I-AES-NI ku-OpenSSL noma ukudlulisela ku-kernel: iyiphi oyidingayo?

Amalebula amabili asetshenziswa sengathi into eyodwa: asheshiswe nge-hardware futhi adluliselwe ku-kernel. Elinye lichaza ukuthi iyiphi imiyalelo eyenziwa yinqubo ye-AES yelabhulali, elinye lichaza ukuthi ukucubungula kwamaphakethe kwenzeka kuphi. I-VPN ingaba nokokuqala ngaphandle kwesibili, okwesibili ngaphandle kokokuqala, noma kokubili ndawonye. Noma isiphi isinqumo mayelana nokusebenza kumele siqale ngokusho ukuthi iyiphi kulezi ezimbili oyishintshayo ngempela.

Imiphambili emibili, hhayi iphuzu elilodwa

Umphambili wokuqala ukuqaliswa: ingabe ikhodi eyenza i-AES-256-GCM iqondiswa enguqulweni esebenzisa imiyalelo ekhethekile yeprosesa noma endleleni ehambisekayo eyenza leyo miyalelo njengezibalo ezijwayelekile. Lokhu kukhetha kuhlala ngaphakathi kwelabhulali ye-crypto futhi kwenziwa lapho iqala.

Umphambili wesibili indawo: ingabe iphakethe lidlula endleleni yokuguqula ye-kernel noma i-daemon esendaweni yomsebenzisi ifunda kudivayisi ye-tunnel, ibethe imfihlo bese iphinda ibhale.

Awukho umphambili ovimbela omunye. I-VPN esendaweni yomsebenzisi ku-CPU enemiyalelo ye-AES ingayisebenzisa ngaso sonke isikhathi, futhi indlela ye-kernel ku-CPU engenayo ibuyela ekuqalisweni kwesoftware. Amalebula ezincwadini zabathengisi awavamile ukukhombisa lo mehluko, yingakho izeluleko zokulungisa ezikopishwe phakathi kwezimo ezimbili zivame ukungenzi lutho.

Umphambili wokuqala: iyiphi ikhodi eyenza ukubethela

I-OpenSSL ithola izici zeprosesa ngesikhathi sokuqala futhi isebenzisa umphumela ukukhetha izindlela zekhodi ezilungisiwe, njengoba incwadi yamakhono e-x86 ichaza. I-AES-NI ingelinye lamakhono abhaliwe ngemuva kwalokho kuthunyelwa. Akukho kulokhu okudinga ukuthi ilabhulali ibe ingxenye ye-kernel.

Qinisekisa ukuthi isici siyabonakala kunqubo ngaphambi kokucabanga ukuthi indlela esheshayo iyasetshenziswa. Ku-Linux umthombo iwukukhala kwe-flags ku-/proc/cpuinfo, futhi ngaphakathi kwesivakashi kukhombisa lokho okuvezwa yi-hypervisor hhayi igama lemodeli yomsingathi wangempela.

grep -m1 '^flags' /proc/cpuinfo | grep -o '\baes\b'
openssl list -providers -verbose

Umyalo wesibili usho abahlinzeki abalayishiwe kulokho kwakhiwa. Awukutsheli ukuthi isevisi ye-VPN ixhume kuyiphi ilabhulali, futhi umsingathi owodwa angathwala ukufakwa kwe-OpenSSL okubili kuyilapho inqubo esebenzayo isebenzisa okukodwa kuphela.

Umphambili wesibili: indlela yamaphakethe isebenza kuphi

Ukubeka ku-kernel kusho ukuthi ukuguqulwa kwenzeka emishinini ye-IPsec ye-kernel uqobo noma ngaphakathi kwedrayiva ye-tunnel ku-kernel, ngakho amaphakethe awadingi uhambo lokuya nokubuya ngaphakathi kwenqubo yesikhala somsebenzisi eqenjini ngalinye. Lokhu kunganciphisa amakhophi nokushintsha komongo, futhi kusabalalise umsebenzi kuma-core ngendlela i-daemon enentambo eyodwa engakwazi ngayo. Futhi kuhambisa izibali nemikhondo ozoyifunda lapho ukuhamba kwehla, ngoba umsebenzi manje wenzeka ngale komngcele ongawulawuliyo. Thatha lokhu njengezindleko zokulungisa amaphutha, hhayi isinqumo sokusebenza kuphela.

Akudali ukusekelwa kwemiyalelo, akulungisi i-cipher futhi akwenzi indlela ekhona isebenze.

I-virtualisation yengeza umphetho kulo mphambili futhi. Isivakashi singanikezwa imodeli ye-CPU efihliwe efihla izici umsingathi anazo, futhi isivakashi esingaphakathi singabona okuncane nakakhulu. Funda umbono wamakhono ngaphakathi kwendawo i-VPN esebenza kuyo ngempela, hhayi kusikhombisi se-hypervisor.

Ukukhetha ngakunye kuthenga ini, futhi yini elingakwazi

Umbuzo ongokoqobo ukuthi isikhathi siya kuphi. Uma intambo eyodwa ematasa, amakhophi e-buffer aphindaphindiwe noma ukushayela kwesistimu ngephakethe ngalinye kunciphisa ukuhamba, ukuhambisa ukuguqulwa endleleni eqeda lezo zindleko kungasiza, inqobo nje uma i-kernel yenza ukuguqulwa okudingayo.

Uma umkhawulo kuwukuxhumana okuphezulu okugcwele, indlela enokulahleka, isikhathi eside sokuya nokubuya, isevisi yendawo ekuyiwa kuyo egcwele noma intambo eyodwa eboshelwe ku-core eyodwa, indawo ayishintshi lutho olubalulekile. Kuyafana nasekukhetheni imiyalelo: i-AES ku-hardware ekhethekile ayikwazi ukulungisa indlela engekho futhi ngeke isize uma i-tunnel ingasebenzi ngoba ukuxazululwa kwamagama kwehluleka.

Lapho kokubili kusebenza khona, kuyahlangana. Indlela ye-kernel ingasebenzisa ukuthunyelwa okufanayo kwezinga lemiyalelo ngaphakathi kwe-API ye-crypto ye-kernel, futhi indlela yesikhala somsebenzisi enelabhulali ekhethwe kahle isivele iyisebenzisa. Isinqumo akusona sokuthi iyiphi eshesha ngendlela engaqondile; isinqumo ngezindleko onabo ubufakazi bazo.

Bhala amaqiniso amane ngaphambi kokushintsha noma yini

Bhala i-binary yesevisi kanye nelabhulali ye-crypto exhunywe nayo, ngoba yikho okunquma umphambili wokuqala. Bese ubhala ukuvikelwa kwedatha okuvunyelwene ngakho, ngoba i-cipher engenayo indlela yemiyalelo ekhethekile iziphatha ngendlela ehlukile kunaleya enayo, futhi isethi ikhethwa yizinhlangothi zombili.

Bese kuba umbono wamakhono ngaphakathi kwendawo esebenzayo, futhi ekugcineni indlela yamaphakethe esebenzayo enobufakazi bokuthi imodi ocabanga ukuthi ivuliwe ivuliwe ngempela. Imojuli elayishiwe akusona ubufakazi bokuthi iphrofayili iyisebenzisa, futhi umugqa wokulungiselela awusona ubufakazi bokuthi i-kernel uyamukele.

Shintsha into eyodwa, bese uqhathanisa nomthwalo womsebenzi ozinzile onezindawo zokugcina ezifanayo nendlela efanayo yokudlulisa. Isimangalo sesivinini ongasilinganisanga sincane inani kunesaziso esithi i-backend ayikaze ibe semkhathizini.