NET_ADMIN kusikhwama se-VPN: yini futhi kuphi engayishintsha

Leli khono livumela izinguquko kuma-interface, emizileni nasocingo lomlilo ngaphakathi kwendawo eyodwa yamagama enethiwekhi. Ngokuxhumana kwenethiwekhi yomsingathi, leyo ndawo iyisitaki somsethi uqobo.

NET_ADMIN yikhono le-Linux elivumela inqubo ukuthi yenze ukuphathwa kwenethiwekhi, futhi kusikhwama kusebenza ngqo lokho ngaphakathi kwendawo yamagama enethiwekhi lapho inqubo isebenza khona. Akusona imvume yokuvula isokhethi, futhi akusona esikhundleni sedivayisi noma umzila. Umbuzo othakazelisayo awukaze ube ukuthi ikhono linikeziwe yini, kodwa ukuthi iyiphi indawo yamagama ethola ushintsho.

Ikhono lihlanganisa ini

Ngaphakathi kwendawo yalo yamagama, inqubo ephethe NET_ADMIN ingakhuphula futhi yehlise ama-interface, inikeze amakheli, ingeze futhi isuse imizila, futhi ibhale imithetho yocingo lomlilo, okuyiqembu lemisebenzi eliqoqwa yi-capabilities(7) ngaphansi kwaleli khono. Ingaphinda ilungise izilungiselelo ezisezingeni le-interface ezilawula indlela i-kernel elayisha futhi ehlunga ngayo ithrafikhi. Iklayenti le-VPN ngokuvamile lidinga ezimbalwa zazo ekuqaleni futhi akukho okunye ngemva kwalokho. Yingakho ama-image amaningi ecela ububanzi obukhulu kunalokho akuwusebenzisayo.

Imisebenzi engaphandle kwaleyo ndawo yamagama ayifakiwe, futhi amalungelo aseduze ahlukile. Ukufunda nokubhala amaphakethe aluhlaza kungaphansi kwe-NET_RAW, futhi ukwakha idivayisi ye-tun kudinga kokubili ikhono kanye nokufinyelela kunodi yedivayisi. Inqubo engenayo idivayisi ithola iphutha lemvume elibonakala njengenkinga yenethiwekhi kodwa akusiyo.

Indawo yamagama inquma ububanzi bomonakalo

Isikhwama esikunethiwekhi yaso yebhuloho sifinyelela i-loopback yaso, ama-interface aso kanye nethebula yemizila yaso. Ukunikeza NET_ADMIN lapho kuvumela iklayenti le-VPN ukuthi lakhe umhubhe ngaphandle kokuthinta izinqumo zemizila zomsingathi, okuyilokho okucatshangelwa ama-image amaningi esikhwama.

Shintsha leso sikhwama siye kunethiwekhi yomsingathi futhi imvume efanayo manje ihlela imizila yomsingathi kanye nocingo lomlilo lomsingathi, ngoba ayisekho indawo yamagama ehlukile. Iklayenti obekufanele liphathe umhubhe owodwa lingakwazi ukuqondisa kabusha ithrafikhi yomshini wonke, futhi iphutha kuskripthi salo sokuhlakaza lishiya umsingathi nemithetho okungekho muntu oyibhalile. Akukho okwashintshayo kukhono ngokwalo; ingqikithi yashintsha. Yingakho ifayela le-compose elifanayo liziphatha ngendlela ehlukile kuma-host amabili.

Izimfuneko ezintathu ezihlanganayo zibe eyodwa

Ukwehluleka kokuqala kuma-VPN kuvame ukuthinta into eyodwa kwezintathu ezihlukile: ikhono, idivayisi yomhubhe kanye nokusekelwa kwe-kernel kwephrothokholi. Ukunikeza zontathu kanyekanye kuyasebenza, futhi kwenza nokwehluleka okulandelayo kungabi nokukholelwa kukho. Ingxenye encane ye-compose inikeza ikhono futhi idlulise inodi yedivayisi ngokusobala:

services:
  vpn:
    image: example/vpn-client:latest
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1

Funda imibhalo yesithombe uqobo mayelana nokuthi yimaphi ama-sysctl edingayo, ngoba i-sysctl kusikhwama ingase idinge ilungelo elengeziwe noma isilungiselelo sezinga lomsingathi. Lapho isithombe sisekela imodi yendawo yomsebenzisi kuphela, akukho divayisi edingekayo nakancane futhi uhlu lwamakhono luyancipha ngokufanele.

Nikeza umsebenzi omncane, hhayi imodi

Imodi yelungelo idlulisa wonke amakhono futhi ngesikhathi esifanayo yandisa ukufinyelela kwedivayisi, ngakho ifihla ukuthi yikuphi kwezimfuneko ezintathu obekungekho. Futhi yenza izindlela zokwehluleka zesikhwama zingahlukaniseki nezingunquko zomsingathi. Khetha uhlu olucacile ngisho nalapho luba lude ukulubhala.

Ukusetshenziswa okungenayo impande kanye nasezindaweni zamagama abasebenzisi kushintsha okushiwo ikhono empeleni, ngoba inqubo ingalibamba kuphela ngaphakathi kwendawo yamagama emaphisiwe. Ukukopisha uhlu lwamakhono kusibonelo esinempande kuya endaweni yokusebenza engenayo impande nokulindela ububanzi obufanayo kuyindlela evamile yokulahlekelwa yintambama.

Izimfihlo zingezinye isinqumo. Ukuba ne-NET_ADMIN akusho lutho mayelana nokuthi iklayenti likhombisa luphi ubuwena bontanga, yikuphi ubufakazi elikulayishayo noma ukuthi ziyashintshwa kanjani. Ukuphathwa kwenethiwekhi akunikezi ukuthembana.

Qinisekisa ushintsho futhi ubhale ukuthi kungani imvume ikhona

Qinisekisa ukuthi isikhwama sathola ini ngempela ngaphambi kokuxazulula umhubhe. Ukuhlola okungezansi kubika amakhono angeziwe kanye nemodi yenethiwekhi, bese kubonisa ukuthi uhlu lwama-interface lubukeka kanjani ngaphakathi:

docker inspect --format '{{.HostConfig.CapAdd}} {{.HostConfig.NetworkMode}} {{.HostConfig.Privileged}}' vpn
docker exec vpn sh -c 'grep CapEff /proc/self/status'
docker exec vpn ip -br addr
docker exec vpn ip route

Uma ikhono likhona futhi uhlu lwama-interface lusalutho, iklayenti lehlulekile ngaphambi kokuba likwazi ukwakha noma yini, futhi indawo elandelayo yokubheka imibhalo yesikhwama. Uma umhubhe ukhona kodwa ithrafikhi ingahambi, ithebula yemizila ngaphakathi kwesikhwama liphendula umbuzo olandelayo.

Hlola futhi indlela yokuhlakaza, ngoba iklayenti elibhala imithetho yocingo lomlilo lingayishiya ngemuva. Misa isikhwama futhi uhlole isethi yemithetho yomsingathi uma kusetshenziswa inethiwekhi yomsingathi. Imvume edingeka imizuzwana emibili kuphela ekuqaleni akufanele ichazwe efayeleni le-compose njengesidingo saphakade ngaphandle kwenothi elichaza lokho.

Bhala isizathu eceleni kwalo lolo khono: yimuphi umsebenzi owawulidinga nokuthi kwenzekani kwehluleke ngaphandle kwalo. Lelo nothi lihlala likhona ngemva kwezibuyekezo zesithombe, futhi yilowo mehluko phakathi kohlu lwamalungelo olubuyekeziwe kanye nolukhule ngokukopisha nokunamathisela.

Izihloko ezihlobene