I-conntrack NEW kupakethe we-ACK: lokho okungakufakazeli

Kusichibiyelo somlilo kukhona umugqa owawungalindele: ipakethe ye-ACK, isimo se-conntrack esingu-NEW, ikheli lomthombo okungewona elakho, imbobo yendawo ephokophelwe ivuliwe. Isilingo ukukufunda njengokuxhumana okusha okungena kungekho muntu okugunyazile. Okushiwo yilowo mugqa ngempela kuncane kakhulu: ngesikhathi leyo pakethe ifika kule hook, umlandeli wayengenaso isimo esifanayo, futhi ipakethe yayithwele i-ACK. Lawa ngamaqiniso amabili ngazinto ezimbili ezahlukene, futhi akukho nanye yawo okuwumbhalo ophelele wokuxhawana izandla. Lona uhlelo engilulandela ngaphambi kokufika esiphethweni.

Qala ngepakethe, hhayi ngesigwebo

Hlukanisa imibono ngaphambi kokuyihumusha. Amafulegi e-TCP achaza le pakethe, isimo somlandeli sichaza lokho ayekwazi kulelo hook, futhi ukubamba kwakho kuchaza kuphela iwindi olirekhodile.

Ukuhlanganisa lezo zintathu yiyo indlela i-ACK eyiba ngayo “umhlinzeki uvumele umuntu ukungena”.

I-NEW isho ukuthini ngempela kule hook

ukufaniswa kwe-conntrack ku-iptables kubhala i-NEW njengepakethe eqala ukuxhumana, noma leyo ehlobene nokuxhumana okungakaboni thrafikhi ezinhlangothini zombili. I-ESTABLISHED isho ukuthi umlandeli ubonile amapakethe ezinhlangothini zombili. Akukho ncazelo ethi ipakethe yayiyi-SYN, noma ukuthi yafika ingenalo umlando.

Umlandeli oqala ukubuka ukugeleza phakathi nendawo uhlukanisa ipakethe elilandelayo ngokolokho akwaziyo, futhi lokho kungase kube lutho. Lokho kuyisitatimende ngememori yomlandeli, hhayi ngenhloso yomsingathi okude.

Ukulandelela okuxegayo kuchaza iningi lezimanga ze-ACK

I-kernel ibhala nf_conntrack_tcp_loose, okuvumela umlandeli ukuthi athathe ukuxhumana kwe-TCP angakubonanga ukuqala kwako. Uma isilungiselelo sisemgqeni waso wokuzenzakalela, i-ACK evela phakathi nendawo ingamukelwa njengokugeleza osekumisiwe. Yivala, futhi ipakethe efanayo izohlukaniswa njenge-INVALID esikhundleni se-NEW. Yomibili imiphumela ichaza imithetho yomlandeli, hhayi umlando wohlelo.

Ngakho hlola leso silungiselelo ngaphambi kokwakha ithiyori phezu kwelebula.

Susa izimbangela eziyisicefe ngokulandelana lokhu

Iningi lezigameko ze-NEW-kwi-ACK engizilandele zagcina kwesinye salezi, futhi zonke zishibhile ukuzihlola:

• Ithebula le-conntrack lakhishwa, noma umlandeli waqalwa kabusha.
• Umsingathi waqalwa kabusha, noma ukugeleza kwathuthela kwenye i-namespace noma idivayisi.
• Ukuhamba kwendlela okungalingani kwakhipha i-SYN ngendlela ongayibambiyo.
• I-NAT yabhala kabusha i-tuple, ngakho umbhalo awusafani nalokho okukufundile.
• Ukubamba kwaqala sekwedlule isikhathi futhi akukaze kubone ukuqala.

Ngayinye yalezi isusa amapakethe angaphambili ekuboneni komlandeli futhi ishiya akuphambili kungashayiwe. Ukuqalwa kabusha noma ukukhishwa kwethebula kungaqinisekiswa kalula kusukela ku-uptime nakumalogi. Ukuhamba kwendlela okungalingani kubonakala njengokubamba kwendlela eyodwa. I-NAT iyikhohlisi, ngoba i-tuple umlandeli ayigcinile akuyona i-tuple ephrintwe kulogi.

Bhala ukuthi yikuphi kulokhu okukususile, nokuthi kanjani, ngaphambi kokuqhubeka.

Funda i-tuple, i-interface kanye ne-hook

Umbhalo we-conntrack wenziwa isihluthulelo ngamakheli, amachweba kanye nephrothokholi, ngakho noma yikuphi ukuhumusha kushintsha ukuthi imuphi umbhalo ofanayo. Bhala ne-interface ne-hook, ngoba ipakethe elibonakala ku-interface engalungile noma ngemva komunye uchungechunge litshela ukuthi indlela ayiyona leyo esemdwebeni. Uma isigameko sihilela i-VPN, ncika ukuthi ubheka ipakethe langaphakathi noma umthwali wangaphandle. Bese uqhathanisa nalokho okubhalwe i-gedi ngenkathi ye-tuple yezingxenye ezinhlanu efanayo.

Imibono emibili yokugeleza okukodwa engavumelani inolwazi oluningi kunanoma yimuphi kwayo uwedwa.

Kunini lapho kufanele kukhushulwe

Khukhula uma ungakhombisa insiza efinyelelekayo futhi okungafanele ibe njalo, kanye nokugeleza, inqubomgomo eyivumelayo kanye nobufakazi obuvela ezinhlangothini zombili. Ungabiki ukukhubazeka komhlinzeki ngokusekelwe kwilebula eyodwa yesimo noma ekubambeni okwengxenye okukodwa, ngoba lowo mbiko uzovalwa ngale ncazelo osanda kuyifunda. Uma insiza ivulekile ngempela, umnikazi walowo mkhawulo uyena umuntu ofanele ukuyilungisa, futhi imephu yamachweba edlulisiwe noma umlaleli ongahlosiwe kuyimbangela enokwenzeka kakhulu kunephutha.

Bese uvale igebe lokubonakala elavumela ipakethe elilodwa ukuthi libonakale njengesikhathi esiphelele.