mDNS phezu kwe-WireGuard: izango ezintathu ngaphambi kokuba i-peer iphendule
I-Avahi idinga isixhumi esifanele, umzila oya eqenjini kanye ne-peer ephethe indawo okuyiwa kuyo. Izango ezintathu, ukuhlola okuthathu okuhlukene futhi akukho kusatshalaliswa.
Ukusetha ifulegi le-multicast kudivayisi ye-WireGuard kwenza isixhumi sifanele isofthiwe yokuthola, futhi yilokho kuphela okwenziwa yifulegi. Akutsheli iphrothokholi ukuthi iphakethe leqembu kufanele liye kuphi, futhi kudivayisi enama-peer amaningi akukho mpendulo eyodwa ecacile. Izango ezintathu ezihlukene zimi phakathi kwedaemon esebenzayo nesevisi etholiwe.
Zihlole ngokulandelana, ngoba ukudlula kwelinye akusho lutho ngelilandelayo.
Isango lokuqala: ifulegi kanye nenqubomgomo yedaemon
Idivayisi ye-Linux WireGuard yakhiwa njengoxhumano lwephuzu-kuya-ephuzwini ngaphandle kwe-ARP, futhi ngokuzenzakalela ayiphethe ifulegi le-multicast. Ukwengeza ifulegi wushintsho lwesixhumi lwasekhaya, olwenziwa yinoma yini ephethe idivayisi. I-Avahi inombono wayo womhlaba phezu kwalokhu, futhi inqubomgomo yayo ezenzakalelayo yeqa ngokuphelele izixhumi zephuzu-kuya-ephuzwini. Ngakho-ke kusebenza izivivinyo ezimbili ezizimele zokufaneleka ngaphambi kokuba iphakethe elilodwa linyakaze.
Ngakho-ke idaemon idinga isinqumo esicacile, hhayi inqubo esebenzayo kuphela. Izilawuli zayo ezibhalwe phansi zihlanganisa allow-interfaces, deny-interfaces kanye ne-allow-point-to-point, futhi eyokugcina isilungiselelo abantu abasigeji.
Ukuhlola okungezansi kubika amafulegi oxhumano, umzila we-multicast kanye nokuthi ingabe ukucushwa kwedaemon kuyahlaziywa nhlobo:
ip -d link show wg0
ip route get 224.0.0.251
avahi-daemon --checkIdaemon eqale ngempumelelo ayisho ukuthi ivule amasokhethi kusixhumi esibalulekile kuwe. Funda ukucushwa kwayo okusebenzayo esikhundleni sokucabanga ukuthi isimo sesevisi silingana nokufinyeleleka.
Isango lesibili: umzila oya eqenjini
Isango lesibili ukuhlela imizila okuvamile. Iphakethe elibhekiswe ku-224.0.0.251 lilandela ithebula lokudlulisela njengayo yonke enye into, futhi uma ithebula likukhipha ngokusebenzisa isixhumi esibonakalayo se-LAN, akukho kucushwa kwe-WireGuard okuzokushintsha lokho. Lungisa umzila kuqala bese ucwaningo olusele lufushane. Bheka lokho ikreneli elikubika ngekheli leqembu ngaphambi kokuthinta noma yiziphi izikhiye ze-peer.
| Observation | Gate it belongs to | What it does not prove |
|---|---|---|
Multicast flag present on wg0 | Interface eligibility | The daemon will use the interface |
Route to the group via wg0 | Forwarding | Any peer will receive it |
| Destination inside a peer's allowed list | Peer selection | That peer's network will answer |
Ngaphandle komzila othile, ikreneli libuyela ekuphatheni kwalo i-multicast yoxhumano, yingakho okuzenzakalelayo kubonakala kulungile ku-LAN eyisicaba futhi kungalungi ngaso sona sikhathi lapho uhambo lweqembu olufanayo kufanele luphume ngomhubhe. Ukwehluleka kuthule ngasohlangothini lomthumeli: umbuzo uya endaweni ethile, futhi impendulo ayifiki neze.
Isango lesithathu: i-WireGuard ikhetha i-peer eyodwa ngephakethe ngalinye
I-WireGuard ikhetha i-peer ephumayo ngokufuna indawo okuyiwa kuyo kumasethi amakheli avunyelwe, futhi indlela yokudlulisa ye-Linux yenza lokho kufuna kanye ngephakethe ngalinye. Umphumela munye, futhi iphakethe libethelwa leyo peer. Isiqalo seqembu esifanayo esivela ezindaweni ezivunyelwe zama-peer amaningi asidali ubulungu noma ukukopishwa; sidala ukufuna okungacacile okugcina kwenye yazo.
Kuxhumano olukhethekile oluneziphetho ezimbili lokhu kuyilokho okukufunayo ngqo, ngoba kunomamukeli oyedwa ohlosiwe wohambo lweqembu oluthwalwa ngamabomu. Kusixhumi esinama-peer amahlanu lokhu kuwumkhawulo, hhayi isici, futhi ukulungiswa kungokomklamo hhayi ukucushwa kwanoma iyiphi i-peer eyodwa.
Umklamo wokusabalalisa udinga i-relay ecacile, izixhumanisi ezihlukene noma indlela yokuthola ehluke ngokuphelele. Ukushicilela iresiphi yeziphetho ezimbili njengesixazululo samakhasimende amaningi ngenxa yokuthi ikhasimende ngalinye lingaphinga isango yindlela lokhu okusetshenziswa ngayo ngokungalungile.
Ukuqondiswa kokungena kuhlolwa ngendlela ehlukile: umthombo wephakethe elitholiwe kufanele uwele ngaphakathi kohlu oluvunyelwe lwe-peer eqinisekisiwe. Ukwengeza indawo okuyiwa kuyo ye-multicast lapho akuthathi indawo yobunikazi bangempela bomthombo womthumeli.
Ukubonakaliswa kuwumngcele, akulona ibhuloho
Isibonisi se-Avahi siphinde sidale imilayezo ye-mDNS phakathi kwezixhumi ezikhethile, esigabeni sohlelo lokusebenza. Kungumngcele wokuthola phakathi kwenethiwekhi, akulona ibhuloho le-Ethernet futhi akulona isihambisi se-multicast esijwayelekile. Izibonisi ezimbili ezixhunwe kunethiwekhi ezifanayo zizokwakha ngokujabula umjikelezo wezimemezelo eziphindwayo.
Ukubonakaliswa futhi kudlulisela amagama esevisi kanye nemethadatha yayo kwenye inethiwekhi, okuyisinqumo sobumfihlo njengoba kuyisinqumo sokuhlela imizila. Khawulela izixhumi ezikhethiwe, futhi usebenzise izihlungi zesevisi lapho inguqulo efakiwe izisekela khona, ukuze kuphela izimemezelo ezidingwa umsebenzisi ogunyaziwe ziwele umngcele.
Ukutholwa nokusetshenziswa kuhlala kuyimiphumela ehlukene. Iklayenti lingabona isimemezelo sesevisi okukuyo ikheli elicishiwe lingafinyeleleki kusuka lapho iklayenti likhona, noma isango layo lenqatshwa inqubomgomo yayo yokufinyelela. Qinisekisa ukuxhumana kwesevisi ngemva kokuvela kwesimemezelo, futhi uma uhlelo lokusebenza lusekela igama le-DNS elizinzile noma ikheli leseva elicacile, khetha lokho esikhundleni sokwandisa ukutholwa kwasekhaya koxhumano. Incazelo yokuhlela imizila ngokhiye wokubethela ihlanganisa ukukhethwa kwe-peer okusekelwe endaweni okuyiwa kuyo okuncike kukho konke lokhu.