VPN baakidhku immisa checksum ayuu leeyahay? Way ku xiran tahay

Sheegashada ah in baakidhka VPN uu qaado laba checksum oo sax ah ayaa u eg mid nidaamsan oo inta badan khaldan oo u qalma in lafalaqdho. Tirada waxay ku xiran tahay noocyada IP ee soo baxa, borotokoolka gaadiidka ee la qaado iyo qaabka ilaalinta ee tunnel-ku isticmaalo. Checksumka cinwaanka, checksumka lakabka sare iyo calaamadda daacadnimada cryptographic waa saddex hab oo leh saddex baaxadood. In la tirito waxay ka bilaabataa calaamadaynta waxa mid kastaa daboolo.

Hubi noocyada IP ee dhab ahaan ku jira siliga

Cinwaannada IPv4 waxay qaadaan checksum cinwaan 16-bit ah, cinwaannada IPv6-na waxba kama qaadaan wax la mid ah. Xaqiiqadan keliya waxay beddelaysaa tirada tunnel kasta, sababtoo ah IPv4 ku duubidda IPv6 iyo IPv6 ku duubidda IPv4 waxay soo saaraan dukumeenti kala duwan. Tunnel-ku wuxuu qaadi karaa labada qoys isku mar, markaasna dhinac midkii ayaa laga yaabaa inuu leeyahay goob aan kan kale lahayn. Go'aami noocyada ka hor inta aanad wax tirin.

Qor qaabka liis cinwaanno ah halkii sawir, ma aha. Nidaamka ayaa muhiim ah marka la akhrinayo duubista, iyo joogitaanka ama maqnaanshaha goobta checksumka ayaa ah waxa ugu horreeya ee la calaamadeeyo.

outer IPv6 | ESP | inner IPv6 | UDP | application data
outer IPv4 | ESP | inner IPv4 | TCP | application data

Sadarka koowaad ma laha checksum cinwaan IP meel kasta oo ka mid ah cinwaannadiisa IP, halka tan labaad ay leedahay laba marka labada cinwaan ay IPv4 yihiin. Isla tignoolajiyada tunnel, tiro kala duwan, oo midkoodna sadarrada ma aha qaab silig oo buuxa.

Hubi waxa checksum kastaa daboolo

Daboolka waa qaybta dadku dhaafaan, waana tan tirada macne u yeelata. Checksumka cinwaanka IPv4 wuxuu ilaaliyaa cinwaanka oo wax kale ma aha, sidaas darteed wax kama sheegayo culayska ka dambeeya. Checksumka UDP ee IPv6 wuxuu daboolaa pseudo-cinwaan iyo sidoo kale cinwaanka UDP iyo culayska, taas oo macnaheedu yahay inuu gaadho baakidhka la qaado marka datagram-ku tunnel ku jiro. TCP wuxuu leeyahay checksum u gaar ah oo leh ku-tiirsanaan la mid ah pseudo-cinwaanka. Kuwani waa saddex baaxadood oo kala duwan inkastoo saddexdaaba loo yaqaan checksum.

RFC 791 wuxuu qeexayaa hubinta cinwaanka IPv4 iyo dib-u-xisaabintiisa bood kasta, RFC 8200-na wuxuu qeexayaa maaraynta lakabka sare ee IPv6 oo ay ku jirto pseudo-cinwaanka. Midkoodna dukumeenti ma sheegayo in baakidhka VPN uu leeyahay tiro go'an oo checksum, sababtoo ah midkoodna ma qeexayo tunnel.

tshark -r capture.pcap -Y "ip.proto == 50" -V | grep -i checksum

Hubi ilaalinta daacadnimada si gooni ah

Daacadnimada ESP waa ilaalin cryptographic oo leh daboolkeeda iyo matalaad ku xiran algorithm-ka. Ma aha checksum IP ama UDP magac kale, dhererkeeduna wuu kala duwan yahay iyadoo loo eegayo qaabka la doortay. Hubinta daacadnimadu waxay daboolaa qayb qeexan oo baakidhka ah, taas oo ku xiran habka la isticmaalayo ay ku dari karto cinwaanka ESP iyo qayb culayska. In loo tiriyo goob checksum ah oo ballac la yaqaan waa halka inta badan sharraxaadahan ku burburaan.

Akhri qaabka la doortay ka hor inta aanad tirin bytes, oo natiijada u sharax ilaalin daacadnimo ah halkii aad ka dhigi lahayd checksum calaamad kale leh. Decoder-ku wuxuu kuu sheegayaa magaca goobta haddii aad weydiiso.

tshark -r capture.pcap -Y esp -V | grep -iE "integrity|icv"

Hubi barta kormeerka ka hor inta aanad tirin

Duubis ka mid ah interface-ka gudaha iyo duubis siliga ah waxay muujin karaan lakabyo gabi ahaan kala duwan. Interface-ka gudaha tunnel-ka hore ayaa loo saaray, sidaas darteed waxaad aragtaa baakidhka la qaado oo midkoodna cinwaannada dibadda ma aragto. Siliga waxaad ku aragtaa cinwaannada dibadda iyo culays sir ah oo aadan akhrin karin. Midkoodna aragtida ma khaldan, mana aha aragtiyo shay isku mid ah. Sheeg halka duubista laga qaaday ka hor inta aanad soo xigtaan tiro kasta.

sudo tcpdump -ni eth0 -vv -c 5 esp
sudo tcpdump -ni tun0 -vv -c 5

Amarka koowaad wuxuu muujinayaa baakidhka dibadda oo ay la socoto trailer-ka daacadnimada, tan labaadna waxay muujinaysaa baakidhka la qaado oo ay la socoto checksumkiisa gaadiidka. Isku-darka tirooyinka labada duubis ma tirinayo wax labanlaab ah, laakiin waxay laba jeer sharraxaysaa isla baakidhka.

Isbarbar dhig tirada duubis dhab ah

Decode hal baakidh si buuxda oo calaamadee goob kasta oo decoder-ku u yaqaan checksum ama qiime daacadnimo. Kadib isbarbar dhig calaamad kasta qaabka aad qortay, oo tirtir kuwa ka tirsan lakab aadan dhab ahaan tirinayn. Tirada ka badbaadda tababarkaas waa mid la difaaci karo, tan xusuusta laga soo xigtayna ma aha.

Ku celi jihada jawaabta, sababtoo ah tunnel-ka qaada labada qoys ayaa ku kala duwanaan kara jihada iyo qulqulka. Kadib sheeg tirada oo ay la socoto baaxaddeeda, tusaale ahaan saddex checksum baakidhkan gudaha ah ee barta kormeerkan, ma aha sifo guud oo baakidhada VPN.

tshark -r capture.pcap -T fields -e ip.checksum -e udp.checksum -e tcp.checksum