Indlela yokukhipha isub-nethi kuthumbu le-VPN ye-Android

I-VpnService ye-Android ayinawo umzila wokukhipha, futhi asikho isilinganiso sokufunda i-API esizokwakha owodwa. Builder.addRoute() ihlala yengeza izindawo kuphela kuthumbu, ngakho ukugcina ingxenye ye-LAN yendawo kusho ukuthi leyo ngxenye ayisoze ingene ohlwini lwemizila. Lokho okwengezayo esikhundleni salokho yisiphelelisi sengxenye, esivezwe ngamaprefikhi avamile. Umsebenzi wukubala, futhi wehluleka ezindaweni ezimbalwa ezingabikezelwa.

Hamba ngezihlolo ezingezansi ngokulandelana. Ngayinye icabanga ukuthi eyandulelayo yama, ngakho ma ekhukhuleni lokwehluleka kokuqala esikhundleni sokulungisa izimpawu ngezansi.

Qala ngalokho okushiwo yithumbu

Ukudlulisa i-0.0.0.0/0 ku-addRoute() kutshela i-Android ukuthi yonke indawo ye-IPv4 ingeyethumbu. Yingakho amaklayenti amaningi ebonakala engakwazi ukwenza ithumbu elihlukanisiwe: afuna yonke indawo yamakheli bese ezama ukukhipha kuyo. Akukho lutho olukhiphayo kumakhi. Umzila oqondile kakhulu wenethiwekhi obufuna ukuyigcina yendawo wenza okuphambene nalokho abantu abakulindele, ngoba iprefikhi ende kakhulu efanayo iyawina futhi leyo nethiwekhi ingena ngaphakathi kuthumbu.

Uhlu lwemizila yiyo yonke inqubomgomo. Akukho veto yendawo ngayinye ngemuva kwayo, futhi isithenjwa se-Builder asikho isu elisikhombayo elinganikeza eyodwa.

Khiqiza isiphelelisi kusukela ekubaleni kwamaprefikhi

Isiphelelisi seprefikhi ekhishiwe iqoqo labafowabo basendleleni eya empandeni yesihlahla samakheli. Kubude ngakunye kusukela ku-1 kuye kobude obukhiwe, thatha ibhlokhi yalobo bude equkethe iprefikhi yakho, phendula ibhithi engaphansi kweprefikhi, bese ukhipha umphumela. Kuzwakala kungaqondakali kuze kube uyisebenzisa.

Ukukhipha i-10.0.0.0/8 kunikeza imizila eyisishiyagalombili: 128.0.0.0/1, 64.0.0.0/2, 32.0.0.0/3, 16.0.0.0/4, 0.0.0.0/5, 12.0.0.0/6, 8.0.0.0/7, 11.0.0.0/8. Akukho kuyo equkethe i-10.0.0.0/8, futhi ndawonye ihlanganisa konke okunye.

Imigqa eyisishiyagalombili yakha lolo hlu kunoma iyiphi iprefikhi:

import ipaddress
def complement(addr, length):
    base = int(ipaddress.IPv4Address(addr))
    out = []
    for k in range(1, length + 1):
        block = base & (0xFFFFFFFF << (32 - k))
        sibling = block ^ (1 << (32 - k))
        out.append(f"{ipaddress.IPv4Address(sibling)}/{k}")
    return out
print(complement("10.0.0.0", 8))

Inani lemizila lilingana nobude beprefikhi, futhi yilokho okufanele ugade. Ukukhipha okukodwa kwe-/21 kubiza imizila engu-21 futhi kuhlala kufundeka. Ukukhipha okuyishumi kungabiza amakhulu ambalwa, okungukuthi ngokuvamile ukuthi umklamo wenethiwekhi udinga ukushintshwa, hhayi umkhiqizi.

Hlola umndeni wamakheli kanye nobukhulu bethumbu

Imizila ye-IPv4 ayenzi lutho ku-IPv6. Uma ithumbu lifuna ikheli le-IPv6, iprefikhi ye-LAN ye-IPv6 idinga isiphelelisi sayo, esikhiqizwe ngokubala okufanayo phezu kwe-128 amabhithi. Isizathu esivamile sokuthi ukukhipha kusebenze ephepheni kanti idivayisi yendawo ihlala ingafinyeleleki yilesi: kubhekwe isiphathi ngokusebenzisa i-IPv6, futhi i-IPv4 kuphela eyayisikiwe. Hlola yomibili imindeni ngaphambi kokuphetha ngokuthi izibalo azilungile.

Ubukhulu buwuhhafu wesibili wokuhlola. I-Android ilandelela ukuhlelwa kwemizila ngenethiwekhi nangohlelo ngakunye, ngakho iprefikhi efanayo ingadlula ethumbeni kuhlelo olulodwa futhi iqonde kwelinye ngokuxhomekeke ekutheni i-VPN yamenyezelwa kanjani.

Beka imithetho ye-DNS neyehlelo ngakunye endaweni efanele

Ukukhipha imizila akukushintshi isixazululi. Igama lesiphathi sendawo lingasaphendulwa iseva ye-DNS yethumbu ngenkathi ikheli laso lihlelwa endaweni, futhi ukungafani kubonakala njengegama elixazulula entweni i-LAN engakwazi ukuyifinyelela. Beka inqubomgomo yesixazululi ngamabomu, ngesizinda sokusesha noma umthetho we-DNS ohlukanisiwe. Ungacabangi ukuthi imizila inqume lokho esikhundleni sakho.

addDisallowedApplication() igcina uhlelo olulodwa ngaphandle kwayo ithumbu; ayigcini indawo ngaphandle kwezinhlelo ezisala ngaphakathi. I-protect() ivumela isokhethi oyivulayo ukuba yeqe ithumbu, futhi kanjalo ithumbu ligwema ukubamba ukuthutha kwalo. Akukho kukho kokubili okuthatha indawo yesiphelelisi.

Qinisekisa ngokusesha, hhayi ngohlu lwakho

Uma ithumbu selimi, buza idivayisi ukuthi ikheli liya ngempela kuphi esikhundleni sokufunda kabusha uhlu olwakhe. Kubakho kwe-iproute2, i-adb shell ip route get 10.1.2.3 ibalula isixhumanisi esikhethwe i-kerneli. Sebenzisa umyalo ofanayo kukheli lomphakathi bese uqinisekisa ukuthi ibalula ithumbu.

Ezinye izihlolo ezimbili zivala umjikelezo. Xazulula igama lendawo kuqala, bese usebenzisa i-adb shell ip route get kukheli elixazululiwe futhi ufune isixhumanisi okungewona ithumbu, ngoba i-adb shell ping -c 1 host.lan ephumelelayo ifakazela ukufinyeleleka hhayi indlela. Phinda ukuhlola komndeni wamakheli ku-IPv6 uma ithumbu lifuna elilodwa. Hlola ezingeni le-API olithumelayo, ngoba indlela amanethiwekhi e-VPN avezwa ngayo etafuleni lokuhlela imizila ishintshile phakathi kwezinhlelo. Uhlu lwemizila olubonakala lulungile ephepheni nokusesha okukhetha isixhumanisi esingalungile kungamaphutha ahlukene, futhi okwesibili kuphela okufinyelela kubasebenzisi.

Uma uhlu lokukhipha luqhubeka lukhula, yeka ukukhiqiza imizila bese uphinda unombola inethiwekhi ekude noma nciphisa ithumbu esikhundleni salokho. Umkhiqizi uyisu elizungeza i-API engekho, hhayi ithuluzi lokuklama.