Ukwehluleka kwe-client-connect ku-OpenVPN: ingabe ukuhlanza ngesikhathi se-disconnect kuqinisekisiwe?
Iklayenti elinqatshiwe alihlehlisi umthetho we-firewall noma irekhodi elibhaliwe. Qhathanisa inkontileka ye-callback nokuhlehliswa okufanele ikwenze ngokwakho i-hook yakho.
Lapho iskripthi se-client-connect siphuma ngekhodi engeyona uziro, i-OpenVPN iyenqaba iklayenti, futhi abasebenzi bavame ukucabanga ukuthi iskripthi se-client-disconnect esihambisanayo sizohlanza konke. Kaningi asikaze sisebenze, ngoba ukucutshungulwa kwe-disconnect kuncike kulokho okwakutholakala yisigaba se-connect. Ukuthatha ukwenqaba nokuhlehliswa njengendlela eyodwa yikho okuguqula ukungena okwehlulekile kube umthetho we-firewall ovuzile noma irekhodi elingenanina. Lezi zibopho ezimbili ezihlukene, futhi eyodwa kuphela yazo ezenzakalelayo. Funda indlela yokuphuma ye-hook ngokwayo ngaphambi kokusola iseva ngokushiya isimo.
Ukuphuma okungekhona uziro kwenqaba iklayenti; akukuhlehlisi umsebenzi wakho
Isimo sokuphuma se-client-connect yisinqumo sokwamukela. Uziro kusho ukwamukela, noma yini enye isho ukubhidliza isibonelo ngaphambi kokuba sizinze ngokugcwele. Akukho lutho kuleyo nkontileka oluhlola lokho iskripthi esikwenzile emhlabeni wangaphandle. Uma iskripthi sengeze umthetho we-iptables, sabhala umugqa noma sakhulisa isibali, lezo zinguquko zisinda ekwenqatshweni.
Ukungalingani okufanayo kuyasebenza kuzijobelelo, lapho imisebenzi eminingi ye-connect ingasebenza khona isibonelo esisodwa. Ukwehluleka kwakamuva akukuhlehlisi emuva ukuphumelela kwangaphambilini, futhi umsebenzi wangaphambilini awunayo indlela yokwazi ukuthi umsebenzi ongudadewabo wehlulekile.
Ukwengaba kuzenzakalelayo, ukuhlanza akunjalo
Incwadi ye-OpenVPN 2.6 ihlanganisa ukucutshungulwa kwe-client-disconnect nokuphumelela kokucutshungulwa kwe-connect kwangaphambilini. Okunye ukuhlukile okubhaliwe kuhlanganisa amaketanga e-cascade: uma isinyathelo esisodwa se-connect sesivele sabuyisela impumelelo, izinyathelo ze-disconnect ezihambisanayo zisasebenza lapho isibonelo sibhidlizwa, ngisho noma isinyathelo se-connect sakamuva sehlulekile. Lokho kuhlukile kuncane futhi kuncike ekutheni zingaki izinto zokushaywa zilungisiwe, yingakho ukuhlola iskripthi esisodwa se-shell akukutsheli lutho mayelana neketanga.
Yenza imephu yokulungiselelwa kwangempela ngaphambi kokuklama mayelana nakho: yisiphi iskripthi, yisiphi isijobelelo nokuthi zihamba ngakuphi ukulandelana. Ithebula elingezansi libala lokho ukulungiselelwa okungaphelele okushiya ngemuva.
| What the hook did before failing | What the client sees | What stays behind |
|---|---|---|
| Created a firewall entry | A rejection, with no tunnel | A rule matching an address nobody owns |
| Wrote a state row | A rejection, with no tunnel | A record of a session that never started |
| Allocated a tunnel address | A rejection, with no tunnel | An address marked busy until something releases it |
Umgqa ngamunye ugcina ngendlela efanayo kuklayenti nangendlela ehlukile kumsingathi. Iklayenti alikwazi ukwazi ukuthi yikuphi kulokho okwenzekile, ngakho i-hook kufanele ihlehlise emuva lokho eyakwenza ngaphambi kokubuyisela isimo sokwehluleka.
Nxephezela ngaphakathi kwiskripthi esihlulekile
Qinisekisa konke okungenzeka ngaphambi kokuthinta isimo esabiwe: izinkambu zesitifiketi, ukutholakala kwekheli, iqembu iklayenti elikulo. Ukwenqaba okushibhile kakhulu yilokho okwenzeka ngaphambi kwanoma yikuphi ukwabiwa. Uma ukulungiselelwa kuhlanganisa imisebenzi eminingi yangaphandle, gcina irekhodi lokuthi yikuphi okwaqedwa bese ukuhlehlisela emuva ngokulandelana okuphambene ngaphambi kokubuyisela isimo sokwehluleka.
Icala elithile: iskripthi sidala ukufakwa kwe-firewall kuklayenti ngakunye, bese sihluleka ukubhala umugqa wesimo osichazayo. Igatsha elihlulekile kufanele lisuse ukufakwa okusanda kudaliwe bese liphuma ngekhodi engeyona uziro. Ukulinda umcimbi we-disconnect ongase ungakaze uhlelwe yiyo indlela umthetho ophila ngayo isikhathi eside kunomhlangano owawumiselwe wona.
Yenza isinxephezelo sisebenze kaningi futhi sibe nomnikazi
Ukuhlanza kufanele kuphephe ukusebenza kabili futhi kube nemboni mayelana nalokho okungakususa. Umcimbi wakamuva ovela emzamweni wangaphambilini akufanele ususe ukwabiwa komhlangano omusha ngoba nje kokubili kwabelana ngegama elivamile noma ikheli lethunjana elisetshenziswe kabusha. Rekhoda isibambo esithile noma i-id yokusebenza kanye nensiza, bese ususa ngalokho khiye hhayi ngegama. Izinkokhelo zesizindalwazi zisiza kuphela ngezinguquko zesizindalwazi uqobo; umthetho we-firewall ongaphandle kwalowo mngcele udinga isinyathelo esicacile senxephezelo.
Cabanga ukuthi inqubo ingafa phakathi koshintsho nokuhlanza, futhi engeza umhlanganisi oqhathanisa isimo sangaphandle nohlu lwamaklayenti amukelwe ngokohlelo.
Hlola izindlela ezintathu ezihluke ngempela
Zijwayeze izimo ezintathu: ukwenqaba ngaphambi kokuthi kube nokwabiwa, ukwenqaba ngemuva kokwabiwa okwengxenye, nomhlangano ojwayelekile owamukelwe ophela kamuva. Lezo zintathu zikhiqiza imigqa yelogi ehlukile nezinsalela ezihlukile. Qinisekisa isimo sangaphandle ngemuva kwakho ngakunye, hhayi umyalezo wokwehluleka weklayenti kuphela, ngoba ukwehluleka kweklayenti yiwona mphumela olindelekile ezimweni ezimbili kwezintathu.
Rekhoda isigaba se-hook, isimo sokuphuma kanye nalokho okwabiwe noma okukhululiwe, ngaphandle kwezifakazelo. Ilogi ye-hook ebiza insiza eyayidalile yiyo eyenza umthetho ovuzile utholakale ezinyangeni eziyisithupha kamuva.