Ukuhambisa kwe-VPN ku-Android: imithetho yenqubomgomo ngaphambi kwethebula main
I-Android ikhetha ithebula lokuhambisa ngemithetho ye-uid nomaka ngaphambi kwanoma yikuphi ukufunwa kwendawo, ngakho umzila owengezwa ku-main ungase ungahlolwa neze.
Umzila owengezwa kuthebula main ku-Android ubukeka ulungile kukho konke ukuhluza futhi awuthwali ithrafikhi. Isizathu ukuthi ithebula main ingenye yezinketho ezimbalwa, futhi ayibuzwa kuqala. Insizakalo yenethiwekhi ye-Android yakha imithetho yenqubomgomo ekhetha ithebula lokuhambisa ngolwazi okungekho kukheli lwendawo — i-uid yohlelo, umaka osesigabeni, i-interface eza ngayo — futhi ukufunwa kwendawo kwenzeka ngemuva kwalokho, ngaphakathi kwethebula elikhethwe yileyo mitherho.
Izinqumo ezintathu ngokulandelana okungaguquki
Isigaba esiphumayo sithatha izinqumo ezintathu ezihlukene. Okokuqala, umthetho wenqubomgomo unquma ukuthi iyiphi ithebula lokuhambisa elisebenza. Okwesibili, umzila ngaphakathi kwalelo thebula unquma ukugxuma okulandelayo ne-interface yokuphuma. Okwesithathu, izingwegwe ze-netfilter zinquma ukuthi isigaba sizophila, sizoshintshwa noma sizoqondiswa kwenye indawo.
Ukulandelana kubalulekile ngoba isigaba ngasinye singaphendula umbuzo waso kuphela. Umthetho wodonga lomlilo owamukela isigaba awukhethi ithebula, futhi umzila owengezwa kuthebula okungekho mthetho owukhethayo awusebenzi. Iningi lokudideka mayelana nama-VPN e-Android livela ekulungiseni okukodwa kwabathathu nokungaboni ushintsho, ngoba iphutha lalikwelinye.
| Stage | Selector | What it cannot decide |
|---|---|---|
| Policy rule | uid range, mark, incoming interface | Which route exists inside the table |
| Route lookup | Destination prefix, longest match | Whether the packet is allowed out |
| Netfilter hook | Chain position, match conditions | Which table was selected |
Amamaka ayingxenye epakiwe, hhayi ilebula oyiphethe
I-Android ipakisha amaqiniso amaningi kunani elilodwa lomaka: iyiphi inethiwekhi ekhethiwe, ingabe uhlelo lwakhetha inethiwekhi ngokusobala, ingabe i-socket ivikelwe ku-VPN, namabhithi ahlobene nezimvume. Isihloko se-fwmark se-AOSP sichaza lokho kuhlelwa kwesihlahla samanje, futhi ukuhlelwa kuyinto yangaphakathi yepulatifomu eshintsha phakathi kwezinguqulo.
Yingakho ku-Android kuyingozi ukubhala inani eliphelele lomaka nge-iptables -j MARK --set-mark. Akwengezi ithegi; kushintsha ukukhethwa kwenethiwekhi okwenziwe uhlelo kakade. Isigaba sibe sesihambisana neminye imithetho, okungabonakala sengathi i-VPN iqalile ukusebenza, noma sengathi uhlelo olungahlobene luphelelwe uxhumano, kuye ngokuthi yimaphi amabhithi abhalwa phezu kwawo.
Uma kufanele uthinte amamaka, qala ufunde inani lamanje bese usebenzisa isifihlo ukuze kushintshwe kuphela lawo mabhithi owaqondayo:
ip rule show
ip route show table all | head -40
ip route get 10.20.4.11Umaka woxhumano uyinto ehlukile kumaka wesigaba, futhi akukho kuzo okuwumzila. Ukubuyisela umaka ezigabeni eziphendulayo kuyisinyathelo esihlukile ekukhetheni ithebula lapho uphuma, yingakho izilungiso zohlangothi olulodwa zikhiqiza uxhumano oluvulekayo bese lulenga.
Ubani ongumnikazi wemithetho namathebula
Insizakalo yenethiwekhi ye-Android, i-netd, idala imithetho namathebula ngenethiwekhi ngayinye. AOSP RouteController yindawo lapho leyo mitherho ihlanganiswa khona yama-VPN, amanethiwekhi abonakalayo nemikhawulo ye-uid, futhi umjikelezo wayo wokuphila uhlobene nezigameko zenethiwekhi hhayi nefayela lokuhlela.
Imiphumela emibili iyalandela. Okokuqala, izinto ezibalulekile nezinombolo zamathebula ozithola kudivayisi eyodwa ziyiminingwane yangaphakathi yokwakhiwa, hhayi i-interface: izinombolo ezibukeka zifana kwenye inguqulo ye-Android zingasho into ehluke ngokuphelele. Okwesibili, isimo sakhiwa kabusha lapho amanethiwekhi eshintsha, ngakho umthetho ofakwe namuhla kusuka ku-root shell ungase ungasekho ngemuva kokushintsha kwe-Wi-Fi okulandelayo.
Lokho kunyamalala kuvame ukubikwa njengokuthi uhlelo lweqa umzila. Okwenzeka ngempela ukuthi umthetho owawukhetha ithebula awusekho, futhi umzila ongaphakathi kwethebula manje awufinyeleleki ngokombono wesigaba. Hlola uhlu lwemithetho, hhayi uhlu lwemizila, lapho ukuhlelwa okusebenzayo kuyeka ukusebenza ngemuva kokuxhuma kabusha.
Imibuzo ngokulandelana kwezingwegwe ayinayo impendulo efanayo kuye wonke umuntu
Umbuzo wokuthi i-iptables isebenza ngaphambi kokuhambisa kwe-VPN awukwazi ukuphendulwa ngaphandle kokusho indlela yesigaba. Isigaba esakhiwe endaweni sidlula ingwegwe ye-output, lapho ushintsho lomaka lubangela ukuhlolwa kokuhambisa kabusha — lokhu kuwukufunwa kwesibili, hhayi ukuhlelwa kwangemuva kokuqala. Isigaba esivela kuklayenti ye-tether sidlula endleleni ye-prerouting futhi sidluliselwa phambili esikhundleni salokho, futhi amaketanga asibonayo ahlukile.
Ngakho umthetho ofanayo ungasebenza kuthrafikhi yohlelo futhi ungabonakali kuthrafikhi ye-tether, futhi isibali esihlala kuziro sikutshela ukuthi isigaba sithathe muphi umzila, hhayi ukuthi umthetho awulungile. Sebenzisa izibali ukuze uqinisekise umzila ngaphambi kokushintsha noma yisiphi isimo sokufanisa.
Lena futhi iyisigaba lapho iphutha lokuhambisa ngenqubomgomo liba nzima ukulibona. Ukuhambisa kubethebula elikhona kodwa elingenawo umkhathi kukhiqiza inethiwekhi engafinyeleleki ebonakala njengokulahla kodonga lomlilo, kuyilapho ukulahla kodonga lomlilo kukhiqiza ukuphela kwesikhathi okubonakala njengomgodi omnyama wokuhambisa.
Xilonga ngaphakathi kohlelo, noma uyeke
Ukuze kube nokubuyekezwa okugunyaziwe, qinisekisa amaqiniso amane ngaphambi kokuthinta noma yini: i-uid nephrofayela yohlelo, inethiwekhi eyakhethwa i-Android yalo, ingabe i-VPN iyahlanganisa ngempela lolo hlelo, nokuthi ingabe inkinga ikhona kuzo zombili izinhlobo zamakheli. Ukukhishwa kohlelo ngakunye kuchaza izethulo eziningi ze-VPN ayisebenzi ngaphandle kwanoma yiphutha lokuhambisa.
Bese ufunda imithetho, izifihlo namathebula asebenza ngempela, futhi ugcine ukushintsha kwenethiwekhi ngaphakathi kwewindi lokubheka. Uma ukuziphatha kushintsha phakathi kokuxhuma kabusha, ubheka umjikelezo wokuphila ophethwe, hhayi umzila ongekho.
Izidingo ezijwayelekile, sebenzisa izilawuli ezisekelwayo: ukufakwa nokukhishwa kohlelo ngakunye kuhlelo lwe-VPN, nokukhethwa kwenethiwekhi kwepulatifomu ngokwayo kukho konke okudinga umzila othile. Uma ukuhlanganiswa okunegunya kufanele ngempela kusebenzisane nomshini wokuhambisa, khomba ekusetshenzisweni kwenguqulo ye-Android eqondile oyisekelayo futhi ugcine umjikelezo wayo wokuphila ngengxenye engumnikazi wayo. Ukususa amaketanga epulatifomu noma ukufaka umthetho ophambili kakhulu kuguqula ukuxilonga kube umphathi wenethiwekhi wesibili, futhi ifoni izoziphatha ngokufanele.