Kungani i-403 evela kusayithi ye-VPN akuwona ukwehluleka kweproxy

Abasebenzisi banqamula i-VPN, bahlangabezana ne-403 kusayithi langaphakathi futhi babika ukuthi iproxy iphukile. Izinto ezintathu ezihlukene zingakhiqiza lelo khasi: umthombo wenqabile isicelo, iproxy yokuya phambili yenqabile ukuvula umhubhe, noma iproxy yafuna izifakazelo zayo. Ngayinye iyimpendulo efanele embuzweni ohlukile, futhi ukuzicaba zibe yikhasi elilodwa lokwehluleka okujwayelekile kucekela phansi ubufakazi obulodwa onabo. Hlela ukwenqaba ngezingxenye ezikhiqize, bese uqhathanisa indlela yenethiwekhi esetshenziswa yingxenye ngayinye ngempela.

Shono ingxenye ekhiqize i-403

Ikhodi yesimo se-HTTP ingeyalowo oyithumele. Lapho umthombo ubuyisela i-403, uhlaziye isicelo futhi wanquma ukuthi umfoni kungenzeka akanaso isisetshenziswa, okuyimpendulo yegunya hhayi inkinga yokuthutha. Lapho iproxy yokuya phambili iphendula nge-403 ku-CONNECT, yenqaba ukwakha umhubhe nhlobo, futhi akukho lutho olungaphezulu olwake lwaxhunyaniswa. Lapho iphendula nge-407, ifuna izifakazelo zayo, ezingahlobene nokungena kohlelo.

I-RFC 9110 ichaza lezi zindima, kuhlanganise nenselelo eqondene neproxy. Funda isimo sompendulo uqobo kanye nanoma iyiphi intloko ye-Proxy-Authenticate ngaphambi kokufunda umzimba, ngoba ikhasi lephutha le-HTML elinomusa ngokuvamile lifihla ukuthi iyiphi ingxenye elibhalile.

Okufihlwa umhubhe we-CONNECT kudluliso lwamabhayithi

Lapho iproxy ibuyisela i-200 ku-CONNECT, idlulisa amabhayithi futhi isiphequluli sigcina iseshini yaso ye-TLS nomthombo. Ngakho iproxy edlulisa amabhayithi ayikwazi ukufunda i-403 ebethelwe ngaphakathi kwaleyo seshini, futhi ayisoze ibe umbhali wokwenqaba. Ukwenqaba ngaphambi kokuvulwa komhubhe kungumcimbi ohluke ngokuphelele, okhiqizwa ezingeni elilodwa ngaphansi.

Iproxy ehlanekezelayo eqeda i-TLS isesimweni esihlukile: ingumnikazi womngcele we-TLS, ihlaziya i-HTTP futhi ingabhalha kabusha noma ivimbe izimpendulo ngokusemthethweni. Lelo khono liwukukhetha kokuhlelwa, hhayi isici seproxy ngokujwayelekile, futhi alikuniki igunya lokweqa inqubomgomo yokufinyelela yohlelo. Ukufunda impendulo kuyikhono; ukunquma ukuthi umfoni angabona ini kuhlala kuwumsebenzi womthombo.

Umphumela ongokoqobo ukuthi kufanele wazi ukuthi iyiphi kwezindlela ezintathu ozisebenzisayo ngaphambi kokuhumusha i-403. Ukwengeza imithetho yokuhlola i-HTTP kuproxy yokugeleza akukuyiniki ukubonakala, futhi ukulindela ukuthi ukudluliswa kwamabhayithi kuchaze ukwenqaba komthombo kuzokuthumela kuyilogi engalungile.

Qhathanisa indlela yokuphuma yeproxy nekheli lomhubhe lesiphequluli

Isiphequluli esixhunywe ku-VPN asiyithuthi ngokuzenzakalela iseva yeproxy ehlukile iye kulowo mhubhe. Umthombo ubona ikheli lokuphuma leproxy, futhi uma iproxy isaphuma ngomzila ozenzakalelayo wasekhaya, isayithi elivikelwe libona ikheli elingakaze lihlelwe ukuba lithenjwe. Ikheli le-VPN langaphakathi kukhompyutha ephathwayo alibonakali kulo mthombo. Lesi yisizathu esivame kakhulu sokuthi umhubhe osebenzayo usanikeza i-403 kusayithi esiziphatha kahle kubo bonke abanye.

Hlola izindlela zombili ngokwehlukana ukuze amakheli angadidaniswa.

curl -sS -o /dev/null -w 'status=%{http_code}\n' --noproxy '*' https://198.51.100.20/private
curl -sS -o /dev/null -w 'status=%{http_code}\n' -x http://203.0.113.10:3128 https://198.51.100.20/private

Isicelo sokuqala sibonisa ukuthi umthombo uphendula ini ekhelini lakho, esesibili sibonisa ukuthi uphendula ini ekhelini leproxy. Ipheya ye-403 ehambisanayo ikhomba emithethweni yegunya yomthombo; i-200 elandelwa i-403 ikhomba endleleni yeproxy. Buza umnikazi womthombo ukuthi iyiphi imithetho eyamukela ngempela amakheli omsuka, esikhundleni sokucabanga ukuthi ichibi le-VPN lifakiwe.

Hlola umngcele ngamunye ngesicelo osihlukanisayo

Hlukanisa ungqimba lweproxy ngokuyicela into engeke ikwazi ukuyinqaba ngenxa yezizathu zohlelo. I-CONNECT iya kumsingathi iproxy evunyelwe ukufinyelela kuwo, ngokulahla okukhiphayo, ikutshela ukuthi ukungena emhubheni kuyasebenza yini nhlobo.

curl -sSv -o /dev/null -x http://203.0.113.10:3128 https://198.51.100.20/ 2>&1 | grep -E 'CONNECT|HTTP/1.1|Proxy-Authenticate'

Uma lokho kuphrinta i-200 ye-CONNECT bese kuba ukuxhawulana kwe-TLS, ukungena kweproxy kulungile futhi i-403 yakamuva yavela emthonjeni. Uma kuphrinta i-407, nikeza izifakazelo zeproxy nge---proxy-user bese uphinda ngaphambi kokufinyelela noma yisiphi isiphetho ngesayithi. Uma kuphrinta i-403 emgqeni we-CONNECT, uhlu lwemvume lweproxy uqobo luwumngcele okufanele uhlolwe, futhi uhlelo alunandaba.

Gcina izifakazelo ngaphandle komlando we-shell nangaphandle kwemibhalo enanyathiselwe. Iphasiwedi yeproxy ethayiphiwe emgqeni womyalo iyabonakala kwabanye abasebenzisi basendaweni, futhi umkhondo we-CONNECT othweswe izifakazelo mubi kunokungabi nawo nhlobo.

Gcina isinqumo sifundeka esikhundleni sokubhala kabusha ikhasi

Uma usazi ukuthi iyiphi ingxenye enqabile, gcina leyo mpendulo. Iproxy ehlanekezelayo eqamba kabusha i-403 yomthombo njengokuphela kwesikhathi kwe-504, noma eyishintsha ngekhasi lokuphumelela, ifihla isinqumo segunya ngemuva kwendaba yokutholakala futhi ithumela ophendulayo olandelayo eqenjini elingalungile. Amakhasi ephutha enziwe ngokwezifiso alungile uma egcina isimo futhi engeza umongo.

Ukugcinwa kukhashe nakho kufanele kunakekelwe ngendlela efanayo. I-RFC 9111 ilawula ukuthi amakhashe abiwe angayisebenzisa kabusha kanjani imimpendulo, futhi ukwenqaba okukhiqizelwe umfoni oyedwa akumele kunikezwe omunye ngokungathi kuyimvume. Uma imimpendulo yokwenqaba igcinwa nhlobo, gcina iyimfihlo futhi inomkhawulo, futhi ungasoze wengeze umthetho wokusha komphakathi ukuze nje wehlise ithrafikhi ephezulu.

Qeda ngesinqumo esibhaliwe esisho ingxenye, isimo esikhiqize kanye nekheli lomsuka umthombo owubonile. Rekhoda isicelo esiqondile, izilungiselelo zeproxy ezisebenzayo kanye nesikhathi, ukuze umbiko olandelayo uqhathaniswe nobufakazi obufanayo esikhundleni sokuphinde bucashunwe enkumbulweni. Lokho kurekhoda kuphendula umbiko olandelayo ngemizuzwana futhi kuvimbela i-403 efanayo ukuba iphinde ihlolwe njengokuphazamiseka kwe-VPN.