{"id":91188,"date":"2020-08-09T13:42:21","date_gmt":"2020-08-09T11:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni"},"modified":"2020-08-09T13:42:21","modified_gmt":"2020-08-09T11:42:21","slug":"kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","title":{"rendered":"Hiina on hakanud blokeerima HTTPS-\u00fchendusi, mis on loodud TLS 1.3 ja ESNI abil","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

China rakendatud<\/a><\/noindex> blokeerimise<\/a><\/noindex> k\u00f5ikide HTTPS-\u00fchenduste jaoks, kus kasutatakse TLS 1.3 protokolli ja TLS-i laiendust ESNI (Encrypted Server Name Indication), mis tagab taotletava hosti andmete kr\u00fcpteerimise. Blokeerimine toimub \u00fclekande ruuterites nii \u00fchenduste puhul, mis luuakse Hiinast v\u00e4lismaailma kui ka v\u00e4lismaailmast Hiinasse.<\/p>\n

Blokeerimine toimub pakettide filtreerimise kaudu kliendist serverisse, mitte pakettide asendamise kaudu RST-flaagiga, mis oli varem rakendatud SNI sisu p\u00f5hjalikuks blokkimiseks. P\u00e4rast ESNI paketi blokeerimist blokeeritakse 120 kuni 180 sekundi jooksul ka k\u00f5ik v\u00f5rgu paketid, mis vastavad algse IP, siht-IP ja sihtpordi numbriga seotud kombinatsioonile. HTTPS-\u00fchendused vanemate TLS versioonide ja TLS 1.3, millega ei kaasne ESNI-d, lubatakse tavap\u00e4raselt. <\/p>\n

Tulet t\u00e4hele, et mitu HTTPS-saiti saab \u00fche IP-aadressi peal t\u00f6\u00f6le panna SNI laienduse abil, mis edastab hostinime avatud kujul ClientHello s\u00f5numis, mis saadetakse enne kr\u00fcpteeritud suhtluskanali loomist. Selline omadus v\u00f5imaldab internetiteenuse pakkujal valikuliselt filtreerida HTTPS-i liiklust ja anal\u00fc\u00fcsida, milliseid saite kasutaja avab, mis ei v\u00f5imalda saavutada t\u00e4ielikku konfidentsiaalsust HTTPS-i kasutamisel.<\/p>\n

Uus TLS-i t\u00e4iendus ECH (endise nimetusega ESNI), mida saab kasutada koos TLS 1.3-ga, k\u00f5rvaldab selle puuduse ja v\u00e4listab t\u00e4ielikult teabe leket kohta, millist veebisaiti taotletakse HTTPS-\u00fchenduste anal\u00fc\u00fcsimisel. Koos sisuhalduse v\u00f5rguga aitab ECH\/ESNI rakendamine peita ka taotleja IP-aadressi. Liikluseneeringud n\u00e4evad vaid CDN-i p\u00e4ringuid ja ei saa blokeerida ilma TLS-seansi asendamiseta, mille korral kuvatakse kasutaja brauseris vastav sertifikaadi asendamise teade. DNS v\u00f5ib siiski j\u00e4\u00e4da lekete kanaliks, kuid DNS-i taotlusi saab kliendi poolt varjata DNS-over-HTTPS v\u00f5i DNS-over-TLS abil.<\/p>\n

Uurijad on juba tuvastasid<\/a><\/noindex> leiutanud mitmeid viise Hiina blokeeringute \u00fcletamiseks klientide ja serverite k\u00fcljelt, kuid need v\u00f5ivad kiiresti vananeda ja neid tuleks pidada vaid ajutiseks lahenduseks. N\u00e4iteks on praegu blokeeritud ainult packets, mille laienduse identifikaator on ESNI 0xffce (encrypted_server_name), mis kasutati standardi eeln\u00f5u viienda versiooni puhul<\/a><\/noindex>, kuid praegu j\u00e4etakse vahele 0xff02 (encrypted_client_hello) identifikaatoriga paketid, mis on ette n\u00e4htud ECH seitsmendas mustandis<\/a><\/noindex>. <\/p>\n

Teiseks v\u00f5imaluseks on mittestandardsest \u00fchenduse l\u00e4bir\u00e4\u00e4kimise protsessi kasutamine, n\u00e4iteks blokeerimine ei toimi, kui saadetakse eelnevalt lisasyn paket, millel on vale j\u00e4rjestusnumber, paketifragmenteerimisflaggide manipuleerimine, paketiga, millel on samaaegselt seatud FIN ja SYN flagid, RST-paketi asendamine vale kontrollsummaga v\u00f5i paketi saatmine, millel on SYN ja ACK flagid, enne \u00fchenduse l\u00e4bir\u00e4\u00e4kimiste algust. \u00dcksikasjalikud meetodid on juba rakendatud pluginana t\u00f6\u00f6riistakogusse Genf<\/a><\/noindex>, mida arendab<\/a><\/noindex> censuuri meetodite \u00fcletamiseks.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS 1.3 \u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 ESNI (Encrypted Server Name Indication), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u0430\u043a \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u043c\u0438\u0440, \u0442\u0430\u043a \u0438 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043c\u0438\u0440\u0430 \u0432 \u041a\u0438\u0442\u0430\u0439. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91188","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hiina on hakanud blokeerima HTTPS-\u00fchendusi, mis on loodud TLS 1.3 ja ESNI-ga | ProHoster","description":"Hiina on rakendanud","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-09T11:42:21+00:00","article:modified_time":"2020-08-09T11:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91188","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:32:23","updated":"2022-09-28 04:45:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=91188"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91188\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=91188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=91188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=91188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}