{"id":102274,"date":"2021-11-12T21:36:38","date_gmt":"2021-11-12T19:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-nebula-1-5-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej"},"modified":"2021-11-12T21:36:38","modified_gmt":"2021-11-12T19:36:38","slug":"vypusk-nebula-1-5-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-nebula-1-5-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej","title":{"rendered":"Vyd\u00e1n\u00ed Nebula 1.5, syst\u00e9mu pro vytv\u00e1\u0159en\u00ed overlayov\u00fdch P2P s\u00edt\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byl vyd\u00e1n projekt Nebula 1.5, kter\u00fd nab\u00edz\u00ed n\u00e1stroje pro vytv\u00e1\u0159en\u00ed zabezpe\u010den\u00fdch overlay s\u00edt\u00ed. S\u00ed\u0165 m\u016f\u017ee propojit n\u011bkolik a\u017e des\u00edtky tis\u00edc geograficky rozpt\u00fdlen\u00fdch hostitel\u016f um\u00edst\u011bn\u00fdch u r\u016fzn\u00fdch poskytovatel\u016f, \u010d\u00edm\u017e vytv\u00e1\u0159\u00ed samostatnou izolovanou s\u00ed\u0165 nad glob\u00e1ln\u00ed s\u00edt\u00ed. Projekt je naps\u00e1n v jazyce Go a je distribuov\u00e1n pod licenc\u00ed MIT. Projekt byl zalo\u017een spole\u010dnost\u00ed Slack, kter\u00e1 vyv\u00edj\u00ed stejnojmenn\u00fd firemn\u00ed messenger. Podporuje provoz v Linuxu, FreeBSD, macOS, Windows, iOS a Android. <\/p>\n

Uzly v s\u00edti Nebula spolu komunikuj\u00ed p\u0159\u00edmo v re\u017eimu P2P \u2014 jakmile je pot\u0159eba p\u0159en\u00e1\u0161et data mezi uzly, jsou dynamicky vytv\u00e1\u0159ena p\u0159\u00edm\u00e1 VPN<\/a>-p\u0159ipojen\u00ed. Identita ka\u017ed\u00e9ho hostitele v s\u00edti je potvrzena digit\u00e1ln\u00edm certifik\u00e1tem, a p\u0159ipojen\u00ed k s\u00edti vy\u017eaduje autentizaci \u2014 ka\u017ed\u00fd u\u017eivatel obdr\u017e\u00ed certifik\u00e1t, kter\u00fd potvrzuje IP adresu v s\u00edti Nebula, jm\u00e9no a \u010dlenstv\u00ed ve skupin\u00e1ch hostitel\u016f. Certifik\u00e1ty jsou podepisov\u00e1ny intern\u00edm certifika\u010dn\u00edm centrem, kter\u00e9 je nasazeno tv\u016frcem s\u00edt\u011b na jeho za\u0159\u00edzen\u00edch a pou\u017e\u00edv\u00e1 se pro ov\u011b\u0159ov\u00e1n\u00ed pravomoc\u00ed hostitel\u016f, kte\u0159\u00ed maj\u00ed pr\u00e1vo p\u0159ipojit se k overlayov\u00e9 s\u00edti. <\/p>\n

Pro vytvo\u0159en\u00ed autentizovan\u00e9ho a zabezpe\u010den\u00e9ho komunika\u010dn\u00edho kan\u00e1lu v Nebula se pou\u017e\u00edv\u00e1 vlastn\u00ed tunelov\u00fd protokol zalo\u017een\u00fd na protokolu v\u00fdm\u011bny kl\u00ed\u010d\u016f Diffie-Hellmana a \u0161if\u0159e AES-256-GCM. Implementace protokolu je zalo\u017eena na osv\u011bd\u010den\u00fdch a prov\u011b\u0159en\u00fdch prvc\u00edch, kter\u00e9 poskytuje framework Noise, kter\u00fd se tak\u00e9 pou\u017e\u00edv\u00e1 v projektech jako WireGuard, Lightning a I2P. Tvrd\u00ed se, \u017ee projekt pro\u0161el nez\u00e1visl\u00fdm auditem bezpe\u010dnosti. <\/p>\n

Pro detekci dal\u0161\u00edch uzl\u016f a koordinaci p\u0159ipojen\u00ed k s\u00edti jsou vytv\u00e1\u0159eny speci\u00e1ln\u00ed uzly \u201elighthouse\u201c, jejich\u017e glob\u00e1ln\u00ed IP adresy jsou pevn\u011b stanoveny a zn\u00e1m\u00e9 \u00fa\u010dastn\u00edk\u016fm s\u00edt\u011b. Uzly-\u00fa\u010dastn\u00edci nemaj\u00ed vazbu na extern\u00ed IP adresu<\/a>, jsou identifikov\u00e1ny podle certifik\u00e1t\u016f. Majitel\u00e9 hostitel\u016f nemohou prov\u00e1d\u011bt zm\u011bny v podepsan\u00fdch certifik\u00e1tech a na rozd\u00edl od tradi\u010dn\u00edch IP s\u00edt\u00ed nemohou simulovat jin\u00e9ho hostitele jednoduchou zm\u011bnou IP adresy. P\u0159i vytv\u00e1\u0159en\u00ed tunelu je identita hostitele potvrzena individu\u00e1ln\u00edm soukrom\u00fdm kl\u00ed\u010dem. <\/p>\n

Vytvo\u0159en\u00e9 s\u00edti je p\u0159i\u0159azen specifick\u00fd rozsah intranetov\u00fdch adres (nap\u0159\u00edklad 192.168.10.0\/24) a je zaji\u0161t\u011bno spojen\u00ed intern\u00edch adres s certifik\u00e1ty hostitel\u016f. Z \u00fa\u010dastn\u00edk\u016f overlay s\u00edt\u011b mohou b\u00fdt tvo\u0159eny skupiny, nap\u0159\u00edklad pro odd\u011blen\u00ed server\u016f a pracovn\u00edch stanic, na kter\u00e9 se vztahuj\u00ed r\u016fzn\u00e9 pravidla filtrov\u00e1n\u00ed provozu. Jsou poskytov\u00e1ny r\u016fzn\u00e9 mechanismy pro obch\u00e1zen\u00ed p\u0159ekladatel\u016f adres (NAT) a firewall\u016f. Je mo\u017en\u00e9 organizovat sm\u011brov\u00e1n\u00ed p\u0159es overlay s\u00ed\u0165 provozu t\u0159et\u00edch hostitel\u016f, kte\u0159\u00ed nejsou sou\u010d\u00e1st\u00ed s\u00edt\u011b Nebula (unsafe route). <\/p>\n

Je podporov\u00e1no vytv\u00e1\u0159en\u00ed firewall\u016f pro odd\u011blen\u00ed p\u0159\u00edstupu a filtrov\u00e1n\u00ed provozu mezi uzly v overlay s\u00edti Nebula. Pro filtrov\u00e1n\u00ed se pou\u017e\u00edvaj\u00ed ACL s ozna\u010den\u00edm tagy. Ka\u017ed\u00fd hostitel v s\u00edti m\u016f\u017ee definovat vlastn\u00ed pravidla filtrov\u00e1n\u00ed podle hostitel\u016f, skupin, protokol\u016f a s\u00ed\u0165ov\u00fdch port\u016f. P\u0159itom jsou hostitel\u00e9 filtrov\u00e1ni nikoli podle IP adres, ale podle certifikovan\u00fdch digit\u00e1ln\u00edm podpisem identifik\u00e1tor\u016f hostitel\u016f, kter\u00e9 nelze pad\u011blat bez kompromitace koordinuj\u00edc\u00edho certifika\u010dn\u00edho org\u00e1nu s\u00edt\u011b. <\/p>\n

V nov\u00e9m vyd\u00e1n\u00ed: <\/p>\n