ืืขืื ืืึทืืจ, ืืืื ื ืึธืืขื ืืื ืืืืึท, ืืื ืึทืจืืขื ืืื ืื ืคึผืืึทืืคืึธืจืืข ืืึทื ืฉืึทืคึฟื ืืื ืขืงืกื ืขืกืก. ืืืจ ืึทื ืืืืืงืืขื ืืื ืื ืกืืจืืืขื ื ืื ืืึทืจืฅ ืื ืคืจืึทืกืืจืึทืงืืฉืขืจ ืงืึทืืคึผืึธืื ืึทื ืฅ ืืืึธืก ืืื ืืืขืจ ืคึผืจืึธืืืงื ืึทื ืืืืืงืืื ื ืืืื ื ืืฆื.
ืืื ืืขื ืึทืจืืืงื, ืืื ืืืึธืื ืืื ืฆื ืืืืื ืืืื ืืขืจืคืึทืจืื ื ืคืื ืืืคึผืืึทืืขื ืื ื ืขื ืงืจืืคึผืืื SNI (ESNI) ืืขืื ืึธืืึธืืืข ืืื ืื ืื ืคืจืึทืกืืจืึทืงืืฉืขืจ ืคืื ืขืคื ืืืขื ืืืขืืกืืืขืก.
ืื ื ืืฆื ืคืื ืืขื ืืขืื ืึธืืึธืืืข ืืืขื ืคืึทืจืืจืขืกืขืจื ืื ืืืืขืจืืืื ืืืจืื ืืืขื ืืจืืขืื ืืื ืึท ืขืคื ืืืขื ืืืขืืืืืื ืืื ื ืึธืืงืืืขื ืืื ืื ืขืจืืขื ืืืืขืจืืืื ืกืืึทื ืืึทืจืืก ืื ืืขื ืืืขื ืืืจื ืื ืคึฟืืจืืข.
ืขืจืฉืืขืจ ืคืื ืึทืืข, ืืื ืืืึธืื ืืื ืฆื ืคืื ื ืืืืก ืึทื ืื ืืขืื ืึธืืึธืืืข ืืื ื ืืฉื ืกืืึทื ืืขืจืืืืื ืืื ืืื ื ืึธื ืืื ืืขื ืคึผืืึทื, ืึธืืขืจ CloudFlare ืืื Mozilla ืฉืืื ืฉืืืฆื ืขืก (ืืื ). ืืึธืก ืืึธื ืืื ืื ืืึธืืืึทืืืืืืึทื ืคึฟืึทืจ ืึทืืึท ืึทื ืขืงืกืคึผืขืจืืืขื ื.
ืขืืืขืืข ืืขืึธืจืืข
ESNI ืืื ืึท ืคืึทืจืืขื ืืขืจืื ื ืฆื ืื TLS 1.3 ืคึผืจืึธืืึธืงืึธื ืืืึธืก ืึทืืึทืื SNI ืขื ืงืจืืคึผืฉืึทื ืืื ืื TLS ืืึทื ืืฉืืืง "ืงืืืขื ื ืืขืื" ืึธื ืืึธื. ืืึธ ืก ืืื ืืขืจ ืงืืืขื ื ืืขืื ืงืืงื ืืื ืืื ESNI ืฉืืืฆื (ืึทื ืฉืืึธื ืคืื ืื ืืขืืืืื ืืืขื SNI ืืืจ ืืขื ESNI):
ืฆื ื ืืฆื ESNI, ืืืจ ืืึทืจืคึฟื ืืจืื ืงืึทืืคึผืึธืื ืึทื ืฅ:
- ืื ืก;
- ืงืืืขื ื ืฉืืืฆื;
- ืกืขืจืืืืจืขืจ ืืืึทื ืฉืืืฆื.
ืื ืก
ืืืจ ืืึทืจืคึฟื ืฆื ืืืืื ืฆืืืื ืื ืก ืจืขืงืึธืจืืก - Aืืื ืืงืกื (ืื ืืงืกื ืจืขืงืึธืจื ืึผืืื ืื ืฆืืืืจ ืฉืืืกื ืืื ืืืึธืก ืืขืจ ืงืืืขื ื ืงืขื ืขื ืื ืงืจืืคึผื SNI) - ืืขื ืืื ืื. ืืื ืืขืจืฆื, ืขืก ืืืื ืืืื ืฉืืืฆื ืืึธื (ืื ืก ืืืืขืจ ืืืืคึผืก) ืืืืึทื ืื ืืืฆื ืงืืืืึทื ืฅ (ืืขื ืืืืืืขืจ) ืืึธื ื ืื ืืขืื ESNI ืฉืืืฆื ืึธื ืืึธื. ืืึธืก ืืื ืืึทืืืฉืืงืึทื, ืืืืึทื ESNI ืืืคึผืืืื ืขื ืงืจืืคึผืฉืึทื ืคืื ืื ื ืึธืืขื ืคืื ืื ืืืื ืืืึธืก ืืืจ ืึทืงืกืขืก, ืืึธืก ืืื, ืขืก ืืื ืงืืื ืืื ืขื ืฆื ืึทืงืกืขืก DNS ืืืืขืจ UDP. ืืขืจืฆื, ืื ื ืืฆื ืึทืืึทืื ืืืจ ืฆื ืืึทืฉืืฆื ืงืขืื ืงืึทืฉ ืคืึทืจืกืึทืืื ื ืื ืคืืื ืืื ืืขื ืกืฆืขื ืึทืจ.
ืืืฆื ืื ืืืฆื , ืฆืืืืฉื ืืื:
CloudFlare (ืืฉืขืง ืืืึทื ืืจืึทืืืขืจ โ ืขื ืงืจืืคึผืืื SNI โ ืืขืจื ืืขืจ) ืึทื ืืืืขืจ ืกืขืจืืืขืจืก ืฉืืื ืฉืืืฆื ESNI, ืืึธืก ืืื, ืคึฟืึทืจ CloudFlare ืกืขืจืืืขืจืก ืืื ืื ืื ืก ืืืจ ืืึธืื ืืคึผืืืช ืฆืืืื ืจืขืงืึธืจืืก - ื ืืื ืืงืกื. ืืื ืืขื ืืืึทืฉืคึผืื ืืื ืื ืืืจ ืึธื ืคึฟืจืขื Google DNS (ืืืืขืจ ืืืืคึผืก):
ะ ืคึผืึธืืืฆืืข:
curl 'https://dns.google.com/resolve?name=www.cloudflare.com&type=A'
-s -H 'accept: application/dns+json'
{
"Status": 0,
"TC": false,
"RD": true,
"RA": true,
"AD": true,
"CD": false,
"Question": [
{
"name": "www.cloudflare.com.",
"type": 1
}
],
"Answer": [
{
"name": "www.cloudflare.com.",
"type": 1,
"TTL": 257,
"data": "104.17.210.9"
},
{
"name": "www.cloudflare.com.",
"type": 1,
"TTL": 257,
"data": "104.17.209.9"
}
]
}
ืืงืกื ืจืขืงืึธืจื, ืืขืื ืืื ืืืฉืขื ืขืจืืืืึทื ืืืื ืึท ืืืกืืขืจ _esni.FQDN:
curl 'https://dns.google.com/resolve?name=_esni.www.cloudflare.com&type=TXT'
-s -H 'accept: application/dns+json'
{
"Status": 0,
"TC": false,
"RD": true,
"RA": true,
"AD": true,
"CD": false,
"Question": [
{
"name": "_esni.www.cloudflare.com.",
"type": 16
}
],
"Answer": [
{
"name": "_esni.www.cloudflare.com.",
"type": 16,
"TTL": 1799,
"data": ""/wEUgUKlACQAHQAg9SiAYQ9aUseUZr47HYHvF5jkt3aZ5802eAMJPhRz1QgAAhMBAQQAAAAAXtUmAAAAAABe3Q8AAAA=""
}
],
"Comment": "Response from 2400:cb00:2049:1::a29f:209."
}ืึทืืื, ืคึฟืื ืึท ืื ืก ืคึผืขืจืกืคึผืขืงืืืื, ืืืจ ืืึธื ื ืืฆื ืืึธื (ืคึผืจืขืคืขืจืึทืืื ืืื DNSSEC) ืืื ืืืืื ืฆืืืื ืืืื ืกื.
ืงืืกืืืืขืจ ืืืืฃ
ืืืื ืืืจ ืืขื ืขื ืืขืจืขืื ืืืขืื ืืจืึทืืืขืจื, ืืื ืืขื ืืึธืืขื ื . ืืึธ ืืขื ืขื ืื ืกืืจืึทืงืฉืึทื ื ืืืืฃ ืืื ืฆื ืึทืงืืึทืืืืื ESNI ืืื DoH ืฉืืืฆื ืืื FireFox. ื ืึธื ืืขื ืงืึทื ืคืืืืขืจื ืืืขืืขืจืขืจ, โโืืืจ ืืึธื ืืขื ืขืคึผืขืก ืืื ืืึธืก:
ืฆื ืงืึธื ืืจืึธืืืจื ืืขื ืืืขืืขืจืขืจ.
ืืึธื, TLS 1.3 ืืืื ืืืื ืืขืืืืื ื ืฆื ืฉืืืฆื ESNI, ืืืืึทื ESNI ืืื ืึทื ืคืึทืจืืขื ืืขืจืื ื ืฆื TLS 1.3.
ืคึฟืึทืจ ืืขื ืฆืืืขืง ืคืื ืืขืกืืื ื ืื ืืึทืงืขื ื ืืื ESNI ืฉืืืฆื, ืืืจ ืืืคึผืืึทืืขื ืึทื ืืขื ืงืืืขื ื ืืืืฃ go, ืืืขืจ ืืขืจ ืืืืฃ ืืขื ืฉืคึผืขืืขืจ.
ืกืขืจืืืืจืขืจ ืืืึทื ืฉืืืฆื
ืืขืจืืืืึทื, ESNI ืืื ื ืืฉื ืืขืฉืืืฆื ืืืจื ืืืขื ืกืขืจืืืขืจืก ืืื nginx / apache, ืืื"ื ื, ืืืืึทื ืืื ืึทืจืืขืื ืืื TLS ืืืจื OpenSSL / BoringSSL, ืืืึธืก ืืึธื ื ืื ืึทืคืืฉืึทืื ืฉืืืฆื ESNI.
ืืขืจืืืขืจ, ืืืจ ืืึทืฉืืึธืกื ืฆื ืฉืึทืคึฟื ืืื ืืืขืจ ืืืืืขื ืข ืคืจืึธื ื-ืขื ื ืงืึธืืคึผืึธื ืขื ื (ESNI ืคืึทืจืงืขืจื ืคึผืจืึทืงืกื), ืืืึธืก ืืืึธืื ืฉืืืฆื TLS 1.3 ืืขืจืืึทื ืืืฉืึทื ืืื ESNI ืืื ืคึผืจืึทืงืกื ืืืืคึผ (S) ืคืึทืจืงืขืจ ืฆื ืื ืึทืคึผืกืืจืื, ืืืึธืก ืฉืืืฆื ื ืืฉื ESNI. ืืึธืก ืึทืืึทืื ืื ืืขืื ืึธืืึธืืืข ืฆื ืืืื ืืขืืืืื ื ืืื ืึท ืฉืืื ืืืืืกืืื ื ืื ืคืจืึทืกืืจืึทืงืืฉืขืจ, ืึธื ืืฉืึทื ืืื ื ืื ืืืืคึผื ืงืึทืืคึผืึธืื ืึทื ืฅ - ืืึธืก ืืื, ื ืืฆื ืงืจืึทื ื ืืืขื ืกืขืจืืืขืจืก ืืืึธืก ืฉืืืฆื ื ืืฉื ESNI.
ืคึฟืึทืจ ืงืืขืจืืื, ืืึธ ืืื ืึท ืืืึทืืจืึทืืข:
ืืื ืืึธื ืึทื ืื ืคึผืจืึทืงืกื ืืื ืืืืืื ื ืืื ืื ืคืืืืงืืื ืฆื ืคืึทืจืขื ืืืงื ืึท TLS ืคึฟืึทืจืืื ืืื ื ืึธื ESNI, ืฆื ืฉืืืฆื ืงืืืืึทื ืฅ ืึธื ESNI. ืืขืจ ืงืึธืืื ืืงืึทืฆืืข ืคึผืจืึธืืึธืงืึธื ืืื ืึทืคึผืกืืจืื ืงืขื ืขื ืืืื ืืืื HTTP ืึธืืขืจ HTTPS ืืื ืึท TLS ืืืขืจืกืืข ื ืืืขืจืืงืขืจ ืืื 1.3 (ืืืื ืึทืคึผืกืืจืื ืฉืืืฆื ื ืืฉื 1.3). ืืขื ืกืืขืืข ืืื ืืึทืงืกืืืื ืืืืืืงืืื.
ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื ESNI ืฉืืืฆื ืืืืฃ go ืืืจ ืืึธืื ืืขืืืื ื ืคึฟืื . ืืื ืืืึธืื ืืื ืฆื ืืึธื ืืืืื ืึทื ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืืื ืืื ืืึทื ืฅ ื ืื-ื ืืืืืืึทื, ืืืืึทื ืขืก ืื ืืืึทืืืื ืขื ืืขืจืื ืืขื ืืื ืื ื ืึธืจืืึทื ืืืืืืึธืืขืง ืงืจืืคึผืืึธ / ืืืก ืืื ืืขืจืืืขืจ ืจืืงืืืืืขืจื "ืคึผืึทืืืฉืื ื" GOROOT ืืืืืขืจ ืคึฟืึทืจืืึทืืืื ื.
ืฆื ืืืฉืขื ืขืจืืื ESNI ืฉืืืกืืขื ืืืจ ืืขืืืืื ื (ืืืื ืื ืืจืืื ืืฉืืืื ืคืื CloudFlare). ืื ืฉืืืกืืขื ืืขื ืขื ืืขื ืืฆื ืคึฟืึทืจ SNI ืขื ืงืจืืคึผืฉืึทื / ืืขืงืจืืคึผืืืึธื.
ืืืจ ืืึธืื ืืขืืขืกื ืืขื ืืืื ื ืืฆื ืืืง go 1.13 ืืืืฃ Linux (Debian, ืืืคึผืืื) ืืื ืืึทืงืึธืก.
ื ืืืกื ืืืขืจืืขืจ ืืืขืื ืึทืคึผืขืจืืืฉืึทื ืึทื ืคึฟืขืึดืงืืืื
ESNI ืคืึทืจืงืขืจื ืคึผืจืึทืงืกื ืืื ืืขืืจืืงืก ืืื ืคึผืจืึธืืขืืืขืืก ืคึฟืึธืจืืึทื, ืึทืืึท ืืื ืจืคึผืก, ืึทืคึผืกืืจืื ืืืืืึทื ืกื ืืื ืขื ืืคืขืจ ืงืึธืืื, ืืืจืืคืึทื / ืืขืจืึธืื TLS ืืึทื ืืฉืืืงืก ืืื TLS ืืึทื ืืฉืืืง ืืขืืืืขืจ. ืืื ืขืจืฉืืขืจ ืืืืง, ืืึธืก ืืื ืืขืืืขื ืืขื ืื ืฆื ืึธืคึผืฉืึทืฆื ืืื ืื ืคึผืจืึทืงืกื ืืึทื ืืึทืื ืคืึทืจืงืขืจ.
ืืืจ ืืืื ืืืจืืืขืงืึธืื ืืึทืกืข ืืขืกืืื ื ืืืืืขืจ ื ืืฆื. ืจืขืืืืืึทืื ืืื ืื:
wrk -t50 -c1000 -d360s 'https://esni-rev-proxy.npw:443' --timeout 15s
Running 6m test @ https://esni-rev-proxy.npw:443
50 threads and 1000 connections
Thread Stats Avg Stdev Max +/- Stdev
Latency 1.77s 1.21s 7.20s 65.43%
Req/Sec 13.78 8.84 140.00 83.70%
206357 requests in 6.00m, 6.08GB read
Requests/sec: 573.07
Transfer/sec: 17.28MB ืืืจ ืืึธืื ืืืจืืืขืงืึธืื ืจืืื ืงืืืึทืืืืึทืืืืืข ืืึทืกืข ืืขืกืืื ื ืฆื ืคืึทืจืืืืึทืื ืื ืกืืขืืข ืืื ESNI ืคืึทืจืงืขืจื ืคึผืจืึทืงืกื ืืื ืึธื. ืืืจ "ืืืืกืืขืืืกื" ืคืึทืจืงืขืจ ืืึธืืงืึทืื ืืื ืกืืจ ืฆื ืขืืืืื ืืจื "ืื ืืขืจืคืืจืึทื ืก" ืืื ืื ืืขืจืืืืืื ืงืึทืืคึผืึธืื ืึทื ืฅ.
ืึทืืื, ืืื ESNI ืฉืืืฆื ืืื ืคึผืจืึทืงืกืืื ื ืฆื ืึทืคึผืกืืจืื ืคึฟืื ืืืืคึผ, ืืืจ ืืึทืงืืืขื ืึทืจืื ~ 550 ืจืคึผืก ืคึฟืื ืืืื ืืืึทืฉืคึผืื, ืืื ืื ืืืจืืฉื ืืืืขื ืงืคึผื / ืืึทืจืึทื ืงืึทื ืกืึทืืฉืึทื ืคืื ESNI ืคืึทืจืงืขืจื ืคึผืจืึทืงืกื:
- 80% CPU ืืึทื ืืฅ (4 vCPU, 4 ืืืืืืืื ืจืึทื ืืึธืกืืก, Linux)
- 130 MB Mem RSS
ืคึฟืึทืจ ืคืึทืจืืืืึทื, RPS ืคึฟืึทืจ ืืขืจ ืืขืืืืงืขืจ ื ืืื ืงืก ืึทืคึผืกืืจืื ืึธื TLS (HTTP ืคึผืจืึธืืึธืงืึธื) ืืขืจืืึทื ืืืฉืึทื ืืื ~ 1100:
wrk -t50 -c1000 -d360s 'http://lb.npw:80' โ-timeout 15s
Running 6m test @ http://lb.npw:80
50 threads and 1000 connections
Thread Stats Avg Stdev Max +/- Stdev
Latency 1.11s 2.30s 15.00s 90.94%
Req/Sec 23.25 13.55 282.00 79.25%
393093 requests in 6.00m, 11.35GB read
Socket errors: connect 0, read 0, write 0, timeout 9555
Non-2xx or 3xx responses: 8111
Requests/sec: 1091.62
Transfer/sec: 32.27MB ืื ืื ืืืขืื ืืืื ืคืื ืืืืืึทืืืก ืืืืืื ืื ืขืก ืืื ื ืืื ืื ืืื ืจืขืกืืจืกื (ืืืจ ืืืื ืืขื ืืฆื 4 vCPU, 4 GB RAM ืืืืกืืก, Linux), ืืื ืืื ืคืึทืงื ืืื ืื ืคึผืึธืืขื ืฆืืขืืข RPS ืืขืืขืจ (ืืืจ ืืึธืื ืืึทืงืืืขื ืฆืืคืขืจื ืืื 2700 RPS ืืืืฃ ืฉืืึทืจืงืขืจืข ืจืขืกืืจืกื).
ืืื ืืกืงื ื, ืืื ืืึธื ืึทื ESNI ืืขืื ืึธืืึธืืืข ืงืืงื ืืึทื ืฅ ืคึผืจืึทืืึทืกืื ื. ืขืก ืืขื ืขื ื ืึธื ืคืืืข ืึธืคึฟื ืคึฟืจืืื, ืืืฉื, ืื ืืฉืื ืคืื ืกืืึธืจืื ื ืื ืขืคื ืืืขื ESNI ืฉืืืกื ืืื ืื DNS ืืื ืจืึธืืืืืืื ื ESNI ืฉืืืกืืขื - ืื ืืฉืื ืืขื ืขื ืึทืงืืืืืื ืืืกืงืึทืกื, ืืื ืื ืืขืฆืืข ืืืขืจืกืืข ืคืื โโืื ESNI ืคึผืืึทื (ืืื ืืขืจ ืฆืืื ืคืื ืฉืจืืืื) ืืื ืฉืืื .
ืืงืืจ: www.habr.com
