API-yada VPN ee iOS: NEVPNManager, bixiyaha tunnel ama profile?

Saddex badeecooyin kala duwan ayaa u jawaaba magaca iOS VPN, oo ma wadaagaan hal API. Personal VPN wuxuu ku socdaa IPsec iyo IKEv2 ee ku dhex jira nidaamka. Custom tunnel wuxuu ku shaqeeyaa protocol-kaaga gaarka ah gudaha network extension. Configuration profile wuxuu habayaa midkood oo wuxuu ku dari karaa dhaqanka on-demand. Inaad ku dooratid transport-ka aad tahay inaad lahadasho ayaa ka dhaqso badan inaad ku dooratid tutorial-kii ugu horreeyay ee la compile-gareeyay.

Soco hubinta hoose si taxane ah, sababtoo ah tallaabo kastaa waxay u malaynaysaa in tii hore soo saartay habayn sax ah.

Tallaabada 1: ku dooro transport-ka

Haddii server-ku yahay IKEv2 ama IPsec qaab Cisco, NEVPNManager wuu ku filan yahay oo transport-yada nidaamka waxay ku yimaadaan bilaash. Haddii server-ku ku hadlo OpenVPN, WireGuard ama wax kale, NEVPNManager ma caawin karo: ma laha qabato protocol-ka dhinac saddexaad. Xaaladdaas waxay u baahan tahay NETunnelProviderManager oo la socda packet tunnel provider oo hirgeliya protocol-ka. Profile wuxuu kaliya qaybiyaa habaynta, oo ma dari karo transport uusan nidaamka hawlgalku lahayn.

PPTP maaha bartilmaameed nidaamyada hadda. Shared-secret IPsec weli wuxuu filayaa magaca kooxda ee remoteIdentifier, shay keychain oo qarinaya sirta, iyo xaqiijin la ballaadhiyay marka server-ku weydiisto magaca isticmaalaha. Qayb kasta oo maqan waxay u soo baxdaa isla qaladka guud ee habaynta, markaa ku dar dhammaantood ka hor intaadan debug wax kale.

Tallaabada 2: ixtiraam nidaamka kaydinta, rarista, bilowga

NEVPNManager wuxuu wax ku qoraa preferences, dib u akhriyaa, ka dibna kaliya bilaabaa. Buuxi shayyada protocol-ka iyo manager-ka, wac saveToPreferences, wac loadFromPreferences, oo wac startVPNTunnel from load completion handler. Bilowga ka hor inta rarista soo noqon waxay soo saartaa qalad configuration-invalid, NEVPNErrorDomain code 1, habayn haddii kale sax ah.

Qaabku wuu gaaban yahay oo hal meel lagu hayn karaa:

manager.protocolConfiguration = proto
manager.isEnabled = true
manager.saveToPreferences { }
manager.loadFromPreferences { manager.connection.startVPNTunnel() }

startVPNTunnel wuxuu soo noqdaa marka codsiga la aqbalo, ma aha marka tunnel-ku kor yahay. La soco NEVPNStatusDidChange oo akhri connection.status xaaladda dhabta ah. App-ka u malaynaya guul goobta wicitaanka wuxuu soo sheegaa VPN ku xiran inta extension-ku weli gorgortanaya. Xaaladda connecting waa caadi daqiiqad; xaalad aan waligeed ka bixin waa guuldarada mudan in la diiwaangeliyo.

Tallaabada 3: sii hannaanka provider waxa uu u baahan yahay

Custom transport wuxuu ku socdaa hannaan gooni ah oo leh bundle identifier u gaar ah iyo entitlement u gaar ah. Container app-ka iyo provider-ku labaduba waxay u baahan yihiin entitlement network-extension marka la saxeexayo, oo build Developer ID oo ka baxsan App Store wali waa inuu ku qaataa provisioning profile. Entitlement maqan wuxuu u eg yahay bug protocol sababtoo ah extension-ku si fudud uma bilaabmo.

Ma jiro socket descriptor dadweyne oo la amaahan karo. NEPacketTunnelProvider wuxuu ku siinayaa NEPacketTunnelFlow leh read, write iyo cancel, oo code-ka gaadha waddooyinka fure gaar ah wuu jabaa inta u dhaxaysa releases. Provider-ku wuu sii socdaa marka app-ku background yahay, sidaas darteed container app-ku uma baahna hab background taas.

Tallaabada 4: on-demand waa xeerar, ma aha switch

isOnDemandEnabled wuxuu kaliya diyaariyaa xeerarka; NEOnDemandRuleConnect iyo walaalihiis waxay go'aansadaan goorta tunnel-ku soo baxo. Xeerta evaluate-connection oo leh probe URL waxay leedahay qiimo inta URL-kaas leeyahay. Haddii probe-ku ka jawaabo tunnel-la'aan, xeertu waxay go'aansataa in shabakadda gaarku horey u gaari karto oo waligeed ma xirmo, markaa u jeedi wax ka jawaaba kaliya gudaha.

Always-on waa ballan gooni ah. Wuxuu u baahan yahay qalab la kormeero iyo profile la maareeyo, oo isticmaale aan la kormeerin wuxuu profile ka saari karaa goor kasta oo uu doono. Ha soo dirin naqshad ku tiirsan always-on haddii aan la kormeerin kooxda.

Tallaabada 5: caddee waddada, ma aha calaamadda

Baaritaanka interface-yada tun, tap, ppp ama ipsec wuxuu caddeeyaa in VPN la habeeyay, ma aha in codsigaaga uu isticmaalay. NWPathMonitor oo leh usesInterfaceType(.other) wuxuu sheegaa in interface-ka macmalka ah uu diyaar yahay, oo viability handler wuxuu tijaabin karaa hal host. Labaduba ma caddeeyaan waddada bixitaanka, markaa ku dar codsi ku socda kheyraadka kaliya tunnel-ku gaari karo. Magacyada interface-ku waa caawin cilmi-baaris, waligeed ma aha albaab ay tahay in macquulka app-ku ka laamo.

Hubin goob, isbarbardhig ciwaanka dadweynaha tunnel-ku la socdo iyo la'aan oo soo qaado bog gudaha kaliya. Wicitaanka status wuxuu soo sheegi karaa xiriir inta provider-ku gorgortanayo, markaa go'aanka ha yimaado natiijada kheyraadka, status-na u qaado caddayn taageero.