OpenVPN nge-TCP: i-rto_min ayilungisi ukuvaleka komugqa

I-shell esebenzisanayo phezu komhubhe iyabanda imizuzwana eminingi ngesikhathi kusebenza ukukopisha ifayela, bese iqhubeka sengathi akukho okwenzekile. Inkinga is ekulandeni kuphela, nokho ne-shell iyalinda, futhi zombili zilulama ngasikhathi sinye. Leyo phethini iwuphawu lomgudu owodwa othembekile othwala izingxoxo eziningi, futhi ihlula cishe zonke izinguquko zokulungisa abantu abazama kuqala.

Uphawu kufanele lufundwe ngokucophelela ngoba lukhombisa indlela yokusebenza hhayi isilungiselelo: ukuma kwabiwe, ngakho imbangela iyabiwa, futhi into eyabiwe ukuxhumana kwangaphandle. Konke okunye kulogi kubonakala kujwayelekile ngesikhathi lokhu kwenzeka.

Uphawu: konke kuma ngesikhathi esisodwa

Ukuxhumana okubili kwangaphakathi okubambana ndawonye kuwumkhondo. Ukulanda okunensayo ne-shell enensayo kuyizingxoxo ze-TCP ezihlukene ezinamazinombolo wokulandelana ahlukene nesimo sokuminyana esihlukene, ngakho iphutha kwelinye akufanele lithinte elinye. Uma kuma ngomgqigqo ofanayo, kukhona okuthile ngaphezulu kwabo okuhlela ama-byte abo.

Lokho okuthile wumbhede wokuthutha womhubhe. Kumodi ye-TCP, i-OpenVPN ibhala amaphakethe afakiwe kuxhumano olulodwa lwe-TCP oluya kwelinye icala, futhi isivumelwano se-TCP ukuhanjiswa ngokulandelana komgudu owodwa wama-byte. Ama-byte akamuva awanikezwa uhlelo ngaphambi kwalawo alahlekile, kungakhathaliseki ukuthi ingxoxo iphi yangaphakathi.

Qaphela okungakushiwo uphawu. Alusho ukuthi indlela yephukile, ukuthi iseva igcwele kakhulu, noma ukuthi ukubhala ngemfihlo kunensayo. Lokho kuletha ezinye izimo: umthamo ophansi ngokulinganayo, ukuphuma kwesikhathi, noma ukwehluleka okuthinta uhlangothi olulodwa. Ukuma okwabiwe okuphela lapho ingxenye elahlekile iphinde ithunyelwa kuwumphumela wokuhleleka ngqo.

Umgudu owodwa wama-byte wangaphandle, izingxoxo eziningi zangaphakathi

Cabanga umhubhe uthwala ukulanda ne-shell ngesikhathi esisodwa. Ingxenye eyodwa yoxhumano lwangaphandle iyalahleka. Izingxenye ezilandelayo zingafika kusihlalo esamukelayo, futhi isiqoqwana se-TCP esamukelayo sizozamukela, kodwa asikwazi ukuzidlulisa phezulu kuze kugcwaliswe isikhala. Ngakho i-OpenVPN ayinalutho lokufunda lwe-shell, nakuba ama-byte e-shell uqobo afika kudala.

Lokhu ukuvaleka komugqa ngaphakathi koxhumano olulodwa, futhi akudingi ukuthi izinhlelo ezimbili zabelane ngoxhumano lwangaphakathi. Zabelana ngalolo lwangaphandle, futhi lokho kwanele.

Umphumela wezinga lesibili ukwenza kube kubi kakhulu. Umthumeli wangaphakathi ongaboni iziqinisekiso angase aphinde athumele idatha isendlalelo sangaphandle esivele sizama ukuyihambisa. Lokho kuphinda kuthunyelwe kuba umgudu owengeziwe womhubhe endleleni esanda kufakazela ukuthi ingalahlekelwa izingxenye, ngakho umsebenzi wokululama ugcwele umsebenzi wokululama obalulekile.

Akukho kwalokhu okuqinisekisa ukuwa. Endleleni ehlanzekile enohambo olufushane nemigqa ebanzi, leli hlelo lingaba usizo ngokuphelele iminyaka. Ukwehluleka kuvela lapho ukulahleka, ukubambezeleka nokujula komugqa kuhlangana khona, futhi yingakho imibiko iqoqana eduze kwezixhumo ezingaphezulu eziminyene nezixhumo zamaselula hhayi emahofisini anikezwe kahle.

Kungani isikhathi sangaphakathi eside singasizi

Ukuphakamisa isikhathi esincane sokuthumela kabusha endleleni nge-rto_min kubambezela ukuthumela kabusha okusekelwe esikhathini kugudlu lwe-TCP olwenziwe endaweni olusebenzisa leyo ndlela. Kuyisibambo sangempela esinomphumela wangempela, futhi kubhekana nenkinga yezinga lesibili hhayi eyokuqala.

ip route show
ip route show cache 2>/dev/null | head
ss -tin dst 10.70.0.1

Eningakwazi ukukwenza ukukhulula ama-byte angaphandle ngaphandle kokulandelana, ukululama ingxenye elahlekile ngokushesha, noma ukwenza iseva yohlelo ekude yamukele isikhathi esifanayo. Isiqoqwana esamukelayo sisahambisa ngokulandelana, futhi umthumeli ekugcineni okude usasebenzisa izilinganiso zaso zohambo.

Futhi akucimi zonke ezinye izindlela zokululama ukulahleka. Lapho ukulahleka kwangempela kudinga ukululama okusekelwe esikhathini, okuncane okukhulu kwenza uhlelo lulinde isikhathi eside ngaphambi kokuthatha isinyathelo, okuphambene nalokho okudingwa yiseshini ebucayi ekubambezelekeni.

Isisekelo esigxilile semizuzwana eyishumi nambili sivela ezelulekweni ngalesi sihloko sengathi ukuba khona komhubhe we-TCP kukudinga. Isikhathi sokuthumela kabusha esichazwe ku-RFC 6298 sithathwa esikhathini sohambo esikalisiwe ngokuhlehla okukhulayo, ngakho isisekelo esingaguquki siwukukhetha kwenqubomgomo yendlela ethile, hhayi imfuneko yephrothokholi. Uma sisetshenziswa kabanzi, sifihla uphawu kanti sishintsha ukululama komgudu ngamunye ohlanganiswa yileyo ndlela.

Okwenziwa nokungenziwa yi-tcp-nodelay

Inketho yomhubhe evala ukugcinwa kwesikhashana kwesitayela se-Nagle kusokhethi yokuthutha inomgomo omncane: ivimbela ukubhala okuncane ukuthi kulinde idatha eyengeziwe ngaphambi kokuthunyelwa. Lokho kusiza ukuthutha okusebenzisanayo ukugwema ukubambezeleka okwengeziwe endleleni enempilo ngenye indlela.

Akwenzi ukuthutha kungabi nokulandelana, futhi akufinyezi ukululama ngemva kwengxenye elahlekile. I-shell ema ngenxa yesikhathi sokuthumela kabusha izokwama futhi nakuba leyo nketho ivuliwe, ngoba inketho ayikaze ithinte umthetho wokulandelana.

Kulula ukudida lezi ezimbili ngoba zombili zichazwa njengezilungiso zokubambezeleka. Enye isusa ukulinda okwenziwe ukugcinwa kwesikhashana, enye ingadinga ukushintsha lokho okukuqinisekisayo ukuthutha, futhi akukho nketho yesokhethi eyenza lokho.

Indlela yokuqhathanisa ukuthutha ngobulungisa

Uma umqhubi evuma futhi zombili izinsizakalo zikhona, qhathanisa insizakalo ye-UDP nensizakalo ye-TCP ethwala umthwalo womsebenzi ofanayo endleleni efanayo yokungena eya kuseva efanayo. Ukushintsha izwe, umhlinzeki noma isizukulwane seseva phakathi kwezivivinyo ezimbili kuletha okuguquguqukayo okuzobusa umphumela.

Bheka ukuma okwabiwe hhayi inombolo yomthamo. Izinhlelo eziningi zangaphakathi ezibambana ndawonye ngesikhathi sokulahleka kwangaphandle kuwukubona okukhomba ukuvaleka komugqa; inombolo eyodwa ephansi yokuhlolwa kwesivinini ayikwenzi lokho.

Ukuthwebula okuvunyelwe kusixhumanisi somhubhe nakusixhumanisi somzimba kuhlukanisa izingqimba ezimbili ngokuhlanzekile, ngoba ukuthumela kabusha kwangaphakathi nokwangaphandle kungokwabaxhumano abehlukene abanendawo zokulandelana ezihlukene. Ukubona ukuthumela kabusha kwangaphakathi ngesikhathi umgudu wangaphandle ukhombisa isikhala wubufakazi obuqondile.

Ukushintshela ku-UDP kususa umgudu othembekile owengeziwe futhi kushiya i-TCP yangaphakathi ukuthi yenze ukululama kwayo. Akuthembisi ukulahleka okuyiziro noma ukubambezeleka okuphansi, futhi isixhumo esingaphezulu esigcwele, imigqa emikhulu kakhulu noma inkinga ye-MTU kusazodinga ukulungiswa. Ukuthutha okungaphandle komhubhe akukaze kubanjwe ngemuva kwesikhala sokulandelana komhubhe, nakuba kusengahlupheka lapho zombili izindlela zabelana ngoxhumano olulodwa oluminyene, futhi lokho kuvaleka okwabiwe kufanele ukuphenywa kwako hhayi ukugoqwa kulokhu.