I-VPN ku-Mac ixhunyiwe kodwa i-ip-up ayikaze igijime: qalisa ukugada kwe-launchd

Ufaka umyalo we-route ku-/etc/ppp/ip-up, uxhuma kabusha ithumbu lehhovisi, futhi ifayela alikaze ligijime. Akukho okungalungile kuskripti: lokho kuxhumana akudluli nge-PPP nhlobo. Amaklayenti akhelwe ngaphakathi e-Cisco IPSec ne-IKEv2 awawuqali neze u-pppd, ngakho ifolda yama-hook ayifundwa neze, kuyilapho i-PPTP ne-L2TP phezu kwe-IPSec zisadlula kuyo. Thola ukuthi yisiphi isimo sakho, bese uvusa leso esingeyona eye-PPP emsebenzini wokugada we-launchd.

Hlola i-interface ngaphambi kokuhlela noma iyiphi i-hook

Imiyalo emibili inquma ukuthi iyiphi indlela engasebenza. Bhala izinsizakalo ezihleliwe, bese ubhala ama-interface akhona ngesikhathi ithumbu livuliwe. Igama le-interface liwubufakazi; ilebula ku-System Settings akulona.

scutil --nc list
ifconfig -l | tr ' ' '\n' | grep -E '^(utun|ppp)[0-9]+$'

Insizakalo ekhiqiza i-ppp0 igijima ama-hook e-PPP futhi izogijima ifayela lakho. Insizakalo ye-Cisco IPSec noma ye-IKEv2 ikhiqiza idivayisi ye-utun esikhundleni salokho, i-interface yethumbu engenaso isigaba se-PPP, ngakho akukho lutho ngaphakathi kwe-/etc/ppp olungayifinyelela. Lapho kuhlanganisa zombili izinhlobo, hlola ukuthi uxhume kuyiphi insizakalo. Abantu bachitha intambama ku-hook engalungile ngokufunda igama leklayenti.

Endleleni ye-PPP ifayela kufanele libe ngelika-root futhi likwazi ukugijinywa, ngoba i-pppd ihlola kokubili ngaphambi kokugijima noma yini. I-install ibeka umnikazi nemodi ngisinyathelo esisodwa.

sudo install -o root -g wheel -m 0755 /dev/null /etc/ppp/ip-up
sudo ls -l /etc/ppp/ip-up

Ifayela elidalwe nge-Finder noma ngesihleli sezithombe ngokuvamile ligcina lingelakho i-akhawunti yakho, noma lingenaso isigamu sokugijima, bese lihluleka buthule njenge-hook elahlekile. Beka i-ip-down eceleni kwalo manje. I-root ne-wheel kukholomu yomnikazi kanye ne-rwxr-xr-x kukholomu yemodi yikho okukufunayo.

Vumela i-launchd ivuse iskripti lapho kuvela ithumbu

Kumaklayenti angalithinti neze ithumbu le-PPP, isivusi kufanele sivele kwenye indawo, futhi isitolo sokuhlela sohlelo siwumthombo othembekile: i-macOS iyibhala kabusha kukho konke ukushintsha kwethumbu. Umsebenzi we-launchd ogada leyo folda ubizwa lapho ithumbu livela noma linyamalala.

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  <key>WatchPaths</key>
  <array><string>/Library/Preferences/SystemConfiguration</string></array>
  <key>Label</key><string>net.example.tunnel-watch</string>
  <key>ProgramArguments</key>
  <array><string>/bin/sh</string><string>/usr/local/sbin/tunnel-hook</string></array>
  <key>RunAtLoad</key><true/>
  <key>ThrottleInterval</key><integer>20</integer>
</dict>
</plist>

Faka njenge-launch daemon, hhayi njenge-ejenti yomsebenzisi ngamunye, ngoba ukulungiswa kwemizila kungokwomshini. I-bootstrap ithatha indawo yefomu elidala le-load -w ezinguqulweni zamanje. I-RunAtLoad yenza ukugijima kokuqala kubonakale, futhi i-ThrottleInterval ivimbela igagasi lezinguquko zokuxhuma kwi-Wi-Fi ukuthi liqalise iskripti kaningi.

sudo install -o root -g wheel -m 0644 tunnel-watch.plist \
  /Library/LaunchDaemons/net.example.tunnel-watch.plist
sudo launchctl bootstrap system \
  /Library/LaunchDaemons/net.example.tunnel-watch.plist

Ugibe ukuthi ifolda egadiwe iyashintsha ngezehlakalo ezingenamhlangano ne-VPN yakho: ukuxhuma kwi-Wi-Fi, ukuvuselelwa kwe-DHCP, ikhebula elixhunyiwe. Umgadi ongezansi uguqula isivusi esinomsindo sibe i-hook elisebenzayo, futhi umugqa welogi uchaza umzila ngesikhathi esingajwayelekile.

Ubunikazi buhlanganisa i-plist kanye neskripti. I-daemon egijima ifayela efoldeni i-akhawunti yakho engabhala kuyo inika leyo akhawunti i-root.

Vikela iskripti ukuze ukugijima kwesibili kungashintshi lutho

Iskripti siqala ngokunquma ukuthi ithumbu likhona yini, bese siphuma buthule uma lingekho. Konke okulandela kufanele kuphephe ukuphindwa, ngoba isivusi sishaya kaningi kakhulu kunokuxhumana okukodwa. Xazulula i-interface ngesikhathi sokugijima esikhundleni sokubhala ngekhodi eqinile inkomba ezoqushuka ekuxhumaneni okulandelayo.

#!/bin/sh
set -u
TUN=$(ifconfig -l | tr ' ' '\n' | grep -m1 '^utun[0-9]' || true)
[ -n "$TUN" ] || exit 0
netstat -rn -f inet | grep -q '^10\.42' && exit 0
route -n add -net 10.42.0.0/16 -interface "$TUN"

I-route add iphuma nesimo esingesona uziro lapho umzila usuvele ukhona, ngakho iskripti ethatha sonke isimo esingesona uziro njengokwehluleka ibika i-hook ephukile njalo lapho yenza okulungile. Ukuhlola nge-netstat ngenhla kwenza leso simo sibe yi-no-op ecacile.

Ukuba khona kwe-interface ubufakazi obuthaka kunalokho okubonakala, ngoba amanye amaklayenti e-VPN nezinye izindawo zama-containers nazo zakha amadivayisi e-utun. Buza insizakalo ngokwayo nge-scutil --nc status "Office VPN" futhi ufune isimo esixhunyiwe ngaphambi kokuthinta umzila. Gcina impendulo emugqeni welogi, ngoba ngemuva kweviki elilodwa leyo rekhodi iyoba ukuphela kwencazelo onayo.

Buyisa isango ngaphandle kokuphula i-DNS

Lapho ithumbu lithatha umzila okuzenzakalelayo, ukuphequlula okuvamile kuphuma ngokwehhovisi futhi indlela yasendaweni ye-inthanethi iyeka ukusebenza. Qala ubambe i-router ye-interface yomzimba, bese uqondisa okuzenzakalelayo kuyo. I-DHCP iyedlula ukuhlaziya ithebula esivele linokweyayo okuzenzakalelayo kwethumbu.

PHYS=en0
GW=$(ipconfig getoption "$PHYS" router)
[ -n "$GW" ] && sudo route -n change default "$GW"

Izixazululi ziyisigaba esihlukile ngezinsiza ezihlukile, futhi ukulungisa umzila akuzilungisi. Bheka nge-scutil --dns ukuthi yini esebenzayo, bese ulungisa okukhiqizayo: ukulandelana kwezinsizakalo kanye namafaka we-DNS ensizakalweni yomzimba. Ukusula i-cache kuxilonga ukusesha okubambekile ngemuva kokushintsha kwenethiwekhi; akusiyo into okufanele ihlelwe.

Ithumbu elidlula ukushintsha kwe-Wi-Fi kodwa i-DNS ima yindawo yesithathu yephutha: i-sudo killall -HUP mDNSResponder yenza isixazululi sifunde kabusha ukuhlelwa kwaso. Yisebenzise kanye, ngesandla.

Fakazela ukuthi umsebenzi uzivusa wodwa

Phoqa ukugijima okukodwa nge-kickstart -k ngaphambi kokuthemba indlela yokugada, bese ufunda isimo sokuphuma esiqoshwe umsebenzi. Ukuphuma okuhlanzekile kufakazela ukuthi iskripti iyasebenza; akufakazeli ukuthi isivusi siyasebenza. Bese unqamula futhi uxhuma kabusha umsebenzi usulayishiwe, futhi ubheke ukugijima ongakucelanga.

sudo launchctl kickstart -k system/net.example.tunnel-watch
sudo launchctl print system/net.example.tunnel-watch | grep -E 'last exit code|state ='

Hlola i-scutil --nc status ngaphambi nangemuva komzamo ngamunye. Iskripti eyagijima ngesikhathi ithumbu liphansi ayifakazeli lutho ngendlela yokuxhumana.

Igatsha lokuhlakaza lifanelwe ukunakekelwa okufanayo negatsha lokuxhuma: susa umzila ngesandla, vumela umsebenzi ugijime, futhi uqinisekise ukuthi uyabuya. I-hook engeza umzila futhi engawususi neze ishiya umshini oziphatha kabi ngemuva kweviki elilodwa, kungabanga lutho oluxhumanisa lezi zehlakalo ezimbili. Lapho kokubili ukuziphatha kuma, i-sudo launchctl bootout system/net.example.tunnel-watch ihoxisa umsebenzi ngokuhlanzekile. I-daemon yokugada eshiywe ilayishiwe iyona ndlela okulungiswa kwesikhathi esisodwa okuba umzila ongachazwanga ezinyangeni eziyisithupha kamuva.