I-HTTPS kukhonteyina ku-VPN yebhizinisi iyama? Hlola umlenze we-DTLS

Ngaphakathi kukhonteyina engemuva kwe-VPN yebhizinisi, i-DNS iyaxazululwa, ikhasi lokungena liyalayisha, iphoyinti lokugcina lezempilo liyaphendula, bese isicelo se-HTTPS siyama kuze kuphele isikhathi. Ukwakha kabusha isithombe nokushintsha okuguquguqukayo kwe-proxy akushintshi lutho, ngoba ingxenye ehlulekayo ayikho esithombeni. Iklayenti lizifakazela ngobufakazi kolunye uhlobo lokuthutha futhi lihambisa idatha enkulu kolunye, futhi eyesibili kuphela ephukile.

Izindlela zokuthutha ezimbili, uphawu olulodwa oludidayo

Iklayenti lebhizinisi elisekelwe ku-TLS ngokuvamile lizifakazela ngobufakazi ngoxhumano olujwayelekile lwe-TLS, bese lixoxisana ngesiteshi sesibili sedatha esisekelwe ku-UDP sesikhathi. Lapho lowo mlenze wesibili usebenza, ukudlula nokubambezeleka kuyathuthuka. Lapho kuhlungwa noma kungangeni endleleni, konke ngaphambi kokudluliswa okukhulu kuyaphumelela futhi ukudluliswa uqobo kuyama, okuyiphethini engenhla ngqo.

Ikhonteyina ayilushintshi loluxoxiswano; ishintsha indlela amaphakethe angaphandle ahamba ngayo. Umsingathi uhumusha ukugeleza kukhonteyina, ngakho ama-datagram e-UDP aphuma embobeni yomthombo ehlukile kune-socket yendawo yeklayenti, futhi abuya ngokungena kokuhumusha okuphelelwa yisikhathi ngesibali sesikhathi esifushane kakhulu kunokugeleza kwe-TCP okusunguliwe. Uma ithuneli lisebenza kumsingathi kodwa lehluleka kukhonteyina, qhathanisa leyo migelezo emibili ngaphambi kokusola uhlelo lokusebenza. Lokho kuqhathanisa kunquma okuningi kunanoma yikuphi ukwakhiwa kabusha kwesithombe.

Nquma ngokuhlola, hhayi ngomuzwa

Ukuhlola okushibhe kakhulu kuvala isiteshi sedatha se-UDP futhi kuphinda isicelo. Sebenzisa iklayenti lomugqa womyalo esikhundleni sokugoqa kwedesikithophu, ukuze ifulegi lisetshenziswe ngempela: openconnect vpn.example.net --user=you --interface=tun0 --no-dtls. Uma isicelo ebesiyima manje siqedwa, umlenze we-DTLS wawuyinkinga futhi okunye kwakumsindo.

Qinisekisa umphumela kuzo zombili izinhlangothi kusuka kukhonteyina elilodwa, isicelo esikhulu esisodwa sinefulegi nesinye singenalo. Ukushintsha kokuziphatha okulandela ifulegi kuwubufakazi; ikhasi eligcina lilayishile akusona ubufakazi.

Uma ifulegi likulungisa, nquma ukuthi kungani

Izimo ezintathu zikhiqiza uphawu olufanayo, futhi zidinga izimpendulo ezihlukile. Indlela ingase ihlunge i-UDP ngokuphelele, okwenza ifulegi libe impendulo yaphakade elungile yaleyo nethiwekhi. Indlela ingase ivumele i-UDP kodwa ilahle ama-datagram amakhulu, okukhomba ku-MTU hhayi ekuhlungeni. Noma indlela ingase ibe nokulahleka okwanele kangangokuthi umlenze we-UDP usebenze kabi kune-TCP, okuyisinqumo somthamo hhayi sokufinyeleleka.

Hlukanisa phakathi kwazo ngaphambi kokubhala isixazululo sesikhashana. Ukuhlunga kuhlala kunoma yibuphi ubukhulu bephakethe, izinkinga ze-MTU zivela kuphela ngaphezu komkhawulo, futhi ukulahleka kubonakala njengokuthumela kabusha nokubambezeleka okushintshayo hhayi njengokuma okumsulwa. Ukuhlola ngakunye kunciphisa imbangela ngaphandle kokushintsha ukulungiselelwa kweklayenti.

Hlola ubukhulu bephakethe ngaphambi kokugcina isixazululo sesikhashana

Uma ubukhulu buyimbangela, isixhumi sethuneli samukela amaphakethe indlela engakwazi ukuwathwala, futhi inkinga iyabuya kunoma yiluphi ukuthutha ngokushesha lapho umthwalo ukhula. Qhathanisa izixhumi: ip link show tun0 kumsingathi, bese docker network inspect bridge ukufunda i-MTU erekhodiwe kuzinketho zenethiwekhi. Ibhuloho lekhonteyina elisahleli ku-1500 byte ngaphansi kwethuneli elithwala okuncane ukutholakala okuvamile.

Phenya phezulu kusukela kubukhulu obaziwayo obuhle ngokuhlola kokuvinjwa kokuhlukaniswa ngaphakathi kwethuneli, bese wehlisa i-MTU yenethiwekhi yekhonteyina noma uqinise i-TCP MSS ethunelini. Noma yikuphi kwalokho kulungisa kuvame ukwenza indlela ye-UDP isebenziseke futhi kususe isidingo sefulegi, okuwumphumela ongcono lapho ukuhlunga kungeyona imbangela.

Nquma ukuthi yini ozimisele ukuyishintsha

Uma isiteshi sedatha sivaliwe, ithuneli lithwala umthwalo walo ngaphakathi koxhumano lwe-TCP. Endleleni ehlanzekile lokho kumane kube kancane; kweyokulahleka, ingxenye eyodwa elahlekile ibambezela konke okusemuva kwayo futhi ukuthumela kabusha kwangaphandle kuncintisana nokwangaphakathi. Lokho kushintshana kufanele ukuthuthukiswa okusebenzisanayo nezingcingo ezincane ze-API, futhi akufanele ukudluliswa okukhulu noma izikhathi ezinde ezixhumweni zamaselula.

Noma yikuphi ukukhetha okukhethayo, rekhoda ukuthi ithuneli lagcina lisebenzisa luphi uhlobo lokuthutha nokuthi kungani. Ikhonteyina elithembele ngokuthula efulegini umuntu alengeze ezinyangeni ezedlule yiphutha elilandelayo, futhi ozolilungisa ngeke azi ukuthi ifulegi laliyisixazululo sesikhashana sokuhlunga noma insalela yokuhlola kwe-MTU.