I-VPN ye-Android ngaphandle kwe-root: ubani ongeqiniso, imizila nokuvinjwa
Imvume, isixhumanisi se-TUN kanye nomgomo wokuvinjwa wesistimu kungamalungelo amathathu ahlukene. Thola ukuthi iyiphi ingxenye ephethe ngalinye ngaphambi kokuhlola uhlelo lwe-VPN lwe-Android.
I-root akuyona into evumela uhlelo lwe-VPN lwe-Android ukuthi luthwale ithrafikhi, luvimbe ukucwila noma luqhubeke ngemuva kokuqalisa kabusha. Abantu bahlanganisa konke lokhu ngokuthi „uhlelo lunemvume ye-VPN“, okufihla izindlela ezintathu ezihlukene: imvume evela kumsebenzisi, isixhumanisi samaphakethe esisungulwa isistimu, kanye nomgomo wokuvinjwa wepulatifomu okungeyona eyohlelo ukuwuchaza. Ukuhlola umklamo we-VPN ye-Android kusho ukubuza ukuthi isitatimende sisekela kuyiphi kulezi zintathu, ngoba ngayinye inomnini nendlela yokwehluleka ehlukene.
Imvume iza ngomsebenzi wesistimu
VpnService.prepare() awunikezi lutho. Ibuyisela i-intent ku-msebenzi wemvume wesistimu uma imvume ingekho, futhi uhlelo luvula leyo ngxoxo ukuze umsebenzisi agunyaze insizakalo. Ukuqalisa inqubo yohlelo ngokwalo, ukwengeza imvume ku-manifest, noma ukubonisa isikrini esenziwe ngokwezifiso esithi „nikeza amandla i-VPN“ akudali imvume.
Imvume futhi inobubanzi. Ingokwephakethe elikwiphrofayela yomsebenzisi, ngakho ikhophi yomuntu siqu nekhophi yomsebenzi yizinqumo ezihlukene, futhi umnikazi wedivayisi angalungiselela iphrofayela elawulwayo ngendlela ehlukile kuneyomuntu siqu. Uma ingxoxo ingaveli neze futhi prepare() ibuyisela i-null, imvume isivele ikhona yaleyo phakethe kuleyo phrofayela; lokho akubona ubufakazi bokuthi uhlelo luthembekile, kukhombisa nje ukuthi imvume ikhona.
Isixhumanisi siyisicelo esigcwaliseka yisistimu
Ngemuva kwemvume, uhlelo luchaza okulufunayo nge-VpnService.Builder: amakheli, imizila, amaseva e-DNS, i-MTU futhi, lapho kusekelwa khona, izinhlelo ezizofakwa noma zikhishwe. establish() icela isistimu ukuthi yakhe isixhumanisi somhubhe futhi iqondise ithrafikhi ehambisanayo kuwo. Isistimu inesinqumo somzila; uhlelo luthola isichazi sefayela bese kufanele lwenze okuthile okusizayo ngamaphakethe.
| What you observe | Who actually owns it |
|---|---|
| VPN consent dialog | The system, triggered by prepare() |
| Routes, DNS and app lists | The app requests them; the system applies them |
| One active VPN per profile | The platform; a new service replaces the old one |
| Always-on and block-without-VPN | Device policy enforced by the platform |
Lelo thebula liwumklamo endaweni eyodwa. Uhlelo lubamba iqhaza ekusingathweni kwamaphakethe; aluphethe isixhumanisi, ithebula lemizila noma inani lezinsizakalo ezingasebenza.
Isokhethi yomhubhe kufanele ibalekele umhubhe wayo
Ukuxhumana okuthwala ithrafikhi ebethelwe ngokwako kuyisokhethi. Uma kubuyiselwa esixhumanisini esisanda kwakhiwa uhlelo, umhubhe uncika kumhubhe futhi uyama. VpnService.protect() ibophela leyosokhethi kunethiwekhi engaphansi ukuze idlule ekubanjweni, yingakho iklayenti elilungile livikela isokhethi yalo yangaphandle ngaphambi kokuxhawulana kokuqala.
adb shell dumpsys connectivity | grep -i -A5 vpn
adb shell settings get global always_on_vpn_app
adb shell settings get global always_on_vpn_lockdownLe mikhondo ibonisa inethiwekhi ye-VPN efakiwe, iphakethe elihlala livuliwe nokuthi ukukhiywa kusethiwe yini. Lokhu kungukubona kokufunda kuphela: uma amanani engahambisani nalokho umklamo okushoyo, isitatimende sikhuluma ngesixhumanisi sohlelo hhayi ngesimo sesistimu.
Ukuvinjwa kungaba ngepulatifomu
I-Android ibhala umgomo ovimbela ukuxhumana okungasebenzisi i-VPN. Lokho kuphoqelela kuyisivumelwano sepulatifomu, hhayi uhlelo oluphinda luzame ukuxhumana emjikelezweni. Isishintshi sisezilungiselelweni ze-VPN zedivayisi ngokuthi „Vimbela ukuxhumana ngaphandle kwe-VPN“, futhi kudivayisi elawulwayo umnikazi angayivula yonke iphrofayela. Lo mehluko ubalulekile lapho uhlola isitatimende sokumaketha: iklayenti lingabonisa isithonjana sokhiye futhi lixhumane kabusha ngamandla ngenkathi ithrafikhi eqondile isenokwenzeka, noma izinhlelo ezimboziwe zingahlala zingaxhunyiwe ngenxa yokuthi isistimu iphoqelela ukukhiya.
Isithonjana sokhiye sidwetshwa uhlelo, ngakho sifakazela kuphela ukuthi uhlelo lukholelwa ukuthi luxhunyiwe. Ukuthi olunye uhlelo luzolahlekelwa ukufinyelela kunethiwekhi kunqunywa ipulatifomu, ngakho ukuhlola okusizayo ukubona lolo hlelo luhluleka ngenkathi umhubhe uvuliwe.
Ilebuli ethi „ihlala ivuliwe“ evela esitolo sezinhlelo nayo ayithathi indawo yaleso sivumelwano. Ukuhlala kuvuliwe nokukhiya kuyizilungiselelo zedivayisi, ezivame ukusetshenziswa umnikazi, futhi ukuziphatha kwazo ezinhlelweni ezikhishiwe kuchazwa ipulatifomu. Funda isilungiselelo, hhayi ibheji.
Imibuzo emine yokuhlola umklamo
Okokuqala, ubani wavuma: iyiphi iphakethe, iyiphi iphrofayela, futhi kwakungumsebenzisi noma umgomo wedivayisi elawulwayo? Okwesibili, uhlelo lwacela ini: yimiphi imizila, yimiphi imikhakha yamakheli, yiziphi izinhlelo ezifakiwe noma ezikhishiwe? Okwesithathu, kwenzekani uma umhubhe ungatholakali: ingabe isistimu ivimbela noma ithrafikhi ibuyela kunethiwekhi engaphansi? Okwesine, uhlelo lwenzani ngamaphakethe eliwatholayo?
Umbuzo wesine yiwona imodeli yemvume engakwazi ukuwuphendula. Imvume nesixhumanisi se-TUN kufakazela ukuthi uhlelo lungathola ithrafikhi, hhayi ukuthi luyibethela, luqinisekisa ozakwabo noma lululama ngokuhlanzekile. Lezo yizici zokuqaliswa, futhi yilapho ukuhlola okuqotho kuchitha isikhathi sako.
Isicelo se-root esingadingekile asibi semthethweni ngokubiza umphumela ngokuthi isishintshi sokubulala, futhi ingxoxo yemvume ayilona ukuhlolwa kwezokuphepha. Gcina izimvume ezintathu zihlukene futhi zonke izitatimende ziyahloleka.