{"id":91188,"date":"2020-08-09T13:42:21","date_gmt":"2020-08-09T11:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni"},"modified":"2020-08-09T13:42:21","modified_gmt":"2020-08-09T11:42:21","slug":"kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","title":{"rendered":"Kina je po\u010dela da blokira HTTPS veze postavljene pomo\u0107u TLS 1.3 i ESNI.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kitajska implementiral<\/a><\/noindex> pod blokado<\/a><\/noindex> vse HTTPS-povezav, kjer se uporablja protokol TLS 1.3 in raz\u0161iritev TLS ESNI (Encrypted Server Name Indication), ki zagotavlja \u0161ifriranje podatkov o zahtevanem gostitelju. Blokada se izvaja na tranzitnih usmerjevalnikih tako za povezave, ki se vzpostavljajo iz Kitajske v preostali svet, kot tudi iz preostalega sveta v Kitajsko.<\/p>\n

Za blokado se izvede zavra\u010danje paketov od odjemalca do stre\u017enika, namesto da bi se vstavljali paketi z zastavico RST, kar je bilo prej izvajano pri selektivni blokadi po vsebini SNI. Po aktiviranju blokade paketa z ESNI se v \u010dasu od 120 do 180 sekund blokirajo tudi vsi omre\u017eni paketi, ki ustrezajo povezavi iz izvornega IP, ciljnega IP in \u0161tevilke ciljanega porta. HTTPS-povezave na osnovi starej\u0161ih razli\u010dic TLS in TLS 1.3 brez ESNI se obravnavajo normalno. <\/p>\n

Spomnimo, da je bilo za organizacijo delovanja ve\u010d HTTPS-spletnih mest na enem IP-naslovu razvito raz\u0161iritev SNI, ki omogo\u010da prenos imena gostitelja v odprti obliki v sporo\u010dilu ClientHello, ki se po\u0161lje pred vzpostavitvijo \u0161ifriranega komunikacijskega kanala. Tak\u0161na posebnost omogo\u010da internetnim ponudnikom selektivno filtriranje HTTPS-prometa in analizo, kateri spletni strani odpirajo uporabniki, kar ne omogo\u010da popolne zasebnosti pri uporabi HTTPS.<\/p>\n

Nova TLS-raz\u0161iritev ECH (prej ESNI), ki se lahko uporablja skupaj s TLS 1.3, odpravlja to pomanjkljivost in popolnoma izklju\u010duje uhajanje informacij o zahtevanem spletnem mestu pri analizi HTTPS-povezav. V kombinaciji z dostopom prek omre\u017eja za distribucijo vsebine uporaba ECH\/ESNI prav tako omogo\u010da skriti IP-naslov zahtevanega vira pred ponudnikom. Sistemi za pregledovanje prometa bodo videli le klice do CDN in ne bodo mogli izvesti blokade brez zamenjave TLS-seje, v primeru katere bo uporabniku v brskalniku prikazano ustrezno obvestilo o zamenjavi certifikata. Mo\u017een kanal uhajanja ostaja DNS, vendar za skrivanje poizvedb do DNS lahko stranka uporablja DNS-over-HTTPS ali DNS-over-TLS.<\/p>\n

Raziskovalci so \u017ee su otkrili<\/a><\/noindex> ve\u010d na\u010dinov za obhod kitajske blokade na strani odjemalca in stre\u017enika, vendar morda izgubijo veljavnost in jih je treba obravnavati le kot za\u010dasno re\u0161itev. Na primer, trenutno so blokirana le paketi z identifikatorjem raz\u0161iritve ESNI 0xffce (encrypted_server_name), ki se je uporabljal v peti razli\u010dici osnutka standarda<\/a><\/noindex>, a paketi z aktualnim identifikatorjem 0xff02 (encrypted_client_hello), ki ga predlaga sedmi osnutek specifikacije ECH<\/a><\/noindex>. <\/p>\n

Druga mo\u017enost obhoda je uporaba nestandardnega postopka dogovarjanja o povezavi, na primer, blokada se ne aktivira pri predhodnem po\u0161iljanju dodatnega SYN-paketa z napa\u010dnim zaporednim \u0161tevilom, manipulacijah z zastavicami fragmentacije paketov, po\u0161iljanju paketa z isto\u010dasno nastavitvijo zastavic FIN in SYN, nadome\u0161\u010danju RST-paketa z napa\u010dno kontrolno vsoto ali po\u0161iljanju paketa z zastavicami SYN in ACK pred za\u010detkom dogovarjanja o povezavi. Opisane metode so \u017ee realizirane v obliki dodatka k orodju \u017deneva<\/a><\/noindex>, ki ga razvija<\/a><\/noindex> za obhod cenzurnih metod.<\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS 1.3 \u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 ESNI (Encrypted Server Name Indication), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u0430\u043a \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u043c\u0438\u0440, \u0442\u0430\u043a \u0438 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043c\u0438\u0440\u0430 \u0432 \u041a\u0438\u0442\u0430\u0439. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91188","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kitajska je za\u010dela blokirati HTTPS-povezave, vzpostavljene s TLS 1.3 in ESNI | ProHoster","description":"Kitajska je uvedla","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-09T11:42:21+00:00","article:modified_time":"2020-08-09T11:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91188","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:32:23","updated":"2022-09-28 04:45:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/91188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=91188"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/91188\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=91188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=91188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=91188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}