{"id":91188,"date":"2020-08-09T13:42:21","date_gmt":"2020-08-09T11:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni"},"modified":"2020-08-09T13:42:21","modified_gmt":"2020-08-09T11:42:21","slug":"kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","title":{"rendered":"China a \u00eenceput s\u0103 blocheze conexiunile HTTPS stabilite cu TLS 1.3 \u0219i ESNI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

China a implementat<\/a><\/noindex> blocajul<\/a><\/noindex> toate conexiunile HTTPS care utilizeaz\u0103 protocolul TLS 1.3 \u0219i extensia TLS ESNI (Encrypted Server Name Indication), care asigur\u0103 criptarea datelor despre gazda solicitat\u0103. Blocarea se efectueaz\u0103 pe routerele de tranzit at\u00e2t pentru conexiunile stabilite din China c\u0103tre exterior, c\u00e2t \u0219i din exterior c\u0103tre China.<\/p>\n

Pentru blocare, se realizeaz\u0103 eliminarea pachetelor de la client la server, \u0219i nu \u00eenlocuirea pachetelor cu semnalul RST, care anterior a fost efectuat\u0103 la blocarea selectiv\u0103 bazat\u0103 pe con\u021binutul SNI. Dup\u0103 activarea bloc\u0103rii pachetului cu ESNI, timp de 120 p\u00e2n\u0103 la 180 de secunde toate pachetele de re\u021bea corespunz\u0103toare combina\u021biei dintre IP-ul surs\u0103, IP-ul \u021bint\u0103 \u0219i num\u0103rul portului de destina\u021bie sunt de asemenea blocate. Conexiunile HTTPS bazate pe vechile versiuni de TLS \u0219i TLS 1.3 f\u0103r\u0103 ESNI sunt permise ca de obicei. <\/p>\n

S\u0103 ne amintim c\u0103, pentru a organiza func\u021bionarea mai multor site-uri HTTPS pe un singur IP, a fost dezvoltat\u0103 extensia SNI, care transmite numele gazdei \u00een format deschis \u00een mesajul ClientHello, trimis \u00eenainte de stabilirea canalului de comunicare criptat. Aceast\u0103 caracteristic\u0103 permite furnizorului de internet s\u0103 filtreze selectiv traficul HTTPS \u0219i s\u0103 analizeze ce site-uri acceseaz\u0103 utilizatorul, ceea ce nu permite ob\u021binerea unei confiden\u021bialit\u0103\u021bi complete prin utilizarea HTTPS.<\/p>\n

Noua extensie TLS ECH (anterior ESNI), care poate fi utilizat\u0103 \u00eempreun\u0103 cu TLS 1.3, elimin\u0103 aceast\u0103 deficien\u021b\u0103 \u0219i exclude complet scurgerile de informa\u021bii despre site-ul solicitat \u00een analiza conexiunilor HTTPS. \u00cen asociere cu utilizarea unei re\u021bele de livrare a con\u021binutului, aplica\u021bia ECH\/ESNI de asemenea permite ascunderea adreselor IP ale resurselor solicitate de c\u0103tre furnizor. Sistemele de inspec\u021bie a traficului vor vedea doar solicit\u0103rile c\u0103tre CDN \u0219i nu vor putea aplica blocarea f\u0103r\u0103 \u00eenlocuirea sesiunii TLS, \u00een cazul c\u0103reia utilizatorului \u00eei va fi afi\u0219at un mesaj corespunz\u0103tor de \u00eenlocuire a certificatului. Un posibil canal de scurgere r\u0103m\u00e2ne DNS, dar pentru a ascunde solicit\u0103rile c\u0103tre DNS, clientul poate utiliza DNS-over-HTTPS sau DNS-over-TLS.<\/p>\n

Cercet\u0103torii deja au identificat<\/a><\/noindex> exist\u0103 c\u00e2teva solu\u021bii pentru ocolirea bloc\u0103rii chineze\u0219ti, at\u00e2t de client, c\u00e2t \u0219i de server, dar acestea pot deveni \u00eenvechite \u0219i trebuie considerate doar o m\u0103sur\u0103 temporar\u0103. De exemplu, \u00een prezent sunt blocate doar pachetele cu identificatorul de extensie ESNI 0xffce (numele_serverului_encrypted), care a fost utilizat \u00een versiunea a cincea a proiectului standard<\/a><\/noindex>, dar p\u00e2n\u0103 acum sunt permise pachetele cu identificatorul actual 0xff02 (hello_client_encrypted), propus \u00een proiectul al \u0219aptelea al specifica\u021biei ECH<\/a><\/noindex>. <\/p>\n

O alt\u0103 op\u021biune de ocolire este utilizarea unui proces neconven\u021bional de negociere a conexiunii, de exemplu, blocajul nu se activeaz\u0103 atunci c\u00e2nd se trimite un pachet SYN suplimentar cu un num\u0103r de secven\u021b\u0103 incorect, manipul\u0103ri ale flagurilor de fragmentare a pachetelor, trimiterea unui pachet cu flagurile FIN \u0219i SYN setate simultan, inserarea unui pachet RST cu un checksum incorect sau trimiterea unui pachet cu flagurile SYN \u0219i ACK \u00eenainte de negocierea conexiunii. Metodele descrise au fost deja implementate sub form\u0103 de plugin pentru instrumentarul Geneva<\/a><\/noindex>, dezvoltat<\/a><\/noindex> pentru ocolirea metodelor de cenzur\u0103.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS 1.3 \u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 ESNI (Encrypted Server Name Indication), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u0430\u043a \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u043c\u0438\u0440, \u0442\u0430\u043a \u0438 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043c\u0438\u0440\u0430 \u0432 \u041a\u0438\u0442\u0430\u0439. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91188","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47China a \u00eenceput s\u0103 blocheze conexiunile HTTPS stabilite cu TLS 1.3 \u0219i ESNI | ProHoster","description":"China a implementat","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-09T11:42:21+00:00","article:modified_time":"2020-08-09T11:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91188","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:32:23","updated":"2022-09-28 04:45:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/91188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=91188"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/91188\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=91188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=91188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=91188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}