{"id":91188,"date":"2020-08-09T13:42:21","date_gmt":"2020-08-09T11:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni"},"modified":"2020-08-09T13:42:21","modified_gmt":"2020-08-09T11:42:21","slug":"kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","title":{"rendered":"Hiina on alustanud HTTPS-\u00fchenduste blokeerimist, mis on loodud TLS 1.3 ja ESNI-ga.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hiina rakendanud<\/a><\/noindex> blokeerimist<\/a><\/noindex> k\u00f5ikidele HTTPS-\u00fchendustele, kus kasutatakse protokolli TLS 1.3 ja TLS-i laiendust ESNI (Encrypted Server Name Indication), mis tagab andmete kr\u00fcpteerimise n\u00f5utava hosti kohta. Blokeerimine toimub transiitruuterites nii \u00fchenduste puhul, mis loodud Hiinast v\u00e4lismaailma, kui ka v\u00e4lismaailmast Hiinasse.<\/p>\n

Blokeerimise teostamiseks toimub paketide mahaviskamine kliendilt serverisse, mitte RST lipuga pakettide asendamine, nagu varem toimus SNI sisu p\u00f5hjalise valikulise blokeerimise korral. P\u00e4rast ESNI paketi blokeerimist blokeeritakse 120 kuni 180 sekundi jooksul ka k\u00f5ik v\u00f5rgu paketid, mis vastavad algse IP, siht-IP ja sihtporti seotud kombole. HTTPS-\u00fchendused, mis p\u00f5hinevad vanematel TLS-i versioonidel ja TLS 1.3-il ilma ESNI-ta, lubatakse nagu tavaliselt. <\/p>\n

Tuletame meelde, et mitme HTTPS-saiti t\u00f6\u00f6 korraldamiseks \u00fchel IP-aadressil on v\u00e4lja t\u00f6\u00f6tatud SNI laiendus, mis edastab hostinime avatud kujul ClientHello s\u00f5numis, mis saadetakse enne kr\u00fcpteeritud sidekanali loomist. Selline omadus v\u00f5imaldab interneti pakkujal valikuliselt filtreerida HTTPS-liiklust ja anal\u00fc\u00fcsida, milliseid saite kasutaja avab, mis ei v\u00f5imalda saavutada t\u00e4ielikku konfidentsiaalsust HTTPS-i kasutamisel.<\/p>\n

Uus TLS-laiendus ECH (endine ESNI), mida saab kasutada koos TLS 1.3-ga, k\u00f5rvaldab selle puuduse ja v\u00e4listab t\u00e4ielikult teabe leket k\u00fcsitava saidi kohta HTTPS-\u00fchenduste anal\u00fc\u00fcsi k\u00e4igus. Koos sisu edastamise v\u00f5rgu kasutamisega v\u00f5imaldab ECH\/ESNI rakendamine samuti peita pakkuja eest ka p\u00e4ringuri IP-aadressi. Liiklusinspektsiooni s\u00fcsteemid n\u00e4evad ainult p\u00f6\u00f6rdumisi CDN-i poole ja ei suuda blokeerida ilma TLS-istseeni asendamata, mille korral kuvatakse kasutaja brauseris vastav teade sertifikaadi asendamisest. DNS j\u00e4\u00e4b ikkagi v\u00f5imaliku leketee allikaks, kuid DNS-i varjamiseks v\u00f5ib klient kasutada DNS-over-HTTPS v\u00f5i DNS-over-TLS.<\/p>\n

Uuringud on juba tuvastasid<\/a><\/noindex> m\u00f5ned ringitee lahendused Hiina tsensuuri \u00fcletamiseks kliendi ja serveri tasandil, kuid need v\u00f5ivad kaotada oma \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c ja neid tuleks k\u00e4sitleda kui ajutisi meetmeid. N\u00e4iteks on hetkel blokeeritud ainult paketid, mille tuvastusidentifikaator on ESNI 0xffce (encrypted_server_name), mida on kasutatud viied draft standardi<\/a><\/noindex>, kuid praegu lubatakse pakette, mille tuvastusidentifikaator on 0xff02 (encrypted_client_hello), mis on ette pandud seitsmendas ECH spetsifikatsiooni draftis<\/a><\/noindex>. <\/p>\n

Teine ringtee variant on mittestandardsel \u00fchenduse l\u00e4bir\u00e4\u00e4kimise protsessil p\u00f5hinev, n\u00e4iteks blokeerimine ei toimi, kui eelt\u00f6\u00f6deldakse lisa SYN-paketti vale j\u00e4rjestusnumbriga, pakettide fragmentimise m\u00e4rkide manipuleerimine, paketi saatmine samaaegselt FIN ja SYN lipud, RST-paketi asendamine vale kontrollsummaga v\u00f5i paketi saatmine, millel on SYN ja ACK lipud, enne \u00fchenduse l\u00e4bir\u00e4\u00e4kimise alustamist. Kirjeldatud meetodeid on juba rakendatud pistikprogrammina t\u00f6\u00f6riistadele Genf<\/a><\/noindex>, mida arendab<\/a><\/noindex> tsensuurimeetodite \u00fcletamiseks.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS 1.3 \u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 ESNI (Encrypted Server Name Indication), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u0430\u043a \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u043c\u0438\u0440, \u0442\u0430\u043a \u0438 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043c\u0438\u0440\u0430 \u0432 \u041a\u0438\u0442\u0430\u0439. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91188","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hiina on alustanud HTTPS-\u00fchenduste blokeerimist, mis on loodud TLS 1.3 ja ESNI abil | ProHoster","description":"Hiina on rakendanud","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-09T11:42:21+00:00","article:modified_time":"2020-08-09T11:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91188","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:32:23","updated":"2022-09-28 04:45:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=91188"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91188\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=91188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=91188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=91188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}