{"id":52639,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3"},"modified":"2026-05-20T19:54:20","modified_gmt":"2026-05-20T17:54:20","slug":"domen-fronting-na-baze-tls-1-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","title":{"rendered":"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h3>Giri\u015f<\/h3>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/9e81fbeed9c8d41c7e4f583235541370.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><br \/>\nM\u00fcasir korporativ m\u0259zmun filtrasiya sisteml\u0259ri, Cisco, BlueCoat, FireEye kimi tan\u0131nm\u0131\u015f istehsal\u00e7\u0131lar\u0131n m\u0259hsullar\u0131, daha g\u00fccl\u00fc analoqlar\u0131 olan DPI sisteml\u0259ri il\u0259 bir \u00e7ox ox\u015farl\u0131qlara malikdir. H\u0259r iki sistemin \u0259sas\u0131, daxil olan v\u0259 \u00e7\u0131xan internet trafikinin yoxlan\u0131lmas\u0131 v\u0259 qara\/a\u011f siyah\u0131lara \u0259saslanaraq internet ba\u011flant\u0131s\u0131n\u0131 qada\u011fan etm\u0259k q\u0259rar\u0131n\u0131 q\u0259bul etm\u0259kdir. H\u0259m\u00e7inin, h\u0259r iki tip sistem, i\u015f prinsipl\u0259rind\u0259 ox\u015far yana\u015fmalara \u0259sasland\u0131\u011f\u0131 \u00fc\u00e7\u00fcn, onlar\u0131n a\u015f\u0131lmas\u0131 yollar\u0131nda da ox\u015farl\u0131qlar olacaq.<\/p>\n<p>DPI v\u0259 korporativ sisteml\u0259ri effektiv \u015f\u0259kild\u0259 a\u015fma\u011fa imkan ver\u0259n texnologiyalardan biri dom\u0259n-fronting texnologiyas\u0131d\u0131r. Bu texnologiyan\u0131n mahiyy\u0259ti, bloklanm\u0131\u015f resursa, \u0259vv\u0259lc\u0259d\u0259n qada\u011fan edilm\u0259y\u0259c\u0259k, m\u0259s\u0259l\u0259n, google.com, reputasiyas\u0131 yax\u015f\u0131 olan dig\u0259r, a\u00e7\u0131q bir dom\u0259nl\u0259 gizl\u0259n\u0259r\u0259k daxil olmaqdan ibar\u0259tdir.<\/p>\n<p>Bu texnologiya haqq\u0131nda art\u0131q kifay\u0259t q\u0259d\u0259r m\u0259qal\u0259 yaz\u0131l\u0131b v\u0259 bir \u00e7ox n\u00fcmun\u0259l\u0259r g\u0259tirilib. Lakin son zamanlarda populyar v\u0259 m\u00fczakir\u0259 olunan DNS-over-HTTPS v\u0259 encrypted-SNI texnologiyalar\u0131, el\u0259c\u0259 d\u0259 TLS 1.3 protokolunun yeni versiyas\u0131 dom\u0259n-fronting-in ba\u015fqa bir variant\u0131n\u0131 n\u0259z\u0259rd\u0259n ke\u00e7irm\u0259y\u0259 imkan verir.<br \/>\n<a rel=\"nofollow\" name=\"habracut\"><\/a><\/p>\n<h3>Texnologiyaya bax\u0131r\u0131q<\/h3>\n<p>\u0130lk \u00f6nc\u0259 \u0259sas anlay\u0131\u015flar\u0131 m\u00fc\u0259yy\u0259nl\u0259\u015fdir\u0259k ki, ham\u0131n\u0131n kim kimdir v\u0259 niy\u0259 bu laz\u0131md\u0131r anlay\u0131\u015f\u0131 olsun. Biz eSNI mexanizmi haqq\u0131nda dan\u0131\u015fd\u0131q, i\u015f prinsipi a\u015fa\u011f\u0131da izah edil\u0259c\u0259k. eSNI mexanizmi (encrypted Server Name Indication) - yaln\u0131z TLS 1.3 protokoluna aid olan, SNI-nin t\u0259hl\u00fck\u0259siz bir versiyas\u0131d\u0131r. \u018fsas mahiyy\u0259ti - ist\u0259nil\u0259n dom\u0259n\u0259 g\u00f6nd\u0259ril\u0259n sor\u011funu da \u015fifr\u0259l\u0259m\u0259kdir.<\/p>\n<p>\u0130ndi g\u0259lin eSNI mexanizminin praktikada nec\u0259 i\u015fl\u0259diyini n\u0259z\u0259rd\u0259n ke\u00e7ir\u0259k.<\/p>\n<p>Tutaq ki, m\u00fcasir DPI sistemi t\u0259r\u0259find\u0259n bloklanan bir internet resursumuz var (m\u0259s\u0259l\u0259n, m\u0259\u015fhur torrent tracker - rutracker.nl). Torrent tracker sayt\u0131na daxil olma\u011fa \u00e7al\u0131\u015fd\u0131\u011f\u0131m\u0131zda - provayderin resursun blokland\u0131\u011f\u0131 haqq\u0131nda standart siqnal\u0131n\u0131 g\u00f6r\u00fcr\u00fck:<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/6a2aeccd290f9046efa799166ffa875f.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>RKN sayt\u0131nda bu domen h\u0259qiq\u0259t\u0259n d\u0259 qara siyah\u0131larda yer al\u0131r:<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/1c881e2c8403cf85f77d9d74cbf3f54e.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>Whois sor\u011fusu ed\u0259rk\u0259n - domenin Cloudflare adl\u0131 bulud provayderinin arxas\u0131nda \"gizl\u0259dildiyini\" g\u00f6r\u00fcr\u00fck.<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/55b472de20a6eb85162ffbba286b9487.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>Lakin RKN \"m\u00fct\u0259x\u0259ssisl\u0259ri\"-d\u0259n f\u0259rqli olaraq, daha texniki bilikl\u0259r\u0259 malik olan beeline i\u015f\u00e7il\u0259ri (ya da bizim m\u0259\u015fhur t\u0259nziml\u0259yicimizin ac\u0131 t\u0259cr\u00fcb\u0259sind\u0259n d\u0259rs g\u00f6t\u00fcrm\u00fc\u015f olanlar) sad\u0259c\u0259 IP \u00fcnvan\u0131na g\u00f6r\u0259 sayt\u0131 qada\u011fan etm\u0259yi se\u00e7m\u0259dil\u0259r, \u0259ksin\u0259, qara siyah\u0131ya daxil etdil\u0259r <a href=\"https:\/\/prohoster.info\/az\/domain\/\">domen ad\u0131n\u0131.<\/a>Bunun asanl\u0131qla ba\u015fa d\u00fc\u015f\u00fclm\u0259si m\u00fcmk\u00fcnd\u00fcr, \u0259g\u0259r eyni adl\u0131 ba\u015fqa domenl\u0259rin arxas\u0131nda gizl\u0259ndiyin\u0259 baxsaq, <a href=\"https:\/\/prohoster.info\/az\/lir\/ipv4\/\">IP \u00fcnvan\u0131.<\/a>, onlardan birini ziyar\u0259t ed\u0259r\u0259k, giri\u015fin bloklanmad\u0131\u011f\u0131n\u0131 g\u00f6rm\u0259k olar:<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/fe7de472c9c5cc8abe4d4ed6cacdd21c.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>B\u0259s bu nec\u0259 olur? Provayder DPI, brauzerimin hans\u0131 domen\u0259 daxil oldu\u011funu nec\u0259 bilir? Ax\u0131 b\u00fct\u00fcn kommunikasiya https protokolu \u00fcz\u0259rind\u0259n ba\u015f verir, el\u0259 deyilmi? Y\u0259qin ki, Beeline-dan https sertifikatlar\u0131n\u0131n d\u0259yi\u015fdirilm\u0259sini h\u0259l\u0259 g\u00f6rm\u0259mi\u015fik. Yoxsa o, g\u00f6r\u0259n deyil, yoxsa m\u0259nim arxamca izl\u0259m\u0259 apar\u0131l\u0131r?<\/p>\n<p>Bu suala cavab verm\u0259y\u0259 \u00e7al\u0131\u015faq, trafiki Wireshark vasit\u0259sil\u0259 ara\u015fd\u0131raraq.<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/330f05030e9edb066bf2fd80c935e0c3.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>Ekran g\u00f6r\u00fcnt\u00fcs\u00fcnd\u0259 g\u00f6r\u00fcnd\u00fcy\u00fc kimi, \u0259vv\u0259lc\u0259 brauzer DNS vasit\u0259sil\u0259 serverin IP \u00fcnvan\u0131n\u0131 al\u0131r, sonra h\u0259d\u0259f serverl\u0259 standart TCP \u0259lveri\u015fi ba\u015f verir, daha sonra brauzer ssl \u0259laq\u0259sini qurma\u011fa \u00e7al\u0131\u015f\u0131r. Bunun \u00fc\u00e7\u00fcn o, paket <a href=\"https:\/\/prohoster.info\/az\/ssl-sertifikat\/\">SSL<\/a> Client Hello g\u00f6nd\u0259ri\u015fini \u00f6t\u00fcr\u00fcr ki, burada a\u00e7\u0131q \u015f\u0259kild\u0259 \u0259sas domenin ad\u0131 m\u00f6vcuddur. Bu sah\u0259 Cloudflare-nin \u00f6n u\u00e7 serverin\u0259 \u0259laq\u0259ni d\u00fczg\u00fcn y\u00f6nl\u0259ndirm\u0259k \u00fc\u00e7\u00fcn laz\u0131md\u0131r. Burada provayder DPI bizi tutur, bizim \u0259laq\u0259mizi k\u0259sir. Bununla yana\u015f\u0131, provayder t\u0259r\u0259find\u0259n he\u00e7 bir say\u011fac alm\u0131r\u0131q v\u0259 brauzerd\u0259n standart x\u0259ta mesaj\u0131n\u0131 g\u00f6r\u00fcr\u00fck, el\u0259 bil ki, sayt ba\u011fl\u0131d\u0131r ya da sad\u0259c\u0259 i\u015fl\u0259m\u0259yir:<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/9642c783158c0ace70c50fea917e7d9d.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>\u0130ndi g\u0259lin brauzerd\u0259 eSNI mexanizmini aktivl\u0259\u015fdir\u0259k, nec\u0259 yaz\u0131lm\u0131\u015fd\u0131r. <a href=\"https:\/\/miketabor.com\/enable-dns-over-https-and-encrypted-sni-in-firefox\/\" rel=\"nofollow\">TIFF <\/a>:<br \/>\nBunun \u00fc\u00e7\u00fcn Firefox-un konfiqurasiya s\u0259hif\u0259sini a\u00e7\u0131r\u0131q. <b>about:config<\/b> v\u0259 a\u015fa\u011f\u0131dak\u0131 parametrl\u0259ri aktivl\u0259\u015fdiririk:<\/p>\n<pre><code class=\"plaintext\">network.trr.mode = 2;\nnetwork.trr.uri = https:\/\/mozilla.cloudflare-dns.com\/dns-query\nnetwork.security.esni.enabled = true\n<\/code><\/pre>\n<p>Bundan sonra Cloudflare sayt\u0131nda parametrl\u0259rin d\u00fczg\u00fcn i\u015fl\u0259m\u0259sini yoxlayaca\u011f\u0131q. <a href=\"https:\/\/www.cloudflare.com\/ssl\/encrypted-sni\/\" rel=\"nofollow\">linkd\u0259<\/a> V\u0259 yenid\u0259n torrent izleyicimizl\u0259 bu hiyl\u0259ni yoxlayaca\u011f\u0131q.<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/4996a67993bd2f1b5ebeb1ac156ba29a.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>V\u0259ssalam. Sevdiyimiz izleyici, he\u00e7 bir VPN v\u0259 ya proksi server olmadan a\u00e7\u0131ld\u0131. \u0130ndi g\u0259lin Wireshark-da trafik damlas\u0131na n\u0259z\u0259r salaq, n\u0259l\u0259r ba\u015f verdi.<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/a7e305afbf29896f6ebb82e53c7fed88.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>Bu d\u0259f\u0259 ssl client hello paketi a\u00e7\u0131q \u015f\u0259kild\u0259 h\u0259d\u0259f domenini i\u00e7ermir, bunun \u0259v\u0259zin\u0259 paketd\u0259 yeni bir sah\u0259 \u2013 encrypted_server_name m\u00f6vcuddur \u2013 bu sah\u0259d\u0259 rutracker.nl d\u0259y\u0259ri saxlan\u0131l\u0131r v\u0259 onu yaln\u0131z Cloudflare-in \u00f6n u\u00e7 serveri de\u015fifr\u0259 ed\u0259 bil\u0259r. Bel\u0259 oldu\u011fu halda, provayderin DPI \u00fc\u00e7\u00fcn ba\u015fqa variant qalm\u0131r, onun \u0259ll\u0259rini yuyub bel\u0259 trafiki buraxmal\u0131d\u0131r. V\u0259 \u015fifr\u0259l\u0259m\u0259 m\u00f6vzusunda dig\u0259r variantlar da yoxdur.<\/p>\n<p>Bel\u0259likl\u0259, brauzerd\u0259 texnologiyan\u0131n nec\u0259 i\u015fl\u0259diyini g\u00f6rd\u00fck. \u0130ndi g\u0259lin bunu daha spesifik v\u0259 maraql\u0131 \u015feyl\u0259r \u00fc\u00e7\u00fcn t\u0259tbiq etm\u0259y\u0259 \u00e7al\u0131\u015faq. \u0130lk n\u00f6vb\u0259d\u0259, eSNI-d\u0259n istifad\u0259 ed\u0259r\u0259k TLS 1.3 il\u0259 i\u015fl\u0259y\u0259n curl-i \u00f6yr\u0259d\u0259k, el\u0259c\u0259 d\u0259 eSNI \u0259sas\u0131nda domen-frontal\u0131n nec\u0259 i\u015fl\u0259diyini ara\u015fd\u0131raq.<\/p>\n<h3>eSNI il\u0259 domen-frontal<\/h3>\n<p>Curl https protokolu vasit\u0259sil\u0259 ba\u011flanma \u00fc\u00e7\u00fcn standart OpenSSL kitabxanas\u0131n\u0131 istifad\u0259 etdiyi \u00fc\u00e7\u00fcn, \u0259vv\u0259lc\u0259 orada eSNI d\u0259st\u0259yini t\u0259min etm\u0259liyik. OpenSSL-in master \u015fax\u0259l\u0259rind\u0259 eSNI d\u0259st\u0259yi h\u0259l\u0259 yoxdur, buna g\u00f6r\u0259 x\u00fcsusi OpenSSL \u015fax\u0259sini y\u00fckl\u0259m\u0259k, t\u0259rtib etm\u0259k v\u0259 qura\u015fd\u0131rmaq m\u0259cburiyy\u0259tind\u0259yik.<\/p>\n<p>GitHub-dan repositoriyan\u0131 klonlay\u0131r\u0131q v\u0259 ad\u0259t \u00fczr\u0259 t\u0259rtib edirik:<\/p>\n<pre><code class=\"plaintext\">$ git clone https:\/\/github.com\/sftcd\/openssl\n$ cd openssl\n$ .\/config\n\n$ make\n$ cd esnistuff\n$ make\n<\/code><\/pre>\n<p>Daha sonra curl repositoriyas\u0131n\u0131 klonlay\u0131r\u0131q v\u0259 onu, bizim t\u0259rtib etdiyimiz OpenSSL kitabxanas\u0131ndan istifad\u0259 ed\u0259r\u0259k t\u0259rtib etm\u0259y\u0259 konfiqurasiya edirik:<\/p>\n<pre><code class=\"plaintext\">$ cd $HOME\/code\n$ git clone https:\/\/github.com\/niallor\/curl.git curl-esni\n$ cd curl-esni\n\n$ export LD_LIBRARY_PATH=\/opt\/openssl\n$ .\/buildconf\n$ LDFLAGS=\"-L\/opt\/openssl\" .\/configure --with-ssl=\/opt\/openssl --enable-esni --enable-debug\n<\/code><\/pre>\n<p>Burada openssl-in yerl\u0259\u015fdiyi b\u00fct\u00fcn qovluqlar\u0131 d\u00fczg\u00fcn g\u00f6st\u0259rm\u0259k vacibdir (bizim hal\u0131m\u0131zda bu \/opt\/openssl-dir) v\u0259 konfiqurasiya prosesinin s\u0259hvsiz ke\u00e7diyin\u0259 \u0259min olmaq laz\u0131md\u0131r.<\/p>\n<p>U\u011furlu konfiqurasiya hal\u0131nda \u2014 biz a\u015fa\u011f\u0131dak\u0131 x\u0259tti g\u00f6r\u0259c\u0259yik:<\/p>\n<p><b>WARNING: esni ESNI enabled but marked EXPERIMENTAL. Use with caution!<\/b><\/p>\n<pre><code class=\"plaintext\">$ make<\/code><\/pre>\n<p>Paket m\u00fcv\u0259ff\u0259qiyy\u0259tl\u0259 qurulduqdan sonra, openssl-in t\u0259rkibind\u0259ki x\u00fcsusi bash skriptind\u0259n istifad\u0259 ed\u0259c\u0259yik ki, curl-u t\u0259nziml\u0259y\u0259k v\u0259 i\u015f\u0259 salaq. Rahatl\u0131q \u00fc\u00e7\u00fcn onu curl qovlu\u011funa k\u00f6\u00e7\u00fcr\u0259c\u0259yik:<\/p>\n<pre><code class=\"plaintext\">cp \/opt\/openssl\/esnistuff\/curl-esni <\/code><\/pre>\n<p>V\u0259 eyni zamanda DNS v\u0259 TLS paketl\u0259rini Wireshark-da qeyd ed\u0259r\u0259k cloudflare serverin\u0259 test https sor\u011fusu g\u00f6nd\u0259r\u0259c\u0259yik.<\/p>\n<pre><code class=\"plaintext\">$ ESNI_COVER=\"www.hello-rkn.ru\" .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n<p>Serverd\u0259n g\u0259l\u0259n cavabda openssl v\u0259 curl-dan \u00e7oxsayl\u0131 debug m\u0259lumatlar\u0131 il\u0259 yana\u015f\u0131 cloudflare-dan 301 kodlu HTTP cavab\u0131 alaca\u011f\u0131q.<\/p>\n<pre><code class=\"plaintext\">HTTP\/1.1 301 Moved Permanently\n&lt; Date: Sun, 03 Nov 2019 13:12:55 GMT\n&lt; Transfer-Encoding: chunked\n&lt; Connection: keep-alive\n&lt; Cache-Control: max-age=3600\n&lt; Expires: Sun, 03 Nov 2019 14:12:55 GMT\n&lt; Location: https:\/\/www.cloudflare.com\/\n<\/code><\/pre>\n<p>bu, bizim sor\u011funun m\u00fcv\u0259ff\u0259qiyy\u0259tl\u0259 t\u0259yinat serverin\u0259 \u00e7atd\u0131r\u0131ld\u0131\u011f\u0131n\u0131, e\u015fidildiyini v\u0259 emal edildiyini g\u00f6st\u0259rir.<\/p>\n<p>\u0130ndi is\u0259 Wireshark-da trafik y\u0131\u011f\u0131nca\u011f\u0131na baxaq, y\u0259ni bu halda internet provayderinin DPI-sinin g\u00f6rd\u00fckl\u0259rini yoxlayaq.<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/25945e28e6ff5dec3ab92e018b91bab1.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>G\u00f6r\u00fcn\u00fcr ki, \u0259vv\u0259lc\u0259 curl cloudflare serveri \u00fc\u00e7\u00fcn a\u00e7\u0131q eSNI a\u00e7ar\u0131n\u0131 DNS serverind\u0259n soru\u015fub \u2014 _esni.cloudflare.com \u00fc\u00e7\u00fcn TXT DNS sor\u011fusu (paket \u211613). Sonra, openssl kitabxanas\u0131n\u0131 istifad\u0259 ed\u0259r\u0259k, curl cloudflare serverin\u0259 TLS 1.3 sor\u011fusu g\u00f6nd\u0259rib v\u0259 burada SNI sah\u0259si \u0259vv\u0259lki m\u0259rh\u0259l\u0259d\u0259 al\u0131nm\u0131\u015f a\u00e7\u0131q a\u00e7ar il\u0259 \u015fifrl\u0259nib (paket \u211622). <b>Lakin eSNI sah\u0259sind\u0259n \u0259lav\u0259, SSL-hello paketind\u0259 ba\u015fqa bir sah\u0259 d\u0259 var \u2014 a\u00e7\u0131q SNI, hans\u0131 ki, biz ist\u0259diyimiz qaydada g\u00f6st\u0259r\u0259 bil\u0259rik (bu halda \u2014 <a href=\"http:\/\/www.hello-rkn.ru\" rel=\"nofollow\">www.hello-rkn.ru<\/a>). <\/b><\/p>\n<p>Bu a\u00e7\u0131q SNI sah\u0259si cloudflare serverl\u0259ri t\u0259r\u0259find\u0259n emal ed\u0259rk\u0259n he\u00e7 bir hesaba al\u0131nm\u0131r v\u0259 sad\u0259c\u0259 provayderin DPI-sin\u0259 qar\u015f\u0131 maska rolunu oynay\u0131r. Cloudflare serveri bizim ssl-hello paketimizi q\u0259bul etdi, eSNI-ni \u015fifr\u0259ni a\u00e7d\u0131, oradan orijinal SNI-ni \u00e7\u0131xartd\u0131 v\u0259 onu oldu\u011fu kimi emal etdi (bunu eSNI-nin haz\u0131rlanmas\u0131nda n\u0259z\u0259rd\u0259 tutuldu\u011fu \u015f\u0259kild\u0259 etdi).<\/p>\n<p>Buna g\u00f6r\u0259 DPI-nin \u0259lind\u0259n tutula bil\u0259c\u0259k yegan\u0259 m\u0259qam \u2014 _esni.cloudflare.com \u00fc\u00e7\u00fcn ilkin DNS sor\u011fusudur. Lakin biz DNS sor\u011funu a\u00e7\u0131q etdik yaln\u0131z bu mexanizmin daxili i\u015fini g\u00f6st\u0259rm\u0259k \u00fc\u00e7\u00fcn.<\/p>\n<p>N\u0259hay\u0259t, DPI-nin aya\u011f\u0131n\u0131n alt\u0131ndan yerini \u00e7\u0259k\u0259r\u0259k, art\u0131q deyildiyi kimi DNS-d\u0259n HTTPS vasit\u0259sil\u0259 i\u015fl\u0259m\u0259 mexanizmini istifad\u0259 ed\u0259c\u0259yik. Ki\u00e7ik bir izah \u2013 DOH \u2013 \"orta adam\" h\u00fccumuna qar\u015f\u0131 qorunma\u011fa imkan ver\u0259n protokoldur, \u00e7\u00fcnki DNS sor\u011fusunu HTTPS protokolu vasit\u0259sil\u0259 g\u00f6nd\u0259rir.<\/p>\n<p>Sor\u011funu yenid\u0259n icra ed\u0259c\u0259yik, lakin bu d\u0259f\u0259 a\u00e7\u0131q eSNI a\u00e7arlar\u0131n\u0131 https protokolu il\u0259 alaca\u011f\u0131q, yoxsa DNS il\u0259:<\/p>\n<pre><code class=\"plaintext\">ESNI_COVER=\"www.hello-rkn.ru\" DOH_URL=https:\/\/mozilla.cloudflare-dns.com\/dns-query .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n<p>Sor\u011fu trafikinin dump-u a\u015fa\u011f\u0131dak\u0131 ekranda g\u00f6r\u00fcn\u00fcr:<\/p>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/284d1d8110b24c647a57e644d93a8142.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>G\u00f6r\u00fcn\u00fcr ki, curl \u0259vv\u0259lc\u0259 104.16.249.249 serverin\u0259 DoH protokolu vasit\u0259sil\u0259 (https ba\u011flant\u0131s\u0131) mozilla.cloudflare-dns.com serverin\u0259 m\u00fcraci\u0259t edir, SNI \u015fifr\u0259l\u0259m\u0259si \u00fc\u00e7\u00fcn a\u00e7arlar\u0131n d\u0259y\u0259rl\u0259rini almaq \u00fc\u00e7\u00fcn, daha sonra is\u0259 art\u0131q hedef server\u0259 m\u00fcraci\u0259t edir, bu arada is\u0259 \u00f6z\u00fcn\u00fc domenl\u0259 gizl\u0259dir. <a href=\"http:\/\/www.hello-rkn.ru\" rel=\"nofollow\">www.hello-rkn.ru<\/a>.<\/p>\n<p>Yuxar\u0131da qeyd olunan mozilla.cloudflare-dns.com DoH \u00e7\u00f6z\u00fcc\u00fcs\u00fcnd\u0259n \u0259lav\u0259, biz m\u0259\u015fhur DoH xidm\u0259tl\u0259rini d\u0259 istifad\u0259 ed\u0259 bil\u0259rik, m\u0259s\u0259l\u0259n, tan\u0131nm\u0131\u015f 'pis korporasiya' t\u0259r\u0259find\u0259n t\u0259qdim edil\u0259n xidm\u0259tl\u0259ri.<br \/>\nBel\u0259 bir sor\u011fu ed\u0259k:<\/p>\n<pre><code class=\"plaintext\">ESNI_COVER=\"www.kremlin.ru\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n<p>V\u0259 cavab al\u0131r\u0131q:<\/p>\n<pre><code class=\"plaintext\">&lt; HTTP\/1.1 301 Moved Permanently\n&lt; Date: Sun, 03 Nov 2019 14:10:22 GMT\n&lt; Content-Type: text\/html\n&lt; Transfer-Encoding: chunked\n&lt; Connection: keep-alive\n&lt; Set-Cookie: __cfduid=da0144d982437e77b0b37af7d00438b1a1572790222; expires=Mon, 02-Nov-20 14:10:22 GMT; path=\/; domain=.rutracker.nl; HttpOnly; Secure\n&lt; Location: https:\/\/rutracker.nl\/forum\/index.php\n&lt; CF-Cache-Status: DYNAMIC\n&lt; Expect-CT: max-age=604800, report-uri=&quot;https:\/\/report-uri.cloudflare.com\/cdn-cgi\/beacon\/expect-ct&quot;\n&lt; Server: cloudflare\n&lt; CF-RAY: 52feee696f42d891-CPH\n<\/code><\/pre>\n<p><img decoding=\"async\" style=\"display: block; margin: 0 auto;\" src=\"\/wp-content\/uploads\/2019\/11\/c77b8a396e7d20f0b4d74b61380595df.jpg\" alt=\"TLS 1.3 \u0259sas\u0131nda domen \u00f6nl\u0259yici\" \/><\/p>\n<p>Bu halda biz bloklanm\u0131\u015f rutracker.nl serverin\u0259 m\u00fcraci\u0259t etdik, eyni zamanda DoH \u00e7\u00f6z\u00fcc\u00fcs\u00fc dns.google istifad\u0259 etm\u0259kl\u0259 (burada he\u00e7 bir yaz\u0131 s\u0259hvi yoxdur, indi tan\u0131nm\u0131\u015f korporiyan\u0131n \u00f6z birinci s\u0259viyy\u0259li domeni var) v\u0259 art\u0131q ba\u015fqa bir domenl\u0259 gizl\u0259ndik, bunu is\u0259 DPI t\u0259r\u0259find\u0259n qada\u011fan edilir.<\/p>\n<p>SNI-nin a\u00e7\u0131q \u015f\u0259kild\u0259 g\u00f6nd\u0259rdiyimiz\u0259 t\u0259minat \u00fc\u00e7\u00fcn \u0259lav\u0259 yoxlama olaraq \u2014 biz ba\u015fqa bir qada\u011fan olunmu\u015f resursa, m\u0259s\u0259l\u0259n, ba\u015fqa 'yax\u015f\u0131' torrent izl\u0259yicisi il\u0259 rutracker.nl-\u0259 m\u00fcraci\u0259t ed\u0259 bil\u0259rik:<\/p>\n<pre><code class=\"plaintext\">$ ESNI_COVER=\"rutor.info\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n<p>Serverd\u0259n cavab almayaca\u011f\u0131q, \u00e7\u00fcnki sor\u011fumuz DPI sistemind\u0259 bloklanacaq.<\/p>\n<h3>Birinci hiss\u0259y\u0259 q\u0131sa yekun<\/h3>\n<p>Bel\u0259likl\u0259, openssl v\u0259 curl vasit\u0259sil\u0259 eSNI-nin i\u015fl\u0259diyini g\u00f6st\u0259rm\u0259y\u0259 v\u0259 eSNI-y\u0259 \u0259saslanan domen-frontal\u0131 test etm\u0259y\u0259 m\u00fcv\u0259ff\u0259q olduq. Eyni qaydada sevdiyimiz openssl kitabxanas\u0131n\u0131 istifad\u0259 ed\u0259n al\u0259tl\u0259rimizi dig\u0259r domenl\u0259rin \u2018qar\u015f\u0131s\u0131nda\u2019 i\u015fl\u0259m\u0259yi uy\u011funla\u015fd\u0131ra bil\u0259rik. Bununla ba\u011fl\u0131 daha \u0259trafl\u0131 \u2013 n\u00f6vb\u0259ti m\u0259qal\u0259l\u0259rimizd\u0259.<\/p>\n<p>M\u0259nb\u0259: <a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/475372\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0438\u043c\u0435\u043d\u0438\u0442\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a Cisco, BlueCoat, FireEye \u0438\u043c\u0435\u044e\u0442 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043c\u043e\u0449\u043d\u044b\u043c\u0438 \u0438\u0445 \u0441\u043e\u0431\u0440\u0430\u0442\u044c\u044f\u043c\u0438 \u2014 DPI \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0438\u043b\u0435\u043d\u043d\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435. \u0421\u0443\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0442\u0435\u0445 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u043e\u0441\u043c\u043e\u0442\u0440 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u043d\u044b\u0445\/\u0431\u0435\u043b\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52639","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"az_AZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-11-12T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-20T17:54:20+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47TLS 1.3 \u00fcz\u0259rind\u0259 Domen-frontal | ProHoster","description":"Giri\u015f M\u00fcasir korporativ filtrasiyalar\u0131 sisteml\u0259ri.","canonical_url":"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2026-05-20T17:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52639","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:27","updated":"2026-01-24 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/52639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=52639"}],"version-history":[{"count":3,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/52639\/revisions"}],"predecessor-version":[{"id":173323,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/52639\/revisions\/173323"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=52639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=52639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=52639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}