Ukuhlukanisa umhubhe ku-Android VpnService: yini ongayihambisa ngempela

Ukuhlukanisa umhubhe kuhlelo lwe-VpnService kwehla ezindaweni ezimbalwa eziqondile, futhi ukulungisa kuyahluka kwesinye nesinye. Iklayenti likhombisa indawo eyodwa ehlulekile kuphela, ngakho umsebenzi wokuqala ukuthola ukuthi yimuphi umngcele owushayayo: imizila i-builder eyitholile, i-proxy ongakwazi ukuyiqinisekisa, i-resolver oyimemezele kuphela, noma uhlu lwezinhlelo olusetshenziswa yipulatifomu kumsebenzisi ngamunye. Yingakho ngigcina ukuhlola okuyizinyathelo ezine. Kuhamba ngokulandelana okungezansi futhi kuma ekwehlulekeni kokuqala.

Qinisekisa ukuthi i-builder yanikeza ini ipulatifomu

I-VpnService.Builder iwuhlu lwezimemezelo. I-establish() ibuyisela i-ParcelFileDescriptor yesixhumi esibonakalayo, futhi ipulatifomu ithumela kuleso sichazi kuphela ukuxhumana okuhambisana neziqalo ze-addAddress ne-addRoute; i-addDnsServer itshela amaklayenti ukuthi yiluphi i-resolver okufanele bayibuze. Indawo engaphandle kwazo zonke iziqalo ozifakile ayifiki neze kuhlelo lwakho, noma isixhumi sithembisa ini. Leli qiniso elilodwa lichaza iningi lemibiko yokuhlukanisa umhubhe ephukile ngaphambi kokushintshwa kwekhodi.

Bhala emibhalweni yohlu lwamakheli, imizila ne-DNS okuhlanganiswe yi-builder yakho, bese uwaqhathanisa nezindawo ezihlulekile. I-/32 engekho yesibambi sokuphatha ivame kakhulu kunomhubhe ophukile. Uma uhlu lulungile, qhubeka; uma lungalungile, okusele kohlu lokuhlola kuwumzamo oyize.

I-excludeRoute ikhona kusukela ku-API 33 kuphela

Ukukhipha okususelwe endaweni yikho okuceliwe okuvame ukuphenduka uchungechunge lokusekelwa. I-builder.excludeRoute(IpPrefix) yafika ku-API 33; ngaphambi kwalokho indlela eyodwa esekelwayo ukwengeza imizila kukho konke ngaphandle kwesiqalo esikhiyiwe, okusho ukuthi kufanele uzibalele ngokwakho iziqalo ezigcwalisa. Izingcingo ezimbili azizona izithombe zesibuko: esinye sisusa kusethi yemizila yesixhumi, esinye sakha isethi kusukela kuqanda, futhi idivayisi endala izokhipha noma izinge igcine ngokuthula ucingo engalwazi. Phamisa nge-Build.VERSION.SDK_INT futhi uhlole zombili izindlela kuhadiwe yangempela.

Uma ubala izigcwalisi, qaphela ukuqondana kweziqalo. Ukukhipha i-/24 ngaphakathi komzila we-/16 kudinga iziqalo ezimbozayo ezichaza ngempela okusele, hhayi i-/8 eyodwa ekhubazekile. Bhala uhlu lokugcina futhi uqinisekise ukuthi isibambi esikhiyiwe sisaxazululwa ngomzila ongaphandle komhubhe.

Imininingwane yokuqinisekisa ye-proxy ayivezwa

I-setHttpProxy(ProxyInfo) iqondisa isixhumi ku-proxy ye-HTTP noma ye-SOCKS, futhi i-PAC URL ingakhetha phakathi kwazo endaweni ngayinye. I-ProxyInfo noma ifomethi ye-PAC akukho okuthwala igama lomsebenzisi nephasiwedi, ngakho i-proxy edinga ukuqinisekiswa ihlala ngaphandle kwe-API yepulatifomu. Izinhlelo ezikudingayo zivame ukufaka i-stack yendawo yomsebenzisi, i-tun2socks noma injini efanayo, futhi ziziphendula ngokwazo inselelo ye-407.

Lokho kukhetha kunemiphumela. I-stack yendawo yomsebenzisi ibona kuphela ukuxhumana okuqondisa kuyo, ngakho kufanele ihlale ngaphakathi komngcele ofanayo wesichazi, futhi izuza imfuneko efanayo ye-protect() kusokhethi yayo ephezulu. Uma ushiya i-protect(), umhubhe ubamba ezakho ukuthutha, okubonakala njengokuxhawana okuma ngemva kwephakethe lokuqala. Hlola ku-proxy efuna imininingwane yokuqinisekisa, ngoba i-proxy evulekile idlula emzileni wepulatifomu futhi ayifakazeli lutho.

Uhlu lwezinhlelo ngayinye ne-DNS nakho kuyizimemezelo

I-Builder inakho kokubili i-addAllowedApplication ne-addDisallowedApplication, futhi azihambisani: ukushaya zombili kukhipha okuhlukile. Noma kunjalo uhlu lusetshenziswa kumsebenzisi ngamunye lapho kuhlelwa isixhumi, ngakho uhlelo lwephrofayela yomsebenzi lulawulwa umhubhe wephrofayela yomsebenzi hhayi owakho. Into engekho i-API eyinikezayo ukulawula isinqumo sohlelo olunye: awukwazi ukusunduza iphakethe kumhubhe wakho ngaphandle, futhi awukwazi ukuvala noma ukuhlela kabusha i-VPN esivele isebenza.

I-DNS ilandela iphethini efanayo. I-addDnsServer imemezela ikheli le-resolver; ayivumeli uhlelo lwakho ukuba liphendule imibuzo. Uma ufuna ukuxazulula amagama ngokwakho, sebenzisa i-resolver bese uqondisa ikheli layo kumhubhe. Izinhlelo ezisebenzisa i-DoT noma i-DoH kugama lesibambi elingaguquki zingadlula ikheli olimemezele, ngakho thatha ukuxazululwa kwamagama njengomzamo ongcono kakhulu ngaphandle uma ubamba nomzila wombuzo.

I-Manifest, i-always-on kanye nokuhlola okuyizinyathelo ezine

Ukufaneleka kumemezelwa ku-manifest: i-BIND_VPN_SERVICE, isihlungi se-intent se-android.net.VpnService kanye nensizakalo yangaphambili uma umhubhe kufanele uqhubeke ngemuva. I-always-on VPN idinga futhi i-onRevoke ehlanzekile, ngoba uhlelo luyibiza lapho umsebenzisi eshintsha izilungiselelo noma olunye uhlelo luthatha ulawulo.

Qhuba ukuhlola ngokulandelana futhi ume ekwehlulekeni kokuqala. Okokuqala, khipha uhlu lwamakheli, imizila ne-DNS olunikezwe i-builder. Okwesibili, qinisekisa ukuthi i-establish() ibuyisele isichazi nokuthi isokhethi yokuthutha ivikelekile. Okwesithathu, cela indawo eyodwa ngaphakathi kwesiqalo esifakiwe nenye ngaphakathi kwesiqalo esikhiyiwe. Okwesine, hlola ukuthi iyiphi i-resolver ephendule ngempela ngokubuza igama lesibambi elingaxazululwa kuphela i-resolver yakho.

Ukuxhawana okuqediwe akufakazeli noma yisiphi isinyathelo esilandelayo. Ukuhlola ngakunye kuhlukanisa ungqimba olulodwa, ngakho ukuphumelela esinyathelweni sesibili akusho lutho ngesesine.

Incwadi yereferensi ye-VpnService.Builder ibala yonke indawo ye-builder. Noma yini oyidingayo ngale kwalokho ingenye i-API, olunye uhlelo noma i-stack yakho yendawo yomsebenzisi, futhi leso yisinqumo somklamo hhayi iphutha lokuhlukanisa umhubhe.