I-VPN ku-Android isebenza nge-IPv6, kodwa isiphequluli sisakhetha i-IPv4

I-VPN ivuliwe, isixhumi esibonakalayo sewebhu sangasese siphendula nge-IPv6 sisuka kukhompyutha ephathwayo, kanti ifoni ye-Android isavula ikhasi elifanayo nge-IPv4 noma iyenqaba ukuyilayisha ngokuphelele. Irekhodi le-AAAA likhona. Umhubhe ubika ikheli le-IPv6. Akukho okubonakala kungalungile kumklami. Imiphumela inqunywa izinqumo ezine ezihlukene: iyiphi isixazululi ephendulile, yini i-VpnService eyayimemezele ku-Android, umndeni wamakheli awukhiphi isiphequluli owawuzimisele ukuwuzama, nokuthi ingabe iphakethe lingenza uhambo lokuhamba nokubuya. Sebenza ngazo ngalolo hlelo esikhundleni sokwengeza umzila ozenzakalelayo nokuthemba ukuthi uphawu luzosuka.

Isigaba 1: fakazela ukuthi iyiphi isixazululi ephendule umbuzo we-AAAA

I-Android ayinayo indlela eyodwa ye-DNS. I-VPN ingaphusha iseva ye-DNS yenethiwekhi yayo, uhlelo lungasebenzisa i-Private DNS kumagama wabasingathi eliwathatha njengafanelekile, futhi i-Chrome ingasebenzisa isixazululi sayo esifihliwe sisuka ku-chrome://settings/security. Efoni lapho umhubhe uphusha khona u-10.61.0.1 kodwa i-Private DNS ikhomba kumhlinzeki womphakathi, igama elingaphakathi kwendawo yakho yangasese alixazululwa umshini ophethe leyo ndawo. Isiphequluli sithola impendulo esuka kwisixazululi esingenalo igunya ngalelo gama futhi sikubheka njengokungekho, futhi umbhalo wephutha awukaze ukhulume nge-DNS.

Buza isixazululi somhubhe ngqo ngaphambi kokushintsha enye into. Imiyalo emibili yokuqala ibonisa ukuthi yimaphi amaseva e-DNS i-Android ewaxhumanisa nenethiwekhi esebenzayo nokuthi i-Private DNS ikumodi ezenzakalelayo noma eqinile; eyesithathu isebenza kusuka kunoma yimuphi umklami ngaphakathi komhubhe, hhayi kusuka efoni.

adb shell dumpsys connectivity | grep -A3 "DnsAddresses"
adb shell settings get global private_dns_mode
nslookup -type=AAAA nas.lan 10.61.0.1

Isigaba 2: funda ukuthi i-VpnService yamemezela ini ngempela

Uhlangothi lwe-Android lucacile hhayi oluqagelwayo. I-VpnService.Builder yengeza amakheli nge-addAddress, imizila nge-addRoute, amaseva e-DNS nge-addDnsServer, futhi ingakhawulela wonke umhubhe emndenini owodwa wamakheli nge-allowFamily. Umakhi otshaye u-allowFamily(AF_INET) wabe esengeza umzila we-IPv6 utshele uhlelo izinto ezimbili eziphikisanayo, futhi ukukhawulelwa komndeni yikho uhlelo olugcinayo. Umzila ohlanganisa u-fd00:61::/64 kanye nekheli lesixhumi esisendaweni yesiqalo esihlukile wehluleka ngesizathu esifanayo: ikheli likhona, kodwa alikho on-link kulo mzila.

Funda isimemezelo esikhundleni sokwethemba iswishi eseku-app. I-dumpsys netd iphrinta amakheli nemizila exhunywe kusixhumi se-tun, futhi i-LinkProperties yenethiwekhi ngayinye ngaphakathi kwe-dumpsys connectivity ikhombisa uhlu lwe-DNS eceleni kwemindeni okuthiwa inayo inethiwekhi.

adb shell ip -6 addr show tun0
adb shell ip -6 route show table all | grep tun0
adb shell dumpsys connectivity | grep -E "LinkAddresses|Routes"

Uma isixhumi se-tun sinekheli le-IPv6 kodwa awukho umzila ohambisana nesiqalo sesevisi, ukulethwa kwe-IPv6 sekukhona konakele ngaphambi kokuba isiphequluli sifike. Leli iphutha elihlukile kuneliphequluli elinqaba ukuzama, futhi lidinga ukulungiswa okuhlukile.

Isigaba 3: isiphequluli sinquma ukuthi sizozama i-IPv6 noma cha

I-Chromium ayisebenzisi yonke irekhodi le-AAAA eliyitholayo. Isixazululi sayo sabasingathi siphethe ukuhlolwa kokufinyeleleka kwe-IPv6 nokuhlungwa kwabangeneleli okungase kulahle noma kwehlise ukubaluleka kwe-IPv6 uma inethiwekhi ibhekwa njengengakwazi ukuyithwala, futhi umthombo wesixazululi ukhombisa lokho kuhlolwa kanye nezimo ezikuzungezile. Umqondo uncike kunguqulo nakumafulegi, futhi yikho kanye isizathu sokuthi amafoni amabili emhubheni owodwa enze ngendlela ehlukile. Lapho sekunabangeneleli, i-Happy Eyeballs iqhudelanisha imindeni ngokuxhumana ngakunye, ngakho umzila we-IPv6 ophendula kancane usengase uhlulwe i-IPv4 ephendula ngokushesha.

Qaphela isinqumo esikhundleni sokusiqagela. Iseshini erekhodwe nge-chrome://net-export futhi yadlalwa futhi kusibuki se-netlog ikhombisa ukuxazululwa ngakunye nomndeni okhethiwe; i-chrome://net-internals/#dns ikhombisa imiphumela egciniwe. Ukuxazululwa okubuyisa amarekhodi e-A kuphela egameni eline-AAAA kwisixazululi sakho siqu kukhomba ngqo kulesi sigaba.

Isigaba 4: qinisekisa ukuthi iphakethe lingenza uhambo lokuhamba nokubuya

Ukukhetha ikheli akukhona ukuletha. I-Android igcina amathebula omzila nemithetho yenqubomgomo yenethiwekhi ngayinye ekhetha ithebula nge-fwmark, ngakho umzila obonakala kuthebula eliyinhloko awuyona ngokuzenzakalela imzila esetshenziswa isokhethi. Ukufunda imithetho nokucela i-kernel ukuba ixazulule indawo yokuphela yekheli lomthombo kuhlukanisa lezi ezimbili.

adb shell ip -6 rule show
adb shell ip -6 route get fd00:61::20 from fd00:61::10

Umphumela we-route get uwona ophendula umbuzo. Uma ukhomba i-tun0 kodwa amaphakethe asafa, yiya ku-MTU yomhubhe nasekudlulisweni kwe-IPv6 kwesango esikhundleni sokubuyela efoni.

Kungani ukwengeza i-::/0 kuvame ukwenza kube kubi kakhulu

Ukwengeza i-::/0 kushintsha isimangalo somhubhe sisuke esiqalweni esisodwa siye kuyo yonke indawo yokuphela ye-IPv6. Efoni lokho kungase kwanelise ukuhlolwa kokufinyeleleka, ngoba ikheli lokuhlola elingaphandle kwesiqalo sakho selibonakala lihamba ngomzila. Kodwa akudali umthamo we-IPv6 wokuya phezulu esangweni, futhi amasango amaningi asekhaya awanawo nhlobo uxhumano lwe-IPv6 oluya phezulu olusebenzayo. Umphumela umgodi omnyama we-IPv6 yomphakathi: amagama ayekade ehlehlela ku-IPv4 manje alenga, futhi ikhasi langasese lingase libonakale lingcono ngoba nje ukuhlolwa kukala enye into.

Kunesindleko senqubomgomo futhi. Uma i-::/0 isemhubheni, yonke ithrafikhi ye-IPv6 iphuma nge-VPN, kuhlanganise nethrafikhi umnikazi wenethiwekhi angakaze avume ukuyithwala. Kubheke njengesinqumo sokusatshalaliswa esinomnikazi oqanjiwe, hhayi njengesinyathelo sokulungisa iphutha osithatha ngehora lika-1 ekuseni.

Ukulandelana komsebenzi okuqeda lokhu

Qinisekisa ukuthi impendulo ye-AAAA ivela kwisixazululi esiphethe indawo, funda isimo se-VpnService ne-netd sesixhumi se-tun, thatha umkhondo we-net-export ukuze ubone ukuthi i-Chromium yalahla umngeneleli, bese uhlola uhambo lokuhamba nokubuya nge-ip -6 route get. Lungisa isendlalelo esihluleke ngempela futhi ushiye inqubomgomo yokuhlukanisa. Uma amagama angasese edinga izimpendulo ezihlukile kunawomphakathi, i-split tunneling yenzelwe lokho.

Bhala ukwakhiwa kwefoni, inguqulo yesiphequluli nesixazululi osibuzile. Lezo zinto ezintathu zishintsha i-"IPv6 is broken" zibe into umuntu olandelayo angayenza futhi.