Uhlu lwezimvume lwe-Android VpnService: kungani amakhasi avunyelwe asalenga

Uhlu lwakho lwezimvume cishe lulungile. Amakhasi alenga ngenxa yempendulo ye-DNS, itafula lemizila, isokhethi yesixazululi noma i-MTU. Nansi indlela yokuhlola.

Wengeze isizinda ohlwini lwezimvume, umbuzo ufinyelela kuhlelo lwakho lokusebenza, isifanisi sibuyisela imvume, futhi ikhasi alikaze lilayishe. Ngaleso sikhathi iningi liqala ukubhala kabusha isifanisi futhi lengeze ukuqhathaniswa kwe-wildcard. Ngokuhlangenwe nakho kwami isifanisi ngokuvamile sinembile, futhi ukwehluleka kulele ungqimba olulodwa ngezansi: empendulweni ye-DNS oyenzile, emzileni owifakile, noma kusokhethi oyisebenzise ukudlulisa umbuzo. Uhlu luyingxenye elula; indlela yephakethe iyindawo lapho uhlu lwezimvume luphuka khona.

Isifanisi asivamisile ukuba yicala

Into yokuqala okufanele ihlukaniswe ukuthintwa nokuphukile. Igama elithintiwe kufanele lihluleke ngokushesha futhi ngokubonakalayo, ngoba isiphequluli sithola impendulo yokuthi igama alikho bese liyama. Igama eliphukile liyalenga, lizame futhi nge-IPv6, liwele kwesinye isithuthi, futhi likushiye nesikhombisi esijikelezayo. Uma ubona isikhombisi esijikelezayo, uhlu lwakho lwezimvume cishe luphendula ngento iklayenti engakwazi ukwenza lutho ngayo.

Irekhodi le-A elingenalutho iyiphutha lendabuko. Ukubuyisela i-NOERROR ngempendulo eziyiziro kubonakala njengempendulo evumelekile, ngakho isixazululi se-stub siyayamukela, isiphequluli sizama futhi, sizama i-AAAA, sizama esinye isixazululi, bese siyeka sekwedlule isikhathi eside. Ikhodi yempendulo engu-3, okuyi-NXDOMAIN, nokubuyiselwa kwengxenye yombuzo nokukopishwa kwe-ID yokwenziwa, iqeda ingxoxo ngokushesha. Yisebenzise kuyo yonke imininingwane oyinqaba ngamabomu.

I-IPv6 nayo ifanelwe yisinqumo esifanayo esikhundleni sokwenziwe ngokuzenzakalelayo. Uma uphendula nge-NXDOMAIN ku-A bese uvumela i-AAAA, iklayenti lingafinyelela igama elithintiwe nge-IPv6 futhi isihlungi siyavuza. Ezinye izinzame ziphendula imibuzo ye-AAAA ethintiwe ngekheli le-loopback ukuze ukuxhumana kuhluleke ngokushesha esikhundleni sokuwa kwelinye icala. Khetha inqubomgomo eyodwa, yisebenzise kuzo zombili izinhlobo zamarekhodi, futhi ubhale zombili kumhlahlandlela.

Umzila obamba konke ungumnikazi wakho konke

Isakhiwo se-DNS kuphela asikaze sengeze addRoute("0.0.0.0", 0), ngakho imibuzo kuphela ingena kusixhumi se-TUN futhi konke okunye kuqhubeka sisebenzisa inethiwekhi engaphansi. Leso yisimo esiphephile, futhi sichaza nokuthi kungani ezinye izinhlu zezimvume zibonakala zisebenza ku-Wi-Fi kodwa zehluleka kunethiwekhi yeselula.

Ngesikhathi lapho umzila ozenzakalelayo ukhona, yonke imisele yeyakho. Iphakethe le-TCP elifika kusixhumi futhi elingadluliswanga noma elingaphendulwanga lihlala emugqeni kuze kuphele isikhathi sekhayenti, futhi akukho phutha elizobhalwa ngoba akukho okuhlulekile. Ngibonile umuntu echitha intambama esele ohlu lwezimvume olwephukile okwakuyisidlulisi esingekho somgudu 443. Bhala iphrothokholi nendawo okufikwa kuyo yephakethe ngalinye onquma ukulilahla.

Isokhethi yesixazululi kufanele iphume emhubeni

Ukudlulisela yindawo lapho ugibe olulandelayo lukhona. Izixazululi zomhlinzeki zivamise ukuhlala ekhelini eliyimfihlo umhubhe ongakwazi ukufinyelela kulo, ngakho umbuzo owudluliselayo awuyi ndawo futhi uhlelo lubika ukuphela kwesikhathi sokufunda. Thumela imibuzo evunyelwe kusixazululi owaziyo ukuthi siyafinyeleleka, futhi unikeze leso sokhethi ku-VpnService.protect() kuqala. Isokhethi engavikelwe ibuyisela umbuzo emhubeni wakho uqobo, lapho ufika khona futhi kuhlelo futhi uzungeza kuze kuqale isikhathi sokuphela.

Ukwehluleka kubonakala kufana nokuphazamiseka kwenethiwekhi, yingakho kuhlala isikhathi eside emibikweni yephutha. Gcina izibali zemibuzo ethunyelwe nezimpendulo ezitholiwe: uma inombolo yokuqala inyuka kanti eyesibili ihlala kuziro, ubheka isokhethi hhayi uhlu.

Usayizi nama-checksum kwehluleka ngaphandle komlayezo

Ukulahlwa buthule kuphuma nasosayizini. Impendulo ye-DNS enesethi enkulu yezimpendulo, noma ukuxhawula kwe-TCP ngezinketho eziningi, kungadlula i-MTU yomzila ongakaze uyibeke ngokucacile; ucezu lunyamalala phezulu futhi iklayenti liphinda lizame ngokuncane noma liyeke ukuzama. Ukubeka i-MTU yesixhumi ku-1280 kuyisinqumo esilondolozayo esimelana nemizila eminingi yeselula, futhi ukucaca kungcono kunokuthola njengefa inani elingagcinwe noma ngubani.

Uma wakha amaphakethe ngokwakho, i-checksum ingesinye isibulali buthule. I-checksum ye-UDP ebalwa phezu kwesihloko esingelona sobuqiniso esishiya ubude be-UDP noma inkambu yephrothokholi ikhiqiza iphakethe elibonakala lilungile ngakwakho futhi elilahlwa ngumamukeli ngaphandle komkhondo. Qhathanisa isihloko sakho esingelona sobuqiniso nomhlahlandlela inkambu ngenkambu, futhi uphrinte i-checksum ebalwe yokusakaza okwaziwayo ngesikhathi uhlola amaphutha.

Okungeke VpnService ikwenzele wena

Kunezingqinamba ezimbili okufanele uzazi ngaphambi kokuklama ngazo. Alukho uhlelo lokusebenza olujwayelekile olungafaka i-proxy yesistimu yonke noma ifayela le-PAC ngaphandle kwe-Wi-Fi, futhi leyo ngxenye ayikashintshi. Indlela yohlelo ngalunye isishintshile: ngaphambi kwe-API 29 i-VpnService.Builder yayingakwazi ukuthwala i-proxy nhlobo, futhi kusukela ku-API 29 i-setHttpProxy(ProxyInfo.buildPacProxy(uri)) inikeza inkundla umbhalo we-PAC ozohlolwa kwinethiwekhi ye-VPN. Hlola imithetho kukhodi yakho lapho uqondise kuma-API amadala noma lapho imodeli ye-PAC ingakwazi ukuveza umthetho. I-UDP nayo ayimahhala: iziphequluli zithumela i-TCP kuphela nge-proxy ye-SOCKS, futhi iningi lamaklayenti e-SOCKS5 alikaze lenze i-UDP ASSOCIATE, ngakho isakhiwo esisekelwe ku-proxy silahla noma sivuze i-UDP ngesikhathi i-TCP ibonakala iphilile.

Leyo ngqinamba yesibili iyisizathu sokuthi iphrothokholi esekelwe ku-UDP ingasebenza kunethiwekhi ejwayelekile bese yehluleka ngesikhathi i-VPN yakho ixhuma. Uma umhubhe ulindeleke ukuthwala i-UDP, isidlulisi kufanele senze indlela yokudlulisa yayo, hhayi kuphela indlela ye-TCP enolunye uhlobo lwesokhethi.

Hlola ngalolu hlelo

Sebenza ngohlu ngokulandelana futhi ume esigabeni sokuqala esihlulekayo, ngoba konke ukuhlola okulandelayo kungumsindo kuze kume okwangaphambili.

  1. Bhala imizila efakiwe futhi uqinisekise ukuthi amaphakethe angewona e-DNS angena kusixhumi se-TUN.
  2. Bhala igama lombuzo, isinqumo nekhodi yempendulo yegama elithintiwe nelivunyelwe.
  3. Qinisekisa ukuthi isokhethi yesixazululi ivikelwe nokuthi isixazululi esikhethiwe siphendula sisemhubeni.
  4. Qinisekisa i-MTU yesixhumi ne-checksum yempendulo eyodwa oyakhile ngesandla.
  5. Phinda ikhasi elifanayo ku-Wi-Fi nakunethiwekhi yeselula, ngoba izixazululi zomhlinzeki ne-MTU yomzila ziyehluka.

Uma zonke ezinhlanu zima futhi ikhasi lisalenga, umsoli olandelayo isidlulisi ngokwaso: qhathanisa isicelo esitholiwe nempendulo etholiwe futhi ufune inani lamabhayithi alahlekile noma isokhethi evaliwe ingxenye. Incwadi ye-VpnService.Builder ihlanganisa izivumelwano zomzila, i-DNS ne-MTU, futhi i-protect() iwukushaywa kwe-VpnService okwehlukile hhayi ukukhetha kwe-builder; isixhumi esixhunyiwe sisho kuphela ukuthi isivumelwano sokuqala sigcwalisiwe.

Izihloko ezihlobene