Izendlalelo ze-SSTP zichaziwe: iphakethe langaphakathi lisadalula ini

I-SSTP isonga i-PPP kanye nephakethe langaphakathi ngaphakathi kwe-TLS, kodwa uxhumano lwe-TCP lwangaphandle lusakhombisa ukuthi ubani ukhulume nobani. Bhala ilebula esigabeni ngasinye ngaphambi kokufunda ukubamba.

Ezincazelweni eziningi amaqiniso amabili mayelana ne- SSTP ahlangana ndawonye, futhi lokho kuhlangana yikho okwenza ukubamba kube nzima ukuqondwa. Iphakethe lohlelo luhlala likhona ngaphakathi komzila ovikelwe, futhi uxhumano lwe-TCP oluthwala lowo mzila lugcina amakheli alo wona ukuze konke ukuhamba. Okuhamba ocingweni umthwali kanye nomthwalo wawo, hhayi into esikhundleni sanoma yikuphi kwalokho. Hamba isitaki kusukela ngaphandle kungena ngaphakathi futhi ubhale ilebula kunoma yimuphi umngcele owuwelayo.

Qala kumthwali wangaphandle

Into yokuqala ocingweni uxhumano lwe-TCP oluvamile oluya ekuphumeni okungu-443, olunamakheli angempela adluliswa ngamarutha. Yilo uxhumano oludlula ekuhumusheni amakheli enethiwekhi futhi yilokho umhlinzeki wokufinyelela angakubala. Ukuvikela umthwalo akususi umthwali, futhi akufihli umthamo noma isikhathi.

Konke okulandela leli phuzu kuyathwalwa esikhundleni sokuqondiswa. Umthwali uyaqhubeka usebenza ngisho nalapho ukushintshana kwangaphakathi kwehluleka.

Landela ukugoqwa kungena ngaphakathi

Ngaphakathi komzila ovikelwe kukhona ukushintshana kokulawula kwe-SSTP, bese kuba yiseshini ye-PPP, bese kuba iphakethe lenethiwekhi iklayenti elifuna ukulithumela. Isigaba ngasinye sinezingxoxo zaso, imilayezo yaso yephutha kanye nomshini waso wesimo. Ngakho-ke iphutha lingabonakala njengephutha le-TLS ngakolunye uhlangothi kanye nephutha le-PPP ngakolunye. Ukufunda izigaba ngokulandelana kutshela ukuthi imuphi umshini wesimo owama.

Ukubamba okukodwa akuvamisile ukukhombisa isitaki sonke. Izihloko zangaphandle zibonakala ngaphandle kwephuzu lokugcina kuphela, kanti ezingaphakathi zibonakala ngemuva kokukhululwa kokugoqwa. Lokho kungafani kuvela lapho umi khona, hhayi kumthetho wokuxhumana.

Umdwebo ongezansi uhlanganisa izigaba ukuze kukhulunywe ngazo nokho. Awukona ukuhlelwa kwamabhayithi, awuthembisi irekhodi elilodwa ngephakethe ngalinye, futhi awusho lutho mayelana nokuthi ukusetshenziswa okuthile kwenza imisebenzi emingaki yokubhala ngemfihlo.

outer IP header
  TCP to port 443
    TLS record layer
      SSTP control and data packets
        PPP frames
          inner IP packet
            application transport and payload

Bhala ilebula kumqaphi ngaphambi kokufunda ukubamba

Ukubamba okubili kwesesheni eyodwa kuphendula imibuzo ehlukene, futhi isixhumanisi lapho kuthathwe khona sinquma ukuthi iyiphi. Emkhondweni wokufinyelela ubona umthwali kanye namarekhodi e-TLS, futhi ungakala ubukhulu nezikhala ngaphandle kokubona ikheli langaphakathi. Ephuzwini lokugcina, ngemuva kokukhululwa kokugoqwa, iphakethe langaphakathi iwukuhamba okuvamile ngaphansi kwenqubomgomo yangasese yokudlulisa.

Bhala isixhumanisi nendlela kukho konke ukubamba ngaphambi kokukuhumusha. Umkhondo othathwe kusiphathimandla somzimba awusoze wakhombisa amakheli ohlelo lwangaphakathi njengezinkambu zangaphandle ezivamile, futhi ukufunda lokho kungabikho njengokwehluleka kokubethela kuyiphutha elivamile. Umkhondo othathwe ngaphakathi kumhubhe awubonisi mthwali nhlobo, ngakho-ke awukwazi ukuphendula umbuzo mayelana nombono womhlinzeki. Isiyalo esifanayo sisebenza kumarekhodi ephuzu lokugcina, abhala ukulandelana kwezingxoxo hhayi okuqukethwe.

Gcina izihlolo umdwebo ongakwazi ukuzifakazela

Ukulandelana kwezigaba akufakazeli ukuthi ukusetshenziswa kuthile kuqinisekisa isitifiketi seseva, kuxoxisana ngenguqulo ye-TLS esekwayo noma kugunyaza i-akhawunti. Ngakunye kwalokho isinqumo sokuhlelwa esihluleka ngokuzimela ekugoqweni.

Qinisekisa ngeklayenti elibika ukuthi laxoxisana ngani esikhundleni sokuqagela kusukela kumdwebo. Qala ngokuxhawulana kwe-TLS, bese ukushintshana kwe-SSTP, bese kuba i-PPP, futhi ume esigabeni sokuqala esibika iphutha. Umyalo wokuqala uprinta uchungechunge kanye nenguqulo okuxoxiswene ngayo, kanti owesibili ubala ukuxhawulana okukhona ekubambeni.

openssl s_client -connect vpn.corp.internal:443 -servername vpn.corp.internal
tshark -r sstp.pcap -Y "tls.handshake.type == 1"

Izihloko ezihlobene