Ukubethelwa komgudu we-WSS kugcina kusihlanganisi se-TLS, hhayi ku-app

Umhubhe othwalwa ngaphakathi kwe-WebSocket evikelekile unokubethela okulingana ncamashí nalokho iklayenti elikufake, hhayi okwengeziwe. Uhlelo lwe-wss:// luthi i-TLS ivikela ukuxhumana okukodwa esigabeni esisodwa. Ayisho lutho mayelana nokuthi amabhayithi angaphakathi kwimiyalezo ye-WebSocket avikelwe ngokwehlukana yini, futhi umehluko lowo uwona onquma ukuthi ngubani ongafunda ithrafikhi yakho lapho okuthile phakathi nendawo kuqeda i-TLS.

Izendlalelo ezimbili ezibonakala njengesisodwa

I-WebSocket evikelekile yi-TLS enokuxhawana kwe-WebSocket okwenziwa phezu kwayo, njengoba RFC 6455 ichaza ezigabeni zayo zokuxhumana nokuphepha. Isendlalelo se-TLS siqinisekisa iseva futhi sibethela umsinga, bese isendlalelo se-WebSocket sihlanganisa lokho uhlelo lokusebenza olunquma ukukuthumela.

Lezi yizinqumo ezimbili ezizimele, futhi umdwebo odwetshela ingidi eyodwa kuyo yonke indlela ufihla eyesibili. Buza ukuthi ngubani oqeda ukuxhumana kwe-TLS. Bese ubuza ukuthi iklayenti lifaka ini ngaphakathi kumyalezo ngamunye. Konke okunye mayelana nokusetshenziswa kulandela kulezi zimpendulo ezimbili.

Idizayini A: ukuthutha ukuphela kokubethela

Emdwebeni olula, iklayenti lithatha amaphakethe e-IP aluhlaza futhi liwagoqa emiyalezweni ye-WebSocket. Akukho lutho ngaphakathi olubethelwe, ngakho ingxenye ephethe isikhathi se-TLS ifunda imithwalo yombhalo ocacile. Lapho leyo ngxenye iyiseva yakho yomhubhe, lena iyindawo yokugcina ehlosiwe futhi idizayini iyahambisana, ngoba iseva yayizobona ithrafikhi noma kanjani.

Kuba ukuhlelwa okunye lapho i-proxy yokuhlola ihlezi endleleni futhi iqeda i-TLS ngesitifiketi iklayenti elisithembayo. Leyo proxy manje isiphethe umbhalo ocacile ofanayo obewuzophela iseva, futhi akukho nani lokuhlanganisa kwe-WebSocket okungakushintsha lokho. Isitoreji sokuthemba sekhayenti sanquma lo mphumela kudala ngaphambi kokuvulwa komhubhe, ngoba sakhetha ukwamukela leso sitifiketi salelo gama. I-proxy ibona futhi umsingathi oceliwe nosayizi womyalezo ngamunye, okwanele ukuthatha uphawu lweminwe lwemisebenzi eminingi ngaphandle kokukhipha okunye okubethelwe.

Idizayini B: umthwalo uphethe okhiye bakho

Emdwebeni wesibili, iklayenti libethela futhi liqinisekise amaphakethe alo ngephrothokholi ye-VPN enobunikazi bozakwabo kanye nokushintshana kokhiye kwayo, bese lithwala umphumela ngaphakathi kwimiyalezo ye-WebSocket. Ukuqeda i-TLS yangaphandle lapha kuveza umbhalo obethelwe, hhayi ithrafikhi. I-proxy ingabona osayizi nokuhamba kwesikhathi kwemiyalezo, futhi akukho okunye emthwalweni. Lokhu kuwukuchayeka okuncane kakhulu, futhi kuseyimethadatha efanele ukuqanjwa emhlolweni kunokushaywa indiva.

Izindawo zokugcina zephrothokholi yangaphakathi zisabona umbhalo ocacile, okuyiyo inhloso yalokhu kuhlelwa futhi kuyiwona umkhawulo wakho. Uma ingxenye endaweni yokugcina igunyaziwe ukufunda idatha ngaphambi kokubethela noma ngemuva kokukhipha ukubethela, isendlalelo esengeziwe asiyivimbi. Okhiye, kanye nesofthiwe ebaphethe, kuhlala kuwumkhawulo obalulekile.

Ilebula le-VPN, isithonjana sekhayenti esijwayelekile noma ikhasi lokumaketha akubona ubufakazi bokuthi le dizayini yenzeka. Ukufunda ifomethi yomthwalo ubufakazi.

Landelela ukuthi umbhalo ocacile uvela kuphi ngempela

Uhlelo lwe-URL lunikeza iqiniso elilodwa, ngakho thola okunye kusuka kuzixhumanisi. Gijimisa izivivinyo ezingezansi ngokulandelana, ngoba ngayinye inciphisa elandelayo:

ss -tnp | grep -E ':(443|8443)\b'
ip -br link show type tun
openssl s_client -connect vpn.example.net:443 -servername vpn.example.net -brief
tcpdump -ni tun0 -c 5 -X

Qala ngokuxhumana kwangaphandle. Isikhathi se-TCP eside esiya embobeni we-TLS yikho ukubukeka komthwali we-WebSocket, futhi isikhathi sesibili esiya kumsingathi ongahlobene kufanele kuchazwe ngaphambi kokubuka ngokujulile. Bese uthola isixhumanisi somhubhe kuklayenti, ngoba idivaysi ye-tun noma i-tap ikutshela ukuthi iklayenti liphethe amaphakethe e-IP kunokuba lenze i-proxy yomsinga owodwa wohlelo.

Ukuthwebula kusixhumanisi somhubhe ngokuvamile kuxazulula umbuzo womthwalo. Izihloko ezifundekayo lapho zisho ukuthi amaphakethe angaphakathi awazange abethelwe ngokwehlukana, kanti imithwalo ene-entropy ephezulu isho ukuthi yabethelwa. Phinda ukuthwebula kusixhumanisi sangaphandle futhi uqhathanise kokubili: uma kokubili kubonakala kungahleliwe, isendlalelo sangaphakathi senza umsebenzi isendlalelo sangaphandle esingakwazi ukuwuhlehlisa.

Buyekeza ukuthemba okuyikho okuwunikezile

Isitifiketi somsuka wenkampani efakiwe siyiqiniso mayelana nesitoreji sokuthemba sekhayenti, hhayi isitatimende mayelana nalokho noma iyiphi i-proxy ekubhalayo noma ekuhlolayo. Setha inqubomgomo esetshenzisiwe kanye nomzila wangempela wokuxhumana esikhundleni sokucabangela indlela yokuziphatha ngokuba khona kwe-CA.

Kumathuluzi aphethwe, buza umphathi ukuthi iyiphi ingxenye eqeda i-TLS, ingabe iklayenti liqinisekisa isitifiketi esikhonjisiwe noma esidlangalaleni, nokuthi iyiphi ifomethi yomthwalo. Lezo zimpendulo ezintathu zikhiqiza okutholakele ongakuvikela kamuva.

Bhala umphumela njengomkhawulo hhayi njengesinqumo. "I-TLS iphela ku-proxy yokuhlola, futhi umthwalo wangaphakathi ubethelwe ngokwehlukana ngokhiye abanabo kuphela izindawo zokugcina" isitatimende esiqinisekisekayo esihlala sikhona uma umthengisi eshintsha. "Ama-WebSockets avikelekile" akuhlali.