{"id":91188,"date":"2020-08-09T13:42:21","date_gmt":"2020-08-09T11:42:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni"},"modified":"2020-08-09T13:42:21","modified_gmt":"2020-08-09T11:42:21","slug":"kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","title":{"rendered":"Kina ka filluar t\u00eb bllokoj\u00eb lidhjet HTTPS q\u00eb vendosen me TLS 1.3 dhe ESNI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kina ka vendosur<\/a><\/noindex> bllokimin<\/a><\/noindex> e t\u00eb gjitha lidhjeve HTTPS ku p\u00ebrdoret protokolli TLS 1.3 dhe zgjerimi TLS ESNI (Encrypted Server Name Indication), i cili siguron enkriptimin e t\u00eb dh\u00ebnave p\u00ebr hostin e k\u00ebrkuar. Bllokimi kryhet n\u00eb ruter\u00ebt transit, si p\u00ebr lidhjet e vendosura nga Kina drejt bot\u00ebs s\u00eb jashtme, ashtu edhe nga jasht\u00eb drejt Kin\u00ebs.<\/p>\n

P\u00ebr bllokimin, hidhen posht\u00eb paketat nga klienti te serveri, dhe jo z\u00ebvend\u00ebsimi i paketave me flamurin RST, si\u00e7 b\u00ebhej m\u00eb par\u00eb gjat\u00eb bllokimit selektiv sipas p\u00ebrmbajtjes s\u00eb SNI. Pas aktivizimit t\u00eb bllokimit t\u00eb nj\u00eb pakete me ESNI, p\u00ebr 120 deri n\u00eb 180 sekonda bllokohen gjithashtu t\u00eb gjitha paketat e rrjetit q\u00eb p\u00ebrputhen me kombinimin e IP-s\u00eb burimore, IP-s\u00eb s\u00eb destinacionit dhe numrit t\u00eb port\u00ebs s\u00eb destinacionit. Lidhjet HTTPS t\u00eb bazuara n\u00eb versionet e vjetra t\u00eb TLS dhe n\u00eb TLS 1.3 pa ESNI kalojn\u00eb si zakonisht. <\/p>\n

Kujtojm\u00eb se p\u00ebr t\u00eb mund\u00ebsuar funksionimin e disa faqeve HTTPS n\u00eb t\u00eb nj\u00ebjt\u00ebn adres\u00eb IP, u zhvillua zgjerimi SNI, i cili d\u00ebrgon emrin e hostit n\u00eb form\u00eb t\u00eb hapur n\u00eb mesazhin ClientHello, q\u00eb transmetohet para se t\u00eb vendoset kanali i enkriptuar i komunikimit. Kjo ve\u00e7ori u jep mund\u00ebsi ofruesve t\u00eb internetit t\u00eb filtrojn\u00eb n\u00eb m\u00ebnyr\u00eb selektive trafikun HTTPS dhe t\u00eb analizojn\u00eb se cilat faqe hap p\u00ebrdoruesi, \u00e7ka pengon arritjen e konfidencialitetit t\u00eb plot\u00eb gjat\u00eb p\u00ebrdorimit t\u00eb HTTPS.<\/p>\n

Zgjerimi i ri TLS ECH (m\u00eb par\u00eb ESNI), i cili mund t\u00eb p\u00ebrdoret s\u00eb bashku me TLS 1.3, e eliminon k\u00ebt\u00eb mang\u00ebsi dhe p\u00ebrjashton plot\u00ebsisht rrjedhjen e informacionit p\u00ebr faqen e k\u00ebrkuar gjat\u00eb analiz\u00ebs s\u00eb lidhjeve HTTPS. I kombinuar me p\u00ebrdorimin e nj\u00eb rrjeti t\u00eb shp\u00ebrndarjes s\u00eb p\u00ebrmbajtjes, ECH\/ESNI b\u00ebn t\u00eb mundur edhe fshehjen e adres\u00ebs IP t\u00eb burimit t\u00eb k\u00ebrkuar nga ofruesi. Sistemet e inspektimit t\u00eb trafikut do t\u00eb shohin vet\u00ebm k\u00ebrkesat ndaj CDN dhe nuk do t\u00eb mund t\u00eb zbatojn\u00eb bllokimin pa z\u00ebvend\u00ebsuar sesionin TLS; n\u00eb k\u00ebt\u00eb rast, n\u00eb shfletuesin e p\u00ebrdoruesit do t\u00eb shfaqet njoftimi p\u00ebrkat\u00ebs p\u00ebr z\u00ebvend\u00ebsimin e certifikat\u00ebs. Nj\u00eb kanal i mundsh\u00ebm rrjedhjeje mbetet DNS, por p\u00ebr ta fshehur k\u00ebrkes\u00ebn DNS nga ana e klientit mund t\u00eb p\u00ebrdoret DNS-over-HTTPS ose DNS-over-TLS.<\/p>\n

Studiuesit tashm\u00eb identifikuan<\/a><\/noindex> Ka disa m\u00ebnyra an\u00ebsore p\u00ebr t\u00eb anashkaluar bllokimin kinez si n\u00eb an\u00ebn e klientit ashtu edhe n\u00eb at\u00eb t\u00eb serverit, por ato mund t\u00eb humbasin shpejt aktualitetin dhe duhen par\u00eb vet\u00ebm si mas\u00eb e p\u00ebrkohshme. P\u00ebr shembull, aktualisht bllokohen vet\u00ebm paketat me identifikuesin e zgjerimit ESNI 0xffce (encrypted_server_name), i cili p\u00ebrdorej n\u00eb versionin e pest\u00eb t\u00eb draftit t\u00eb standardit<\/a><\/noindex>, por p\u00ebr momentin ende kalojn\u00eb paketat me identifikuesin aktual 0xff02 (encrypted_client_hello), i propozuar n\u00eb draftin e shtat\u00eb t\u00eb specifikimit ECH<\/a><\/noindex>. <\/p>\n

Nj\u00eb tjet\u00ebr m\u00ebnyr\u00eb anashkalimi \u00ebsht\u00eb p\u00ebrdorimi i nj\u00eb procesi jo standard t\u00eb negocimit t\u00eb lidhjes; p\u00ebr shembull, bllokimi nuk aktivizohet kur paraprakisht d\u00ebrgohet nj\u00eb paket\u00eb shtes\u00eb SYN me num\u00ebr t\u00eb pasakt\u00eb sekuence, kur manipulohen flamujt e fragmentimit t\u00eb paketave, kur d\u00ebrgohet nj\u00eb paket\u00eb me flamujt FIN dhe SYN t\u00eb vendosur nj\u00ebkoh\u00ebsisht, kur futet nj\u00eb paket\u00eb RST me checksum t\u00eb pasakt\u00eb ose kur para nisjes s\u00eb negocimit t\u00eb lidhjes d\u00ebrgohet nj\u00eb paket\u00eb me flamujt SYN dhe ACK. Metodat e p\u00ebrshkruara tashm\u00eb jan\u00eb zbatuar n\u00eb form\u00ebn e nj\u00eb plugini p\u00ebr mjetin Geneva<\/a><\/noindex>, q\u00eb po zhvillohet<\/a><\/noindex> p\u00ebr t\u00eb anashkaluar metodat e censur\u00ebs.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0432\u0441\u0435\u0445 HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TLS 1.3 \u0438 TLS-\u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 ESNI (Encrypted Server Name Indication), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0437\u0430\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u0445\u043e\u0441\u0442\u0435. \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u043a\u0430\u043a \u0434\u043b\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438\u0437 \u041a\u0438\u0442\u0430\u044f \u0432\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0439 \u043c\u0438\u0440, \u0442\u0430\u043a \u0438 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043c\u0438\u0440\u0430 \u0432 \u041a\u0438\u0442\u0430\u0439. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91188","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kina nisi t\u00eb bllokoj\u00eb lidhjet HTTPS t\u00eb krijuara me TLS 1.3 dhe ESNI - ProHoster","description":"Kina ka zbatuar","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0438\u0442\u0430\u0439 \u043d\u0430\u0447\u0430\u043b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTPS-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u043c\u044b\u0435 \u0441 TLS 1.3 \u0438 ESNI | ProHoster","og:description":"\u041a\u0438\u0442\u0430\u0439 \u0432\u043d\u0435\u0434\u0440\u0438\u043b","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/kitaj-nachal-blokirovat-https-soedineniya-ustanavlivaemye-s-tls-1-3-i-esni","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-09T11:42:21+00:00","article:modified_time":"2020-08-09T11:42:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91188","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:32:23","updated":"2022-09-28 04:45:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=91188"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91188\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=91188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=91188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=91188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}