Android always-on VPN: igama le-endpoint lixazululwa kanjani kuqala
I-Android ivimbela ithrafikhi ngaphambi kokuba umhubhe ube khona, kodwa iklayenti kusafanele lixazulule i-endpoint yalo. Nakhu ukulandelana, nokuthi kuhlehla kuphi.
Ifoni iqala kabusha, always-on ivuliwe, «vimba ukuxhumana ngaphandle kwe-VPN» kuvuliwe, futhi umhubhe awukhe unyuke. Akukho okulungiswe kabi: ukuvimba kwenza umsebenzi wako, futhi nomzamo weklayenti uqobo wokufinyelela i-endpoint yalo ungaphansi kwalokho. Igama le-endpoint kufanele lixazululwe ngaphambi kokuba umhubhe ube khona, yiklayenti elivunyelwe ukukhuluma nenethiwekhi ngesikhathi zonke ezinye izinhlelo zingavunyelwe. Ukuqonda ukuthi iyiphi ingxenye eyenza lokhu, nangaluphi ukulandelana, yikho okuguqula le mfihlakalo ibe umbuzo wokumisa.
Isakhi se-VPN sidingani ngempela
Uhlelo lokusebenza lwe-VPN lwe-Android alunikezi ipulatifomu ikheli leseva. Lakha isixhumanisi sasendaweni: amakheli nemizila yomhubhe, izixazululi okufanele izinhlelo zizisebenzise ngaphakathi kuwo, bese kuthi establish() kubuyisele isichazi sefayela uhlelo olusebenzisayo njengamaphakethe e-IP aluhlaza. I-endpoint ekude ayibonakali nhlobo kuleso sakhi.
Lokho yiqiniso eliyisisekelo lesakhiwo. Ipulatifomu idala isixhumanisi se-tun futhi isebenzisa umgomo kuso; uhlelo lusebenzisa ukuthutha endaweni yomsebenzisi, okusho ukuthi uhlelo ngokwalo luxazulula igama le-endpoint yalo futhi luvule ukuxhumana okubethelwe. Ngakho-ke i-endpoint ngesimo segama lomsingathi iyenzeka — hhayi ngoba ipulatifomu isekela amagama, kodwa ngoba ipulatifomu ayikaze ibone i-endpoint.
Inkambu eyodwa kusakhi yamukela amakheli: amaseva e-DNS. Kufanele kube amakheli ezixazululi eziyizinombolo, ngokuvamile lawo omenzi efuna ukubuza ngawo ngomhubhe. Leyo nkambu ichaza lapho izinhlelo zithumela khona imibuzo ngemva kokuba umhubhe unyukile. Ayisho lutho mayelana nokuthi iklayenti liyithola kanjani i-endpoint, futhi ukucabangela lezi zinto ezimbili njengokuhlela okukodwa yikho okuqala ukudideka.
Imibuzo emibili ye-DNS, hhayi eyodwa
Umbuzo wokuqala: lapho izinhlelo zithumela khona imibuzo lapho umhubhe usunyukile? Impendulo iyikheli lesixazululi ngaphakathi komhubhe, elifinyeleleka ngesixhumanisi se-tun, futhi eliyizinombolo ngokwakhiwa.
Umbuzo wesibili: iklayenti liyithola kanjani i-endpoint yalo ngaphambi kokuba lowo mhubhe ube khona? Lokho kusesha kwenzeka ngaphandle komhubhe, kunethiwekhi engaphansi, enqubeni yeklayenti. Kungasebenzisa igama, futhi kufanele kusebenzise isixazululi idivayisi engasifinyelela ngaphandle kwe-VPN.
| Stage | Who resolves | Path | Failure looks like |
|---|---|---|---|
| Endpoint lookup | The VPN app | Underlying network, protected socket | Never connects; no tunnel interface traffic |
| Peer authentication | Client and server | Tunnel transport | Connects then drops; certificate or key error |
| Private name lookup | Apps via the tunnel | Resolver inside the tun | Tunnel up, internal sites do not resolve |
Izigaba ezintathu, izimpawu ezintathu ezihlukene. Umlayezo owodwa wephutha othi «akukwazi ukuxhuma» uhlanganisa ndawonye, yikho lokho abantu abaqala ngakho ukuhlela inkambu yeseva ye-DNS ukuze balungise inkinga eyenzeka ngaphambi kokuba leyo nkambu ifundwe.
Kungani i-bootstrap ingahlehlisa
I-Always-on nokuvimba okusebenzayo kusho ukuthi ithrafikhi engekho ngaphakathi kwe-VPN iyalahlwa, kuhlanganise nethrafikhi yohlelo olunayo i-VPN. Indlela yokuphuma icacile: uhlelo lufona i-protect() kusokhethi, okulibophela kunethiwekhi engaphansi ukuze idlule emhubheni futhi ivunyelwe ukuphuma. Iklayenti ngalinye le-VPN kufanele lenze lokhu ekuthutheni kwalo, kungenjalo aliyikufinyelela iseva.
Manje cabanga ngokufakwa lapho isixazululi esisodwa esazi igama le-endpoint sisengaphakathi komhubhe. Iklayenti lidinga umhubhe ukuze lixazulule igama, futhi lidinga igama ukuze lakhe umhubhe. Lokho kuwukuncika okuyindilinga kwangempela, futhi akukho kumisa kweklayenti okukuxazululayo. Leli yiphutha lokwakha, hhayi iphutha lohlelo.
Isikhathi sembula ukuncika okufanayo ngezimo ezithambile. Ekuqaleni ngaphambi kokuvulwa kokuqala, idivayisi ingase ingabi nayo inethiwekhi esebenzisekayo; ku-captive portal inethiwekhi ikhona kodwa ivimba konke ngaphandle kwe-portal; ekushintsheni kusuka ku-Wi-Fi kuya kunethiwekhi yeselula, inethiwekhi engaphansi yesokhethi evikelwe iyashintsha futhi iklayenti kufanele likuqaphele bese lixazulula futhi. Ngakunye kwalokhu kuyisigameko se-bootstrap, futhi ngakunye kufanele kuhlolwe ngamabomu kunokuba kutholwe ngo-3 ekuseni.
Kungani ukugxilisa impendulo kungesona isixazululo
Indlela ekhangayo ukuxazulula igama kanye bese unamathisela ikheli elitholiwe enkambini yezinombolo, noma ulibhale ngqo ekwakhiweni okwenziwe ngokwezifiso. Kubonakala kusebenza, futhi kuguqula igama libe isithombe. Lapho umenzi ehambisa i-endpoint — ukufuduka, ushintsho lwe-anycast, ikheli lesifunda elisha — iklayenti liyaqhubeka lishaya elidala futhi akukho lutho ku-UI oluchaza ukuthi kungani.
Amarekhodi e-DNS anesikhathi sokuphila ukuze izimpendulo zikwazi ukushintsha; ukugcina kuchazwa ngaleyo nkathi, hhayi unomphela. Ukugxilisa impendulo kulahla indlela eyenza igama libe ngcono kunekheli, kuyilapho igcina izindleko zokusebenza zokusebenzisa igama.
Ukugxilisa ngokuvamile kuhamba nokujwayela okubi kwesibili: ukuxegisa ukuhlolwa kobunikazi ngoba ukuxhumana manje kwehluleka ngendlela ehlukile. Ukuqinisekiswa kobunikazi beseva akuyona ingxenye yenkinga ye-bootstrap, futhi ukukwenza buthaka kushintshanisa ubunzima be-DNS nengozi yokugadwa.
Izindlela ezimelana nokuqala kabusha
Isimo esihlala isikhathi asikhangi. Sebenzisa iklayenti elisebenzisa kahle amasokhethi avikelwe futhi elixazulula i-endpoint yalo kunethiwekhi engaphansi, bese ulinika igama le-endpoint elixazululwa esidlangalaleni, noma ngesixazululi esifinyeleleka ngaphambi komhubhe. Shiya ukuvimba kuvuliwe; ukukucisha ngokuphelele ukuze i-DNS isebenze kususa isici okukhona ngaso lokhu kufakwa.
Lapho i-endpoint kufanele ihlale iyimfihlo, hlinzeka ngendlela ecacile ye-bootstrap ipulatifomu engayisebenzisa — isixazululi esifinyeleleka ngaphandle komhubhe, noma ukuxhumana kokuphatha okugcinwa umenzi — futhi gcina lokho kukhululwa kukuncane futhi kuphethwe umgomo, hhayi iswishi yomsebenzisi. Imibhalo ye-Android VpnService iyisithenjwa salokho ipulatifomu ekuqinisekisayo mayelana nokuvikelwa nomjikelezo wokuphila, futhi isithenjwa se-VpnService.Builder siqinisekisa ukuthi inkambu ye-DNS yamukela amakheli ezinombolo.
Bese uqinisekisa izigaba ezintathu, ngokulandelana, ekuxhumaneni okusha ngemva kokuqala kabusha: igama le-endpoint liyaxazululwa, umhubhe uyasungulwa futhi umlingani uyaqinisekiswa, futhi igama eliyimfihlo lixazululwa ngesixazululi somhubhe. Uma isigaba sokuqala sehluleka, akukho okulandela okungasebenza, futhi ukulungisa kungokwendlela ye-bootstrap — akukaze kube okwenkambu yesixazululi.
- Ukuxazululwa kwe-endpoint kwenzeka kuhlelo, ngaphandle komhubhe, kusokhethi evikelwe.
- Inkambu ye-DNS kusakhi yeyezinhlelo ezingaphakathi komhubhe, hhayi eye-endpoint yeklayenti uqobo.
- Isixazululi esifinyeleleka kuphela ngomhubhe siwukuhlela, hhayi ukuqala okunensayo.
- Hlola i-endpoint, ukuqinisekisa kanye nokusesha okuyimfihlo ngokwehlukana ngemva kokuqala kabusha.