I-Android 12 ne-IKEv1 VPN: inguqulo yokwethulwa, IKEv2, izinhlelo zangaphandle

Amafoni amabili womabili akhombisa i-Android 12 kuzilungiselelo, futhi yilinye kuphela elisaqala iphrofayela endala ye-IPsec XAuth enikezwa yisango lakho. Umehluko awusona isilungiselelo umsebenzisi angasifinyelela: ukuvikelwa okuvimba indlela yakudala ye-IKEv1 kubheka izinga le-SDK okwafika ngalo idivayisi, hhayi inguqulo ecushwa manje kuphela. Leyo dethi eyodwa inquma ukuthi ukuqhathanisa iqembu kunencazelo yini, futhi inquma nokuthi iyiphi kwezintathu izindlela zokufuduka oyidingayo ngempela.

Amafoni amabili e-Android 12 awusona isimo sokuhlola esisodwa

Ushintsho ku-AOSP olwavimba amadivayisi amasha ukuthi aqale amaphrofayela akudala e-IKEv1 luqhathanisa DEVICE_INITIAL_SDK_INT ne-Android S, okuyi-API 31. Endleleni yakudala yokuqalisa, iphrofayela efanelekile ikhipha ukwehluleka komsebenzi ongasekelwa ngaphambi kokuba kube khona ukuxhumana okuwusizo. Ifoni eyafika ne-Android 11 futhi yabuyekezwa kamuva isadlula lokho kuvikelwa; imodeli eyethulwa ne-Android 12 ayidluli.

Ungafunda lezo zinamba ezimbili kudivayisi enokulungisa amaphutha okuvuliwe:

adb shell getprop ro.product.first_api_level
adb shell getprop ro.build.version.sdk
adb shell getprop ro.build.version.release

Inani lokuqala izinga lokwethulwa ukuvikelwa okubhekelayo, elesibili yilokho ifoni ekucushayo namuhla. Lapho impahla ingekho, ncika emibhalweni yokusekelwa yemodeli esikhundleni sokuqagela ngegama lokumaketha, futhi ungacabangi ukuthi ukwakhiwa komthengisi kugcina zonke izindlela zokuhambisana okwakunazo inguqulo eyisisekelo.

Omunye umehluko ugcina ihora lesikhathi sokusekelwa elahlahala: iphrofayela egciniwe esalotshwe kuzilungiselelo ze-VPN ayifakazi lutho mayelana nokuthi isikhulumi sizoyiqala yini. Ukufaka kabusha i-PSK noma ukuhlela izindlela akukwazi ukususa ukuhlolwa kokusekelwa kweprothokholi okusebenza ngaphambili, futhi ukwehluleka kubonakala njengenkinga yemininingwane yokungena kuyilapho kungewona.

Indlela yokuqala: gcina isitaki sakudala somdabu lapho sisasebenza khona

Isitaki sakudala yileso esifunda amaphrofayela e-IPsec XAuth PSK, IPsec Hybrid RSA ne-L2TP/IPsec PSK kusukela kusikrini se-VPN sohlelo. Kudivayisi eyafika ngaphansi kwe-API 31 isahlala iyindlela esebenzayo ngemva kokuthuthukiswa, yingakho ukuhlolwa kufoni endala kungaphumelela kuyilapho ifoni entsha inqaba iphrofayela efanayo.

Ukuqhathanisa okubalulekile kungokwesigaba sedivayisi, hhayi ngenguqulo ye-Android: bhala amamodeli aseqenjini, funda amazinga abo e-API okwethulwa, futhi uwahlukanise phakathi kwamadivayisi asaqala iphrofayela namadivayisi angenakukwazi. Noma yini enye ikhiqiza inqubomgomo yokusekelwa eziphikisayo ngokwayo ngesikhathi umsebenzisi ethenga ifoni entsha.

Indlela yesibili: amaphrofayela e-IKEv2 esikhulumi

Imodeli yomphakathi yokuhlinzeka ye-Android ye-IKEv2 iyinto ehlukile, hhayi iphrofayela ye-IKEv1 eqanjwe kabusha. I-API yesikhulumi yamaphrofayela e-IKEv2 yafika ne-API 30 futhi ilindele i-IKEv2 ngendlela yokuqinisekisa enikezwa isango, ngokuvamile esekelwe esitifiketini noma ku-EAP. Akukho ukuthuthukiswa okuhambisana ngocingo kusuka ku-IKEv1 XAuth noma Hybrid kuya ku-IKEv2: isango kufanele lilungiselelwe iprothokholi entsha, futhi iphrofayela kufanele iphathe ubunikazi obuhambisanayo.

Lena iyindlela enempilo ende kunazo zonke, futhi iyona eveza umsebenzi wangempela. Ukuqinisekiswa kobunikazi, ukuqinisekiswa komsebenzisi, i-DNS, izindlela zethumbu elihlukanisiwe kanye nokugunyazwa kwezinsiza konke kufanele kudlule ukufuduka; uma kungukuxhawula izandla kuphela okuphumelelayo, abasebenzisi bahlala bexhumeke kuthumbu elingafinyeleli lutho.

Ukusetshenziswa ngokuvamile kudlula ku-MDM noma ekulungiselelweni okuphethwe, hhayi ngomsebenzisi othayipha izinkambu. Uma ingqalasizinda leyo ingekho, uhlelo lokufuduka kufanele ilufake, ngoba ukufaka kabusha iphrofayela ye-IKEv2 ngesandla kudivayisi ngayinye akusona isenzo itafula losizo elingasithwala.

Indlela yesithathu: uhlelo lokusebenza lwekliyente yangaphandle

Ezinye izinhlelo ze-VPN ziletha ukusebenza kweprothokholi yazo futhi azincikile nhlobo esitakini sakudala somdabu. Lokho kuzenza zibe yisixazululo sesikhashana esivumelekile seqembu elingakwazi ukufuduka ngokushesha, kodwa umbuzo wokuhambisana uthuthela ohlelweni: ukuthi lusebenzisa imodi ye-IKEv1 efanayo ekhulunywa isango lakho, nokuqinisekisa namasethi e-cipher adingwa isango.

Thatha imatrix yokusekelwa yohlelo uqobo njengegunya hhayi incazelo yesitolo, futhi uhlole idivayisi eyodwa yangempela nesango langempela ngaphambi kokulusincoma. Ukwenza i-root yefoni ukuze kubuyiselwe indlela yesikhulumi esusiwe nakho akusona isixazululo esigcinwayo; kudlulisela inkinga ekulungiselelweni okungasekelwe okungase kudilizwe buthule ukubuyekezwa kohlelo okulandelayo.

Khetha ngokwalokho isango elingakunikeza

Isinqumo sincipha lapho wazi izinto ezimbili: ukuthi yimaphi amadivayisi ethulwe ku-API 31 noma ngemuva kwalokho, nokuthi isango lingethula insebenzo ye-IKEv2 ngemodeli efanayo yokubhalisa. Uma likwazi, fuduka futhi uyeke ukutshala imali kuphrofayela yakudala. Uma lingakakwazi, gcina i-IKEv1 kumadivayisi asayiqalayo, futhi unikeze amadivayisi amasha ikliyente yangaphandle njengesaphulelo esilotshiwe nesinesikhathi, hhayi njengendlela yokweqa engashiwo.

Amaphuzu amabili enza uhlelo luvikeleke. Okokuqala, bhala isizathu sesaphulelo ngasinye kanye nemodeli nezinga lokwethulwa, ukuze umcwaningi abone ukuthi umngcele ukuvikelwa kwesikhulumi hhayi ukuthanda okungachazwanga. Okwesibili, thatha ukufuduka njengomsebenzi ohleliwe: i-IKEv1 isishiywe yisikhathi emkhondweni wezindinganiso (RFC 9395), okusho ukuthi amadivayisi asele azoqhubeka encipha futhi izaphulelo kufanele ziphele kanye nawo.