I-nftables cgroup bypass idinga nokulungiswa kwekheli lomthombo

Ukumaka i-cgroup eyodwa kuyithumela kwelinye ithebula, futhi isokhethi igcina ikheli ebelivele linayo. Ukuhlukanisa, ukuhambisa nokuhumusha njengezinyathelo ezintathu ezihlukene.

Ukumaka ithrafikhi evela ku-cgroup eyodwa ingxenye elula. Izinqumo ezintathu ezihlukene kufanele zivumelane ngaphambi kokuba uhlelo olulodwa luphume ngesixhumi esibonakalayo somzimba kuyilapho konke okunye kusala kuthaneli: iyiphi isokhethi eyesikhathi esisodwa, ukusesha komzila okuyikuphi okubangelwa uphawu, nokuthi ikheli lomthombo eliphi iphakethe elilithwalayo lapho liphuma. Iningi lemizamo ehlulekayo yenza eyokuqala kahle, eyokuphakathi ingxenye, futhi ayilokothi ibheke eyesithathu.

Izinqumo ezintathu, hhayi esisodwa

Ukuhlukanisa kuphendula ukuthi ubani okhululiwe. Ukuhambisa kuphendula ukuthi iphakethe elimakwe liya kuphi esikhundleni salokho. Ukukhetha umthombo kuphendula ukuthi uhlangothi olude luzobona ini nokuthi impendulo kufanele ibuyele kuphi.

Lokhu kwehluleka ngokuzimela. Iphakethe lingahlukaniswa, liphinde liqondiswe kusixhumi somzimba, futhi lisathwala ikheli langasese okungekho isiphathi-mzila esiphezulu esingalibuyisela, okukhiqiza isikhathi sokuphela esibonakala sifana ncamashi nokuvinjwa kwe-firewall. Akukho lutho esinyathelweni sokuhlukanisa okukuxwayisayo ngalokho. Akukho lutho esinyathelweni sokuhambisa futhi.

Ukulandelana nakho kubalulekile. Ukuhlukanisa kwenzeka lapho iphakethe lenziwa, ukuhambisa kwenzeka ngemva kwalokho, nokuhumusha kwenzeka endaweni yokuphuma.

Uma ungakwazi ukusho ukuthi yisiphi isigaba sokuthathu esiphukile, awuxazululi, uhlela kabusha imithetho futhi unethemba.

Qondanisa i-cgroup ezoba khona nakusasa

I-nftables ingahlola ubulungu be-cgroup v2 besokhethi, okusiza ngempela ngoba ilandela inqubo hhayi indawo eya kuyo. Umcu wukuhlonza. Uhlelo lwedeskithophu oluqalwa kumenyu luvame ukuhlala ku-scope yesikhashana egama layo lishintsha ekuqalweni okulandelayo.

nft list ruleset
systemctl status session.slice 2>/dev/null
cat /proc/self/cgroup

Ukukopisha igama le-scope kusuka kuseshini eyodwa nokulibhala ngokuqinile kukhiqiza umthetho osebenza namuhla futhi uthule uyeke ukuqondana kusasa. Esikhundleni salokho beka uhlelo endaweni yokusebenza ezinzile neyenzelwe, njenge-scope noma i-unit ekhethekile oyilawulayo, bese uqondanisa nayo. Umthetho ke uyasinda ekuqalweni kabusha nasekubuyekezweni kwamaphakethe. Uba yinto futhi umuntu angacabanga ngayo ngaphandle komlando weseshini yakho.

Yiba futhi unemba mayelana nendlela oyisebenzisayo. Ukuhlukanisa kwe-net_cls kwe-cgroup v1 nokuqondanisa kwesokhethi kwe-cgroup v2 kuyizinto ezihlukene, futhi inkambu enegama elifanayo emibhalweni ayizenzi zishintshana.

Uchungechunge lwe-route yilona olubanga ukusesha kwesibili

Kuthrafikhi ekhiqizwa endaweni, uhlobo lochungechunge lunquma ukuthi kukhona okwenzekayo ngemva kokubekwa kophawu. Uchungechunge lwe-output lohlobo lwe-filter lungamaka iphakethe futhi i-kernel izoqhubeka isebenzisa umzila esiwukhethile kakade. Uchungechunge lohlobo lwe-route yindlela ecela ukusesha okusha.

table inet bypass {
  chain mark {
    type route hook output priority mangle; policy accept;
    socket cgroupv2 level 2 "app.slice" meta mark set 0x1 comment "app bypass"
  }
}
ip rule add fwmark 0x1 lookup 200
ip route add default via 203.0.113.1 dev wlan0 table 200

Uphawu ke ludinga umthetho wenqubomgomo oluthumela kwithebula, futhi lelo thebula kufanele liphelele: umzila ozenzakalelayo, izindawo zasendaweni uhlelo olusazidingayo, nesango eliphezulu eliphendula ngempela.

Khetha inani lophawu ngamabomu. I-WireGuard isebenzisa i-fwmark yayo kuthrafikhi yokuthutha yangaphandle, futhi ukuhla ngenhlamvu kunombolo efanayo kungaphazamisa ukukhululwa komzila kwithaneli ngale ndlela okunzima ukuyixilonga.

Ikheli lomthombo alilandeli umzila

Isokhethi esivele lakhetha ikheli lomthombo lomzila wethaneli liyawugcina lowo mzila ngemva kokuqondiswa kabusha. Akukho lutho ekushintsheni komzila okubhala kabusha, yingakho iphakethe liphuma ngesixhumi somzimba linomthombo wangasese ongenakubuyiselwa inethiwekhi ephezulu.

Uphawu olubonakalayo wuhlelo olubonakala luthumela idatha futhi lungalokothi luthole impendulo, kanye nelogi ye-firewall engabonisi lutho ngoba iphakethe alibuyanga neze.

Ukulungiswa okuncane wumthetho wokuhumusha umthombo obekelwe umkhawulo kuphawu lwalolo hlelo kanye nesixhumi salo sangempela sokuphuma, ohlanganiswe ne-NAT ekhona kakade esikhundleni sokuyishintsha:

table inet bypass {
  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;
    meta mark 0x1 oifname "wlan0" masquerade
  }
}

Humusha kuphela ukukhululwa futhi akukho okunye. Umthetho we-masquerade ojwayelekile ulungisa uphawu futhi ucekela phansi ikhono lokusho ukuthi iyiphi ithrafikhi eyathatha umzila upi. Qondanisa uphawu, isixhumi sangempela sokuphuma futhi, uma ukwazi, ikheli lohlelo uqobo. Imithetho ebanzi kulula ukuyibhala futhi cishe ayikwazeki ukuyihlola kamuva.

Okusaphunyuka ekukhululweni

Ukuxazululwa kwamagama kungavela kunqubo ye-resolver ehlukile kwenye i-cgroup, ngakho ukuhlukanisa isokhethi yesiphequluli akukuhlukanisi ukusesha kwaso. Uma imibuzo ye-resolver ihlala kuthaneli kuyilapho uxhumano luphuma ngaphandle kwalo, izimpendulo ze-split-horizon zingase zingavumelani nomzila. Lokho kungavumelani kukhiqiza ukwehluleka okubonakala njengamaphutha e-DNS kodwa okungewona.

Izinqubo zezingane zithola i-cgroup njengefa kuzilungiselelo eziningi, kodwa umsizi ozihambisela ku-scope yakhe awuyitholi. Hlola esikhundleni sokucabanga, ikakhulukazi kunoma yini ezisebenzisa kabusha.

Ekugcineni, nciphisa ukuthi kufanele kwenzeke ini lapho ithaneli liphansi. Ukukhululwa okuba i-bypass ephelele ngokuthula kuyisimo sokuphepha esihlukile kuleso esivala lapho kwehluleka, futhi kukodwa kuphela kwazo okwakuyilokho obukade ukusho.

Izihloko ezihlobene