Culayska dheeriga ah ee IPsec: habka, NAT-T iyo algorithms-ka ayaa wada beddela
Hal lambar oo la daabacay oo culays dheeraad ah waxay qeexdaa hal duubid oo ku taal hal waddo. Isku dar madaxyada tunnel-kaagu runtii ka wada hadlo, ka dibna cabbir waddada.
Meel ku qoran buug-tilmaameed waxaa jira lambar, badanaa u dhexeeya lixdan iyo siddeetan byte, oo qof ka jaray 1500 si uu u helo MTU interface-ka. Lambarkaas waxa uu qeexaa hal duubid gaar ah oo ku taal hal waddo gaar ah. Beddel habka, qoyska cinwaanka dibadda, sir-celinta ama joogitaanka NAT, oo xisaabtu mar dambe kuma khusayso tunnel-kaaga.
Lambarka wuxuu ka yimid tunnel kale
Culayska dheeriga ah ma aha sifo IPsec ah si aan la taaban karin. Waa sifo ka mid ah packet-ka runtii la dhiso: hab la isku afgartay, madax dibadda ah, madax ilaalin ah, buuxin, goob daacadnimo iyo laga yaabo in lagu daro duubid UDP ah.
Lambar lagu sheegay habka gaadiidka ee leh IPv4 iyo NAT la'aan waxa uu qeexaa packet ka yar marka la barbar dhigo habka tunnel-ka ee IPv6 hoos yimaada gudbinta NAT. Labaduba waa sax xaaladdooda. Mid ka mid ah ku koobi gelin kale waa sida dadku ku dhammeeyaan MTU jebiya wareejinta waaweyn. Guuldarradu waa aamusan tahay, sababtoo ah codsiyada yaryar way sii shaqeeyaan.
Isku dar lakabyada runtii jira
Ka bilow madaxa IP dibadda oo u soco gudaha. Habka tunnel-ka packet-kii asalka ahaa waa gudaha, sidaas darteed madaxa dibaddu waa wax lagu daray ee ma aha beddel. RFC 4303 waxa uu qeexaa madaxa ESP, buuxinta iyo xogta daacadnimada ee ka dambeeya.
| Layer | What it adds | When it applies |
|---|---|---|
| Outer IP header | 20 bytes for IPv4, 40 for IPv6 | Always, and 40 rather than 20 if the outer path is v6 |
| ESP header | 8 bytes of SPI and sequence number | Always |
| Block cipher IV | 8 to 16 bytes depending on the transform | When the negotiated cipher uses one |
| Padding and trailer | Padding to the block size, plus two trailer bytes | Always, and the amount varies with payload length |
| Integrity data | 12 to 16 bytes for common authenticated ciphers | When integrity protection is negotiated |
| UDP encapsulation | 8 bytes | NAT traversal on port 4500, which is common for clients behind NAT |
Mid ka mid ah safafkaas ma aha mid joogto ah inta u dhaxaysa gelinta, safka buuxintuna ma aha mid joogto ah xitaa hal gelin gudaheed. Taasi waa sababta oo dhan ee lambarka culayska dheeriga ah ee la daabacay u niyad-jabiyo.
Laba goob ayaa isku khilaafi kara isla tunnel-ka
Packet-ka la ilaaliyay wali waa in uu gudbaa waddada dibadda, waddada dibadduna isku mid ma aha meel kasta. Xiriirka gelitaanka PPPoE waxa uu qaadaa wax ka yar qayb Ethernet nadiif ah. Shabakadda mobaylka waxa laga yaabaa in ay sii yaraato, iyo bixiye tunnel-ka sameeya taraafiikiisa waxa uu ku darayaa duubid kale oo aan cidina sheegin. Tunnel-ka ka shaqeeya hal xiriir oo ku guuldarraysta mid kale waxa uu qeexayaa xiriirka labaad, ma aha borotokoolka.
Labada jiho sidoo kale way kala duwanaan karaan. Waddo aan isku mid ahayn waxay ku siin kartaa soo-qaadis shaqeeya iyo soo-dejin istaagay, taas oo loo akhriyaa dhibaato application ah ilaa aad eegto cabbirrada packet-ka halkii aad eegi lahayd gaaritaanka. Guul ping yar waxa ay caddaynaysaa wax aad u yar oo ku saabsan jawaab cabbir buuxa leh.
Cabbir halkii aad ka jari lahayd
Soo hel datagram-ka ugu weyn ee ka badbaada waddada. Kadib la barbar dhig qiimaha interface-ku soo sheegayo:
ip link show eth0 | grep -o 'mtu [0-9]*' ip xfrm state list ping -M do -s 1400 198.51.100.7 ping -M do -s 1372 198.51.100.7 tcpdump -ni any -c 20 'esp or udp port 4500'
Hoos u dhig cabbirka ping-ka ilaa jawaabuhu yimaadaan, oo u qaado qiimaha ugu weyn ee shaqeeya miisaaniyadda waddadaas. Soo-saarka xfrm waxa uu kuu sheegaa habka iyo algorithms-ka la isku afgartay, waana taas gelinta xisaab kasta oo daacad ah. Qabashadu waxay xaqiijinaysaa in ESP ama ESP ku duuban UDP uu ku jiro siligga, taasina waxay xallinaysaa su'aasha NAT iyada oo aan la malayn.
U dhig hal qiime diyaaradda kontoroolka sidoo kale. Packet-yada is-gacan-qaadka IKE waxay leeyihiin qaab ka duwan packet-yada xogta, sidaas darteed cabbir laga soo saaray qabasho is-gacan-qaad ma aha MTU diyaaradda xogta.
Dhig lambarka meesha uu ku habboon yahay
TCP ee mara tunnel-ka, xaddidka MSS inta badan waa kan ugu yar ee faragelin ah, sababtoo ah waxa uu yareeyaa waxa darafyadu diraan isaga oo aan beddelin tunnel-ka laftiisa. Tunnel ku salaysan waddo, u dhig MTU interface-ka tunnel-ka si ula kac ah oo qor sababta. In labadaba la wada sameeyo kadibna la cabbiro wax wax kuma barinaysid mid ka mid ah ayaa caawiyay.
Ku hay wada tikitka habka la isku afgartay, qoyska dibadda, xaaladda NAT iyo calaamadda dib loo soo saari karo. Diiwaan kooban oo afar xaqiiqo ah ayaa ka roon joogto la xusuusto, waana tan kaliya ee ka badbaada cusboonaysiinta macmiilka ee xigta.