I-TLS ihamba ngaphakathi kwesiteshi sokulawula, hhayi kuwo wonke umhubhe

Ukubona igama elithi TLS encazelweni ye-VPN bese uphetha ngokuthi i-proxy yewebhu izokuqonda lokhu kuthutha kuyisifinyezo esivamile. Ngaphakathi kwale protocol ozakwabo bashintshana ngamaphakethe abo, futhi i-TLS isebenza njengengxenye yesiteshi esisodwa kulokho kushintshana. Umthwalo obalulekile kumsebenzisi uhamba ngefomethi ehlukile yomlayezo, yingakho lezi zimbili zingalokothi zihambelane neseshini evamile ye-HTTPS.

Isembozo siza kuqala

Iphakethe ngalinye lomhubhe liqala ngekhanda le-protocol ngokwayo: uhlobo lomlayezo, isihlonzi sokhiye futhi, ekuthutheni komfula wamabhayithi, isiqalo sobude esikhombisa lapho iphakethe liphela khona. Umfundi ongahlaziyi leso sembozo akakwazi ukwazi ukuthi insimu elandelayo iqala kuphi.

outer transport (UDP datagram or TCP stream)
  -> OpenVPN header (opcode, key id, length where needed)
    -> control message (reliability wrapper, TLS exchange)
    -> data message (protected inner packet)

Leso sifanekiso siyimephu hhayi ithebula lamabhayithi, ngoba izinsimu eziqondile zincike ohlotsheni lomlayezo, nakuba i-octet yokuqala ihlala ihlanganisa ndawonye ikhodi yokusebenza nesihlonzi sokhiye. Ukuqagela uhlobo lomlayezo ngenombolo yechweba yindlela izihlukanisi ezigcina ngayo ziqamba ngokungalungile lokho ezikubonayo. Ukulandelana yikho okubalulekile ekuxilongeni: ukuthutha, bese kuba isembozo se-protocol, bese kuba ngolunye lwezinhlobo ezimbili zomsebenzi. Funda isembozo ngaphambi kokwakha umbono ngalokho okulandelayo. Isihlukanisi esiqala endaweni engalungile sikhiqiza ubuwula obuzethembayo.

Isendlalelo sokwethembeka singeseprotocol

Imilayezo yokulawula idinga ukulethwa okuhlelekile nokuqinisekisiwe, futhi i-protocol iyakuhlinzeka ngokwayo ngamaqiniso nokuthumela kabusha. Isiqinisekiso singafika njengomlayezo waso noma sihambe nomunye umlayezo wokulawula, okwenza imikhondo ibonakale ingahlelekile kunoma ubani olindele ukushintshana okukodwa okuhlanzekile.

Inzuzo ukuthi i-handshake ye-TLS ithola isithwali esithembekile ngisho nalapho ukuthutha kwangaphandle kuyi-UDP. Izindleko ukuthi idatagram eyodwa ingaqukatha ingxenye kuphela yaleyo ngxoxo, ngakho ukuyiphatha njengerekhodi ye-TLS ezimele kukhiqiza ubuwula. Ukuhlanganisa kabusha kufanele kwenzeke esendlalelweni se-protocol. Yingakho iphakethe elithunjiwe lingavamile ukubonakala njengenyathelo eliphelele le-handshake.

Ukushintsha ukuthutha kwangaphandle kube yi-TCP akususi lesi sendlalelo. Ukuthutha okuthembekile kusho ukuthumela kabusha okuncane ezingeni le-protocol, hhayi ukuthi ukuhlanganisa kuyanyamalala noma ukuthutha kuba yi-HTTP.

Amaphakethe edatha asebenzisa ifomethi ehlukile

Lapho iseshini ikhona, umthwalo owusizo ufika njengemilayezo yedatha ethwala amaphakethe e-IP angaphakathi noma ozimele be-Ethernet. Avikelwe ngokhiye bawo nangokucubungula kwawo, futhi awawona amarekhodi ohlelo lwe-TLS nganoma iyiphi incazelo umtapo wezincwadi we-TLS ongayamukela.

Lokho kwehlukana kubonakala ekulungiselelweni: isiteshi sokulawula nesiteshi sedatha sinezilungiselelo zokubethela ezihlukene, ngakho umugqa welogi osho esisodwa awusho lutho ngomunye. Ukufunda ukubethela kokulawula okunamandla njengobufakazi bokubethela kwedatha okunamandla kuyiphutha elivamile lokubika.

Gcina futhi umbono oyiphutha ohlobene ngaphandle kwencazelo. I-TLS akuwona umsele wokhiye womphakathi ohlezi eceleni komsele wedatha olinganayo, ngoba i-TLS ngokwayo ivikela amarekhodi ayo ngokulinganayo lapho okhiye sebekhiwe. Umehluko wangempela yindima nefomethi yephakethe, hhayi ukuthi uhlangothi ngalunye lusebenzisa uhlobo luni lokubethela.

Kungani i-proxy ye-HTTPS ingakwazi ukusiza

I-proxy eqeda i-TLS ilindele umfula wamarekhodi e-TLS bese kuba uhlelo lokusebenza ngaphakathi kwawo. Isiteshi sokulawula sale protocol sithwalwa ngaphakathi kokuhlanganisa kwaso, kunezendlalelo zokwethembeka ezizungezile, ngakho i-proxy eqedayo ifunda lokho kuhlanganisa njengokufakwayo okonakele.

Isidlulisi esisobala esidlulisa amabhayithi noma amadathagrami ngaphandle kokuwachaza singasebenza, inqobo nje uma singabhali kabusha noma singahlanganisi kabusha umfula. Umbuzo okufanele ubuzwe nganoma yimuphi umlamuli ukuthi ngabe udlulisa ukuthutha nokuhlanganisa kwangempela, hhayi ukuthi usekela i-TLS kwenye indawo. Buza lokho ngaphambi kokuchitha ubusuku emikhubeni ye-proxy. Ukwehluleka okuningi lapha kungokwakhiwo hhayi isilungiselelo esingekho.

Ukufunda umkhondo ngendlela efanele

Linda kuqala ukushintshana kokulawula, bese kuba inombolo enkulu kakhulu yemilayezo yedatha, kokubili kwabelana ngokuthutha okukodwa. Uma isigaba sokulawula siqeda futhi isigaba sedatha sima, iphutha liphathelene nokhiye, ukuhlela kabusha noma ukuhlunga komzila wedatha hhayi i-handshake. Thumba imilayezo embalwa yedatha bese uhlola ukuthi ingabe iyaphuma yini kuklayenti. Lokho kubona okukodwa kwehlukanisa ukusesha phakathi.

Izincazelo zomlando zezindlela zokhiye ku-chazelo ye-protocol azisho ukuthi ukukhishwa okuthile kusasekela zonke izimo ezindala. Hlola inguqulo oyisebenzisayo ngaphambi kokwakha okulindelekile esigabeni esichaza ukuthi izinto zazisebenza kanjani ngaphambili.