Kungani i-Android VpnService ibamba ingxenye yethrafikhi, hhayi yonke

Akukho lutho ku-VpnService olubamba ithrafikhi ngokwalo. Icela uhlelo ukuthi linikeze i-tun interface, inikeza ley interface iqoqo lamakheli nemizila, futhi kusukela ngalowo mzuzu i-kernel ikopisha yonke iphakethe elihambisana nalezo mizila ku-file descriptor uhlelo lokusebenza olungayifunda. Ikhodi yohlelo lokusebenza ayilokothi ibone amaphakethe angakhethwanga yimizila, ngakho ububanzi be-tunnel umbuzo wethebula yokuhambisa ngaphambi kokuba kube umbuzo wokuhlela. Yingakho ukusetshenziswa kwesevisi okufanayo kungagwinya yonke imifudlana kuyi icingo elilodwa futhi kugwinye ingxenye kuphela kwelinye, futhi yingakho ukwengeza umzila ngezinye izikhathi kulungisa i-tunnel ebonakale iphukile. Okutholayo yilokho okukumenyezelile, kususwa konke umakhi akwenqabile ngokuthula.

Imizila inquma ukuthi yimaphi amaphakethe afikayo

Builder.addRoute(prefix, prefixLength) ifaka i-prefix kuthebula yokuhambisa yenethiwekhi ye-VPN. Uhlelo luthatha leyo nethiwekhi njengejwayelekile kuzinhlelo ezisobubanzeni, ngakho amarekhodi ayo abhekwa ngaphambi komzila ojwayelekile wenethiwekhi yomzimba futhi i-prefix efanayo yanele ukuhambisa umfudlana kwenye indawo. Ngakho umzila we-0.0.0.0/0 uthatha i-IPv4 yonke, kufaka iphrinta, ilitshe le-cast nekhasi lokuphatha lesiphathimandla somzila.

Amaklayenti afuna lokho kufakwa ngaphandle kokususa irekhodi elijwayelekile lomzimba asebenzisa i-pheya 0.0.0.0/1 ne-128.0.0.0/1 esikhundleni. Imizila emibili eqondile kakhulu yehlula umzila ojwayelekile, ndawonye ihlanganisa yonke indawo yamakheli, futhi irekhodi elijwayelekile lecingo ngokwalo lihlala kuthebula kumakhokho asaboshelwe kunethiwekhi yomzimba.

Amakheli namarekhodi e-DNS avela kumakhi oyedwa futhi aphendula umbuzo ohlukile. addAddress inikeza i-interface ikheli elinobude be-prefix, futhi addDnsServer ifaka isisombululi esizobuzwa yizinhlelo ezisobubanzeni ngokusebenzisa i-interface. Imindeni yomibili ingahlala ku-interface eyodwa, ngakho iqoqo lemizila ye-IPv4 kuphela eduze kwekheli le-IPv6 isakhiwo esifundwa ngendlela efanele futhi esivuzayo. Uma uhambisa umndeni ongenakho ikheli ku-interface, i-kernel ayinakho ikheli lomthombo lalabo maphakethe futhi awaveli neze ku-descriptor.

I-establish() ibuyisa ini

I-establish() ibuyisa i-ParcelFileDescriptor, noma i-null uma uhlelo lokusebenza lungagunyaziwe. I-null yisimo semvume hhayi iphutha lenethiwekhi: i-VpnService.prepare() kufanele ukuthi isivele yabuyisa i-null, noma umsebenzisi kufanele ukuthi wagunyaza ingxoxo yohlelo ngaphambi kocingo. Imvume ingahoxiswa ngenkathi isevisi isebenza, futhi i-interface ivaleka ngaphansi kwezinyawo zakho ngaphandle kwanoma yikuphi ukubuyela embonini yakho yokufunda.

I-descriptor ayivimbi ngaphandle uma usho okunye, ngakho ukufunda kubuyela ngokushesha ngaphandle kwedatha esikhundleni sokumisa umucu. Ilupu ebhalelwe ikhokho evimbayo ishisa ingqondo eyodwa, futhi ilupu ethatha ukufunda okungenalutho njengokubulalayo ihlukanisa i-tunnel phakathi nesekhondi elingenzi lutho. I-Builder.setBlocking(true) ishintsha lokho kuziphatha, futhi intengo umucu olindayo ngaphakathi kokufunda.

Izimpikiswano zomzila nekheli ziqinisekiswa njengamavelu e-LinkAddress, futhi izindawo ze-multicast ezifana ne-224.0.0.0/4 zenqatshwa ngqo. I-interface ye-tun yephoyinti-kuya-phoyinti nayo ayinayo isifunda sokusakaza, ngakho ukuthola i-multicast kuyo kudinga umklamo ohlukile hhayi omunye umzila. Uhlu okufanele lubhekwe yi-VpnService.Builder, ngaphambi kokuthi uphethe ngokuthi ucingo lweqiwe.

Ububanzi ngohlelo ngalunye bunciphisa iqoqo, hhayi i-tunnel

Kusukela ku-API 21 umakhi wamukela i-addAllowedApplication ne-addDisallowedApplication, futhi izinhlu zombili ziyaphikisana ngaphakathi komakhi oyedwa. Uhlu lokuvumela lwenza i-tunnel ibe khona lalabo maphakethe ngenkathi konke okunye kugcina inethiwekhi yomzimba; uhlu lokwenqabela lubamba konke ngaphandle kwamaphakethe ashiwo, okuyilokho iklayenti elikunikezayo njenge-tunnel ehlukanisiwe. Ngaphambi kwe-API 21 awukho neze umshini wesikhulumi, futhi ukuziphatha ngohlelo ngalunye kwakuvela kumaklayenti abantu besithathu ababehlunga nge-UID ngaphakathi kwesidluliseli sabo. Lo mehluko ubalulekile lapho uhlola amaphutha, ngoba i-tunnel ngohlelo ngalunye enohlu lokuvumela lwephakethe elilodwa cishe ayikhiqizi thrafikhi futhi lokho kungukuziphatha okulungile, hhayi umzila ophukile.

Noma ngabe ububanzi bungakanani, ikhokho uhlelo lwakho oluvula ku-server ye-VPN akufanele lidlule kule-tunnel eliyakhayo. I-VpnService.protect(socket) ibopha leyo khokho kunethiwekhi engaphansi ukuze amaphakethe ayo adlule idivayisi ye-tun. Uma weqa ucingo, ukuxhawula kugwinywa i-interface okwakufanele ikukhulise.

I-VpnService.setUnderlyingNetworks ivala umjikelezo ngokutshela uhlelo ukuthi iyiphi inethiwekhi yomzimba ethwala i-tunnel. Lelo velu linquma ukuthi i-VPN ibika kanjani ukuxhumana kwezinye izinhlelo, futhi i-null noma ivelu esidala iyimbangela ejwayelekile ye-tunnel exhunyiwe uhlelo oluthatha njengengaxhunyiwe. Yibuyekeze lapho inethiwekhi engaphansi ishintsha, hhayi kuphela lapho iqala.

Ama-checksum ne-MTU: lapho umzila olungile usahluleka khona

Lapho amaphakethe efika, imininingwane emibili ezingeni lephakethe inquma ukuthi kukhona okusebenzayo kusukela ekupheleni kuya ekupheleni. Okokuqala ikheli lomthombo: ngamakheli amaningi e-interface i-kernel ingakhipha amaphakethe athwala elokuqala, ngakho isidluliseli esibhala kabusha izihloko kufanele silungise ikheli ne-checksum elisibekhayo.

Okwesibili ububanzi be-checksum. Lapho uhlelo lokusebenza lwakha amaphakethe e-TCP noma e-UDP ngokwalo, i-checksum ibekha isihloko esingelona esiphethe ikheli lomthombo, ikheli lomkhondo, inombolo yephrothokholi nobude bokuthutha, futhi ukweqa noma yikuphi kwalokho kunikeza amaphakethe afikayo alahlwe. Lokho kwehluleka kubonakala njengokuphela kwesikhathi ngemva kwempendulo engafiki neze, futhi lokho kubuyisela iningi emizileni. I-setMtu ibeka i-MTU ye-interface, futhi ukufunda ngakunye kubuyisa iphakethe elilodwa le-IP eliphelele, ngakho ibhafa ebhalelwe ukugeleza kwamabhayithi izohlakaza ukuhlaziya kwakho, hhayi iphakethe.

Umjikelezo wokuqinisekisa ohlukanisa izendlalelo

Ukuze uthole lapho ububanzi bungahamba khona kabi, hlola izendlalelo ngokulandelana. Buza idivayisi ukuthi imiphi imizila inethiwekhi ye-VPN eyiphethe ngempela, bese uhlola ukuthi umfudlana oya ekhelini elaziwayo uvela njengokufunda ku-descriptor, bese uhlola ukuthi iphakethe elikhiphwa yisidluliseli sakho lakhiwe kahle. Inkinga yomzila ayibonisi lutho ku-descriptor, kuyilapho inkinga ye-checksum ibonisa iphakethe elifikayo linyamalale.

Uma kungabanga lutho olufinyelela ku-descriptor, okusolwayo yiqoqo lemizila hhayi umfundi: qinisekisa ama-prefix, qinisekisa ukuthi kukhona ikheli emndenini ofanayo, futhi uqinisekise ukuthi uhlelo lokusebenza lungaphakathi kobubanzi obukubekile. Uma amaphakethe efinyelela ku-descriptor kodwa kungabuyi lutho, hlola i-protect() nevelu lenethiwekhi engaphansi ngaphambi kokuthinta umzila futhi. Uma uhlangothi olukude lubika amaphakethe akhohlakele, i-checksum ne-MTU yizindawo okufanele zibhekwe. Ukuhlola okukodwa ngesendlalelo konga ingxenye yosuku yokuqagela.