{"id":91188,"date":"2020-08-09T13:42:21","date_gmt":"2020-08-09T11:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni"},"modified":"2020-08-09T13:42:21","modified_gmt":"2020-08-09T11:42:21","slug":"kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","title":{"rendered":"Kina ka filluar t\u00eb bllokoj\u00eb lidhjet HTTPS q\u00eb krijohen me TLS 1.3 dhe ESNI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kina implementuar<\/a><\/noindex> n\u00eb bllokimin<\/a><\/noindex> t\u00eb gjitha lidhjeve HTTPS, t\u00eb cilat p\u00ebrdorin protokollin TLS 1.3 dhe zgjerimin TLS-ESNI (Encrypted Server Name Indication), q\u00eb siguron enkriptimin e t\u00eb dh\u00ebnave mbi hostin e k\u00ebrkuar. Bllokimi realizohet n\u00eb routerat kalues si p\u00ebr lidhjet q\u00eb krijohen nga Kina n\u00eb bot\u00eb, ashtu edhe p\u00ebr ato nga bota n\u00eb Kin\u00eb.<\/p>\n

P\u00ebr bllokimin e lidhjeve, realizohet hedhja e paketimeve nga klienti n\u00eb server, dhe jo vendosja e paketimeve me flamurin RST, si\u00e7 b\u00ebhej m\u00eb par\u00eb p\u00ebr bllokim selektiv sipas p\u00ebrmbajtjes SNI. Pas aktivizimit t\u00eb bllokimit t\u00eb paket\u00ebs me ESNI, p\u00ebr nj\u00eb periudh\u00eb nga 120 deri n\u00eb 180 sekonda gjithashtu bllokohen t\u00eb gjitha paketet e rrjetit q\u00eb p\u00ebrputhen me \u00e7iftin e IP-s\u00eb burimore, IP-s\u00eb s\u00eb synuar dhe numrit t\u00eb portit. Lidhjet HTTPS q\u00eb bazohen n\u00eb versione m\u00eb t\u00eb vjetra TLS dhe TLS 1.3 pa ESNI kalojn\u00eb si zakonisht. <\/p>\n

T\u00eb kujtojm\u00eb se p\u00ebr t\u00eb organizuar funksionimin e disa faqeve HTTPS n\u00eb nj\u00eb adres\u00eb IP t\u00eb vetme u zhvillua zgjerimi SNI, q\u00eb realizon d\u00ebrgimin e emrit t\u00eb hostit n\u00eb form\u00eb t\u00eb hapur n\u00eb mesazhin ClientHello, i d\u00ebrguar p\u00ebrpara ngritjes s\u00eb kanaleve t\u00eb kriptuara t\u00eb komunikimit. Kjo ve\u00e7ori i jep mund\u00ebsin\u00eb ofruesve t\u00eb sh\u00ebrbimit t\u00eb internetit t\u00eb filtroj\u00eb selektivisht trafikun HTTPS dhe t\u00eb analizoj\u00eb se cilat faqe po hap p\u00ebrdoruesi, \u00e7ka nuk lejon arritjen e nj\u00eb konfidencialiteti t\u00eb plot\u00eb gjat\u00eb p\u00ebrdorimit t\u00eb HTTPS.<\/p>\n

Zgjerimi i ri TLS ECH (m\u00eb par\u00eb ESNI), i cili mund t\u00eb aplikohet s\u00eb bashku me TLS 1.3, eliminohet k\u00ebt\u00eb mang\u00ebsi dhe plot\u00ebsisht p\u00ebrjashton rrjedhjen e informacionit mbi faqen k\u00ebrkuese gjat\u00eb analiz\u00ebs s\u00eb lidhjeve HTTPS. N\u00eb kombinim me p\u00ebrdorimin p\u00ebrmes rrjeteve t\u00eb shp\u00ebrndarjes t\u00eb p\u00ebrmbajtjes, aplikimi ECH\/ESNI gjithashtu ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb fshehur nga ofruesi edhe adres\u00ebn IP t\u00eb burimit t\u00eb k\u00ebrkuar. Sistemet e inspektimit t\u00eb trafikut do t\u00eb shohin vet\u00ebm k\u00ebrkesat ndaj CDN dhe nuk do t\u00eb jen\u00eb n\u00eb gjendje t\u00eb aplikojn\u00eb bllokimin pa z\u00ebvend\u00ebsimin e seanc\u00ebs TLS, rast n\u00eb t\u00eb cilin p\u00ebrdoruesi do t\u00eb shoh\u00eb nj\u00eb njoftim p\u00ebr ndryshimin e certifikat\u00ebs. Nj\u00eb kanal i mundsh\u00ebm rrjedhjeje mbetet DNS, por p\u00ebr t\u00eb fshehur k\u00ebrkesat ndaj DNS nga klienti mund t\u00eb aplikohet DNS-over-HTTPS ose DNS-over-TLS.<\/p>\n

Hulumtuesit tashm\u00eb identifikuan<\/a><\/noindex> kan\u00eb gjetur disa rrug\u00eb alternative p\u00ebr t\u00eb anashkaluar bllokimin kinez n\u00eb an\u00ebn e klientit dhe serverit, por ato mund t\u00eb humbasin r\u00ebnd\u00ebsin\u00eb e tyre dhe duhet t\u00eb merren p\u00ebr konsiderat\u00eb vet\u00ebm si nj\u00eb mas\u00eb p\u00ebrkoh\u00ebsore. P\u00ebr shembull, aktualisht bllokohen vet\u00ebm paketet me identifikuesin e zgjerimit ESNI 0xffce (encrypted_server_name), i cili u p\u00ebrdor n\u00eb versionin e pest\u00eb t\u00eb draftit t\u00eb standardit<\/a><\/noindex>, por p\u00ebr momentin kalohen paketet me identifikuesin e aktualizuar 0xff02 (encrypted_client_hello), t\u00eb propozuar n\u00eb draftin e shtat\u00eb t\u00eb specifikimit ECH<\/a><\/noindex>. <\/p>\n

Nj\u00eb tjet\u00ebr variant i anashkalimit \u00ebsht\u00eb p\u00ebrdorimi i nj\u00eb procesi t\u00eb pazakont\u00eb t\u00eb negociat\u00ebs s\u00eb lidhjes, p\u00ebr shembull, bllokimi nuk aktivizohet kur d\u00ebrgohet paraprakisht nj\u00eb paket\u00eb SYN me num\u00ebr sekvenc\u00eb t\u00eb gabuar, manipulime me flamujt e fragmentimit t\u00eb paketave, d\u00ebrgimi i nj\u00eb pakete me flamujt FIN dhe SYN simultan, z\u00ebvend\u00ebsimi i paket\u00ebs RST me nj\u00eb kontroll t\u00eb pavlefsh\u00ebm ose d\u00ebrgimi i nj\u00eb pakete me flamujt SYN dhe ACK p\u00ebrpara negociat\u00ebs s\u00eb lidhjes. Metodat e p\u00ebrshkruara jan\u00eb implementuar tashm\u00eb n\u00eb form\u00ebn e nj\u00eb plugin-i p\u00ebr mjetin Gjenev\u00eb<\/a><\/noindex>, duke u zhvilluar<\/a><\/noindex> p\u00ebr anashkalimin e metodave t\u00eb censur\u00ebs.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS 1.3 \u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 ESNI (Encrypted Server Name Indication), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u0430\u043a \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u043c\u0438\u0440, \u0442\u0430\u043a \u0438 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043c\u0438\u0440\u0430 \u0432 \u041a\u0438\u0442\u0430\u0439. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91188","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kina filloi bllokimin e lidhjeve HTTPS, t\u00eb cilat krijohen me TLS 1.3 dhe ESNI | ProHoster","description":"Kina ka implementuar","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-09T11:42:21+00:00","article:modified_time":"2020-08-09T11:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91188","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:32:23","updated":"2022-09-28 04:45:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=91188"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91188\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=91188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=91188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=91188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}