I-PHP hook ye-OpenVPN: trusted_ip ngokumelene ne-ifconfig_pool_remote_ip

Uhlu $_ENV olungenalutho kuskripthi se-hook lubonakala njengobufakazi bokuthi OpenVPN ayidlulisanga lutho. Ngokuvamile bufakazela into ehluke ngokuphelele: i-PHP yayilungiselwe ukuthi ingagcwalisi leso superglobal, futhi amanani ayesezimvelweni zenqubo isikhathi sonke. Isiphetho sesibili esingalungile sicashile kakhulu, ngoba izinto eziguquguqukayo ezimbili zamakheli ku-hook yokuxhumana zisho izinto ezihlukene futhi zisetshenziswa ngokushintshana. Womabili amaphutha abiza intambama uma uqala ngalelo elingalungile.

Amakheli amabili, izitatimende ezimbili ezihlukene

Iphoyinti lokugcina langaphandle yilokho iseva ekubonile ngenkathi iklayenti ixhuma, kutholakala njenge-trusted_ip ye-IPv4 ne-trusted_ip6 ye-IPv6. Ikheli elibonakalayo yilokho iphuli elikunikeze le seshini, kutholakala njenge-ifconfig_pool_remote_ip.

Ziphendula imibuzo ehlukene, futhi irekhodi ngokuvamile lidinga elilodwa lazo, hhayi womabili. Okokuqala yilapho uxhumano luqhamuka khona, okungaba ikheli le-NAT elabiwe elisetshenziswa amakhulu abantu. Okwesibili yilapho le seshini ihlala khona ngaphakathi kwethuneli, futhi inganikezwa esinye iseshini kamuva. Ukuhlanganisa womabili kukhiqiza amarekhodi abonakala enengqondo futhi angalungile.

Ukufunda okuncane kubonakala kanje.

$outer4 = getenv('trusted_ip');
$outer6 = getenv('trusted_ip6');
$inner  = getenv('ifconfig_pool_remote_ip');
$outer  = $outer4 !== false ? $outer4 : $outer6;

Alikho inani elikhomba umuntu. Elinye ukubhekwa kwenethiwekhi, elinye isivumelwano sokuqashisa, futhi irekhodi elithatha noma yiliphi lawo njengesihlonzi sedivayisi esizinzile lizoba negalelo lokungabi nalutho ngemuva kokuthi iklayenti ixhumane kabusha lisuka kwenye inethiwekhi noma lithola ikheli lephuli elihlukile. Khetha inkambu ngokombuzo irekhodi okufanele liphendule, bese ubhala lowo mbuzo eceleni kwekholamu.

Hlola ukuthi i-PHP yaqalwa kanjani, hhayi i-shell yakho

I-hook isebenza njengengane yedaemon ye-VPN enemvelo edalwe yidaemon. I-shell yakho yokusebenzisana inenye, futhi ukusebenzisa iskripthi ngesandla kuhlola imvelo ye-shell, hhayi eyase-hook.

Qala ngokuqinisekisa ukuthi i-hook yavela ngempela esigabeni obukulindele. Iskripthi esixhunywe esigabeni esingalungile, noma leso esingazange sisebenze ngoba umyalelo ukhomba kwenye indlela, sinikeza izimpawu ezifanayo nezingaguquguquki ezingekho. Engeza umugqa wokumaka ngamabomu phezulu kweskripthi futhi uqinisekise ukuthi uyavela ngaphambi kokuhlola noma yini enye. Umugqa owodwa onesigxivizo sesikhathi kulogi uhlukanisa «akuzange kusebenze» no-«kusebenzile ngaphandle kwenani».

Bese uqinisekisa ukuthi yiluphi umhumushi naluphi ifayela lokumisa elisetshenziswa yilolo cingo. Ukuhlela ukumisa kwe-PHP kweseva yewebhu akushintshi lutho kunqubo ye-CLI eqaliswe yi-OpenVPN, futhi kokubili kungalayisha amafayela php.ini ahluke ngokuphelele.

Kungani i-$_ENV engenalutho ingafakazi lutho

I-PHP isithenjwa se-getenv sichaza ukufundwa okuqondile kwemvelo yenqubo, okubuyisela i-false uma igama lingekho. I-superglobal $_ENV igcwaliswa ngokwehlukana, futhi umyalelo variables_order unquma ukuthi yimaphi ama-superglobal agcwaliswayo.

Uma lowo myalelo ushiya i-E, i-$_ENV ihlala ingenalutho noma ngabe imvelo iqukethe ini. Ikhodi eyenza inkomba kuyo ibe isibika okuguquguqukayo okungekho empeleni okukhona, futhi uphenyo lubheke i-OpenVPN kuyilapho impendulo ise-php.ini. Hlola umyalelo ikakhulukazi wokumisa kwe-CLI, hhayi kweseva yewebhu.

Ukufunda nge-getenv kugwema yonke le nxushunxushu yokuqonda, futhi iskripthi sokugoqa esihlanza imvelo ngaphambi kokubiza umhumushi siphinde siyilethe ngendlela ehlukile.

Gcina ukuhlobana, hhayi ukubuyekezwa komugqa

Nquma ukuthi irekhodi lidinga liphi inani ngaphambi kokulibhala. Uma inhloso ukubhala ukuthi iseshini ivela kuphi, gcina iphoyinti lokugcina langaphandle futhi ulimake njengokubhekwa. Uma inhloso ukuhlobanisa iseshini nekheli lethuneli ngesikhathi sokuxhumana, gcina ikheli lephuli futhi ulixhumanise neseshini.

Buyekeza ngokobunikazi obuqinisekisiwe kanye neseseshini yamanje, hhayi ngomugqa ngamunye owabelana ngekheli lethuneli, ngoba amakheli ephuli asetshenziswa kabusha futhi umcimbi wokunqamuka ofika sekwedlule ungase ubhale phezu kwedatha yoxhumano olusha. Phatha i-IPv6 ngokusobala esikhundleni sokubhala buthule inani le-IPv4 kuphela. Umugqa onekheli langaphandle elingu-NULL ungcono kunomugqa onekheli elingalungile, ngoba owokuqala ubonakala ungaphelele.

Xhumanisa ukubhala nesihlonzi seseshini esinikezwa yi-OpenVPN ukuze ukuxhumana kabusha kwakhe irekhodi elisha esikhundleni sokuhlela elidala. Sebenzisa izitatimende ezinemigqa yokucacisa kanye ne-akhawunti enezimvume ezidingekayo kuphela. I-hook isebenza ngegunya ledaemon, ngakho umbuzo wokunganaki uyinkinga ebanzi kunomugqa welogi ongalungile.

Hlola ngaphandle kokukhipha imvelo

Bhala kulogi ukuthi yimaphi amagama ayekhona, yisiphi isigaba esasebenza futhi yimuphi umhumushi owasetshenziswa. Ungaphrinti yonke imvelo, ngoba inqubo ye-hook ingazuza amanani angahlobene okungafanele agcine esefayeleni lelogi.

Qinisekisa uxhumano olulodwa kusukela ekuqaleni kuze kube sekugcineni: funda iphoyinti lokugcina langaphandle, funda ikheli elinikeziwe, futhi uqinisekise kokubili ngokombono wesera uqobo ngaleyo seshini. Uma ngabe ipheya seliqinisekisiwe kuklayenti oyedwa, ukuhlobana kungathenjwa kwenye indawo.