VpnService protect() noma ukukhishwa kohlelo lokusebenza: iyiphi elungisa umzila

Kunezindlela ezimbili zokugcina amaphakethe ethuneli ngokwalo ngaphandle kwethuneli: vikela isokhethi yokuthutha, noma khipha lonke uhlelo lokusebenza ku-VPN. Zixazulula izinkinga ezihlukene, futhi ukukhetha okubanzi kakhulu ngenxa nje yokuthi kulula ukukuxhuma yikho kanye okwenza izinhlelo zilahlekelwe ukufinyelela kunethiwekhi yasendaweni kanye ne-DNS ehlukanisiwe ngaphandle kokuqaphela. Qala ngalokho okufanele kuhlale ngaphandle kwethuneli, bese ukhetha ububanzi obuncane kakhulu obukufezayo lokho.

Okukhipha i-protect() ethunelini

VpnService.protect() ukubiza kwesokhethi eyodwa. Unika yona isokhethi noma isichazi esithwala ithuneli, futhi i-Android imaka leyo sokhethi ukuze ukuthutha kwayo kusebenzise inethiwekhi engaphansi esikhundleni sesixhumi se-VPN. Konke okunye okuthunyelwa uhlelo lokusebenza kusalandela umzila ojwayelekile we-VPN.

Yilo ububanzi obuncane inhloso. Isokhethi evikelwe ayishintshi indlela iklayenti lakho le-HTTP elixazulula ngayo amagama, ukuthi yisiphi isixhumi esisetshenziswa izingcingo zakho zokuhlaziya, noma okwenzeka kuxhumano lwesibili oluvulwa kamuva.

Izimo ezintathu ezinquma ububanzi

Isimo sokuqala ukuthi ingabe ukuthutha kwethuneli kuphela okufanele kuphume. Uma okunye ukuthutha kohlelo lokusebenza kusafanele kudlule ku-VPN, ukuvikelwa kwesokhethi yibo ububanzi obulungile. Isimo sesibili ukuthi ingabe uwena olawula ukwakhiwa kwesokhethi. Umtapo wolwazi ovula isokhethi yawo ngokujulile ngaphakathi awukushiyeleli indawo yokubiza i-protect() ngaphandle uma uveza ihhuku noma wamukela isokhethi esivele yakhiwe. Isimo sesithathu ukuthi ingabe uhlelo lokusebenza kufanele lufinyelele ngqo kunethiwekhi yasendaweni noma engxenyeni yokungena, okuyisidingo esihlukile ekugcineni ithuneli liphila.

Ukukhipha uhlelo lokusebenza nge-addDisallowedApplication() iyithuluzi elingagqamile. Ikhipha lonke ukuxhumana okwenziwa uhlelo lokusebenza ku-VPN, kuhlanganise nalokho obufuna ukukuhlola, futhi kwamanye amadivaysi ishintsha nendlela ukutholwa kwasendaweni okuziphatha ngayo.

Inketho yesithathu ukubopha ukuthutha kunethiwekhi ekhethiwe nge-bindProcessToNetwork() noma ngesibambo senethiwekhi esezingeni lesokhethi. Lokhu kuyasiza lapho idivaysi inayo i-Wi-Fi neselula ngasikhathi sinye futhi ufuna ithuneli lihambe ngomzila othile ophezulu.

Yibiza ngenkathi ukuthutha kusakhiwa

Biza i-protect() esigabeni esisodwa esakha ukuthutha, ngaphambi kwe-connect() noma i-send(). Uma ubizo lubuyisa i-false, vala isokhethi futhi ukusethwa kuhluleke; ukuqhubeka kukushiya nokuthutha okungase kuphinde kungene esixhumini sakho amaphakethe alo.

Isimo sincane ngokwanele ukuba sigcinwe endaweni eyodwa:

DatagramSocket transport = new DatagramSocket();
if (!protect(transport)) {
    transport.close();
    throw new IOException("transport not protected");
}
transport.connect(serverAddress);

Kunezinto ezintathu ezilumayo lapha. Okokuqala, inani le-boolean iwukuphela kwesibonakaliso ositholayo, ngakho faka ukwehluleka emlandweni ngomongo owanele wokuhlukanisa imvume ehoxisiwe kusuka ekubizeni okunqatshiwe. Okwesibili, i-protect() ihlanganisa isokhethi, hhayi inombolo yesichazi: uma uvale isokhethi bese kamuva usebenzisa leyo nombolo ephelele kwesinye isokhethi, isokhethi entsha ayivikelwe. Okwesithathu, uma umtapo wolwazi womdabuko uvula ukuthutha, vikela isichazi ngaphambi kokuba ikhodi yomdabuko ixhumane, ngaphandle kwalokho umzila kungenzeka usukhethiwe. Isithenjwa se-VpnService yindawo yokuqinisekisa ukuthi yikuphi ukulayishwa okwedlulayo okuhlinzekwa yizinga le-API yakho oqondile.

Hlola umzila ovinjiwe, hhayi owomhlahlandlela kuphela

Qinisekisa ngethuneli livuliwe, ngoba yisimo okuwukuphela kwaso lapho imizila emibili ingahluka khona. Thumela isicelo esisodwa ngokuthutha okuvikelwe nesinye sisuka emzileni wekhodi ongakaze ubize i-protect(), bese uqhathanisa lokho umkhawulo okude okubonayo: ukuxhumana okuvikelwe kufanele kufike nenethiwekhi engaphansi njengomthombo, kuyilapho okungavikelwe kukhombisa ikheli lethuneli ngokwalo futhi kunyakazisa izibali zamabhayithi ethuneli. Kudivaysi, i-ss noma i-netstat ikhombisa lokho kwahlukanisa ngaphambi kokuba noma yini iphume emsakazweni.

Hlola ukuhoxiswa ngokwehlukile, ngoba ukushintsha kwemvume kubhidliza isixhumi ngaphandle kokuthinta ikhodi yakho yesokhethi. Hoxisa imvume ye-VPN noma ufake isevisi, wakhe kabusha ukuthutha, bese uqinisekisa ukuthi i-protect() isabuyisa i-true nokuthi ukuthutha kuxhuma kabusha uma imvume inikezwa futhi.

Uma isicelo esivikelwe silandela ithuneli noma kunjalo, ubizo lokuvikela cishe lwenzeka ngemva kokuba isokhethi isiqondisiwe. Lususe luyise phambili bese uhlola futhi.

Gcina isinqumo sibhaliwe eduze kokusethwa kokuthutha: yikuphi ukusebenzisa isokhethi okuvikelwe, yikuphi ukuthutha kohlelo lokusebenza okukhishiwe, nokuthi uhlelo lokusebenza lwenzani uma ukuvikela kuhluleka. Lowo mugqa yiwona ovimbayo ukuthi ukuhlelwa kabusha kamuva kungandisi ukukhishwa kulo lonke uhlelo lokusebenza ngenxa yokuthi ukuhlolwa okukodwa kwehluleka. Kubuye kunikeze umuntu olandelayo indlela yokuhlola inhloso ngaphandle kokuqonda i-manifest ngokuhlehla.