Ukuthola i-VPN ku-Android: kungani i-tun0 ne-ping kuduka

Ukuhlola okusetshenziswa iningi lezinhlelo ze-Android ukuthola i-VPN igama le-interface, futhi akukaze kube ukuhlola kwe-VPN. Kubika ukuthi kukhona i-interface enomucu obelindelwe umthuthukisi, okusho i-OpenVPN kudivayisi eyodwa futhi kusho into engahlobene neze kwenye. I-ping iwubufakazi obufanayo: ifakaza ukuthi indawo eyodwa yaphendula, hhayi ukuthi umhubhe wathwala iphakethe. Lokho ipulatifomu ekuchaza ngempela iqoqo lamanehthiwekhi kanye nokuthuthwa okukumenyezelwa yiwo ngamunye, futhi lowo umbuzo ohlukile onesimpendulo ehlukile.

Inkolelo: uma i-tun0 ikhona, i-VPN ivuliwe

Izinhlelo ze-VPN ku-Android ziyizisekelo ze-VpnService ezidlulisela isistimu isichazi sefayela le-tun. Igama le-interface livela kulowo oyidalile: i-OpenVPN ngokuvamile yenza i-tun0, i-PPTP ne-L2TP zenza i-ppp0, i-WireGuard iqamba i-interface yayo ngomhubhe, futhi umhubhe we-IPsec kungenzeka ungabi nalo igama elivamile neze. Ngakho-ke ukufunda i-/proc/net/dev noma ukubala izinto ze-NetworkInterface kufuna umkhuba, hhayi iqiniso.

Izindlela zombili zamaphutha ziyaphila. Idivayisi ingaba ne-tun0 yomhubhe wasekhaya ongahlobene neze ne-VPN yomsebenzisi, futhi umhubhe we-WireGuard onempilo ephelele ungase ungabonakali ekuhloleni okwazi kuphela umucu we-tun0. Imiphumela yamanga evumayo neyephutha emsebenzini oyedwa iwenza ungasebenziseki njengokuxilonga, ngoba ithikithi lokusekela elithi «akukho VPN etholakele» alinakwethenjwa kunoma yiluphi uhlangothi.

Ukufinyelela nakho kuye kwancipha. Izinguqulo ezintsha ze-Android zikhawulela lokho uhlelo olujwayelekile olungakufunda ku-/proc, ngakho-ke ukuhlola okusekelwe egameni obekusebenza ku-Android 8 kungabuyisela uhlu olungenalutho kudivayisi yakamuva ngaphandle koshintsho lwekhodi. Uma ukuhlola kwehluleka buthule ngasohlangothini oluvulekile, uhlelo luphetha ngokuthi akukho VPN kuhadiwe lapho umhubhe ukhona kahle.

Inkolelo: i-ping ephumelelayo isho ukuthi umhubhe uthwala ithrafikhi

I-ping eya kuhosithi yangaphakathi iyaphumelela noma nini lapho kunomzila oya kuleyo hosithi. Ngomhubhe ohlukanisiwe, ihosithi ingafinyeleleka nge-Wi-Fi ngenkathi umhubhe uvuliwe futhi wenza into ehluke ngokuphelele. Nge-VPN yohlelo ngalunye, uhlelo olwenza i-ping lungase lukhishwe emhubheni, ngakho-ke i-echo ye-ICMP iphuma ngaphandle kwawo futhi ibuye, okufakaza okuphambene nalokho okucatshangwa ukuhlola.

I-ICMP ne-TCP nakho kuhluzwa ngokwehlukana. Umhubhe ovumela izicelo ze-echo kodwa owulahla umgudu we-TCP odingwa yisevisi uzodlula ukuhlolwa kwe-ping futhi wehluleke ohlelweni, futhi lokho kuwumthetho we-firewall ohlangothini olulandelayo, hhayi isici sedivayisi. Ukufunda okukodwa okuqotho kwe-ping ephumelelayo ukuthi le ndawo yaphendula kule protocol ngalesi sikhathi.

Lokho ipulatifomu ekubikayo ngempela

Kusukela ku-API 21, i-ConnectivityManager.getAllNetworks() ibuyisela yonke inethiwekhi eyaziwa isistimu, futhi i-getNetworkCapabilities(network) ibika ukuthi ley nethiwekhi ikumemezela ini. Inethiwekhi ye-VPN ithwala i-TRANSPORT_VPN. Ukuzulazula kuzo zonke izinethiwekhi kuphendula umbuzo owodwa: ingabe ikhona i-VPN evuliwe kule divayisi manje?

Umbuzo wesibili, omncane kakhulu udinga okunye ukushaywa. I-getActiveNetwork() ibuyisela inethiwekhi ezosetshenziswa ithrafikhi yohlelo manje, futhi ukuhlola ikhono elifanayo kuyo kuphendula: ingabe ithrafikhi yami izodlula nge-VPN? Kokubili kungase kungavumelani, futhi lokho kungavumelani kunolwazi. I-VPN evuliwe kodwa engeyona yamanje ikhomba ekuhlelweni komzila wohlelo ngalunye noma ekulungiselelweni komhubhe ohlukanisiwe, hhayi emhubheni ongekho.

Network active = cm.getActiveNetwork();
NetworkCapabilities caps = cm.getNetworkCapabilities(active);
boolean viaVpn = caps != null
    && caps.hasTransport(NetworkCapabilities.TRANSPORT_VPN);

Vikela kokubili ukushaywa. Amakhono angaba ngu-null enethiwekhi eyanyamalala phakathi kokubala nokubuza, futhi inethiwekhi esebenzayo ingaba ngu-null ngesikhathi sokudluliswa. I-NET_CAPABILITY_NOT_VPN iwusizo ngakolunye uhlangothi, ukuqinisekisa ukuthi inethiwekhi ayiwona neze umhubhe kunokuba ivele ingenalo ifulegi lokuthutha le-VPN.

I-NetworkInfo kwakuyinkolelo efanayo ene-API

I-ConnectivityManager.TYPE_VPN ne-NetworkInfo iyisizukulwane sesibili salokhu kuhlola, futhi isiphelelwe yisikhathi ngesizathu. Ezinguqulweni zesimanje into ebuyiselwa i-VPN ingaba ngu-null ngenkathi umhubhe uxhumekile, ngakho-ke ikhodi ethatha u-null njengokuthi «akukho VPN» ibika buthule iphutha elingelona iqiniso kumadivayisi lapho impendulo ibaluleke kakhulu.

Ngisho nokusalusa okuvamise ukuhamba nakho akukuhle. I-CONNECTIVITY_CHANGE inomlando obhaliwe wokweqiwa kwezinguquko ze-VPN, kufaka phakathi izinguqulo ezazicika kuphela lapho i-VPN ixhuma noma inqamuka esikhundleni salokho kuzo zonke izinguquko zenethiwekhi. Isilaleli esakhiwe kuyo sikhiqiza okuguquguqukayo kwesimo okusuka ekuboneni kwepulatifomu kuze kube ukuxhumana kabusha okuphelele okulandelayo.

Phendula kuma-callback esikhundleni sokuhlola njalo

Bhalisa i-NetworkRequest edinga i-TRANSPORT_VPN futhi esusa i-NET_CAPABILITY_NOT_VPN, bese ushayela i-registerNetworkCallback ngaleso sicelo. Khona-ke i-onAvailable ne-onLost zikutshela ukuthi isimemezelo sishintsha nini, futhi lowo umcimbi onendaba nawe ngempela. Susa ukubhaliswa kwe-callback lapho ingxenye ima, ngaphandle kwalokho uhlelo lugcina ireferensi yesikrini esifile futhi i-callback iqhubeka nokucika.

NetworkRequest req = new NetworkRequest.Builder()
    .addTransportType(NetworkCapabilities.TRANSPORT_VPN)
    .removeCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
    .build();
cm.registerNetworkCallback(req, callback);

Lokhu kudinga i-ACCESS_NETWORK_STATE, okuyimvume evamile: akukho root, akukho ingxoxo yemvume yomsebenzisi, akukho mvume ye-VPN. Ukuhlola ngesikhathi esimisiwe kuyindlela eyisipesheli abantu abayisebenzisayo, futhi kushisa ibhethri ngenkathi kusadlula ushintsho olufushane kunesikhawu, futhi yilowo ushintsho umsebenzisi akubikayo.

Lokho impendulo engakwazi ukukutshela kona

Awekho kula ma-API abika ukuthi umhubhe unempilo yini, uphela kusiphi iseva, noma ukuthi ithrafikhi yohlelo oluthile ingaphakathi kwawo yini. Inethiwekhi ye-VPN ingaba khona ngaphandle kwemizila esebenzisekayo, futhi umhubhe wohlelo ngalunye ungakhipha uhlelo olubuza umbuzo.

Ngakho-ke rekhoda lokho ukuhlola okukubonile, hhayi i-boolean kuphela. Rekhoda isihlonzi senethiwekhi, ukuthuthwa okumenyezelwe kanye nokuthi ley nethiwekhi ibisebenza yini. Umbiko othi «akukho VPN etholakele» awunamsebenzi, kuyilapho umbiko othi inethiwekhi ethile yamemezela i-TRANSPORT_VPN kodwa i-getActiveNetwork() yabuyisela i-Wi-Fi ukhomba ngqo ekuhlelweni komzila noma ohlwini lokukhishwa, futhi lokho kuyisilungiso umuntu angasebenza kuso.