{"id":38090,"date":"2019-10-31T22:21:36","date_gmt":"2019-10-31T19:21:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/eksperiment-cachebrowser-obhod-kitajskogo-faervola-bez-proksi-s-pomoshhyu-keshirovaniya-kontenta\/"},"modified":"2019-10-31T22:21:36","modified_gmt":"2019-10-31T19:21:36","slug":"eksperiment-cachebrowser-obhod-kitajskogo-faervola-bez-proksi-s-pomoshhyu-keshirovaniya-kontenta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/eksperiment-cachebrowser-obhod-kitajskogo-faervola-bez-proksi-s-pomoshhyu-keshirovaniya-kontenta","title":{"rendered":"Experiment CacheBrowser: obch\u00e1zen\u00ed \u010d\u00ednsk\u00e9 firewall bez proxy pomoc\u00ed cachov\u00e1n\u00ed obsahu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/infatica\/blog\/467201\/\"><img decoding=\"async\" alt=\"Experiment CacheBrowser: obch\u00e1zen\u00ed \u010d\u00ednsk\u00e9 firewall bez proxy pomoc\u00ed cachov\u00e1n\u00ed obsahu\" src=\"\/wp-content\/uploads\/2019\/09\/730c423783cdac5ddd8fef02d1e0bb72.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><i>Obr\u00e1zek: <noindex><a rel=\"nofollow\" href=\"https:\/\/unsplash.com\/photos\/pY_AZJfdbHQ\">Unsplash<\/a><\/noindex><\/i><\/p>\n<p>Dnes je zna\u010dn\u00e1 \u010d\u00e1st ve\u0161ker\u00e9ho obsahu na internetu \u0161\u00ed\u0159ena pomoc\u00ed CDN s\u00edt\u00ed. V tomto ohledu byla provedena \u0159ada v\u00fdzkum\u016f, jak r\u016fzn\u00e9 cenzory uplat\u0148uj\u00ed sv\u016fj vliv na tyto s\u00edt\u011b. V\u011bdci z Massachusettsk\u00e9ho technologick\u00e9ho institutu <noindex><a rel=\"nofollow\" href=\"https:\/\/people.cs.umass.edu\/~amir\/papers\/CacheBrowser.pdf\">analyzovali<\/a><\/noindex> zkoumali mo\u017en\u00e9 metody blokov\u00e1n\u00ed CDN obsahu na p\u0159\u00edkladu praktik \u010d\u00ednsk\u00fdch \u00fa\u0159ad\u016f a tak\u00e9 vyvinuli n\u00e1stroj na obch\u00e1zen\u00ed t\u011bchto blokac\u00ed.<\/p>\n<p>P\u0159ipravili jsme p\u0159ehledov\u00fd materi\u00e1l s hlavn\u00edmi z\u00e1v\u011bry a v\u00fdsledky tohoto experimentu.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>\u00davod<\/h2>\n<p>\nCenzura je glob\u00e1ln\u00ed hrozbou pro svobodu slova na internetu a voln\u00fd p\u0159\u00edstup k informac\u00edm. To je z velk\u00e9 \u010d\u00e1sti mo\u017en\u00e9 d\u00edky tomu, \u017ee internet p\u0159evzal model \"end-to-end komunikace\" z telefonn\u00edch s\u00edt\u00ed 70. let minul\u00e9ho stolet\u00ed. To umo\u017e\u0148uje zablokovat p\u0159\u00edstup k obsahu nebo komunikaci u\u017eivatel\u016f bez v\u011bt\u0161\u00edch n\u00e1mah nebo n\u00e1klad\u016f prost\u011b na z\u00e1klad\u011b IP adresy. Zde je n\u011bkolik zp\u016fsob\u016f, jak blokovat samotnou adresu s zak\u00e1zan\u00fdm obsahem, a\u017e po zablokov\u00e1n\u00ed mo\u017enosti u\u017eivatel\u016fm dokonce zjistit jej\u00ed existenci pomoc\u00ed manipulace s DNS.<\/p>\n<p>V\u00fdvoj internetu v\u0161ak vedl tak\u00e9 k vznik\u016fm nov\u00fdch zp\u016fsob\u016f \u0161\u00ed\u0159en\u00ed informac\u00ed. Jedn\u00edm z nich je pou\u017eit\u00ed cachovan\u00e9ho obsahu pro zlep\u0161en\u00ed v\u00fdkonu a zrychlen\u00ed komunikace. Dnes CDN poskytovatel\u00e9 zpracov\u00e1vaj\u00ed zna\u010dn\u00e9 objemy ve\u0161ker\u00e9ho provozu na sv\u011bt\u011b \u2013 pouze na pod\u00edl vedouc\u00ed firmy v tomto segmentu, Akamai, p\u0159ipad\u00e1 a\u017e 30 % glob\u00e1ln\u00edho statick\u00e9ho webov\u00e9ho provozu. <\/p>\n<p>CDN s\u00ed\u0165 je distribuovan\u00fd syst\u00e9m pro doru\u010dov\u00e1n\u00ed internetov\u00e9ho obsahu s maxim\u00e1ln\u00ed rychlost\u00ed. Typick\u00e1 CDN s\u00ed\u0165 se skl\u00e1d\u00e1 ze server\u016f na r\u016fzn\u00fdch geografick\u00fdch m\u00edstech, kter\u00e9 cachuj\u00ed obsah, aby \"p\u0159ed\u00e1valy\" ho t\u011bm u\u017eivatel\u016fm, kte\u0159\u00ed se nach\u00e1zej\u00ed nejbl\u00ed\u017ee tomuto serveru. To zna\u010dn\u011b zvy\u0161uje rychlost online komunikace.<\/p>\n<p>Krom\u011b zlep\u0161en\u00ed kvality slu\u017eeb pro koncov\u00e9 u\u017eivatele, CDN hosting pom\u00e1h\u00e1 tv\u016frc\u016fm obsahu \u0161k\u00e1lovat jejich projekty, a t\u00edm sni\u017euje z\u00e1t\u011b\u017e na infrastrukturu.<\/p>\n<h2>Cenzura CDN obsahu<\/h2>\n<p>\nI kdy\u017e ji\u017e CDN provoz p\u0159edstavuje zna\u010dnou \u010d\u00e1st ve\u0161ker\u00fdch informac\u00ed p\u0159en\u00e1\u0161en\u00fdch p\u0159es internet, st\u00e1le t\u00e9m\u011b\u0159 neexistuj\u00ed v\u00fdzkumy, jak cenzory v re\u00e1ln\u00e9m sv\u011bt\u011b p\u0159istupuj\u00ed k jeho kontrole. <\/p>\n<p>Auto\u0159i studie za\u010dali zkoum\u00e1n\u00edm technik cenzurov\u00e1n\u00ed, kter\u00e9 mohou b\u00fdt aplikov\u00e1ny na CDN. Pot\u00e9 se zam\u011b\u0159ili na skute\u010dn\u00e9 mechanizmy, kter\u00e9 pou\u017e\u00edvaj\u00ed \u010d\u00ednsk\u00e9 \u00fa\u0159ady. <\/p>\n<p>Nejprve si promluvme o mo\u017en\u00fdch metod\u00e1ch cenzurov\u00e1n\u00ed a o mo\u017enosti jejich vyu\u017eit\u00ed pro kontrolu CDN.<\/p>\n<h2>Filtrace podle IP<\/h2>\n<p>\nTo je nejjednodu\u0161\u0161\u00ed a nejlevn\u011bj\u0161\u00ed technika cenzurov\u00e1n\u00ed internetu. P\u0159i pou\u017eit\u00ed tohoto p\u0159\u00edstupu cenzor ur\u010duje a za\u0159azuje IP adresy zdroj\u016f, kter\u00e9 zve\u0159ej\u0148uj\u00ed zak\u00e1zan\u00fd obsah, na \u010dernou listinu. Pot\u00e9 poskytovatel\u00e9 internetov\u00fdch slu\u017eeb pod kontrolou p\u0159est\u00e1vaj\u00ed doru\u010dovat pakety odes\u00edlan\u00e9 na takov\u00e9 adresy. <\/p>\n<p>Blokace na z\u00e1klad\u011b IP je jednou z nejroz\u0161\u00ed\u0159en\u011bj\u0161\u00edch metod cenzurov\u00e1n\u00ed internetu. V\u011bt\u0161ina komer\u010dn\u011b dostupn\u00fdch s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed je vybavena funkcemi pro prov\u00e1d\u011bn\u00ed takov\u00fdch blokac\u00ed bez v\u00fdrazn\u00fdch v\u00fdpo\u010detn\u00edch n\u00e1klad\u016f.<\/p>\n<p>Tato metoda v\u0161ak nen\u00ed p\u0159\u00edli\u0161 vhodn\u00e1 pro blokaci CDN provozu z d\u016fvodu n\u011bkter\u00fdch vlastnost\u00ed samotn\u00e9 technologie:<\/p>\n<ul>\n<li><b>Distribuovan\u00e9 cacheov\u00e1n\u00ed<\/b> Aby zajistily nejlep\u0161\u00ed dostupnost obsahu a optimalizovaly v\u00fdkon, CDN s\u00edt\u011b cacheuj\u00ed u\u017eivatelsk\u00fd obsah na velk\u00e9m po\u010dtu edge server\u016f rozm\u00edst\u011bn\u00fdch na geograficky vzd\u00e1len\u00fdch m\u00edstech. Aby bylo mo\u017en\u00e9 filtrovat tento obsah na z\u00e1klad\u011b IP, cenzor by musel zn\u00e1t adresy v\u0161ech edge server\u016f a zahrnout je na \u010dernou listinu. To by po\u0161kodilo hlavn\u00ed vlastnosti metody, nebo\u0165 jej\u00ed hlavn\u00ed v\u00fdhodou je, \u017ee v b\u011b\u017en\u00e9m sch\u00e9matu blokov\u00e1n\u00ed jednoho serveru umo\u017e\u0148uje 'od\u0159\u00edznout' p\u0159\u00edstup k zak\u00e1zan\u00e9mu obsahu najednou velk\u00e9mu po\u010dtu lid\u00ed.<\/li>\n<li><b>Sd\u00edlen\u00e9 IP<\/b> Komer\u010dn\u00ed CDN poskytovatel\u00e9 sd\u00edlej\u00ed svou infrastrukturu (tj. edge servery, mapovac\u00ed syst\u00e9m atd.) mezi mnoha klienty. V d\u016fsledku toho je zak\u00e1zan\u00fd CDN obsah na\u010d\u00edt\u00e1n ze stejn\u00fdch IP adres jako nezak\u00e1zan\u00fd obsah. Jak\u00e1koli pokus o filtrov\u00e1n\u00ed IP tedy povede k tomu, \u017ee pod blokac\u00ed se ocitne tak\u00e9 velk\u00e9 mno\u017estv\u00ed web\u016f a obsahu, kter\u00e9 cenzory nezaj\u00edmaj\u00ed. <\/li>\n<li><b>Vysoce dynamick\u00e9 p\u0159id\u011blov\u00e1n\u00ed IP<\/b> \u2013 pro optimalizaci vyva\u017eov\u00e1n\u00ed zat\u00ed\u017een\u00ed a zv\u00fd\u0161en\u00ed kvality slu\u017eeb je mapov\u00e1n\u00ed edge server\u016f a koncov\u00fdch u\u017eivatel\u016f prov\u00e1d\u011bno velmi rychle a dynamicky. Nap\u0159\u00edklad, Akamai aktualizuje vracen\u00e9 IP adresy ka\u017edou minutu. To znemo\u017en\u00ed t\u00e9m\u011b\u0159 jak\u00fdkoliv proces spojov\u00e1n\u00ed adres s zak\u00e1zan\u00fdm obsahem.<\/li>\n<\/ul>\n<p><\/p>\n<h2>DNS interference<\/h2>\n<p>\nKrom\u011b filtrace IP je dal\u0161\u00edm obl\u00edben\u00fdm zp\u016fsobem cenzurov\u00e1n\u00ed interference DNS. Tento p\u0159\u00edstup zahrnuje kroky cenzor\u016f, kter\u00e9 maj\u00ed za c\u00edl, aby se u\u017eivatel\u00e9 v\u016fbec nedozv\u011bd\u011bli IP adresy zdroj\u016f se zak\u00e1zan\u00fdm obsahem. To znamen\u00e1, \u017ee z\u00e1sah je na \u00farovni p\u0159eklad\u016f dom\u00e9nov\u00fdch jmen. Existuje n\u011bkolik zp\u016fsob\u016f, jak to ud\u011blat, v\u010detn\u011b \u00fatok\u016f na DNS spojen\u00ed, pou\u017eit\u00ed techniky DNS poisoning a blokov\u00e1n\u00ed DNS dotaz\u016f na zak\u00e1zan\u00e9 weby.<\/p>\n<p>Je to velmi efektivn\u00ed zp\u016fsob blokov\u00e1n\u00ed, nicm\u00e9n\u011b lze jej obej\u00edt, pokud se pou\u017e\u00edvaj\u00ed nestandardn\u00ed zp\u016fsoby p\u0159eklad\u016f DNS, nap\u0159\u00edklad out-of-band kan\u00e1ly. Proto cenzory obvykle kombinuj\u00ed blokace DNS s pou\u017eit\u00edm IP filtrace. Ale, jak bylo uvedeno v\u00fd\u0161e, IP filtrace nen\u00ed efektivn\u00ed pro cenzurov\u00e1n\u00ed obsahu CDN.<\/p>\n<h2>Filtrace podle URL\/Kl\u00ed\u010dov\u00fdch slov pomoc\u00ed DPI <\/h2>\n<p>\nModern\u00ed za\u0159\u00edzen\u00ed pro monitorov\u00e1n\u00ed s\u00ed\u0165ov\u00e9 aktivity mohou b\u00fdt pou\u017eita k anal\u00fdze konkr\u00e9tn\u00edch URL a kl\u00ed\u010dov\u00fdch slov v p\u0159en\u00e1\u0161en\u00fdch datov\u00fdch paketech. Tato technologie se naz\u00fdv\u00e1 DPI (deep packet inspection). Takov\u00e9 syst\u00e9my vyhled\u00e1vaj\u00ed zm\u00ednky zak\u00e1zan\u00fdch slov a zdroj\u016f, na\u010de\u017e doch\u00e1z\u00ed k z\u00e1sahu do online komunikace. V d\u016fsledku toho jsou pakety jednodu\u0161e vyhozeny. <\/p>\n<p>Tato metoda je efektivn\u00ed, ale slo\u017eit\u011bj\u0161\u00ed a n\u00e1ro\u010dn\u011bj\u0161\u00ed na zdroje, proto\u017ee vy\u017eaduje defragmentaci v\u0161ech datov\u00fdch paket\u016f odes\u00edlan\u00fdch v r\u00e1mci konkr\u00e9tn\u00edch tok\u016f. <\/p>\n<p>CDN obsah lze chr\u00e1nit p\u0159ed podobnou filtrac\u00ed stejn\u011b jako \"b\u011b\u017en\u00fd\" obsah \u2013 v obou p\u0159\u00edpadech pom\u00e1h\u00e1 pou\u017eit\u00ed \u0161ifrov\u00e1n\u00ed (tedy HTTPS).<\/p>\n<p>Krom\u011b pou\u017e\u00edv\u00e1n\u00ed DPI pro vyhled\u00e1v\u00e1n\u00ed kl\u00ed\u010dov\u00fdch slov nebo URL zak\u00e1zan\u00fdch zdroj\u016f mohou b\u00fdt tyto n\u00e1stroje pou\u017eity pro pokro\u010dilej\u0161\u00ed anal\u00fdzu. Mezi tyto metody pat\u0159\u00ed statistick\u00e1 anal\u00fdza online\/offline provozu a anal\u00fdza identifika\u010dn\u00edch protokol\u016f. Tyto metody jsou extr\u00e9mn\u011b n\u00e1ro\u010dn\u00e9 na zdroje a v sou\u010dasn\u00e9 dob\u011b neexistuj\u00ed dostate\u010dn\u00e9 d\u016fkazy o jejich pou\u017e\u00edv\u00e1n\u00ed cenzory v v\u00fdznamn\u00e9m objemu.<\/p>\n<h2>Sebecenzura poskytovatel\u016f CDN<\/h2>\n<p>\nPokud je cenzorem st\u00e1t, m\u00e1 v\u0161echny mo\u017enosti zak\u00e1zat \u010dinnost v zemi t\u011bm poskytovatel\u016fm CDN, kte\u0159\u00ed se nepod\u0159izuj\u00ed m\u00edstn\u00edm z\u00e1kon\u016fm reguluj\u00edc\u00edm p\u0159\u00edstup k obsahu. Sebecenzura se ned\u00e1 nijak odporovat \u2013 proto pokud je poskytovatel CDN zainteresov\u00e1n na \u010dinnosti v n\u011bjak\u00e9 zemi, bude nucen dodr\u017eovat m\u00edstn\u00ed z\u00e1kony, i kdy\u017e omezuj\u00ed svobodu projevu.<\/p>\n<h2>Jak \u010c\u00edna cenzuruje obsah CDN<\/h2>\n<p>\nVelk\u00e1 \u010d\u00ednsk\u00e1 firewall je opr\u00e1vn\u011bn\u011b pova\u017eov\u00e1na za nejefektivn\u011bj\u0161\u00ed a nejpokro\u010dilej\u0161\u00ed syst\u00e9m pro zaji\u0161t\u011bn\u00ed internetov\u00e9 cenzury. <\/p>\n<h3>Metodologie v\u00fdzkumu<\/h3>\n<p>\nV\u011bdci prov\u00e1d\u011bli experimenty pomoc\u00ed Linuxov\u00e9ho uzlu um\u00edst\u011bn\u00e9ho uvnit\u0159 \u010c\u00edny. Tak\u00e9 m\u011bli p\u0159\u00edstup k n\u011bkolika po\u010d\u00edta\u010d\u016fm mimo zemi. Nejprve v\u00fdzkumn\u00edci ov\u011b\u0159ili, co z uzlu podl\u00e9h\u00e1 cenzu\u0159e podobn\u00e9 t\u00e9, kter\u00e1 se uplat\u0148uje na jin\u00e9 \u010d\u00ednsk\u00e9 u\u017eivatele \u2013 k tomu zkou\u0161eli otev\u0159\u00edt na tomto stroji r\u016fzn\u00e9 zak\u00e1zan\u00e9 weby. To potvrdilo p\u0159\u00edtomnost stejn\u00e9 \u00farovn\u011b cenzury. <\/p>\n<p>Seznam webov\u00fdch str\u00e1nek blokovan\u00fdch v \u010c\u00edn\u011b, kter\u00e9 pou\u017e\u00edvaj\u00ed CDN, byl p\u0159evzat z webu GreatFire.org. Pot\u00e9 byla prov\u00e1d\u011bna anal\u00fdza zp\u016fsobu blokace v ka\u017ed\u00e9m p\u0159\u00edpad\u011b. <\/p>\n<p>Podle ve\u0159ejn\u00fdch \u00fadaj\u016f je jedin\u00fdm velk\u00fdm hr\u00e1\u010dem na trhu CDN s vlastn\u00ed infrastrukturou v \u010c\u00edn\u011b spole\u010dnost Akamai. Dal\u0161\u00ed poskytovatel\u00e9, kte\u0159\u00ed se z\u00fa\u010dastnili v\u00fdzkumu: CloudFlare, Amazon CloudFront, EdgeCast, Fastly a SoftLayer.<\/p>\n<p>B\u011bhem experiment\u016f v\u00fdzkumn\u00edci zjistili adresy edge-server\u016f Akamai uvnit\u0159 zem\u011b, a pot\u00e9 se pokusili z\u00edskat p\u0159es n\u011b cacheovan\u00fd schv\u00e1len\u00fd obsah. P\u0159\u00edstup k zak\u00e1zan\u00e9mu obsahu se nezda\u0159il (byla vr\u00e1cena chyba HTTP 403 Forbidden) \u2013 je z\u0159ejm\u00e9, \u017ee spole\u010dnost prov\u00e1d\u00ed sebecenzuru, aby si udr\u017eela mo\u017enost fungovat v zemi. P\u0159itom mimo zemi z\u016fst\u00e1val p\u0159\u00edstup k t\u011bmto zdroj\u016fm otev\u0159en\u00fd.<\/p>\n<p>Poskytovatel\u00e9 bez infrastruktury v \u010c\u00edn\u011b nepou\u017e\u00edvaj\u00ed autocenzuru pro m\u00edstn\u00ed u\u017eivatele. <\/p>\n<p>V p\u0159\u00edpad\u011b ostatn\u00edch poskytovatel\u016f se nej\u010dast\u011bji pou\u017e\u00edvanou metodou blokov\u00e1n\u00ed stala filtraci DNS \u2013 dotazy na blokovan\u00e9 weby jsou sm\u011brov\u00e1ny na nespr\u00e1vn\u00e9 IP adresy. Firewall p\u0159itom neblokuje samotn\u00e9 edge servery CDN, proto\u017ee ty uchov\u00e1vaj\u00ed jak zak\u00e1zan\u00e9, tak povolen\u00e9 informace. <\/p>\n<p>A pokud maj\u00ed \u00fa\u0159ady v p\u0159\u00edpad\u011b ne\u0161ifrovan\u00e9ho provozu mo\u017enost blokovat jednotliv\u00e9 str\u00e1nky web\u016f pomoc\u00ed DPI, p\u0159i pou\u017eit\u00ed HTTPS mohou pouze zak\u00e1zat p\u0159\u00edstup k cel\u00e9mu dom\u00e9n\u011b jako celku. To vede tak\u00e9 k blokaci povolen\u00e9ho obsahu.<\/p>\n<p>Krom\u011b toho v \u010c\u00edn\u011b existuj\u00ed i vlastn\u00ed poskytovatel\u00e9 CDN, mezi nimi\u017e jsou takov\u00e9 s\u00edt\u011b jako ChinaCache, ChinaNetCenter a CDNetworks. V\u0161echny tyto spole\u010dnosti pln\u011b dodr\u017euj\u00ed legislativu zem\u011b a blokuj\u00ed zak\u00e1zan\u00fd obsah.<\/p>\n<h2>CacheBrowser: n\u00e1stroj pro obch\u00e1zen\u00ed blokac\u00ed pomoc\u00ed CDN<\/h2>\n<p>\nJak uk\u00e1zal anal\u00fdza, cenzor\u016fm se blokov\u00e1n\u00ed CDN obsahu dost obt\u00ed\u017en\u011b da\u0159\u00ed. Tedy v\u00fdzkumn\u00edci se rozhodli j\u00edt d\u00e1l a vyvinout n\u00e1stroj pro obch\u00e1zen\u00ed online blokac\u00ed, kter\u00fd nebude pou\u017e\u00edvat technologii proxy. <\/p>\n<p>Hlavn\u00ed my\u0161lenkou n\u00e1stroje je, \u017ee cenzor\u016fm k blokov\u00e1n\u00ed CDN mus\u00ed zasahovat do provozu DNS, ale pro na\u010d\u00edt\u00e1n\u00ed CDN obsahu ve skute\u010dnosti nen\u00ed nutn\u00e9 pou\u017e\u00edvat p\u0159eklad dom\u00e9nov\u00fdch jmen. Takto m\u016f\u017ee u\u017eivatel z\u00edskat pot\u0159ebn\u00fd obsah p\u0159\u00edmo p\u0159\u00edstupem k edge serveru, kde je ji\u017e vyrovnan\u00fd. <\/p>\n<p>Na n\u00ed\u017ee uveden\u00e9m diagramu je zn\u00e1zorn\u011bna struktura syst\u00e9mu. <\/p>\n<p><img decoding=\"async\" alt=\"Experiment CacheBrowser: obch\u00e1zen\u00ed \u010d\u00ednsk\u00e9 firewall bez proxy pomoc\u00ed cachov\u00e1n\u00ed obsahu\" src=\"\/wp-content\/uploads\/2019\/09\/07d32c2f2118c8e2b8a09a6913ff978b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa u\u017eivatelsk\u00e9m po\u010d\u00edta\u010di je nainstalov\u00e1n klientsk\u00fd software a pro p\u0159\u00edstup k obsahu se pou\u017e\u00edv\u00e1 b\u011b\u017en\u00fd prohl\u00ed\u017ee\u010d. <\/p>\n<p>P\u0159i po\u017eadavku URL nebo \u010d\u00e1sti ji\u017e d\u0159\u00edve po\u017eadovan\u00e9ho obsahu, webov\u00fd prohl\u00ed\u017ee\u010d ode\u0161le \u017e\u00e1dost m\u00edstn\u00edmu syst\u00e9mu DNS (LocalDNS), aby z\u00edskal IP adresu hostingu. Obvykl\u00e9 DNS je dotazov\u00e1no pouze pro dom\u00e9ny, kter\u00e9 je\u0161t\u011b nejsou obsa\u017eeny v datab\u00e1zi LocalDNS. Modul Scraper neust\u00e1le proch\u00e1z\u00ed po\u017eadovan\u00e9 URL a hled\u00e1 v seznamu potenci\u00e1ln\u011b blokovan\u00e1 dom\u00e9nov\u00e1 jm\u00e9na. Pot\u00e9 Scraper kontaktuje modul Resolver, aby vy\u0159e\u0161il nov\u011b objeven\u00e9 blokovan\u00e9 dom\u00e9ny, tento modul provede \u00fakol a p\u0159id\u00e1 z\u00e1znam do LocalDNS. N\u00e1sledn\u011b se DNS cache prohl\u00ed\u017ee\u010de vy\u010dist\u00ed, aby byly odstran\u011bny existuj\u00edc\u00ed DNS z\u00e1znamy pro blokovanou dom\u00e9nu.<\/p>\n<p>Pokud modul Resolver nedok\u00e1\u017ee ur\u010dit, ke kter\u00e9mu CDN poskytovateli dom\u00e9na pat\u0159\u00ed, po\u017e\u00e1d\u00e1 o pomoc modul Bootstrapper.<\/p>\n<h2>Jak to funguje v praxi<\/h2>\n<p>\nKlientsk\u00fd software produktu byl realizov\u00e1n pro Linux, ale lze ho snadno portovat tak\u00e9 pro Windows. Jako prohl\u00ed\u017ee\u010d se pou\u017e\u00edv\u00e1 klasick\u00fd Mozilla<br \/>\nFirefox. Moduly Scraper a Resolver jsou naps\u00e1ny v Pythonu, a datab\u00e1ze Customer-to-CDN a CDN-to-IP jsou uchov\u00e1v\u00e1ny v .txt souborech. Jako datab\u00e1ze LocalDNS slou\u017e\u00ed b\u011b\u017en\u00fd soubor \/etc\/hosts v Linuxu.<\/p>\n<p>Nakonec pro blokovan\u00e9 URL typu <noindex><a rel=\"nofollow\" href=\"https:\/\/blocked.com\/\">blocked.com<\/a><\/noindex> skript z\u00edsk\u00e1 IP adresu edge serveru ze souboru \/etc\/hosts a ode\u0161le HTTP GET po\u017eadavek pro p\u0159\u00edstup k BlockedURL.html s poli HTTP hlavi\u010dky Host:<\/p>\n<pre><code class=\"bash\">blocked.com\/ a User-Agent: Mozilla\/5.0 (Windows\nNT 5.1; rv:14.0) Gecko\/20100101 Firefox\/14.0.1<\/code><\/pre>\n<p>\nModul Bootstrapper je realizov\u00e1n pomoc\u00ed bezplatn\u00e9ho n\u00e1stroje digwebinterface.com. Tento DNS resolver nelze zablokovat a odpov\u00edd\u00e1 na DNS dotazy z pohledu mnoha geograficky rozlo\u017een\u00fdch DNS server\u016f v r\u016fzn\u00fdch s\u00ed\u0165ov\u00fdch regionech.<\/p>\n<p>S pomoc\u00ed tohoto n\u00e1stroje se v\u00fdzkumn\u00edk\u016fm poda\u0159ilo ze sv\u00e9 \u010d\u00ednsk\u00e9 uzlu z\u00edskat p\u0159\u00edstup na Facebook \u2013 a\u010dkoli je soci\u00e1ln\u00ed s\u00ed\u0165 v \u010c\u00edn\u011b ji\u017e dlouho blokov\u00e1na.<\/p>\n<p><img decoding=\"async\" alt=\"Experiment CacheBrowser: obch\u00e1zen\u00ed \u010d\u00ednsk\u00e9 firewall bez proxy pomoc\u00ed cachov\u00e1n\u00ed obsahu\" src=\"\/wp-content\/uploads\/2019\/09\/f33cf0e1544785bdb84234a4ac39f727.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Z\u00e1v\u011br<\/h2>\n<p>\nExperiment uk\u00e1zal, \u017ee pou\u017eit\u00ed probl\u00e9m\u016f, kter\u00e9 cenzory poci\u0165uj\u00ed p\u0159i pokusech zablokovat CDN obsah, lze vyu\u017e\u00edt k vytvo\u0159en\u00ed syst\u00e9mu obch\u00e1zen\u00ed blokac\u00ed. Takov\u00fd n\u00e1stroj umo\u017e\u0148uje obej\u00edt blokace i v \u010c\u00edn\u011b, kde p\u016fsob\u00ed jeden z nejsiln\u011bj\u0161\u00edch syst\u00e9m\u016f online cenzury.<\/p>\n<h2>Dal\u0161\u00ed \u010dl\u00e1nky na t\u00e9ma pou\u017eit\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/infatica.io\">rezidentn\u00edch proxy<\/a><\/noindex> pro podnik\u00e1n\u00ed:<\/h2>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/infatica\/blog\/460509\/\">Jak rezidentn\u00ed proxy pom\u00e1haj\u00ed v podnik\u00e1n\u00ed: re\u00e1ln\u00fd p\u0159\u00edpad pou\u017eit\u00ed Infatica v oblasti data miningu<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/infatica\/blog\/461537\/\">Anal\u00fdza. Jak funguje SOCKS proxy: v\u00fdhody, nev\u00fdhody, rozd\u00edly od jin\u00fdch technologi\u00ed<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/infatica\/blog\/454442\/\">Jak vybrat proxy s\u00ed\u0165 pro podnik\u00e1n\u00ed: 3 praktick\u00e9 rady<\/a><\/noindex><\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/infatica\/blog\/467201\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435: Unsplash \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0432\u0441\u0435\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c CDN-\u0441\u0435\u0442\u0435\u0439. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0446\u0435\u043d\u0437\u043e\u0440\u044b \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u0441\u0432\u043e\u0435 \u0432\u043b\u0438\u044f\u043d\u0438\u0435 \u043d\u0430 \u0442\u0430\u043a\u0438\u0435 \u0441\u0435\u0442\u0438. \u0423\u0447\u0435\u043d\u044b\u0435 \u0438\u0437 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u041c\u0430\u0441\u0441\u0430\u0447\u0443\u0441\u0435\u0442\u0441\u0430 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 CDN-\u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u043d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u043f\u0440\u0430\u043a\u0442\u0438\u043a \u0432\u043b\u0430\u0441\u0442\u0435\u0439 \u041a\u0438\u0442\u0430\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043e\u0431\u0445\u043e\u0434\u0430 \u0442\u0430\u043a\u0438\u0445 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043e\u043a. \u041c\u044b \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u043e\u0431\u0437\u043e\u0440\u043d\u044b\u0439 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b \u0441 \u0433\u043b\u0430\u0432\u043d\u044b\u043c\u0438 \u0432\u044b\u0432\u043e\u0434\u0430\u043c\u0438 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28594,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38090","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/eksperiment-cachebrowser-obhod-kitajskogo-faervola-bez-proksi-s-pomoshhyu-keshirovaniya-kontenta\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u042d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 CacheBrowser: \u043e\u0431\u0445\u043e\u0434 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u0444\u0430\u0435\u0440\u0432\u043e\u043b\u0430 \u0431\u0435\u0437 \u043f\u0440\u043e\u043a\u0441\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/eksperiment-cachebrowser-obhod-kitajskogo-faervola-bez-proksi-s-pomoshhyu-keshirovaniya-kontenta\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:21:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:21:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Experiment CacheBrowser: obch\u00e1zen\u00ed \u010d\u00ednsk\u00e9 firewally bez proxy pomoc\u00ed cachov\u00e1n\u00ed obsahu | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/eksperiment-cachebrowser-obhod-kitajskogo-faervola-bez-proksi-s-pomoshhyu-keshirovaniya-kontenta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442 CacheBrowser: \u043e\u0431\u0445\u043e\u0434 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u0444\u0430\u0435\u0440\u0432\u043e\u043b\u0430 \u0431\u0435\u0437 \u043f\u0440\u043e\u043a\u0441\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/eksperiment-cachebrowser-obhod-kitajskogo-faervola-bez-proksi-s-pomoshhyu-keshirovaniya-kontenta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:21:36+00:00","article:modified_time":"2019-10-31T19:21:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38090","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 20:26:14","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:15:23","updated":"2026-01-23 20:26:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=38090"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38090\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/28594"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=38090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=38090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=38090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}