{"id":91188,"date":"2020-08-09T13:42:21","date_gmt":"2020-08-09T11:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni"},"modified":"2020-08-09T13:42:21","modified_gmt":"2020-08-09T11:42:21","slug":"kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","title":{"rendered":"Chiny zacz\u0119\u0142y blokowa\u0107 po\u0142\u0105czenia HTTPS z TLS 1.3 i ESNI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Chiny <noindex><a rel=\"nofollow\" href=\"https:\/\/mailarchive.ietf.org\/arch\/msg\/tls\/Dae-cukKMqfzmTT4Ksh1Bzlx7ws\/\">wdro\u017cono<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/gfw.report\/blog\/gfw_esni_blocking\/en\/\">blokadzie<\/a><\/noindex>  wszystkich po\u0142\u0105cze\u0144 HTTPS, w kt\u00f3rych stosowany jest protok\u00f3\u0142 TLS 1.3 oraz rozszerzenie TLS ESNI (Encrypted Server Name Indication) zapewniaj\u0105ce szyfrowanie danych o \u017c\u0105danym ho\u015bcie. Blokada odbywa si\u0119 na routerach tranzytowych zar\u00f3wno dla po\u0142\u0105cze\u0144 ustanawianych z Chin do \u015bwiata zewn\u0119trznego, jak i z \u015bwiata zewn\u0119trznego do Chin.<\/p>\n<p>Dla blokady wykonywane jest odrzucanie pakiet\u00f3w od klienta do serwera, a nie wstawianie pakiet\u00f3w z flag\u0105 RST, co wcze\u015bniej by\u0142o stosowane podczas selektywnej blokady wed\u0142ug zawarto\u015bci SNI. Po aktywacji blokady pakietu z ESNI przez 120 do 180 sekund blokowane s\u0105 r\u00f3wnie\u017c wszystkie pakiety sieciowe odpowiadaj\u0105ce parze z adresu IP \u017ar\u00f3d\u0142owego, docelowego adresu IP i numeru portu docelowego. Po\u0142\u0105czenia HTTPS oparte na starszych wersjach TLS oraz TLS 1.3 bez ESNI s\u0105 przepuszczane jak zwykle. <\/p>\n<p>Przypomnijmy, \u017ce w celu organizacji pracy na jednym adresie IP kilku stron HTTPS opracowano rozszerzenie SNI, kt\u00f3re umo\u017cliwia przesy\u0142anie nazwy hosta w jawny spos\u00f3b w komunikacie ClientHello, przesy\u0142anym przed nawi\u0105zaniem szyfrowanego kana\u0142u komunikacyjnego. Tego rodzaju w\u0142a\u015bciwo\u015b\u0107 umo\u017cliwia dostawcy internetowemu selektywn\u0105 filtracj\u0119 ruchu HTTPS oraz analizowanie, jakie strony otwiera u\u017cytkownik, co nie pozwala na osi\u0105gni\u0119cie pe\u0142nej prywatno\u015bci przy stosowaniu HTTPS.<\/p>\n<p>Nowe rozszerzenie TLS ECH (wcze\u015bniej ESNI), kt\u00f3re mo\u017ce by\u0107 stosowane w po\u0142\u0105czeniu z TLS 1.3, eliminuje t\u0119 wad\u0119 i ca\u0142kowicie wyklucza wyciek informacji o \u017c\u0105danej stronie podczas analizy po\u0142\u0105cze\u0144 HTTPS. W po\u0142\u0105czeniu z korzystaniem z sieci dostarczania tre\u015bci stosowanie ECH\/ESNI r\u00f3wnie\u017c umo\u017cliwia ukrycie przed dostawc\u0105 oraz adresu IP \u017c\u0105danego zasobu. Systemy inspekcji ruchu b\u0119d\u0105 widzia\u0142y jedynie zapytania do CDN i nie b\u0119d\u0105 mog\u0142y zastosowa\u0107 blokady bez podmiany sesji TLS, w przypadku kt\u00f3rej u\u017cytkownikowi w przegl\u0105darce zostanie wy\u015bwietlone odpowiednie powiadomienie o podmianie certyfikatu. Mo\u017cliwym kana\u0142em wycieku pozostaje DNS, jednak aby ukry\u0107 zapytania do DNS, klient mo\u017ce stosowa\u0107 DNS-over-HTTPS lub DNS-over-TLS.<\/p>\n<p>Badacze ju\u017c <noindex><a rel=\"nofollow\" href=\"https:\/\/geneva.cs.umd.edu\/posts\/china-censors-esni\/esni\/\">ujawnili<\/a><\/noindex> istniej\u0105 r\u00f3\u017cne metody omijania chi\u0144skiej blokady zar\u00f3wno po stronie klienta, jak i serwera, ale mog\u0105 one straci\u0107 na znaczeniu i nale\u017cy je traktowa\u0107 jedynie jako tymczasowe rozwi\u0105zanie. Na przyk\u0142ad obecnie blokowane s\u0105 tylko pakiety z identyfikatorem rozszerzenia ESNI 0xffce (encrypted_server_name), kt\u00f3ry by\u0142 u\u017cywany w <noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/draft-ietf-tls-esni-05\">pi\u0105tej wersji roboczej standardu<\/a><\/noindex>, ale pakiety z aktualnym identyfikatorem 0xff02 (encrypted_client_hello), zaproponowanym w <noindex><a rel=\"nofollow\" href=\"https:\/\/tools.ietf.org\/html\/draft-ietf-tls-esni-07\">si\u00f3dmej wersji roboczej specyfikacji ECH<\/a><\/noindex>.  <\/p>\n<p>Inn\u0105 opcj\u0105 omijania jest wykorzystanie niestandardowego procesu negocjacji po\u0142\u0105czenia, na przyk\u0142ad blokada nie dzia\u0142a przy wst\u0119pnym wysy\u0142aniu dodatkowego pakietu SYN z b\u0142\u0119dnym numerem sekwencyjnym, manipulacjach z flagami fragmentacji pakiet\u00f3w, wysy\u0142aniu pakietu z jednocze\u015bnie ustawionymi flagami FIN i SYN, podstawieniu pakietu RST z nieprawid\u0142ow\u0105 sum\u0105 kontroln\u0105 lub wysy\u0142aniu pakietu z flagami SYN i ACK przed rozpocz\u0119ciem negocjacji po\u0142\u0105czenia. Opisane metody zosta\u0142y ju\u017c wdro\u017cone w formie wtyczki do narz\u0119dzi <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Kkevsterrr\/geneva\">Genewa<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52249\">rozwijanego<\/a><\/noindex> do omijania metod cenzury.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>\u0179r\u00f3d\u0142o: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53520\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS 1.3 \u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 ESNI (Encrypted Server Name Indication), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u0430\u043a \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u043c\u0438\u0440, \u0442\u0430\u043a \u0438 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043c\u0438\u0440\u0430 \u0432 \u041a\u0438\u0442\u0430\u0439. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91188","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-09T11:42:21+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-09T11:42:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Chiny zacz\u0119\u0142y blokowa\u0107 po\u0142\u0105czenia HTTPS nawi\u0105zywane z u\u017cyciem TLS 1.3 i ESNI | ProHoster","description":"Chiny wprowadzi\u0142y","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-09T11:42:21+00:00","article:modified_time":"2020-08-09T11:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91188","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:32:23","updated":"2022-09-28 04:45:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/91188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=91188"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/91188\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=91188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=91188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=91188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}