Android VPN: i-descriptor ye-VpnService ne-divayisi ye-tun ye-root

Izindlela ezimbili zingabeka i-interface ye-IP phambi kohlelo lokusebenza lwe-Android, futhi zombili ziphelela ohlotsheni olufanayo lwe-descriptor yefayela enabanikazi abahluke kakhulu. Enye ihamba nge-VpnService kanye ne-builder yayo, enye nge-root shell kanye ne-/dev/net/tun. Konke ukufunda kuleyo descriptor kuyiphakethe eliphumayo futhi konke ukubhala kuyiphakethe elingenayo. Okuhlukanisa izindlela ukuthi ubani ophethe inqubomgomo, ubani ophula ukuthuthukiswa kwe-OS, nokuthi yingaki ithebula lokuhamba ongayithinta.

Thatha indlela yesikhulumi ngaphandle uma ungakwazi ukusho into ethile esala ukuyenza. Lokho kwala ngokuvamile yi-TAP, ukubamba ngaphandle kwesethi yakho yezinhlelo, noma umthetho wokuhamba ongadalulwanga wuhlelo lwezinhlaka.

Endleleni yesikhulumi umemezela inhloso esikhundleni semiyalo. Unikeza okungenani ikheli elilodwa, imizila oyifunayo, amaseva e-DNS kanye nohlu lwezinhlelo olungakhethwa, bese insizakalo yohlelo lwe-Android yenza ukusethwa okunamalungelo ngaphansi kobuwena bayo. Awulazi igama le-interface kusengaphambili futhi awukhiphi i-ioctl eyidala, futhi yilokho okubalulekile.

Izindlela ezimbili zokuthola i-interface ye-IP

Indlela ye-root iresiphi endala. Uvula i-/dev/net/tun, ushayela i-TUNSETIFF nge-IFF_TUN, uphakamisa i-interface nge-ip link, futhi wengeza amakheli nemizila ngesandla. Isinyathelo ngasinye ngesakho ukuze usenze kahle, kuhlanganise nalezo obekuzozishintsha uhlelo lwezinhlaka buthule. Umzila owodwa ongekho unikeza umsebenzisi umbiko ofanayo noweseva efile.

Ukususa amaphutha kwehluka ngendlela okufana ngayo nokusetha. Endleleni ye-root i-interface ikhona noma i-ioctl yakho ibuyise iphutha ongalifunda ngqo. Endleleni yesikhulumi i-interface ikhona kuphela ngemva kokuphumelela kwe-establish(), ngakho ukwehluleka kuza njengesihluzo noma i-descriptor engu-null esikhundleni sendawo yedivayisi ongayigwaza.

I-establish() ibuyisani ngempela

I-Builder.establish() inemiphumela emithathu futhi idinga izimpendulo ezintathu ezihlukene. I-descriptor isho ukuthi i-interface isethiwe futhi ngeyakho ukuyisebenzisa, i-null isho ukuthi isicelo asidlulanga, futhi isihluzo esikhishiwe sisho ukuthi insizakalo yohlelo iyenqabile. Ukuhlanganisa i-null nokuphumelela kube i-boolean eyodwa iyindlela evame kakhulu uhlelo olubika ngayo umhubhe osebenzayo ongalokothi uthwale iphakethe. Incwadi yokubhekisa ye-Builder isho imfuneko yekheli, futhi kufanelekile ukuyifunda ngaphambi kokusola iseva.

Izindlela zinqunywa i-descriptor, hhayi iphrothokholi yakho. Ukufunda kukunikeza amaphakethe aphumayo asevele eqokiwe we-VPN, futhi ukubhala kujova amaphakethe angenayo abuyele ku-interface. Ukubethela, ukuqinisekisa kanye nokwakha amafremu alawo maphakethe kungumsebenzi wokuthutha kwakho, ngoba isikhulumi siyama emngceleni wephakethe.

I-Binder iyisinyathelo esisodwa, i-JNI ingenye i-eksisi

Isicelo se-builder singena ohlelweni nge-Binder, futhi kwenye indawo ngaphansi kwalokho isikhulumi sibiza ikhodi yomdabu ukusetha idivayisi. Lezi zindlela ezimbili ezihlukene ezibekwe phezu komunye emkhankasweni owodwa. I-Binder ukuxhumana phakathi kwezinqubo phakathi kohlelo lwakho nensizakalo yohlelo, kuyilapho i-JNI iyibhuloho elisuka ku-Java liye komdabu ngaphakathi kwenqubo. Ukufunda isihlahla se-AOSP se-Android 9 kwenza isitaki sibonakale ngokoqobo, futhi kufanelekile ukukhumbula ukuthi amagama ezigaba zangaphakathi nezindlela zamafayela ziyashintsha phakathi kwezindatshana.

Okungashintshi isivumelwano ongasethemba kuso: i-builder, i-descriptor eyibuyisayo, nomjikelezo wokuphila kwensizakalo eyizungezile. Alukho uhlelo okufanele lubize ukwenziwa kwensizakalo kwangaphakathi noma lwakhe kabusha indawo yedivayisi ukuthola i-interface. Uma ikhodi yakho incike egameni lesigaba se-AOSP, izophuka kundatshana ongayihlolanga.

I-TUN ithwala i-IP, i-TAP ithwala i-Ethernet

I-TUN iyi-interface ye-IP. I-TAP iyi-interface ye-Ethernet, futhi lowo mehluko unquma ukuthi ukwakha ibhuloho kungenzeka yini. Idivayisi ye-TUN ayinalo ikheli le-MAC futhi ayinayo inhloko ye-Ethernet okufanele idlulise, ngakho iklayenti le-TUN alikwazi ukujoyina ibhuloho lesigaba 2, noma ngabe imizila ibhalwe kanjani.

I-VpnService ikunikeza uhlobo lwe-IP, okuyilokho i-VPN yezinga lohlelo ekudingayo nokuphakathi kwayo ngaphandle kwesitaki se-Ethernet esiluhlaza. Uma umklamo wakho udinga ibhuloho, indlela yesikhulumi ngeke ikuyise lapho, futhi indlela ye-root izokwenza kuphela uma ikheneli nezimvume zedivayisi zisebenzisana.

Lapho indlela ye-root isanqoba khona

Imisebenzi emithathu icindezela abantu ukuba basuke endleleni yesikhulumi. Ukwakha ibhuloho lesigaba 2 kudinga i-TAP. Ukubamba ithrafikhi evela ezinhlelweni ezingaphandle kobubanzi bakho be-VPN kudinga ukubonakala okungakunikezwa wuhlelo lwezinhlaka. Ukuhamba ngomgomo okungakadalulwa yi-builder, njengethebula elihlukile lendawo eyodwa, kudinga imithetho oyifaka ngokwakho.

Izindleko ziza kamuva: i-bootloader evuliwe noma isithombe esine-root, inqubomgomo ye-SELinux ehamba ngaphansi kwakho, nedivayisi eyeka ukuziphatha kahle ngemva kwe-OTA. Iresiphi ene-root nayo ayikwazi ukukhishwa ngokusabalalisa izinhlelo okuvamile, ngakho amaqembu amaningi ayigcina njengendlela yokuxilonga yangaphakathi esikhundleni somkhiqizo.

Ukukhetha phakathi kwazo

Qala nge-interface oyidingayo, hhayi ngekhodi onayo. Uma impendulo iyidivayisi ye-TUN enemizila ekhawulelwe kuhlelo, indlela yesikhulumi imfushane futhi iyaphula ekuthuthukisweni. Uma impendulo ihlanganisa amafremu e-Ethernet, ukubamba ezinye izinhlelo, noma imithetho yokuhamba eyenqatshwa yi-builder, usendaweni ye-root futhi kufanele uyibhajethe njengezindleko zokusebenza.

Ukuhlola okuqeda izimpikiswano eziningi: qala ngokwakha indlela yesikhulumi, rekhoda umphumela we-establish() ngokwehlukile esimweni sesikhathi esikude, futhi uqinisekise iphakethe elilodwa endleleni ngayinye. Ngemva kwalokho kuphela yenza isinqumo sokuthi ikhono elingekho liyayivumela yini indlela esekelwe ukuthi ishiywe.