Ukuthunyelwa kabusha kwe-TCP ngokumelene nokunqatshwa kokuphindaphinda kwe-IPsec: funda isendlalelo ngasinye

Amathuluzi amathathu ahlukene abika izimpinda ezintathu ezihlukene, futhi yinye kuphela yazo eyisigameko senethiwekhi ongasebenza ngaso. Ukuthunyelwa kabusha kwe-TCP wukuthi umthumeli uthumela kabusha ibanga, i-ACK eqondile wukuthi umamukeli uphinda ukuqinisekisa, futhi ukunqatshwa kokuphindaphinda kwe-ESP wukuthi inhlangano yezokuphepha inqaba inombolo yokulandelana eseyikwamukele. Akukho kulezi zintathu okusho okunye. Funda isibali ngasinye esendlalelweni esisikhiqizayo ngaphambi kokuzixhumanisa endabeni eyodwa.

Izibali ezintathu ezingakali isigameko esifanayo

Umbhalo wokuthunyelwa kabusha kwe-TCP usho ukuthi umthumeli ubeke kabusha ibanga lokulandelana ocingweni. Ukulahleka kungenye yezizathu zalokho, futhi ukubanjwa okuphethe kungenzeka ukuthi akunayo iphakethe lokuqala noma ukuqinisekisa obekungachaza isikhathi. I-ACK eqondile wukuthi umamukeli uphinda ukuqinisekisa okuqoqiwe ngaphansi kwemithetho yokululama kwe-TCP, okuwukuthi akukona ukubhalwa kohlelo okuphindiwe futhi akukona ikhophi yesibili yedatha.

I-ESP isebenza endaweni yayo yokulandelana. Inhlangano ngayinye yezokuphepha inikeza izinombolo amaphakethe eyithumelayo, futhi umamukeli ugcina iwindi lezinombolo asezamukele, ngakho iphakethe le-ESP elifika kabili lichithwa ngesisekelo salokho kuphela. Ngakho isigaba se-TCP esithunyelwe kabusha sihamba ephaketheni elisha le-ESP elinenombolo entsha yokulandelana, okuwukuziphatha okulungile kuzo zombili izingqimba. Amabhayithi afanayo angabonakala emasha kwesinye isibali futhi abe madala kwesinye, futhi asikho isendlalelo esiqambayo.

Okubonwa nokungabonwa yisihlaziyi

Qala ngamagama ohlaziyi, ngoba amagama ezihlungi achaza ukubonwa hhayi ingaphakathi lamaphoyinti okugcina. Ukubala ngamagama afanayo asetshenziswa ithuluzi kukugcina uthembekile mayelana nalokho okwakalwa ngempela. Isibalo esivela ekubanjweni okungaphelele yisibalo salokho okwasinda, hhayi salokho okwenzeka ocingweni.

tshark -r trace.pcap -Y "tcp.analysis.retransmission" | wc -l
tshark -r trace.pcap -Y "tcp.analysis.duplicate_ack" | wc -l

Funda ulwazi lochwepheshe eduze kwalezo zinombolo, ngoba izixwayiso ze-checksum nokulandelana zishintsha ukuthi zifanele isisindo esingakanani. Umkhondo ohlanganisiwe ovela kuzinzwa ezimbili ungabonisa uhlaka olulodwa kabili, futhi ukubala zombili izikhophi kwakha isigameko sokululama esingakaze senzeke.

Izibali ze-ESP zihlala esimweni se-kernel

Izinombolo zokulandelana ze-ESP zingezinhlangano zezokuphepha, hhayi zokugeleza kwe-TCP, ngakho isango yindawo okufanele kubuzywe kuyo. Uhlu lwesimo lubika izibali zamaphakethe namaphutha ngayinye inhlangano ezingekho ukubanjwa okungazakha kabusha.

ip -s xfrm state
tshark -r trace.pcap -Y "esp" -T fields -e esp.seq | head

RFC 4303 ichaza inombolo yokulandelana kanye newindi elilwa nokuphindaphinda eliyisebenzisayo, yingakho isibali sikhuphuka ngisho lapho kungenabutho obuhambisani nalo. Izinombolo zokulandelana zangaphandle ezingaguquki ngaphandle kokungahambi kahle kwe-TCP okuhambisana nazo zikhomba komunye umthumeli noma indlela ephindiwe hhayi isiphepho sokuthumela kabusha. Ukubanjwa kwangaphandle komhubhe obethelwe ngokuvamile kufihla izinombolo zokulandelana ze-TCP zangaphakathi, ngakho akukwazi ukufakazela ukuthi isitaki sangaphakathi senzani. Bamba ngaphakathi komhubhe kuphela lapho inqubomgomo ivumela khona, futhi ungaze uvale ukuvikelwa kokuphindaphinda ukuze uthulise isixwayiso esingahlobene.

Lapho iphoyinti lokubona lishintsha khona impendulo

Ngaphambi kokukhulisa, bhala ukuthi ukubanjwa kwathathwa kanjani: i-interface, ukuthi inqubo yokubamba yabika ukulahleka yini, nokuthi izimpawu zesikhathi ziyafaniswa yini phakathi kwezinzwa. Iphoyinti elilodwa lokubona alikwazi ukubona zombili iziphetho zendlela, ngakho noma yisiphi isitatimende ngokuziphatha komamukeli siwukuqagela hhayi isilinganiso. Umkhondo othathwe esangweni nomkhondo othathwe kusibungu ngeke bavumelane ngokulandelana ngaphansi komthwalo, futhi lokho kungavumelani ngokuvamile kungokokubanjwa hhayi okomhubhe. Ukuxhumanisa imibono emibili yikho okuguqula isibalo sibe ubufakazi.

Sebenzisa ukugeleza kohlelo okukodwa okuvunyelwe futhi urekhode izibali zamaphoyinti okugcina eduze kwezibalo zokubanjwa ngesikhathi esifanayo. Uma izinombolo zingavumelani, themba isendlalelo esiphethe isigameko bese uthatha esinye njenge-artifact yokubonwa kuze kufakazelwe okuphambene. Lowo mthetho uxazulula iningi lamathikithi ngaphandle kokuthinta ukucushwa komhubhe.

Ukufunda izinombolo ngokulandelana okufanele

Qala esendlalelweni lapho umbuzo wabuzwa khona: isixwayiso se-TCP siphendulwa kusukela ekubanjweni kwe-TCP, futhi ukunqatshwa kwe-ESP kuphendulwa kusukela ezibalini zenhlangano yezokuphepha esangweni. Ngemva kwalokho kuphela buza ukuthi imibono emibili ichaza iphakethe elifanayo yini. Isiphetho esidinga zombili izingqimba kufanele sisho zombili, ngoba isitatimende ngomhubhe esincike kumbhalo we-TCP kuphela siwukuqagela.

Rekhoda isendlalelo, isibali nephoyinti lokubona kukho konke okutholakele, futhi umfundi olandelayo ngeke ahlanganise izehlakalo ezintathu zibe yiphutha elilodwa elicatshangelwayo. Khulisa ngalezo zinkambu ezintathu futhi ukulungiswa ngokuvamile kuvela kweyokuqala.