I-openconnect ebulewe: imizila ne-DNS kusabhekisa emhubheni

Umhubhe uvaliwe, kodwa umshini usaziphatha sengathi uvuliwe: ukufuna kuhlala kulindile kuze kuphele isikhathi, futhi umzila ukhomba ku-interface engasekho. Lona wuphawu lwenqubo ye-openconnect eyafa ngaphandle kokusebenzisa umsizi wayo wokunqamula. Isimo senethiwekhi eyasidalayo sisafakiwe, futhi akukho okunye ohlelweni olwazi ukuthi singasuswa kanjani.

Hamba emshinini ngokulandelana okwakhiwe ngakho isimo: inqubo, isixhumanisi, umzila, i-resolver. Isinyathelo ngasinye sikutshela ukuthi iklayenti lihambile ngempela noma lihlukaniswe netheminali yakho kuphela, futhi lowo mehluko unquma ukuthi kukhona yini okufanele kulungiswe.

Qala ngenqubo, hhayi ngokulungiselelwa

Vula itheminali futhi ubuze ukuthi yini esasebenza ngaphambi kokuthinta umzila. pgrep -a openconnect kubala yonke insiza nemibandela yayo, okubonisa ifayela le-pid neskripthi esanikezwa. Inqubo obungayilindelanga ichaza umhubhe womoya ngokushesha kunanoma yiliphi ilogi.

Uma kungasebenzi lutho, bheka isixhumanisi. ip link show tun0 kutshela ukuthi i-interface yasinda yini, futhi ip route show dev tun0 kubala imizila esaboshelwe kuyo. Bese uhlola i-resolver nge resolvectl status. Bhala yonke imiphumela emithathu ngaphambi kokuyishintsha, ngoba lowo mbhalo yiwo oyindlela yokuhlukanisa kamuva umbhalo omdala kowusha.

I-interface enyamalalayo ivamise ukuhamba nemizila yayo. Imizila esinda ngemva kwesixhumanisi ivamise ukusho ukuthi inqubo isaphila noma iklayenti lesibili liphethe idivayisi.

Isiskripthi somsizi siyona esibuyisela izinguquko

I-openconnect ayisusi ngokwayo i-interface, imizila noma imibhalo ye-resolver. Ibiza umsizi wangaphandle, /etc/vpnc/vpnc-script ku-build ye-upstream futhi /usr/share/vpnc-scripts/vpnc-script kumaphakethe e-Debian ne-Ubuntu, ikhethwa nge -s. Isiskripthi esifanayo esakha umhubhe yisona esiwudilizayo.

Uma inqubo iphuma ngaphandle kokubiza lowo msizi, isimo sihlala sikhona. incwadi ye-OpenConnect isho ngokusobala ukuthi ukuhambisa nesevisi yamagama ngeke kusebenze kahle ngaphandle kweskripthi, futhi ichaza umsizi njengengxenye ediliza isimo se-interface lapho kuphuma. Yingakho indlela ibalulekile uma uqalisa iklayenti nge -s.

Iyiphi isignalo efinyelela leyo ndlela yashintsha phakathi kwezinguqulo. Incwadi ye-7.06 ithatha i-SIGTERM njengokuphuma ngokushesha okweqa isiskripthi. Ama-build amanje abhala i-INT ne-TERM njengokuma okuhlanzekile, lapho iseshini iphuma khona futhi umsizi uyasebenza. Funda isigaba se-SIGNALS se-binary onayo ngempela esikhundleni sokucabanga okunye kwalokhu kuziphatha okubili.

man openconnect | sed -n '/^SIGNALS/,/^LIMITATIONS/p'

Thumela isignalo esibhalwe yi-build yakho

Uma usazi isignalo, misa inqubo nge-pid hhayi ngephethini.

pgrep -a openconnect
sudo kill -INT "$(cat /var/run/openconnect.pid)"

Bese uphinda izinto ezintathu zokuhlola zesigaba sokuqala esikhundleni sokuthemba isimo sokuphuma. ip link show tun0 kufanele kwehluleke, ip route show dev tun0 akufanele kushicilele lutho, futhi resolvectl status akufanele kusabala isixhumanisi se-VPN.

I-SIGHUP ayisona isigqoko sokumisa: iyanqamula, isebenzisa isiskripthi futhi ishiya iseshini ingaqhubeka nge --cookie. I-SIGUSR2 iphoqa ukuxhumana kabusha ngokushesha. I-SIGKILL yeqa ngokuphelele ukuhlanza, futhi yiso leso simo umbhalo lo okhuluma ngaso.

Lungisa i-resolver ngaphandle kokushintsha i-resolv.conf

Kumaphakethe amaningi e-Ubuntu /etc/resolv.conf isixhumanisi sokulingisa esiya ku-systemd-resolved, hhayi ifayela okufanele ulihlele. Ukulishintsha kwephula ukuxazululwa kwamagama kunoma iyiphi inethiwekhi, hhayi i-VPN kuphela. Esikhundleni salokho, susa ukubhaliswa komhubhe:

resolvectl revert tun0
resolvectl query example.com

Uma uhlelo lusebenzisa i-resolvconf esikhundleni se-systemd-resolved, umbhalo we-interface ngayinye uhlala ukhona kuze kube yilapho utshelwa ukuthi uyeke isixhumanisi, futhi resolvconf -d tun0 isenzo esilinganayo. Hlola ukuthi iyiphi i-resolver esetshenziswayo ngaphambi kokukhetha umyalo.

Ukufuna okusabhekise kuseva engemva kwesixhumanisi esifile kuhlala kulindile kuze kuphele isikhathi, futhi lokho kubambezeleka kubonakala njengeseva ye-DNS ephukile hhayi njengomzila osele.

Yenza ukunqamula okulandelayo kube nesithukuthezi

Gcina indlela yefayela le-pid ifana ekuqaleni nasekuvaleni ngokunikeza --pid-file njalo, noma sebenzisa i-openconnect ngaphansi kwe-unit okungu KillSignal ohambisana nesignalo ebhalwe yinguqulo yakho. Ukuhlola kuqala phambili kukubonisa imiyalezo yokuvala eshicilelwa umsizi.

Xhuma, nqamula futhi usebenzise izinto ezintathu zokuhlola kanye. Ukuphuma okuhlanzekile akushiyi sixhumanisi se-VPN, umzila we-VPN noma umbhalo we-resolver we-VPN. Uma eyodwa kwezintathu isinda, manje usuyazi ukuthi iyiphi ingxenye ehlulekile ukuhlanza. Uphenyo olulandelayo lube seluqala kuleyo mpendulo hhayi ekufuneni okulindile.