I-SSTP iyahluleka lapho i-HTTPS yesiphequluli iphumelela khona: kungani
I-SSTP isebenza ngaphakathi kwe-TLS kumbambo 443, kodwa akusona isicelo sewebhu. Hlola i-TCP, ubunjalo be-TLS, ukushintshana kwe-SSTP kanye nokuqinisekiswa kwe-PPP njengezigaba ezihlukene.
Isiphequluli sivula igama lomsingathi we-VPN nge-HTTPS ngaphandle kwesikhalazo, futhi iklayenti le-SSTP liyanqaba ukuxhumana. Akukho okungqubuzanayo kulolo mbhangqwana. I-SSTP isebenzisa i-TLS njengokuthutha kwangaphandle bese isebenzisa isicelo sayo kanye nomthwalo we-PPP ngaphakathi kwalokho kuxhumana, ngakho ukulayisha ikhasi ngempumelelo kufakazela into eyodwa encane: umsingathi uphendula i-GET kumbambo 443. Iklayenti libuza omunye umbuzo, futhi iseva ingawuphendula kabi.
Ikhasi liyalayisha, umhubhe awulayishi
Abantu baphendukela ekuhloleni kwesiphequluli ngoba kuyashesha, bese bethatha umphumela njengobufakazi bokuthi iseva iyafinyeleleka futhi ilungisiwe. Kungubufakazi mayelana ne-GET endleleni evulwe ibha yekheli, akukho okunye. Ingxoxo ye-VPN iqala ngemva kokuxhawulana okufanayo kwe-TLS, kodwa ithumela indlela yokwenza nomzila ikhasi lewebhu elingalokothi liwusebenzise. Ngakho impendulo engu-200 yesiphequluli ayisho lutho ngokuthi ingabe iphoyinti lokugcina le-SSTP likhona.
Hlukanisa imibono emibili futhi ukusesha kuba kufushane. Ukuthutha kanye neketanga lesitifiketi kuyasebenza, futhi okuthile ekushintshaneni kweprotocol phezu kwazo akusebenzi. Lolu wuphenyo oluhlukile kunombambo ophukile noma isitifiketi esiphelelwe yisikhathi, futhi ludinga ubufakazi obuhlukile.
Yini iklayenti le-SSTP eliyithumelayo ngempela
Iklayenti lithumela isicelo se-HTTP ngendlela ye-SSTP_DUPLEX_POST endaweni ethi /sra_{GUID}/, bese ligcina umzimba wokuxhumana uvulekile njengomfula wezinhlangothi ezimbili othwala amafreyimu e-PPP. Iseva ethobelayo iphendula nge-HTTP/1.1 200 futhi iyeke ukuziphatha njengesiphakeli sewebhu. Okunye konke kuwuphawu: 405 noma 404 kusho ukuthi iphoyinti lokugcina ayikho, 301 noma 302 kusho ukuthi okuthile kuqondisa kabusha isicelo, futhi i-FIN esheshayo isho ukuthi iproksi noma iseva ivalile umfula.
Yingakho umgomo kufanele kube iseva ye-SSTP hhayi isiphakeli sewebhu esinamathiselwe isitifiketi se-TLS. Indlela, umzila kanye nomzimba wesikhathi eside kuyizidingo zeprotocol, ngakho iproksi ephambene ayikwazi ukuzenezelwa ngokumisa kuphela. Iproksi edlulisa i-HTTPS evamile ngokuphelele ingase namanje yenqabe indlela engayaziyo.
Kuphi iproksi noma isiphakeli sewebhu siphula umfula
Umxhumanisi uhlola umugqa wesicelo se-HTTP ngaphambi kokudlulisa noma yini, futhi indlela eyenzelwe umuntu enomzila ongajwayelekile ingase ihluleke emithethweni yayo. Amanye amadivaysi anikela ngekhasi elivamile kuyilapho enqaba noma ephazamisa umhubhe, ngakho iklayenti libika ngoxhumano oluqala bese lufa esikhundleni sokwenqaba okuhlanzekile. Amanye amukela isicelo, bese esebenzisa isikhathi sokuphela somzimba noma sokungenzi lutho i-PPP keepalive engakwazi ukukubekezelela. Kokubili kubonakala kufana ohlangothini lweklayenti, yingakho isigaba esihlulekile sibaluleke kakhulu kunombhalo wephutha.
Ukwabelana ngombambo 443 phakathi kwewebhusayithi ne-SSTP ukukhetha komzila, akusona isethembiso sokuthi wonke umgxumu uzobhekana nezingxoxo zombili ngendlela efanayo. Uma i-load balancer, i-firewall noma isiphethe se-TLS sikule ndlela, yengeza ohlwini lwabasolwayo ngaphambi kokuthinta ukumisa kwe-VPN.
Hlola izigaba ngokwehlukana
Gijimisa izihlolwa ngokulandelana futhi ume ekwehlulekeni kokuqala, ngoba isigaba ngasinye sisusa ungqimba oluhlukile. I-TLS probe engezansi ihlukanisa ubunjalo besitifiketi kukho konke okwenziwa yi-SSTP. Shintsha igama lomsingathi ngiphoyinti lakho lokugcina futhi ufunde i-subject neketanga eliyiphrintayo.
openssl s_client -connect vpn.example.com:443 -servername vpn.example.comBese uhlobanisa ubufakazi obusele nezigaba esikhundleni sokuqagela kusukela kwiphutha leklayenti. Ithebula elingezansi uhlu lokuhlola okufanele lucashunwe kuthikithi, kanye nophawu oluhlukanisa ukwehluleka okukodwa kokulandelayo.
| Stage | What it proves | Failure signature |
|---|---|---|
| TCP to 443 | A listener exists and the path is open | Timeout or connection refused |
| TLS with SNI | The certificate matches the name you use | Name mismatch or untrusted chain |
| SSTP_DUPLEX_POST exchange | The endpoint is an SSTP server | 405, 404, 301 or an early FIN |
| PPP authentication | The user credential was accepted | Auth failure after a 200 response |
| Inner routing | A permitted destination is reachable | Tunnel up, no reply from the target |
Rekhoda isigaba sokugcina esiphumelele kuthikithi esikhundleni sokubhala "akukwazi ukuxhuma". Isicaciso se-MS-SSTP sibhala isicelo nokushintshana kwe-PPP okulandela ukuxhawulana kwe-TLS, futhi siyisihluthulelo sokuthi kungani ukuhlolwa kwesiphequluli kungakwazi ukumela noma yikuphi kwalokho.
Ubunjalo kuqala, bese kuba yi-PPP
Ubunjalo be-TLS nokuqinisekiswa kwe-PPP kulandelana, akukho okunye, futhi ukukudida kubhekisa abantu ekumiseni iseva okungalungile. Iklayenti liqinisekisa kuqala isitifiketi seseva nenjongo yaso, bese i-PPP ixoxisana ngesimo sayo futhi iqinisekise umsebenzisi ngendlela yenselelo-impendulo noma i-EAP. Inkinga yesitifiketi ikhiqiza iphutha elihlukile kunephasiwedi enqatshiwe, futhi alikho iphutha elichaza isigaba esihlanganiswa okunye.
Ukushintsha igama lomsingathi ngekheli, noma ukuchofoza udlula isixwayiso sesitifiketi, kususa isihlolwa ebesingabona isigaba esihlulekile esikhundleni sokulilungisa. Gcina isixwayiso futhi usifunde. Futhi ungaphindi usethe iphasiwedi ye-PPP lapho ukushintshana kwe-HTTP kungakaze kufinyelele ukuziphatha kwe-SSTP, ngoba ubufakazi bokungena abukaze bucelwe.