Ukunikezwa kwe-VPN ku-Android: getConnectionOwnerUid ngokumelene ne-/proc/net
I-Android 10 ifihla i-/proc/net kuma-app. I-VPN isathola amaphakethe, kodwa ukunikezwa kudlulela ku-getConnectionOwnerUid, nemithetho yayo ye-tuple nezimvume.
Ku-Android 10 nangemuva, i-app evula /proc/net/tcp ithola ukunqatshelwa kokufinyelela esikhundleni sethebula le-socket. I-interface ye-VPN ayikhathazeki: amaphakethe asafika, ngoba ithuneli isinqumo sokuhamba kwendlela, hhayi imvume yefayela. Okwashintshayo yimpendulo yombuzo omncane: “iyiphi i-app ephethe lokhu kuxhumana?” Okungena esikhundleni yi-ConnectivityManager.getConnectionOwnerUid, umbuzo osekelwayo wokuxhumana ngakunye, futhi ukukhetha phakathi komkhuba wakudala ne-API entsha kuncike ekutheni iyiphi kwezintathu imisebenzi onawo ngempela: ukwamukela amaphakethe, ukunikeza umfudlana, noma ukuhlanganisa ukusetshenziswa.
Izindlela ezimbili zokuphendula umbuzo womnikazi
Ngaphambi kwe-API 29, inqubo enelungelo noma i-root yayingafunda amathebula e-socket e-kernel, iqondanise okune, futhi yazi i-UID yomnikazi. Lokho kwakunikeza uhlu lwalo lonke idivayisi kufayela elilodwa. Kusukela ku-API 29 umbono wesistimu yamafayela ukhawulelwe, futhi indlela esekelwayo umbuzo wokuxhumana ngakunye one-protocol, ikheli lendawo kanye nekheli elikude.
| Question | Legacy socket tables | getConnectionOwnerUid |
|---|---|---|
| Who owns this flow? | Scan and match the tuple | Ask once per tuple |
| Device-wide inventory? | Yes, when readable | No, one flow at a time |
| Historical usage? | No | No; that is NetworkStatsManager |
| Works without root? | No on modern releases | Yes, for authorized callers |
Ukuqhathanisa akukhona “okudala ngokumelene nokusha”. Yimisebenzi emithathu ehlukene eyayihlinzekwa yifayela elilodwa elifundekayo futhi manje ihlinzekwa yizindlela ezintathu ezihlukene ezineziqophamlando ezintathu ezihlukene.
Ikheli lendawo liwuphethelo lwe-app
Isiginesha yendlela ithatha i-protocol, ikheli le-socket lendawo kanye nekheli le-socket elikude. “Lendawo” isho uhlangothi lwe-app ekuxhumaneni, hhayi iphethelo eliba umthombo waphakethe ngaleso sikhathi ucwaninga. Iphakethe elihamba lisuka kuseva ekude libuyela ku-app linomthombo nendawo ekuyiwa kuyo kuhlanekezelwe ngokwaleyo ncazelo.
ConnectivityManager cm = getSystemService(ConnectivityManager.class);
int uid = cm.getConnectionOwnerUid(
OsConstants.IPPROTO_TCP, appLocalAddress, appRemoteAddress);Leli phutha lomkhombandlela iyisizathu esivame kakhulu sokuthi umbuzo osebenzayo ubuyise impendulo engalungile, noma lutho. Bhala kokubili okuphethelo ngaphambi kocingo futhi uqinisekise ipharisa ngokuxhumana i-app ewuvulile ngempela. Umndeni wekheli nawo ubalulekile: ikheli elimepishwe nge-IPv4 nekheli le-IPv6 lendabuko kungama-tuple ahlukene, kanye nemifudlana ye-TCP ne-UDP emimoyeni efanayo.
Ugunyaziso nemiphumela engaziwa ziyingxenye yesiqophamlando
Umbuzo ukhawulelwe kubafonelayo abagunyaziwe, kuhlanganise ne-app ye-VPN esebenzayo yomsebenzisi ofanele. I-app yokuqapha engahlobene ayikwazi ukucabanga ukuthi ingabala ukuxhumana kweprofayela enye, futhi ucingo olungagunyaziwe lungaphonsa okuhlukile kwezokuphepha esikhundleni sokubuyisa iphutha elinomusa. Phatha kokubili imiphumela ngokusobala.
Umnikazi ongekho akulona igama lephakethe. Umfudlana kungenzeka wavalwa phakathi kwephakethe nombuzo, i-tuple kungenzeka ayiphelele, noma umfonelayo kungenzeka akanikezwanga imvume yokwazi. Ukugcina impendulo yokuqala ephumelelayo bese uyisebenzisa futhi kamuva kunikeza ukuxhumana okusha ku-app endala, okuyinto embi kunokubika okungaziwa.
Lapho ukunikezwa kwehluleka, ithrafikhi isadinga isinqumo: iyivimbe lapho inqubomgomo ikufuna khona, vumela kuphela ububanzi obuqondayo, noma uveze igebe. Lokho kubuyela emuva kungokomklamo, hhayi umbono.
Ukubalwa kuwumbuzo omunye
I-NetworkStatsManager ibika ukusetshenziswa ngaphansi kwemithetho yayo yokufinyelela. Ingakutshela ukuthi i-UID idlulise malini esikhathini esithile; ayikwazi ukukutshela umnikazi wephakethe eliphilayo elinganoma yini. Amakhono enethiwekhi achaza izakhiwo zenethiwekhi, hhayi uhlu lwama-socket. Ukuhlanganisa kokuthathu kwenza amabhodi okubuka abonakala ehambisana futhi engahambisani.
Esimeni esilula sokunquma ukuthi yimaphi ama-app asebenzisa ithuneli, izinhlu ezisekelwayo ze-Android zama-app avunyelwe nalingavunyelwe seziveza inqubomgomo ngaphandle kwanoma yikuphi ukuklwebha. Gcina ukunikezwa komfudlana ngamunye ezehlakalweni ezikudinga ngempela, futhi uhlele isabelomali sokuqaliswa okunakekelwayo okubhekana nendawo, izimvume nezimo ezingaziwa ndawonye.
Khetha ithuluzi ngokomsebenzi, bese uhlola imiphetho
Uma imfuneko iwukukhetha ithuneli, sebenzisa uhlu lwepulatifomu. Uma kuyukunikezwa okubukhoma, sebenzisa umbuzo womnikazi futhi uthatha yonke i-tuple engaphenduleki njengengaziwa. Uma kuyizibalo zomlando, sebenzisa i-stats API. Bese uhlola imiphetho emithathu ephula ukuqaliswa okulula: iphakethe eliya kwelinye iceleni, umfudlana ovala ngaphambi kokuthi ubuze, nomfonelayo ongeyona i-VPN esebenzayo.
Akukho kulokhu okudinga ukuvala i-SELinux, ukwenza i-root yocingo noma ukwenza amathebula e-kernel afundeke emhlabeni wonke. Umkhawulo uwukho kanye: ipulatifomu yahambisa ukunikezwa ngemuva kwesiqophamlando ukuze impendulo itholakale kwingxenye eyidinga ngokusemthethweni, futhi ingatholakale kumuntu omunye.