Ukuhambisa ngomgqugquzeli uma kuqhathaniswa ne-SOCKS: iluphi ungqimba olwenza i-proxy ngempela

Wengeze indlela yomgqugquzeli ethumela ithrafikhi yeklayenti ye-VPN ku-host eqhuba isilaleli se-SOCKS ku-port 1080. Amaphakethe ayafika, isilaleli asibhali lutho, futhi uxhumano luyalenga. Indlela ayinankinga: i-hop elandelayo ikhetha ukuthi iphakethe liya kuphi, futhi i-SOCKS iyingxoxo okufanele iklayenti iqale yona. Qhathanisa izakhiwo ezintathu abantu abavame ukuziqonda lapho bethumela ithrafikhi nge-proxy, futhi kuzocaca ukuthi iyiphi ingxenye engekho ekusethweni kwakho.

Ukuhambisa, i-DNAT ne-SOCKS kushintsha izinto ezihlukene

Indlela yomgqugquzeli ibhala kabusha isinqumo sengqimba 3. Imigqa emibili yanele ukuthumela ithrafikhi yeklayenti elilodwa ku-hop elandelayo ekhethiwe:

ip route add default via 10.50.0.2 table 101
ip rule add from 10.77.0.2 lookup 101

Ngemva kwalokho i-kernel inikeza iphakethe ku-10.50.0.2 ngenkathi indawo yokugcina yokuqala isekhona ku-IP header. Uma u-10.50.0.2 engumhambisi, udlulisa iphakethe. Uma kuyi-host enedemon ye-SOCKS ku-1080, iphakethe aliqondisiwe kunoma yini engalithola, futhi i-DNAT eya ku-port 1080 ayisizi, ngoba iphakethe elihunyushiwe lisaphethe umthwalo wohlelo wangempela esikhundleni sombingelelo we-SOCKS.

SOCKS5 iqala nge-byte yenguqulo, uhlu lwezindlela, ukushintshana kokuqinisekisa kanye nesicelo esisho indawo yokugcina. Leyo idatha yohlelo. Asikho isingeniso sokuhambisa noma umgomo we-netfilter oyikhiqizayo, futhi lokho ukuqhathanisa ngomugqa owodwa: ukuhambisa kukhetha indlela, i-SOCKS icela iseva ukuthi yenze uxhumano lwesibili.

Icala lokuqala: uhlelo ngokwalo lungakhuluma i-SOCKS

Uma uhlelo lunokulungiselelwa kwe-proxy, lena iyindlela emfishane futhi ayidingi ushintsho ku-kernel. Yikhombe esilalelini, nikeza izifakazelo uma iseva izicela, futhi unqume ukuthi amagama axazululwa endaweni noma adluliselwa ku-proxy. Ku-curl lezi izimpawu ezihlukene, futhi umehluko ubalulekile lapho indawo yokugcina ixazululwa ohlangothini lwe-proxy kuphela:

curl --socks5 10.50.0.2:1080 https://docs.example.com
curl --socks5-hostname 10.50.0.2:1080 https://internal.example.com

Izinhlelo ezingazinaki izinto eziguqukayo zemvelo ye-proxy, noma ezivula amasokhethi aluhlaza, azikwazi ukusizwa ngale ndlela. Iziphequluli namathuluzi amaningi e-HTTP zilungile; iklayenti yomdlalo, idemon yeposi noma ifayela le-binary lomthengisi elingahleliwe ngokuvamile akulona. Umngcele ungowohlelo ngalunye nangeprothokholi ngayinye, yingakho le nketho ihle kakhulu ekuhloleni futhi ibuthakathaka njengempendulo ye-VPN yonke.

Icala lesibili: i-adaptha eguqula imijelo ye-IP ibe yizikhathi ze-proxy

Ezinhlelweni ezingakwazi ukukhuluma i-SOCKS, ukuguqulwa kufanele kwenzeke entweni eqeda ithrafikhi ye-IP futhi ivulele izikhathi ze-proxy egameni lazo. Leyo ngxenye inesixhumi somhubhe, yamukela imijelo ekhethwe ukuhambisa komgqugquzeli, yenza ukuxhawulana kwe-SOCKS kumjelo ngamunye futhi yakha kabusha izimpendulo. Indlela iqondisa ithrafikhi kuyo; i-adaptha iyona edala iseshini.

Funda imibhalo yayo ngaphambi kokuyethemba ngesubneti yonke. Ama-adaptha amaningi athwala i-TCP kahle futhi aphatha i-UDP kuphela ngokuhlangana kwe-UDP kwe-SOCKS5, futhi awekho akaguqula i-ICMP ibe ithrafikhi ye-proxy, ngakho i-ping ephumelelayo ayisho lutho ngomzila we-proxy. I-DNS iwugibe olunye: uma i-adaptha ixazulula amagama endaweni, amarekhodi angaphakathi kuphela axazululwa abe impendulo engalungile, noma abe lutho.

Ukuvimbela imijikelezo yimininingwane yokusebenza elumayo. Ukuxhumana kwe-adaptha ngokwayo okuya kuseva ye-SOCKS akufanele kuhambiswe kubuyele ku-adaptha, ngakho ithrafikhi yayo idinga ukukhishwa emthethweni noma ikheli lomthombo elikhethekile. Uma wenza lokhu kabi, iseshini ye-proxy izozama ukuyenza i-proxy yona uqobo.

Icala lesithathu: i-host iyisango elihambisiwe ngempela

Ngezinye izikhathi ukusethwa okusebenzayo akunayo neze i-SOCKS. I-host ekude idlulisa amaphakethe noma iwenza i-NAT, futhi umthetho osuselwe emthonjeni umane ukhethe njengokuphuma. Lowo mklamo usemthethweni, futhi uchaza ukuthi kungani ukulungiselelwa okukopishiwe kusebenza kwenye inethiwekhi kuhluleke kwenye: umthetho uyafana, ingxenye engekho inkonzo yokudlulisa ngakolunye uhlangothi.

Izigameko ezintathu zihlukana ngokushesha. Hlola ukuthi yini eqinisise ukulalela, bese ubheka ama-byte okuqala afinyelela ku-host:

ss -ltnp 'sport = :1080'
tcpdump -ni eth0 -X 'tcp port 1080'

I-byte yokuqala yomthwalo weklayenti ye-SOCKS yangempela ingu-0x05, inguqulo esembingelelweni. Uma ukuthwebula kubonisa idatha yohlelo yangempela esikhundleni salokho, awekho idemon ye-SOCKS ezophendula, ngoba izingxoxo azizange ziqale. Uma kungekho okulalelayo ku-1080, i-host iyisango, futhi umbuzo uba ukuthi iyadlulisa yini nokuthi ikhona yini indlela yokubuya.

Khetha ingqimba ngemibuzo emine

Ngabe uhlelo lunokulungiselelwa kwe-proxy? Yisebenzise futhi ume lapho. Ngabe ithrafikhi ihlanganisa i-UDP noma i-ICMP okufanele iphile? Isango elihambisiwe noma i-NAT kuphela elithwala i-ICMP, futhi i-UDP idinga ukuhlangana kwe-SOCKS5 okusekelwa yizinhlangothi zombili. Ngabe yonke inqubo kumshini, kuhlanganise leyo ongakwazi ukuyilungiselela, kufanele imbozwe? Khona-ke udinga i-adaptha ephethe isixhumi futhi eqeda imijelo. Ngabe ungakwazi futhi ukuthatha ukuhambisa kwayo, i-DNS kanye nokukhishwa kokuvimbela imijikelezo? Uma kungenjalo, isango elijwayelekile lizobiza kancane ukuyipha.

Umehluko owodwa kufanele ugcinwe ucacile. Inketho ye-socks-proxy yeklayenti ye-VPN ngokwayo ichaza ukuthi uxhumano lomhubhe wangaphandle lufinyelela kanjani kuseva yalo, futhi ayisho lutho ngokuguqulwa kwemijelo yeklayenti yangaphakathi. Lezi zimbili zihlala zididaniswa kuthikithi elilodwa. Nquma ukuthi yibuphi ubudlelwano obudingayo ngaphambi kokuthinta indlela.