Molweni nonke, igama lam ndinguSasha, ndikhokela uvavanyo lwasemva eFunCorp. Thina, njengabanye abaninzi, siphumeze ulwakhiwo olujolise kwinkonzo. Kwelinye icala, oku kuwenza lula umsebenzi, kuba... Kulula ukuvavanya inkonzo nganye ngokwahlukileyo, kodwa ngakolunye uhlangothi, kukho imfuneko yokuvavanya ukusebenzisana kweenkonzo kunye nomnye, odla ngokuvela kwinethiwekhi.
Kweli nqaku, ndiza kuthetha ngezinto ezimbini ezinokuthi zisetyenziswe ukujonga iimeko ezisisiseko ezichaza ukusebenza kwesicelo phambi kweengxaki zenethiwekhi.
Ukulinganisa iingxaki zenethiwekhi
Ngokuqhelekileyo, isoftware ivavanywa kwiiseva zovavanyo ezinoqhagamshelo olulungileyo lwe-Intanethi. Kwiimeko ezingqongileyo zemveliso, izinto zisenokungabi mtyibilizi kangako, ngoko ngamanye amaxesha kufuneka uvavanye iinkqubo kwiimeko zoqhagamshelo olungentle. Kwi-Linux, into eluncedo iya kunceda ngomsebenzi wokulinganisa iimeko ezinjalo tc.
tc(abbr. ukusuka kuLawulo lweZithuthi) ikuvumela ukuba uqwalasele ukuhanjiswa kweepakethi zenethiwekhi kwinkqubo. Olu ncedo lunamandla amakhulu, unokufunda ngakumbi malunga nabo . Apha ndiza kuqwalasela kuphela ezimbalwa zazo: sinomdla wokucwangciswa kwetrafikhi, esiyisebenzisayo qdisc, kwaye kuba sifuna ukulinganisa umsebenzi womnatha ongazinzanga, siyakusebenzisa i-qdisc engenaklasi .
Masiqalise iseva ye-echo kwiseva (ndiyisebenzisile ):
ncat -l 127.0.0.1 12345 -k -c 'xargs -n1 -i echo "Response: {}"'
Ukuze ubonise ngokweenkcukacha zonke izitampu zexesha kwinyathelo ngalinye lokusebenzisana phakathi komxhasi kunye nomncedisi, ndibhale iscript esilula sePython esithumela isicelo. uvavanyo kwiseva yethu ye-echo.
Ikhowudi yemvelaphi yomthengi
#!/bin/python
import socket
import time
HOST = '127.0.0.1'
PORT = 12345
BUFFER_SIZE = 1024
MESSAGE = "Testn"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
t1 = time.time()
print "[time before connection: %.5f]" % t1
s.connect((HOST, PORT))
print "[time after connection, before sending: %.5f]" % time.time()
s.send(MESSAGE)
print "[time after sending, before receiving: %.5f]" % time.time()
data = s.recv(BUFFER_SIZE)
print "[time after receiving, before closing: %.5f]" % time.time()
s.close()
t2 = time.time()
print "[time after closing: %.5f]" % t2
print "[total duration: %.5f]" % (t2 - t1)
print data
Masiyiqalise kwaye sijonge i-traffic kwi-interface lo kunye nezibuko 12345:
[user@host ~]# python client.py
[time before connection: 1578652979.44837]
[time after connection, before sending: 1578652979.44889]
[time after sending, before receiving: 1578652979.44894]
[time after receiving, before closing: 1578652979.45922]
[time after closing: 1578652979.45928]
[total duration: 0.01091]
Response: Test
Ukulahlwa kwetrafikhi
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:42:59.448601 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [S], seq 3383332866, win 43690, options [mss 65495,sackOK,TS val 606325685 ecr 0,nop,wscale 7], length 0
10:42:59.448612 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [S.], seq 2584700178, ack 3383332867, win 43690, options [mss 65495,sackOK,TS val 606325685 ecr 606325685,nop,wscale 7], length 0
10:42:59.448622 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 606325685 ecr 606325685], length 0
10:42:59.448923 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 606325685 ecr 606325685], length 5
10:42:59.448930 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [.], ack 6, win 342, options [nop,nop,TS val 606325685 ecr 606325685], length 0
10:42:59.459118 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 606325696 ecr 606325685], length 14
10:42:59.459213 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [.], ack 15, win 342, options [nop,nop,TS val 606325696 ecr 606325696], length 0
10:42:59.459268 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 606325696 ecr 606325696], length 0
10:42:59.460184 IP 127.0.0.1.12345 > 127.0.0.1.54054: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 606325697 ecr 606325696], length 0
10:42:59.460196 IP 127.0.0.1.54054 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 606325697 ecr 606325697], length 0
Yonke into isemgangathweni: i-handshake yeendlela ezintathu, i-PSH / ACK kunye ne-ACK ekuphenduleni kabini - oku kukutshintshana kwesicelo kunye nempendulo phakathi komxhasi kunye nomncedisi, kunye ne-FIN / ACK kunye ne-ACK kabini - ukugqiba uxhumano.
Ukulibaziseka kwepakethi
Ngoku makhe simisele ulibaziseko ukuya kuma-500 millisecond:
tc qdisc add dev lo root netem delay 500ms
Siqalisa umxhasi kwaye sibone ukuba iskripthi ngoku siqhuba imizuzwana emi-2:
[user@host ~]# ./client.py
[time before connection: 1578662612.71044]
[time after connection, before sending: 1578662613.71059]
[time after sending, before receiving: 1578662613.71065]
[time after receiving, before closing: 1578662614.72011]
[time after closing: 1578662614.72019]
[total duration: 2.00974]
Response: Test
Yintoni esendleleni? Masijonge:
Ukulahlwa kwetrafikhi
13:23:33.210520 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [S], seq 1720950927, win 43690, options [mss 65495,sackOK,TS val 615958947 ecr 0,nop,wscale 7], length 0
13:23:33.710554 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [S.], seq 1801168125, ack 1720950928, win 43690, options [mss 65495,sackOK,TS val 615959447 ecr 615958947,nop,wscale 7], length 0
13:23:34.210590 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 615959947 ecr 615959447], length 0
13:23:34.210657 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 615959947 ecr 615959447], length 5
13:23:34.710680 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [.], ack 6, win 342, options [nop,nop,TS val 615960447 ecr 615959947], length 0
13:23:34.719371 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 615960456 ecr 615959947], length 14
13:23:35.220106 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [.], ack 15, win 342, options [nop,nop,TS val 615960957 ecr 615960456], length 0
13:23:35.220188 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 615960957 ecr 615960456], length 0
13:23:35.720994 IP 127.0.0.1.12345 > 127.0.0.1.58694: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 615961457 ecr 615960957], length 0
13:23:36.221025 IP 127.0.0.1.58694 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 615961957 ecr 615961457], length 0
Uyabona ukuba i-lag elindelekileyo yesiqingatha sesibini ibonakala kwintsebenziswano phakathi komxhasi kunye nomncedisi. Inkqubo iziphatha ngendlela enomdla ngakumbi ukuba i-lag inkulu: i-kernel iqala ukuthumela ezinye iipakethi ze-TCP. Masitshintshe ukulibaziseka kwi-1 yesibini kwaye sijonge kwi-traffic (andiyi kubonisa imveliso yomthengi, kukho imizuzwana emi-4 elindelekileyo ngexesha lilonke):
tc qdisc change dev lo root netem delay 1s
Ukulahlwa kwetrafikhi
13:29:07.709981 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [S], seq 283338334, win 43690, options [mss 65495,sackOK,TS val 616292946 ecr 0,nop,wscale 7], length 0
13:29:08.710018 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [S.], seq 3514208179, ack 283338335, win 43690, options [mss 65495,sackOK,TS val 616293946 ecr 616292946,nop,wscale 7], length 0
13:29:08.711094 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [S], seq 283338334, win 43690, options [mss 65495,sackOK,TS val 616293948 ecr 0,nop,wscale 7], length 0
13:29:09.710048 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 616294946 ecr 616293946], length 0
13:29:09.710152 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 616294947 ecr 616293946], length 5
13:29:09.711120 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [S.], seq 3514208179, ack 283338335, win 43690, options [mss 65495,sackOK,TS val 616294948 ecr 616292946,nop,wscale 7], length 0
13:29:10.710173 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [.], ack 6, win 342, options [nop,nop,TS val 616295947 ecr 616294947], length 0
13:29:10.711140 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 616295948 ecr 616293946], length 0
13:29:10.714782 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 616295951 ecr 616294947], length 14
13:29:11.714819 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 15, win 342, options [nop,nop,TS val 616296951 ecr 616295951], length 0
13:29:11.714893 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 616296951 ecr 616295951], length 0
13:29:12.715562 IP 127.0.0.1.12345 > 127.0.0.1.39306: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 616297952 ecr 616296951], length 0
13:29:13.715596 IP 127.0.0.1.39306 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 616298952 ecr 616297952], length 0
Ingabonwa ukuba umxhasi uthumele i-SYN ipakethe kabini, kwaye umncedisi wathumela i-SYN / ACK kabini.
Ukongeza kwixabiso elingaguqukiyo, ukulibaziseka kunokumiselwa ukutenxa, umsebenzi wokusabalalisa, kunye nokulungelelaniswa (kunye nexabiso lepakethi yangaphambili). Oku kwenziwa ngolu hlobo lulandelayo:
tc qdisc change dev lo root netem delay 500ms 400ms 50 distribution normal
Apha sibeke ukulibaziseka phakathi kwe-100 kunye ne-900 milliseconds, amaxabiso aya kukhethwa ngokokusasazwa okuqhelekileyo kwaye kuya kubakho ulungelelwaniso lwe-50% kunye nexabiso lokulibaziseka kwipakethi yangaphambili.
Usenokuba uqaphele ukuba kumyalelo wokuqala endiwusebenzisileyo ukongeza, ke ngoku utshintsho. Intsingiselo yale miyalelo icacile, ngoko ke ndiza kongeza ukuba kukho okungakumbi del, enokusetyenziswa ukususa uqwalaselo.
Ilahleko yePakethi
Masizame ngoku ukwenza ilahleko yepakethe. Njengoko kunokubonwa kumaxwebhu, oku kunokwenziwa ngeendlela ezintathu: ukulahlekelwa iipakethi ngokungaqhelekanga kunye nokunokwenzeka okuthile, usebenzisa ikhonkco yeMarkov ye-2, i-3 okanye i-4 ithi ukubala ukulahleka kwepakethi, okanye ukusebenzisa imodeli ye-Elliott-Gilbert. Kwinqaku ndiza kuqwalasela indlela yokuqala (elula kwaye icacile), kwaye unokufunda ngabanye .
Masenze ilahleko yeepesenti ezingama-50 zeepakethi ngolungelelwaniso lwe-25%:
tc qdisc add dev lo root netem loss 50% 25%
Ngelishwa wcpdump ayiyi kukwazi ukusibonisa ngokucacileyo ukulahleka kweepakethi, siya kucinga kuphela ukuba isebenza ngokwenene. Kwaye ixesha elongeziweyo nelingazinzanga lokuqhutywa kwescript liya kusinceda siqinisekise oku. umxhasi.py (inokugqitywa ngoko nangoko, okanye mhlawumbi kwimizuzwana engama-20), kunye nokwanda kwenani leepakethi ezithunyelwe kwakhona:
[user@host ~]# netstat -s | grep retransmited; sleep 10; netstat -s | grep retransmited
17147 segments retransmited
17185 segments retransmited
Ukongeza ingxolo kwiipakethi
Ukongeza kwilahleko yepakethi, ungalinganisa umonakalo wepakethi: ingxolo iya kuvela kwindawo engacwangciswanga yepakethe. Masenze umonakalo wepakethi nge-50% enokwenzeka kwaye ngaphandle kolungelelwaniso:
tc qdisc change dev lo root netem corrupt 50%
Siqhuba iskripthi somthengi (akukho nto inomdla apho, kodwa kuthathe imizuzwana emi-2 ukugqiba), jonga kwitrafikhi:
Ukulahlwa kwetrafikhi
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:20:54.812434 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [S], seq 2023663770, win 43690, options [mss 65495,sackOK,TS val 1037001049 ecr 0,nop,wscale 7], length 0
10:20:54.812449 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [S.], seq 2104268044, ack 2023663771, win 43690, options [mss 65495,sackOK,TS val 1037001049 ecr 1037001049,nop,wscale 7], length 0
10:20:54.812458 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 1037001049 ecr 1037001049], length 0
10:20:54.812509 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1037001049 ecr 1037001049], length 5
10:20:55.013093 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1037001250 ecr 1037001049], length 5
10:20:55.013122 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [.], ack 6, win 342, options [nop,nop,TS val 1037001250 ecr 1037001250], length 0
10:20:55.014681 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [P.], seq 1:15, ack 6, win 342, options [nop,nop,TS val 1037001251 ecr 1037001250], length 14
10:20:55.014745 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 15, win 340, options [nop,nop,TS val 1037001251 ecr 1037001251], length 0
10:20:55.014823 IP 127.0.0.1.43666 > 127.0.0.5.12345: Flags [F.], seq 2023663776, ack 2104268059, win 342, options [nop,nop,TS val 1037001251 ecr 1037001251], length 0
10:20:55.214088 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [P.], seq 1:15, ack 6, win 342, options [nop,unknown-65 0x0a3dcf62eb3d,[bad opt]>
10:20:55.416087 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [F.], seq 6, ack 15, win 342, options [nop,nop,TS val 1037001653 ecr 1037001251], length 0
10:20:55.416804 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 1037001653 ecr 1037001653], length 0
10:20:55.416818 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 16, win 343, options [nop,nop,TS val 1037001653 ecr 1037001653], length 0
10:20:56.147086 IP 127.0.0.1.12345 > 127.0.0.1.43666: Flags [F.], seq 15, ack 7, win 342, options [nop,nop,TS val 1037002384 ecr 1037001653], length 0
10:20:56.147101 IP 127.0.0.1.43666 > 127.0.0.1.12345: Flags [.], ack 16, win 342, options [nop,nop,TS val 1037002384 ecr 1037001653], length 0
Inokubonwa ukuba ezinye iipakethi zathunyelwa ngokuphindaphindiweyo kwaye kukho ipakethi enye enemethadatha eyaphukileyo: iinketho [nop,unknown-65 0x0a3dcf62eb3d,[ukhetho olubi]>. Kodwa into ephambili kukuba ekugqibeleni yonke into yasebenza ngokuchanekileyo - i-TCP ihlangabezane nomsebenzi wayo.
Ukuphindaphinda ipakethi
Yintoni enye onokuyenza ngayo netem? Umzekelo, linganisa imeko engasemva yokulahleka kwepakethi-ukuphindaphinda kwepakethi. Lo myalelo kwakhona uthatha iingxoxo ezi-2: okwenzekayo kunye nonxulumano.
tc qdisc change dev lo root netem duplicate 50% 25%
Ukutshintsha ulandelelwano lweepakethe
Unokuxuba iingxowa ngeendlela ezimbini.
Kweyokuqala, ezinye iipakethi zithunyelwa ngokukhawuleza, ezinye ngokulibaziseka okucacisiweyo. Umzekelo kumaxwebhu:
tc qdisc change dev lo root netem delay 10ms reorder 25% 50%
Ngokunokwenzeka kwe-25% (kunye nokulungelelaniswa kwe-50%) ipakethe iya kuthunyelwa ngokukhawuleza, abanye baya kuthunyelwa ngokulibaziseka kwe-10 milliseconds.
Indlela yesibini kuxa ipakethe nganye ye-Nth ithunyelwa ngoko nangoko kunye nethuba elinikiweyo (kunye nolungelelwaniso), kunye nezinye kunye nokulibaziseka okunikiweyo. Umzekelo kumaxwebhu:
tc qdisc change dev lo root netem delay 10ms reorder 25% 50% gap 5
Yonke iphakheji yesihlanu ine-25% ithuba lokuthunyelwa ngaphandle kokulibazisa.
Ukutshintsha iBandwidth
Ngokuqhelekileyo babhekisela kuyo yonke indawo , kodwa ngoncedo netem Unokutshintsha kwakhona i-bandwidth yojongano:
tc qdisc change dev lo root netem rate 56kbit
Eli qela liza kwenza uhambo lokujikeleza localhost kubuhlungu njengokusefa kwi-Intanethi usebenzisa imodem yokucofa. Ukongeza ekuseteni i-bitrate, ungaphinda ulinganise imodeli yeprotocol yomaleko wekhonkco: seta umphezulu wepakethi, ubungakanani beseli, kunye nomphezulu weseli. Umzekelo, oku kunokulinganisa kunye ne-bitrate 56 kbit/umzuzwana:
tc qdisc change dev lo root netem rate 56kbit 0 48 5
Ukulinganisa ukuphela kwexesha loqhagamshelo
Enye inqaku elibalulekileyo kwisicwangciso sovavanyo xa ukwamkela isoftware kukuphelelwa lixesha. Oku kubalulekile kuba kwiinkqubo ezisasazwayo, xa enye yeenkonzo ikhubazekile, abanye kufuneka babuyele kwabanye ngexesha okanye babuyisele impazamo kumxhasi, kwaye akukho meko kufuneka baxhonywe, belindele impendulo okanye uxhulumaniso. ukusekwa.
Kukho iindlela ezininzi zokwenza oku: umzekelo, sebenzisa i-mock engaphenduliyo, okanye udibanise kwinkqubo usebenzisa i-debugger, beka i-breakpoint kwindawo efanelekileyo kwaye umise inkqubo (le yeyona ndlela igqwethekileyo). Kodwa enye yezona zinto zicacileyo kukhuseleko lwamazibuko okanye iinginginya. Iya kusinceda kule nto .
Umboniso, siya kufakwa kwi-firewall port 12345 kwaye siqhube iskripthi somthengi wethu. Unokwenza i-firewall iipakethi eziphumayo kweli zibuko kumthumeli okanye iipakethi ezingenayo kumamkeli. Kwimizekelo yam, iipakethi ezingenayo ziya kuba ne-firewalled (sisebenzisa i-INPUT yekhonkco kunye nokhetho --dport). Iipakethe ezinjalo zinokuba DROP, REJECT okanye REJECT nge TCP iflegi ye RST, okanye nge ICMP umamkeli ongafikelelekiyo (enyanisweni, indlela yokuziphatha engagqibekanga icmp-port-ayifikeleleki, kwaye kukho nethuba lokuthumela impendulo icmp-net-engafikelelekiyo, icmp-proto-engafikelelekiyo, icmp-net-inqatshelwe ΠΈ i-icmp-host-yalelweyo).
I-DROP
Ukuba kukho umthetho one-DROP, iipakethi ziya βkunyamalalaβ ngokulula.
iptables -A INPUT -p tcp --dport 12345 -j DROP
Siqalisa umxhasi kwaye sibone ukuba iyabanda kwinqanaba lokuxhuma kumncedisi. Makhe sijonge itrafikhi:
Ukulahlwa kwetrafikhi
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
08:28:20.213506 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203046450 ecr 0,nop,wscale 7], length 0
08:28:21.215086 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203047452 ecr 0,nop,wscale 7], length 0
08:28:23.219092 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203049456 ecr 0,nop,wscale 7], length 0
08:28:27.227087 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203053464 ecr 0,nop,wscale 7], length 0
08:28:35.235102 IP 127.0.0.1.32856 > 127.0.0.1.12345: Flags [S], seq 3019694933, win 43690, options [mss 65495,sackOK,TS val 1203061472 ecr 0,nop,wscale 7], length 0
Ingabonwa ukuba umxhasi uthumela iipakethi zeSYN kunye nexesha lokuphuma elandiswayo. Ke sifumene ibug encinci kumxhasi: kufuneka usebenzise indlela ixesha lokumisela()ukunciphisa ixesha apho umxhasi azakuzama ukuqhagamshela kumncedisi.
Sisusa ngoko nangoko umgaqo:
iptables -D INPUT -p tcp --dport 12345 -j DROPUngayicima yonke imigaqo ngexesha elinye:
iptables -F
Ukuba usebenzisa i-Docker kwaye kufuneka ufake i-firewall yonke i-traffic eya kwi-container, ngoko ungayenza ngolu hlobo lulandelayo:
iptables -I DOCKER-USER -p tcp -d CONTAINER_IP -j DROP
HLALA
Ngoku masenze umgaqo ofanayo, kodwa nge-REJECT:
iptables -A INPUT -p tcp --dport 12345 -j REJECT
Umxhasi uphuma emva komzuzwana ngempazamo [Errno 111] Uqhagamshelo lwaliwe. Makhe sijonge itrafikhi ye-ICMP:
[user@host ~]# tcpdump -i lo -nn icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
08:45:32.871414 IP 127.0.0.1 > 127.0.0.1: ICMP 127.0.0.1 tcp port 12345 unreachable, length 68
08:45:33.873097 IP 127.0.0.1 > 127.0.0.1: ICMP 127.0.0.1 tcp port 12345 unreachable, length 68
Ingabonwa ukuba umxhasi ufumene kabini izibuko alifikeleleki kwaye emva koko yaphela ngempazamo.
YALA nge-tcp-reset
Makhe sizame ukongeza ukhetho --yala-ngokusetha kwakhona kwe-tcp:
iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with tcp-reset
Kule meko, umxhasi uphuma ngokukhawuleza ngempazamo, kuba isicelo sokuqala sifumene ipakethi yeRST:
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
09:02:52.766175 IP 127.0.0.1.60658 > 127.0.0.1.12345: Flags [S], seq 1889460883, win 43690, options [mss 65495,sackOK,TS val 1205119003 ecr 0,nop,wscale 7], length 0
09:02:52.766184 IP 127.0.0.1.12345 > 127.0.0.1.60658: Flags [R.], seq 0, ack 1889460884, win 0, length 0
YALA nge-icmp-host-engafikelelekiyo
Masizame olunye ukhetho lokusebenzisa REJECT:
iptables -A INPUT -p tcp --dport 12345 -j REJECT --reject-with icmp-host-unreachable
Umxhasi uphuma emva komzuzwana ngempazamo [Errno 113] Ayikho indlela eya kumamkeli, sibona kwitrafikhi ye-ICMP I-ICMP ibamba i-127.0.0.1 ayifikeleleki.
Ungazama ezinye iiparamitha ze-REJECT, kwaye ndiza kugxila kwezi :)
Ukulinganisa ixesha lokuphela kwesicelo
Enye imeko kuxa umxhasi ekwazile ukuqhagamshela kumncedisi, kodwa akakwazi ukuthumela isicelo kuyo. Indlela yokucoca iipakethi ukwenzela ukuba ukuhluza kungaqali ngokukhawuleza? Ukuba ukhangele i-traffic nayiphi na inxibelelwano phakathi komxhasi kunye nomncedisi, uya kuqaphela ukuba xa useka uxhulumaniso, kuphela iiflegi ze-SYN kunye ne-ACK zisetyenzisiweyo, kodwa xa utshintshisa idatha, iphakheji yokugqibela yesicelo iya kuba neflegi ye-PSH. Ihlohla ngokuzenzekelayo ukunqanda ukuphazamisa. Ungasebenzisa olu lwazi ukwenza isihluzi: siyakuvumela zonke iipakethi ngaphandle kwezo ziqulathe iflegi ye-PSH. Ngaloo ndlela, uxhumano luya kusekwa, kodwa umxhasi akayi kukwazi ukuthumela idatha kumncedisi.
I-DROP
Ku-DROP umyalelo unokujongeka ngolu hlobo:
iptables -A INPUT -p tcp --tcp-flags PSH PSH --dport 12345 -j DROP
Qalisa umxhasi kwaye ubukele itrafikhi:
Ukulahlwa kwetrafikhi
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:02:47.549498 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [S], seq 2166014137, win 43690, options [mss 65495,sackOK,TS val 1208713786 ecr 0,nop,wscale 7], length 0
10:02:47.549510 IP 127.0.0.1.12345 > 127.0.0.1.49594: Flags [S.], seq 2341799088, ack 2166014138, win 43690, options [mss 65495,sackOK,TS val 1208713786 ecr 1208713786,nop,wscale 7], length 0
10:02:47.549520 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 1208713786 ecr 1208713786], length 0
10:02:47.549568 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208713786 ecr 1208713786], length 5
10:02:47.750084 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208713987 ecr 1208713786], length 5
10:02:47.951088 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208714188 ecr 1208713786], length 5
10:02:48.354089 IP 127.0.0.1.49594 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1208714591 ecr 1208713786], length 5
Siyabona ukuba uxhulumaniso lusekiwe kwaye umxhasi akakwazi ukuthumela idatha kumncedisi.
HLALA
Kule meko ukuziphatha kuya kufana: umxhasi akayi kukwazi ukuthumela isicelo, kodwa uya kufumana I-ICMP 127.0.0.1 tcp port 12345 ayifikeleleki kunye nokwandisa ixesha phakathi kokufakwa kwakhona kwesicelo ngokukhawuleza. Umyalelo ujongeka ngolu hlobo:
iptables -A INPUT -p tcp --tcp-flags PSH PSH --dport 12345 -j REJECT
YALA nge-tcp-reset
Umyalelo ujongeka ngolu hlobo:
iptables -A INPUT -p tcp --tcp-flags PSH PSH --dport 12345 -j REJECT --reject-with tcp-reset
Sele sisazi ukuba xa usebenzisa --yala-ngokusetha kwakhona kwe-tcp umxhasi uya kufumana i-RST ipakethi ekuphenduleni, ngoko ukuziphatha kunokuqikelelwa: ukufumana ipakethi yeRST ngelixa uxhulumaniso lusekiwe kuthetha ukuba isokhethi ivalwe ngokungalindelekanga kwelinye icala, okuthetha ukuba umxhasi kufuneka afumane. Uqhagamshelo lusetwe ngokutsha ngoontanga. Masiqhube iskripthi sethu kwaye siqiniseke ngale nto. Kwaye yile ndlela iya kujongeka ngayo itrafikhi:
Ukulahlwa kwetrafikhi
[user@host ~]# tcpdump -i lo -nn port 12345
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:22:14.186269 IP 127.0.0.1.52536 > 127.0.0.1.12345: Flags [S], seq 2615137531, win 43690, options [mss 65495,sackOK,TS val 1209880423 ecr 0,nop,wscale 7], length 0
10:22:14.186284 IP 127.0.0.1.12345 > 127.0.0.1.52536: Flags [S.], seq 3999904809, ack 2615137532, win 43690, options [mss 65495,sackOK,TS val 1209880423 ecr 1209880423,nop,wscale 7], length 0
10:22:14.186293 IP 127.0.0.1.52536 > 127.0.0.1.12345: Flags [.], ack 1, win 342, options [nop,nop,TS val 1209880423 ecr 1209880423], length 0
10:22:14.186338 IP 127.0.0.1.52536 > 127.0.0.1.12345: Flags [P.], seq 1:6, ack 1, win 342, options [nop,nop,TS val 1209880423 ecr 1209880423], length 5
10:22:14.186344 IP 127.0.0.1.12345 > 127.0.0.1.52536: Flags [R], seq 3999904810, win 0, length 0
YALA nge-icmp-host-engafikelelekiyo
Ndicinga ukuba sele icacile kuwo wonke umntu ukuba umyalelo uya kubonakala njani :) Ukuziphatha komxhasi kulo mzekelo kuya kuhluke kancinane kuleyo nge-REJECT elula: umxhasi akayi kwandisa ixesha lokuhamba phakathi kwemizamo yokuthumela kwakhona ipakethi.
[user@host ~]# tcpdump -i lo -nn icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
10:29:56.149202 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.349107 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.549117 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.750125 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:56.951130 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:57.152107 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
10:29:57.353115 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable, length 65
isiphelo
Akukho mfuneko yokuba ubhale isigculelo ukuvavanya usebenziso lwenkonzo kunye nomxhasi oxhonyiweyo okanye umncedisi ngamanye amaxesha kwanele ukusebenzisa izixhobo ezisemgangathweni ezifumaneka kwi Linux.
Izinto eziluncedo ekuxoxwe ngazo kwinqaku zinamandla ngakumbi kunoko bekuchaziwe, ngoko ke unokuza nolunye ukhetho lwakho lokuzisebenzisa. Ngokomntu, ndihlala ndinento eyaneleyo endiyibhale ngayo (enyanisweni, nangaphantsi). Ukuba usebenzisa ezi okanye eziluncedo ezifanayo kuvavanyo kwinkampani yakho, nceda ubhale ukuba njani kanye. Ukuba akunjalo, ndiyathemba ukuba isoftware yakho iya kuba ngcono ukuba uthatha isigqibo sokuyivavanya kwiimeko zeengxaki zenethiwekhi usebenzisa iindlela ezicetyiswayo.
umthombo: www.habr.com