Waxa uu REMOTE_ADDR ee PHP runtii kuu sheegayo gadaal VPN
Kani waa qiimo uu server-kaaga web bixiyay, ma aha weydiin ku socota tunnel-ka. Raac dariiqa codsiga, hubi cidda dib u qori karta, oo aqoonsiga ku hay app-ka.
Qof baa weydiiya sababta isticmaalaha VPN uu uga muuqdo diiwaanka app-ka ciwaan ka tirsan gateway-ka, ama ciwaan isbeddelay qadada dabadeed. Jawaabtu waxay ka bilaabataa waxa qiimahan yahay: gelin uu server-ka web dhigay deegaanka codsiga. Ma aha weydiin ku socota tunnel-ka, ma aha aqoonsi shahaado, mana aha ballan ah in lambarku uu ka tirsan yahay hal qof. U akhrinta mid ka mid ah saddexdaas waxay soo saartaa jawaabo kalsooni leh oo khaldan siyaabo kala duwan.
Qiimuhu wuxuu ka yimaadaa server-ka, ma aha tunnel-ka
PHP waxay deegaanka codsiga ka heshaa waxa fuliyay script-ka. Tixraaca doorsoomayaasha server-ka ee PHP waxay sharraxaysaa gelinnadan inay yihiin kuwa uu server-ka web abuuray, helitaankooduna waxa uu ku xidhan yahay sida codsigu u yimid.
Script lagu fuliyo sida hook khadka amarka VPN waa deegaan fulin gabi ahaan kale. Ma laha codsi web, ma laha socket macmiil, mana laha REMOTE_ADDR, taasina waa sababta koodhka web ee lagu koobiyeeyay hook uu u soo saaro qiimooyin madhan halkii kuwa khaldan. Hook waxa uu leeyahay deegaan u gaar ah oo daemon-ku buuxiyo, waana si gooni ah loo diiwaangeliyay. U gaadhista REMOTE_ADDR halkaas waa u gaadhista doorsoome aan waligiis la dejin.
Maskaxda ku hay farqigaas ka hor inta aadan is barbar dhiggin laba diiwaan. Waxa laga yaabaa inaad is barbar dhigayso codsi bog iyo hook, taasina ma aha is barbardhig haba yaraatee. Marka hore hubi deegaanka fulinta, ka dibna ciwaanka.
Raac dariiqa codsiga ka hor inta aadan aammin lambarka
Ciwaanka la soo sheegay waa dhigaha isku-xirka uu server-ka web arkay. Dhex geli wax kasta oo u dhexeeya macmiilka iyo server-kaas oo dhiguhu is beddelo. Turjumaad, dhamaystir iyo isku-dheellitir culeyska mid kastaa waxa uu indha-indheynta u rarqa u dhigaa tallaabo ka sii fog isticmaalaha.
Afar dariiqo oo caadi ah waxay soo saaraan afar indha-indheyn kala duwan.
| Path to the listener | What can be reported |
|---|---|
| Client routed straight to the private listener, no translation | The client's tunnel address |
| Gateway translates the source before forwarding | The gateway's translated address |
| Reverse proxy terminates the client and opens its own backend connection | The proxy's backend address |
| Load balancer in front of two proxies | Whichever hop the server treats as its peer |
Qor dariiqa iyada oo la socoto magaca meesha loo socdo, qoyska ciwaannada iyo qod kasta oo turjumaad. La'aanteed khariidaddaas, qiimaha saxda ah iyo kan khaldan waxay u muuqdaan isku mid khad diiwaan. Laba sadar oo jaantus ah waxay badbaadiyaan galab dood ah.
Beddeliddu waxay dhacdaa oo kaliya halka loo habeeyay
Server ama framework waxa uu si ula kac ah u beddeli karaa ciwaanka macmiilka. Module-ka remote-IP ee Apache iyo module-ka real-IP ee NGINX labaduba way sameeyaan, qiimaha PHP heshana waxa uu ku xidhan yahay habayntaas iyo paramaterrada loo gudbiyay maaraynta script-ka.
Marka REMOTE_ADDR ma aha had iyo jeer dhigaha TCP ee aan la taaban. Waa dhigaha sida server-ku u doortay in uu u soo sheego ka dib markii uu ku dhaqangaliyay siyaasaddiisa. Farqigaas ayaa go'aamiya haddii qiimuhu yahay caddayn ama qurxin.
Weydii milkiilaha server-ka goobtee ayaa amar ku leh hirgelintan iyo sida dhigaha asalka ah loo ilaaliyo marka beddeliddu dhacdo. Haddii aan cidina jawaab karin, diiwaanku wali waxba ma caddeeyo.
Ha akhrin madaxyada gudbinta si kalsooni leh
Yeerta ayaa iyada qudheeda soo diri kartaa madaxyada gudbinta. U qaadashada gelinta ugu horreysa ee comma-ku kala soocay ciwaan isticmaale la xaqiijiyay waa go'aan ah in la aammino qof kasta oo isku xira, taas oo ka soo horjeedda ujeeddada madaxa. Madaxu wuxuu sharraxayaa silsilad, oo lakab la aammin karo oo keliya ayaa dammaanad qaadi kara silsiladdaas.
Isticmaal taageerada proxy-ka la aammin karo ee server-ka ama framework-ka iyada oo silsiladda proxy-ga dhabta ah la habeeyay, oo u ogolow in uu tuuro qiimooyinka ka imanaya ilo ka baxsan silsiladdaas. Falanqaynta gacan ku qoran waa meesha ay ku nool yihiin inta badan cilladaha xiisaha leh.
Ciwaanka proxy-ga soo sheegay sidoo kale ma beddelo isha baakadaha ee derbiga dabka ee sare arko. Ku hay metadata HTTP iyo shaandhaynta shabakadda indha-indheyn gooni ah, sababtoo ah waxay ka jawaabaan su'aalo kala duwan.
Isticmaal aqoonsiga app-ka go'aannada
Helitaanka diiwaannada isticmaalaha, ku tiirsanow qaybta la xaqiijiyay iyo xeerarka fasaxa app-ka. Ciwaan gudaha ah waa dib loo qoondayn karaa, ciwaan turjuman oo keliyaana wuxuu matali karaa boqolaal isticmaale oo isku mar ah. Midna oo ka mid ah sifooyinkan ma aha wax baaritaan ciwaan u hagaajin karo.
Haddii hawlgallada ay u baahan yihiin in codsi lagu xiro fadhi VPN, ku xir ciwaanka la arkay iyo sumadda waqtiga diiwaannada fadhiga ee amar-ku-leh sida qaabka turjumaadda aad diiwaangelisay. Taasi waxay soo saartaa xiriir aad difaaci karto; ciwaan keliya ma sameeyo.
Ogaanshaha, diiwaangeli dhowr goob oo loo baahan yahay halkii aad ka diiwaangelin lahayd shaxda server-ka oo dhan, oo qaadi karta madaxyo iyo walxo xaqiijin. Gabagabada faa'iidada leh waxay sheegtaa waxa qiimahan uga dhigan yahay hirgelintan, ma aha qiimaha ugu eg macmiilka.