{"id":115651,"date":"2024-05-09T13:52:14","date_gmt":"2024-05-09T11:52:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-nebula-1-9-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej"},"modified":"2024-05-09T13:52:14","modified_gmt":"2024-05-09T11:52:14","slug":"vypusk-nebula-1-9-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-nebula-1-9-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej","title":{"rendered":"Vyd\u00e1n\u00ed Nebula 1.9, syst\u00e9mu pro vytv\u00e1\u0159en\u00ed overlayov\u00fdch P2P s\u00edt\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byl vyd\u00e1n release projektu Nebula 1.9, kter\u00fd nab\u00edz\u00ed n\u00e1stroje pro budov\u00e1n\u00ed zabezpe\u010den\u00fdch overlay s\u00edt\u00ed, umo\u017e\u0148uj\u00edc\u00edch spojit geograficky odd\u011blen\u00e9 hosty do samostatn\u00e9 izolovan\u00e9 s\u00edt\u011b, funguj\u00edc\u00ed nad glob\u00e1ln\u00ed s\u00edt\u00ed. Projekt je ur\u010den k vytv\u00e1\u0159en\u00ed vlastn\u00edch overlay s\u00edt\u00ed pro jak\u00e9koli pot\u0159eby, nap\u0159\u00edklad pro spojen\u00ed podnikov\u00fdch po\u010d\u00edta\u010d\u016f v r\u016fzn\u00fdch kancel\u00e1\u0159\u00edch, server\u016f v r\u016fzn\u00fdch datov\u00fdch centrech nebo virtu\u00e1ln\u00edch prost\u0159ed\u00ed u r\u016fzn\u00fdch poskytovatel\u016f cloudu. K\u00f3d je naps\u00e1n v jazyce Go a je distribuov\u00e1n pod licenc\u00ed MIT. Projekt byl zalo\u017een spole\u010dnost\u00ed Slack, kter\u00e1 vyv\u00edj\u00ed stejnojmenn\u00e9ho firemn\u00edho messengeru. Podporuje provoz na Linuxu, FreeBSD, macOS, Windows, iOS a Android. <\/p>\n

Uzly v s\u00edti Nebula spolu komunikuj\u00ed p\u0159\u00edmo v re\u017eimu P2P \u2014 jakmile je pot\u0159eba p\u0159en\u00e1\u0161et data mezi uzly, jsou dynamicky vytv\u00e1\u0159ena p\u0159\u00edm\u00e1 VPN<\/a>-p\u0159ipojen\u00ed. Identita ka\u017ed\u00e9ho hostitele v s\u00edti je potvrzena digit\u00e1ln\u00edm certifik\u00e1tem, a p\u0159ipojen\u00ed k s\u00edti vy\u017eaduje autentizaci \u2014 ka\u017ed\u00fd u\u017eivatel z\u00edsk\u00e1v\u00e1 certifik\u00e1t, kter\u00fd potvrzuje IP adresu v s\u00edti Nebula, jm\u00e9no a \u010dlenstv\u00ed v skupin\u00e1ch hostitel\u016f. Certifik\u00e1ty jsou podepisov\u00e1ny intern\u00edm certifika\u010dn\u00edm \u00fa\u0159adem, kter\u00fd je nasazen tv\u016frcem ka\u017ed\u00e9 jednotliv\u00e9 s\u00edt\u011b na sv\u00fdch za\u0159\u00edzen\u00edch a pou\u017e\u00edv\u00e1 se k ov\u011b\u0159en\u00ed pravomoc\u00ed hostitel\u016f, kte\u0159\u00ed maj\u00ed pr\u00e1vo p\u0159ipojit se k ur\u010dit\u00e9 overlay s\u00edti, v\u00e1zan\u00e9 na certifika\u010dn\u00ed \u00fa\u0159ad. <\/p>\n

Pro vytvo\u0159en\u00ed autentizovan\u00e9ho a zabezpe\u010den\u00e9ho komunika\u010dn\u00edho kan\u00e1lu v Nebula se pou\u017e\u00edv\u00e1 vlastn\u00ed tunelov\u00fd protokol zalo\u017een\u00fd na protokolu v\u00fdm\u011bny kl\u00ed\u010d\u016f Diffie-Hellmana a \u0161if\u0159e AES-256-GCM. Implementace protokolu je zalo\u017eena na osv\u011bd\u010den\u00fdch a prov\u011b\u0159en\u00fdch prvc\u00edch, kter\u00e9 poskytuje framework Noise, kter\u00fd se tak\u00e9 pou\u017e\u00edv\u00e1 v projektech jako WireGuard, Lightning a I2P. Tvrd\u00ed se, \u017ee projekt pro\u0161el nez\u00e1visl\u00fdm auditem bezpe\u010dnosti. <\/p>\n

Pro detekci dal\u0161\u00edch uzl\u016f a koordinaci p\u0159ipojen\u00ed k s\u00edti jsou vytv\u00e1\u0159eny speci\u00e1ln\u00ed uzly \u201elighthouse\u201c, jejich\u017e glob\u00e1ln\u00ed IP adresy jsou pevn\u011b stanoveny a zn\u00e1m\u00e9 \u00fa\u010dastn\u00edk\u016fm s\u00edt\u011b. Uzly-\u00fa\u010dastn\u00edci nemaj\u00ed vazbu na extern\u00ed IP adresu<\/a>, jsou identifikov\u00e1ny podle certifik\u00e1t\u016f. Majitel\u00e9 hostitel\u016f nemohou prov\u00e1d\u011bt zm\u011bny v podepsan\u00fdch certifik\u00e1tech a na rozd\u00edl od tradi\u010dn\u00edch IP s\u00edt\u00ed nemohou simulovat jin\u00e9ho hostitele jednoduchou zm\u011bnou IP adresy. P\u0159i vytv\u00e1\u0159en\u00ed tunelu je identita hostitele potvrzena individu\u00e1ln\u00edm soukrom\u00fdm kl\u00ed\u010dem. <\/p>\n

Vytvo\u0159en\u00e9 s\u00edti je p\u0159id\u011blen ur\u010dit\u00e9 rozmez\u00ed intranetov\u00fdch adres (nap\u0159\u00edklad 192.168.10.0\/24) a je realizov\u00e1no propojen\u00ed intern\u00edch adres s certifik\u00e1ty hostitel\u016f. Jsou poskytov\u00e1ny r\u016fzn\u00e9 mechanismy pro obch\u00e1zen\u00ed p\u0159eklada\u010d\u016f adres (NAT) a firewall\u016f. Je mo\u017en\u00e9 organizovat sm\u011brov\u00e1n\u00ed prost\u0159ednictv\u00edm p\u0159ekryt\u00e9 s\u00edt\u011b provozu jin\u00fdch hostitel\u016f, kte\u0159\u00ed nejsou sou\u010d\u00e1st\u00ed s\u00edt\u011b Nebula (unsafe route). Z \u00fa\u010dastn\u00edk\u016f p\u0159ekryt\u00e9 s\u00edt\u011b mohou b\u00fdt vytv\u00e1\u0159eny skupiny, nap\u0159\u00edklad pro odd\u011blen\u00ed server\u016f a pracovn\u00edch stanic, na kter\u00e9 se vztahuj\u00ed samostatn\u00e1 pravidla filtrov\u00e1n\u00ed provozu. <\/p>\n

Podporov\u00e1no je vytv\u00e1\u0159en\u00ed firewall\u016f pro odd\u011blen\u00ed p\u0159\u00edstupu a filtrov\u00e1n\u00ed provozu mezi uzly v p\u0159ekryt\u00e9 s\u00edti Nebula. Pro filtrov\u00e1n\u00ed se pou\u017e\u00edvaj\u00ed ACL s vazbou tag\u016f. Ka\u017ed\u00fd hostitel v s\u00edti m\u016f\u017ee definovat vlastn\u00ed pravidla filtrov\u00e1n\u00ed podle hostitel\u016f, skupin, protokol\u016f a s\u00ed\u0165ov\u00fdch port\u016f. P\u0159itom jsou hostitel\u00e9 filtrov\u00e1ni ne podle IP adres, ale podle certifikovan\u00fdch digit\u00e1ln\u00edm podpisem identifik\u00e1tor\u016f hostitel\u016f, kter\u00e9 nelze pad\u011blat bez kompromitace certifika\u010dn\u00edho centra, koordinuj\u00edc\u00edho provoz s\u00edt\u011b. <\/p>\n

V nov\u00e9m vyd\u00e1n\u00ed: <\/p>\n