I-domain fronting akusiyo i-VPN: amagama amabili, isicelo esisodwa
Amagama amabili esicelweni esisodwa se-HTTPS akuwona umhubhe. I-fronting incike emithethweni yomzila yomhlinzeki; i-VPN ikhetha ukuthi yimaphi amaphakethe ahambayo. Zidwebe ngokwahlukana.
Lezi zindlela ezimbili zifakwa ndawonye ngoba zombili zihilela umlamuli futhi zombili zizwakala njengokufihla. Kodwa zisebenza ezintweni ezihlukene. I-domain fronting imayelana nokuthi yiliphi igama elivela kuluphi ungqimba lwesicelo esisodwa se-HTTPS. I-VPN imayelana nokuthi yimaphi amaphakethe ahamba ngomzila othile aya kwelinye iqembu. Ukubiza i-fronting ngohlobo lwe-VPN kuholela emiklamweni engakwazi ukusebenza, nasekubuyekezweni okubuza umbuzo ongafanele.
Amagama amabili, izingqimba ezimbili
Ukuxhumana kwe-TLS kungathwala igama leseva ekubambeni ngesandla. Uma ukuxhumana sekukhona, isicelo se-HTTP sikhomba igunya esilifunayo, ngokuvamile kusihloko se-Host. Lawa amasimu amabili afundwa ngezikhathi ezimbili ezihlukene izingxenye ezimbili ezihlukene zesofthiwe.
| Layer | What carries the name | Who reads it |
|---|---|---|
| TLS handshake | Server name indication | The TLS terminator in front of the service |
| HTTP request | Authority or Host header | The routing layer that picks a backend |
| Network path | Destination address and port | Routers, and the VPN peer if one is in use |
I-domain fronting isebenzisa umehluko phakathi kwezimbili zokuqala ukuze insizakalo ye-fronting yamukele ukuxhumana bese iqondisa isicelo kwenye indawo. Isebenza kuphela lapho leyo nsizakalo izimisele ukuqondisa khona, futhi lokho kuwumbuzo wenqubomgomo yomhlinzeki hhayi iqhinga lephrothokholi.
I-fronting incike kumhlinzeki, hhayi kubuchwepheshe
Njengesibonelo esilinganiselwe, Imibuzo evamile nge-Front Door i-Azure ibhala izivikelo ze-domain fronting. Ichaza ukungafani okuvunyelwe kwamadomain ngaphakathi kokubhalisa okukodwa nemizila elungisiwe, kanye nempendulo engu-421 Misdirected Request lapho isivikelo sokungafani sivimba isicelo.
Leyo nqubomgomo eyodwa ebhaliwe iwisa zombili iziqubulo ngasikhathi sinye. Akuzona zonke izinhlanganisela zamagama ahlukene ezisebenzayo, futhi akukho ukungafani okunqatshelwe. Ezinye izinsizakalo zinezabo izihlolo, izidingo zazo zokusabalalisa kanye namakhodi azo amaphutha.
Futhi akusiwona umhlahlandlela wokudlula imikhawulo yolunye uxhoxho. Ukufunda imithetho yomzila yomhlinzeki ukuze uqonde lokho akuvumelayo kuwumsebenzi wokwakha; ukuthatha leyo mithetho njengendlela yokudlula kungomunye umsebenzi oneminye imiphumela. Gcina le misebenzi emibili ihlukene embhalweni oyibhalayo. Eyesibili iyona eyenza umklamo unqatshwe ekubuyekezweni.
I-VPN ikhetha ini ngempela
Ku-VPN yoxhoxho, umzila kanye nenqubomgomo yeplathifomu kukhetha ithrafikhi yangaphakathi yomhubhe oya kwelinye iqembu. Kuye ngokuhlelwa lokho kungahlanganisa izinhlelo ezimbalwa noma isethi encane echaziwe, futhi kungathwala amaphrothokholi angenaso neze isicelo se-HTTP.
I-fronting ayikwenzi lokho. Ukuhlela isicelo esisodwa se-HTTPS ngensizakalo ye-fronting akufaki umzila woxhoxho olusimeme, akuthwali izinhlelo ze-UDP ezingahleliwe, futhi akwenzi wonke uhlelo kudivayisi lisebenzise le nsizakalo. Uma udinga lokho kwembozo, udinga i-proxy noma umhubhe, hhayi iqhinga legama.
Yingakho lezi zimbili zididaniswa ekubuyekezweni: zombili zichazwa njengabalamuli, futhi zombili zivela emibhalweni emayelana nokufinyelela. Isixhumi esibonakalayo esinikezwa yilowo nalowo sihluke ngokuphelele, futhi kunye kuphela kuzo okuwumzila woxhoxho.
Ukubonakala akukona okubili
Ukuqhathanisa futhi akukona nje okufihliwe ngokumelene nokubonakalayo. Imibuzo ye-DNS, amakheli okuya kuwona, izici zokubamba ngesandla, usayizi wamaphakethe kanye nesikhathi kuhlala kubonakala kulowo osesimweni sokuzibona, futhi lokho umbonisi ayekufundayo kuncike lapho ehlezi khona.
Idatha yohlelo nayo ibonakala ezindaweni zokugcina eziyiqedayo. Insizakalo ye-fronting eqondisa isicelo sakho ingenye yalezo zindawo, futhi iqembu le-VPN ingenye. Akukho kwezi zihlelo okwenza okuqukethwe kube mnyama kulolo hlangothi okufanele kukufunde ukuze kukusize.
Dweba amabhokisi amathathu
Ukuze kube nokubuyekezwa kokwakhiwa, dweba indawo yokugcina ye-TLS, insizakalo yomzila we-HTTP kanye nohlelo lokugcina njengamabhokisi amathathu ahlukene, bese udweba noma iliphi iqembu le-VPN kwenye indawo futhi. Indawo ekhetha indawo yokuyisa kuyiwebhu kanye nendawo ethwala amaphakethe oxhoxho olusimeme akudingeki kube wuhlelo olulodwa, futhi ngokuvamile akulona.
Uma amabhokisi esehlukene, imibuzo iyaphenduleka: imaphi amagama avunyelwa yilo mhlinzeki, imiphi imithetho yokuxhumana edinga ukuthwalwa, futhi yiluphi uhlangothi olungabona ini. Umdwebo ohlanganisa konke ukhiqiza umklamo okungekho muntu ongawusebenzisa kanye nokubuyekezwa okuphikisana ngamagama.