{"id":52639,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3"},"modified":"2026-05-20T19:54:20","modified_gmt":"2026-05-20T17:54:20","slug":"domen-fronting-na-baze-tls-1-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","title":{"rendered":"TLS 1.3 p\u00f5hine domeenifronting","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sissejuhatus<\/h3>\n

\"TLS
\nMoodne ettev\u00f5tte sisu filtreerimise s\u00fcsteemid, nagu Cisco, BlueCoat ja FireEye, omavad palju \u00fchist oma v\u00f5imsamate kolleegidega \u2014 DPI s\u00fcsteemidega, mis on laialdaselt kasutusele v\u00f5etud riiklikul tasandil. Nende t\u00f6\u00f6 tuumik on sama: uurida saabuvat ja v\u00e4ljaminevat interneti liiklust ning mustade\/valgete serverite p\u00f5hjal otsustada interneti\u00fchenduse blokeerimise \u00fcle. Kuna m\u00f5lemad tuginevad oma t\u00f6\u00f6s sarnastele p\u00f5him\u00f5tetele, on ka nende \u00fcletamise viisidel palju \u00fchist.<\/p>\n

\u00dcks tehnoloogiatest, mis v\u00f5imaldab t\u00f5husalt v\u00e4ltida nii DPI-d kui ka ettev\u00f5tte s\u00fcsteeme, on domeenifrontimine. Selle olemus seisneb selles, et me p\u00e4\u00e4seme blokeeritud ressursile, varjates end teise, avaliku domeeni, hea mainega, millel ei ole mingit s\u00fcsteemi poolt blokeerimise ohtu, n\u00e4iteks google.com.<\/p>\n

Selle tehnoloogia kohta on juba kirjutatud piisavalt palju artikleid ja toodud esile palju n\u00e4iteid. Kuid populaarsed ja viimastel aegadel arutelud teema DNS-over-HTTPS ja kr\u00fcptitud SNI, samuti uus protokoll TLS 1.3 annavad v\u00f5imaluse vaadelda veel \u00fchte domeenide peitmise varianti.
\n<\/a><\/p>\n

Uurime tehnoloogiat<\/h3>\n

Alustame natuke p\u00f5him\u00f5istetega, et k\u00f5igil oleks arusaam, kes on kes ja miks see k\u00f5ik vajalik on. Oleme maininud eSNI mehhanismi, mille t\u00f6\u00f6le saab edaspidi l\u00e4hemalt vaatama. eSNI (kr\u00fcptitud Server Name Indication) on SNI kaitstud variant, mis on saadaval ainult protokolli TLS 1.3 jaoks. P\u00f5him\u00f5te on selles, et kr\u00fcptida ka teavet selle kohta, millisele domeenile p\u00e4ring saadetakse.<\/p>\n

N\u00fc\u00fcd vaatame eSNI mehhanismi t\u00f6\u00f6d praktikas.<\/p>\n

Oletame, et meil on internetiressurss, mis on blokeeritud kaasaegse DPI lahendusega (v\u00f5tame n\u00e4iteks kuulus torrentide j\u00e4lgija \u2014 rutracker.nl). Kui proovime k\u00fclastada torrentide j\u00e4lgija saiti, n\u00e4eme teenusepakkuja tavalist teavitust, et ressurss on blokeeritud:<\/p>\n

\"TLS<\/p>\n

RKNi lehelt on see domeen t\u00f5epoolest mustades nimekirjades:<\/p>\n

\"TLS<\/p>\n

Whois p\u00e4ringut tehes on n\u00e4ha, et domeen on \u201epeidetud\u201c Cloudflare'i pilveteenuse pakkuja taha.<\/p>\n

\"TLS<\/p>\n

Kuid erinevalt RKN-i \u201espetsialistidest\u201c ei otsustanud tehniliselt paremini haritud t\u00f6\u00f6tajad Beeline'is (v\u00f5i kellel on olnud valusat kogemust meie tuntud regulaatoriga) lihtsalt IP-aadressi p\u00f5hjal saiti blokeerida, vaid lisasid musta nimekirja just domeeninime<\/a>. Selle t\u00f5elisusesse veendumiseks vaadake, millised teised domeenid on sama IP-aadressiga<\/a>, k\u00fclastage \u00fchte neist ja n\u00e4ete, et juurdep\u00e4\u00e4s ei ole blokeeritud:<\/p>\n

\"TLS<\/p>\n

Kuidas see nii juhtub? Kuidas teab teenusepakkuja DPI, kuhu minu brauser suundub, kui k\u00f5ik suhtlused toimuvad https-protokolli kaudu, ja Beeline'i poolt sertifikaatide valevahetust me siiani pole m\u00e4rganud? Kas ta on kaugeleulatuv v\u00f5i j\u00e4lgib keegi mind?<\/p>\n

Proovime sellele k\u00fcsimusele vastata, vaadates liiklust Wiresharki kaudu.<\/p>\n

\"TLS<\/p>\n

Ekraanipildil on n\u00e4ha, et esmalt saab brauser DNS-i kaudu serveri IP-aadresse, seej\u00e4rel toimub standardne TCP k\u00e4tlemine sihiserveriga, ja siis p\u00fc\u00fcab brauser SSL-\u00fchendust serveriga luua. Selleks edastab ta paketi SSL<\/a> Client Hello, milles on algse domeeni nimi avatud kujul. See v\u00e4li on vajalik cloudflare'i esirakenduse serverile, et korralikult suunata \u00fchendust. Just siin tabab meid teenusepakkuja DPI, katkestades meie \u00fchenduse. Sel juhul me ei saa teenusepakkujalt mingit t\u00f5kestust ja n\u00e4eme standardset brauseri viga justkui sait oleks v\u00e4lja l\u00fclitatud v\u00f5i lihtsalt ei t\u00f6\u00f6ta:<\/p>\n

\"TLS<\/p>\n

N\u00fc\u00fcd l\u00fclitame brauseris sisse eSNI mehhanismi, nagu on kirjutatud juhendis Firefox <\/a>:
\nSelleks avame Firefoxi konfiguratsioonilehe about:config<\/b> ja aktiveerime j\u00e4rgmised seaded:<\/p>\n

network.trr.mode = 2;\nnetwork.trr.uri = https:\/\/mozilla.cloudflare-dns.com\/dns-query\nnetwork.security.esni.enabled = true\n<\/code><\/pre>\n
P\u00e4rast seda kontrollime seadete \u00f5igsust cloudflare'i saidil lingi kaudu<\/a> ja proovime meie torrent-trackeriga trikki veel kord.<\/p>\n
\"TLS<\/p>\n
Voil\u00e0. Meie lemmik tracker avanes, ilma igasuguste VPNide ja proksiserveriteta. Vaatame n\u00fc\u00fcd wireshark'is liiklusdummit, mis juhtus.<\/p>\n
\"TLS<\/p>\n
Sel korral ssl kliendi tervituse pakett ei sisalda selges\u00f5naliselt sihtdomeeni, vaid selle asemel on paketi koostises uus v\u00e4li \u2014 encrypted_server_name \u2014 just seal paikneb v\u00e4\u00e4rtus rutracker.nl, ning seda v\u00e4lja suudab dekr\u00fcpteerida ainult Cloudflare'i frontend-server. Seega ei j\u00e4\u00e4 teenusepakkuja DPI-le muud \u00fcle, kui k\u00e4ed \u00fcles t\u00f5sta ja selline liiklus lubada. Teisi \u0161ifreerimise variante pole.<\/p>\n
N\u00fc\u00fcd, kui me oleme vaadanud, kuidas tehnoloogia brauseris t\u00f6\u00f6tab, proovime rakendada seda spetsiifilisematel ja huvitavatel viisidel. Esmalt \u00f5petame curl'i kasutama eSNI-d TLS 1.3 puhul ning vaatame, kuidas toimib domeenifronting eSNI alusel.<\/p>\n
Domeenifronting eSNI-ga<\/h3>\n
Kuna curl kasutab https-protokolli jaoks standardset OpenSSL teeki, peame k\u00f5igepealt tagama eSNI toe just seal. OpenSSL-i master-haru ei toeta veel eSNI-d, seega peame laadima alla erilise OpenSSL haru, selle kompileerima ja installima.<\/p>\n
Kloonime GitHubi hoidla ja kompileerime nagu tavaliselt:<\/p>\n
$ git clone https:\/\/github.com\/sftcd\/openssl\n$ cd openssl\n$ .\/config\n\n$ make\n$ cd esnistuff\n$ make\n<\/code><\/pre>\n
\u0414\u0430\u043b\u0435\u0435 \u2014 \u043a\u043b\u043e\u043d\u0438\u0440\u0443\u0435\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0441 curl \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u0443\u0435\u043c \u0435\u0433\u043e \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0430\u0448\u0435\u0439 \u0441\u043e\u0431\u0440\u0430\u043d\u043d\u043e\u0439 openssl \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438:<\/p>\n
$ cd $HOME\/code\n$ git clone https:\/\/github.com\/niallor\/curl.git curl-esni\n$ cd curl-esni\n\n$ export LD_LIBRARY_PATH=\/opt\/openssl\n$ .\/buildconf\n$ LDFLAGS=\"-L\/opt\/openssl\" .\/configure --with-ssl=\/opt\/openssl --enable-esni --enable-debug\n<\/code><\/pre>\n
\u0417\u0434\u0435\u0441\u044c \u0432\u0430\u0436\u043d\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u0441\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0438, \u0433\u0434\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f openssl (\u0432 \u043d\u0430\u0448\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u2014 \u044d\u0442\u043e \/opt\/openssl\/) \u0438 \u043f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0448\u0435\u043b \u0431\u0435\u0437 \u043e\u0448\u0438\u0431\u043e\u043a.<\/p>\n
\u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u2014 \u043c\u044b \u0443\u0432\u0438\u0434\u0438\u043c \u0441\u0442\u0440\u043e\u043a\u0443:<\/p>\n
WARNING: esni ESNI enabled but marked EXPERIMENTAL. Use with caution!<\/b><\/p>\n
$ make<\/code><\/pre>\n
\u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u043c\u044b \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c bash-\u0444\u0430\u0439\u043b\u043e\u043c \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 openssl \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 curl. \u0421\u043a\u043e\u043f\u0438\u0440\u0443\u0435\u043c \u0435\u0433\u043e \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0441 curl \u0434\u043b\u044f \u0443\u0434\u043e\u0431\u0441\u0442\u0432\u0430:<\/p>\n
cp \/opt\/openssl\/esnistuff\/curl-esni <\/code><\/pre>\n
\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u043c \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0439 https-\u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 cloudflare, \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0437\u0430\u043f\u0438\u0441\u0430\u0432 DNS \u0438 TLS \u043f\u0430\u043a\u0435\u0442\u044b \u0432 Wireshark.<\/p>\n
$ ESNI_COVER=\"www.hello-rkn.ru\" .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
\u0412 \u043e\u0442\u0432\u0435\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043f\u043e\u043c\u0438\u043c\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0430 \u043e\u0442\u043b\u0430\u0434\u043e\u0447\u043d\u043e\u0439-\u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0442 openssl \u0438 curl \u043c\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u043c HTTP-\u043e\u0442\u0432\u0435\u0442 \u0441 \u043a\u043e\u0434\u043e\u043c 301 \u043e\u0442 cloudflare.<\/p>\n
HTTP\/1.1 301 Moved Permanently\n< Date: Sun, 03 Nov 2019 13:12:55 GMT\n< Transfer-Encoding: chunked\n< Connection: keep-alive\n< Cache-Control: max-age=3600\n< Expires: Sun, 03 Nov 2019 14:12:55 GMT\n< Location: https:\/\/www.cloudflare.com\/\n<\/code><\/pre>\n
mis n\u00e4itab, et meie p\u00e4ring on edukalt j\u00f5udnud sihtserverisse, kuulatud ja t\u00f6\u00f6deldud.<\/p>\n
N\u00fc\u00fcd vaatame Wiresharkis liiklust, st mida n\u00e4gi antud juhul teenusepakkuja DPI.<\/p>\n
\"TLS<\/p>\n
On n\u00e4ha, et esmalt k\u00fcsis curl DNS-serverilt avalike eSNI v\u00f5tmete kohta Cloudflare'i serveri jaoks \u2013 TXT DNS-k\u00fcsimus _esni.cloudflare.com (pakett nr 13). Seej\u00e4rel saatis curl, kasutades openssl-i teeki, TLS 1.3 p\u00e4ringu Cloudflare'i serverile, kus SNI v\u00e4li oli kr\u00fcpteeritud eelnevalt saadud avaliku v\u00f5tmega (pakett nr 22). Kuid lisaks eSNI v\u00e4ljale oli SSL-hello paketi koostisesse lisatud veel ka tavap\u00e4rase, avaliku SNI v\u00e4li, mille saame m\u00e4\u00e4rata suvalises j\u00e4rjekorras (antud juhul \u2013 www.hello-rkn.ru<\/a>). <\/b><\/p>\n
Antud avaliku SNI v\u00e4li ei m\u00f5jutanud Cloudflare'i serverites t\u00f6\u00f6tlemist ja see oli lihtsalt teenusepakkuja DPI jaoks maskeeriv. Cloudflare'i server v\u00f5ttis meie ssl-hello paketi vastu, dekr\u00fcpteeris eSNI, ekstrakteeris sealt algse SNI ja t\u00f6\u00f6tles selle nagu tavaliselt (tegi k\u00f5ik just nii, nagu eSNI v\u00e4ljat\u00f6\u00f6tamisel oli planeeritud).<\/p>\n
Ainus, millele sellisel juhul DPI m\u00f5ttes toetuda, on esmase DNS-p\u00e4ringu tegemine _esni.cloudflare.com. Kuid me tegime DNS-p\u00e4ringu avalikuks vaid selleks, et n\u00e4idata, kuidas see mehhanism seestpoolt t\u00f6\u00f6tab.<\/p>\n
DPI alt v\u00e4ljasaamiseks kasutame juba mainitud DNS-over-HTTPS mehhanismi. V\u00e4ike selgitus \u2013 DOH on protokoll, mis kaitseb keskmise inimese r\u00fcnnaku eest, edastades DNS-p\u00e4ringu HTTPS-protokolli kaudu.<\/p>\n
Teeme p\u00e4ringu uuesti, kuid seekord saame avalikud eSNI v\u00f5tmed HTTPS-protokolli, mitte DNS kaudu:<\/p>\n
ESNI_COVER=\"www.hello-rkn.ru\" DOH_URL=https:\/\/mozilla.cloudflare-dns.com\/dns-query .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
P\u00e4ringu liikluse dump on esitatud alloleval ekraanipiltidel:<\/p>\n
\"TLS<\/p>\n
On n\u00e4ha, et esmalt p\u00f6\u00f6rdub curl serveri mozilla.cloudflare-dns.com poole DoH protokolli kaudu (HTTPS-\u00fchendus serveriga 104.16.249.249), et saada neilt avalikud v\u00f5tmed SNI kr\u00fcpteerimiseks, ning seej\u00e4rel juba sihtserveri poole, kaitstes end samas domeeni kaudu. www.hello-rkn.ru<\/a>.<\/p>\n
Lisaks eelnevale DoH resolvijale mozilla.cloudflare-dns.com saame kasutada ka teisi populaarseid DoH teenuseid, n\u00e4iteks \u00fchte kurikuulsast kurjast ettev\u00f5ttest.
\nTeeme sellise p\u00e4ringu:<\/p>\n
ESNI_COVER=\"www.kremlin.ru\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
\u0418 \u043f\u043e\u043b\u0443\u0447\u0438\u043c \u043e\u0442\u0432\u0435\u0442:<\/p>\n
< HTTP\/1.1 301 Moved Permanently\n< Date: Sun, 03 Nov 2019 14:10:22 GMT\n< Content-Type: text\/html\n< Transfer-Encoding: chunked\n< Connection: keep-alive\n< Set-Cookie: __cfduid=da0144d982437e77b0b37af7d00438b1a1572790222; expires=Mon, 02-Nov-20 14:10:22 GMT; path=\/; domain=.rutracker.nl; HttpOnly; Secure\n< Location: https:\/\/rutracker.nl\/forum\/index.php\n< CF-Cache-Status: DYNAMIC\n< Expect-CT: max-age=604800, report-uri=\"https:\/\/report-uri.cloudflare.com\/cdn-cgi\/beacon\/expect-ct\"\n< Server: cloudflare\n< CF-RAY: 52feee696f42d891-CPH\n<\/code><\/pre>\n
\"TLS<\/p>\n
\u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043c\u044b \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0438\u0441\u044c \u043d\u0430 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 rutracker.nl, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c DoH-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440 dns.google (\u0442\u0443\u0442 \u043d\u0435\u0442 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438, \u0442\u0435\u043f\u0435\u0440\u044c \u0443 \u0437\u043d\u0430\u043c\u0435\u043d\u0438\u0442\u043e\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u0441\u0432\u043e\u0439 \u0434\u043e\u043c\u0435\u043d \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f) \u0438 \u043f\u0440\u0438\u043a\u0440\u044b\u043b\u0438\u0441\u044c \u0443\u0436\u0435 \u0434\u0440\u0443\u0433\u0438\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u043c, \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u0442\u0440\u043e\u0433\u043e-\u043d\u0430\u0441\u0442\u0440\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043e \u0432\u0441\u0435\u043c DPI \u043f\u043e\u0434 \u0441\u0442\u0440\u0430\u0445\u043e\u043c \u0441\u043c\u0435\u0440\u0442\u043d\u043e\u0439 \u043a\u0430\u0437\u043d\u0438. \u041f\u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u043c\u0443 \u043e\u0442\u0432\u0435\u0442\u0443 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043d\u044f\u0442\u044c, \u0447\u0442\u043e \u043d\u0430\u0448 \u0437\u0430\u043f\u0440\u043e\u0441 \u0431\u044b\u043b \u0443\u0434\u0430\u0447\u043d\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d.<\/p>\n
\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0441\u043a\u0438\u0439 DPI \u0440\u0435\u0430\u0433\u0438\u0440\u0443\u0435\u0442 \u043d\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 SNI, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u044b \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043a\u0440\u044b\u0442\u0438\u044f \u2014 \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441 \u043a rutracker.nl \u043f\u0440\u0438\u043a\u0440\u044b\u0432\u0448\u0438\u0441\u044c \u043a\u0430\u043a\u0438\u043c-\u043d\u0438\u0431\u0443\u0434\u044c \u0434\u0440\u0443\u0433\u0438\u043c \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043d\u044b\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u043c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u0434\u0440\u0443\u0433\u0438\u043c \u00ab\u0445\u043e\u0440\u043e\u0448\u0438\u043c\u00bb \u0442\u043e\u0440\u0440\u0435\u043d\u0442-\u0442\u0440\u0435\u043a\u0435\u0440\u043e\u043c:<\/p>\n
$ ESNI_COVER=\"rutor.info\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
Serverilt vastust ei saa, kuna meie p\u00e4ring blokeeritakse DPI-s\u00fcsteemi poolt.<\/p>\n
L\u00fchike kokkuv\u00f5te esimesele osale<\/h3>\n
Nii \u00f5nnestus meil demonstreerida eSNI toimimist openssl ja curl abil ning kontrollida eSNI-p\u00f5hise domeeni esiotsa t\u00f6\u00f6kindlust. Samamoodi saame kohandada oma lemmikinstrumente, mis kasutavad openssl raamatukogu, et t\u00f6\u00f6tada \"varjatult\" teiste domeenide all. Rohkem teavet selle kohta leiate meie j\u00e4rgmistest artiklitest.<\/p>\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0438\u043c\u0435\u043d\u0438\u0442\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a Cisco, BlueCoat, FireEye \u0438\u043c\u0435\u044e\u0442 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043c\u043e\u0449\u043d\u044b\u043c\u0438 \u0438\u0445 \u0441\u043e\u0431\u0440\u0430\u0442\u044c\u044f\u043c\u0438 \u2014 DPI \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0438\u043b\u0435\u043d\u043d\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435. \u0421\u0443\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0442\u0435\u0445 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u043e\u0441\u043c\u043e\u0442\u0440 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u043d\u044b\u0445\/\u0431\u0435\u043b\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52639","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Domeeni esiots TLS 1.3 baasil | ProHoster","description":"Sissejuhatus T\u00e4nap\u00e4eva ettev\u00f5tete sisu filtreerimise s\u00fcsteemid, tuntud tootjatelt nagu Cisco, BlueCoat, FireEye, sarnanevad oma v\u00f5imsamate kolleegidega \u2014 DPI s\u00fcsteemidega, mis saavad j\u00e4rjest enam riiklikul tasandil kasutusele. Nende t\u00f6\u00f6 p\u00f5him\u00f5te on kontrollida sissetulevat ja v\u00e4ljuvat internetiliiklust ning mustade\/proovide loendite alusel otsuste tegemine.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0438\u043c\u0435\u043d\u0438\u0442\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a Cisco, BlueCoat, FireEye \u0438\u043c\u0435\u044e\u0442 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043c\u043e\u0449\u043d\u044b\u043c\u0438 \u0438\u0445 \u0441\u043e\u0431\u0440\u0430\u0442\u044c\u044f\u043c\u0438 \u2014 DPI \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0438\u043b\u0435\u043d\u043d\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435. \u0421\u0443\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0442\u0435\u0445 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u043e\u0441\u043c\u043e\u0442\u0440 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u043d\u044b\u0445\/\u0431\u0435\u043b\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2026-05-20T17:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52639","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:27","updated":"2026-01-24 04:19:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=52639"}],"version-history":[{"count":3,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52639\/revisions"}],"predecessor-version":[{"id":173323,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/52639\/revisions\/173323"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=52639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=52639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=52639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}