidsan kaas oo dnsserver gelitaannada si toos ah ugu jiraan dnsservers, suffix-yaduna dnssuffixes gudihiisa. Qayb dheeraad ah oo ku wareegsan cinwaan kasta ma aha qaabkaas, macmiilkuna si aamusnaan ah ayuu ugu noqdaa wixii gateway-gu riixo.

Samee tijaabada ka saarista ka hor inta aadan taaban polkit. Ka saar qaybta suffix-ka, dib u xiriir oo fiiri haddii wadahadalku beddelmo. Haddii uu beddelmo, wicitaankii guuldarraystay wuxuu ahaa gudbinta domain-ka, hagaajintuna waa ogolaansho, ma aha beddel kale oo XML ah.

Hubi domain-ka xiriirka tunnel-ka

Dib u xiriir oo akhri resolvectl status mar kale, hubi in xiriirka tunnel-ku uu wada qaado server-ka magacyada iyo domain-ka raadinta. Xalli magac gaar ah oo gaaban halkii mid dadweyne. Marka magacu xallimo laakiin adeegga ka dambeeya aanu jawaabin, gudbinta DNS way shaqeysay dhibaatada hadhayna waa dariiqa.

Ku qor tigidhka milkiilaha xalliyaha, wicitaanka D-Bus ee guuldarraystay, faylka qaacidada iyo nooca profile-ka. Afartaas sadar waxay laptop-ka Linux ee xiga u beddelaan hagaajin gaaban halkii baaritaan soo noqnoqda.