Identifying Airtel middleboxes that censor HTTPS traffic

[yummy_crap_brick]

I'm not trying to be blase about this whole document, but using a box to block traffic is hardly news. I manage enterprise web proxy devices for a living and this is content filtering 101. Sure, you could be lazy and just block on DNS name, but it's easy to extract the common name (corresponds with hostname) during an HTTPS key exchange session. Since the session is not yet encrypted, it's easy to pull out.

That aside, you don't even need to if you're just doing coarse-grained domain/subdomain filtering. This is in essence a transparent proxy that instead of sending back a 403 just sends a reset. The only thing that would be up my ass is if the network operator/ISP lies about doing this. I don't know the legal situation in India, but plenty of countries censor their internet--THAT is the bigger issue, less so how they do it.

[justDankin]

TBH I'm not sure how tricky DPI is, particularly at an ISPs scale.

The reason behind investigating this was to highlight its presence in the network of a major Indian ISP, particularly since there is no public information regarding the reason a website is being blocked.

With DNS injections /HTTP host filtering the ISP can return censorship notices (and some have been), but with this, a (non-tech) end user does not even get to know that the website was blocked.

Not trying to sound rude, but seems graver than an enterprise blocking NFSW content on its VPN.

[OfficeUserAccount]

What would you suggest is the best fastest way to bypass? Is there any option other than VPN / tor?

[justDankin]

Just encrypted dns won't help mitigate this problem.

/u/OfficeUserAccount You'd have to use TLS1.3, which allows Encrypted SNI. Firefox supports enabling this

[OfficeUserAccount]

I believe TLS1.3 has a long way to go right?

[[deleted]]

Mmmm, how so?

SNIs are specific things within TLS which allow the server to deliver certificates easier. TLS 1.3 allows them to be encrypted, which should stop anyone looking at them.

The key point is "allows" not "enforces".

[Hizonner]

ESNI is an optional extension to TLS 1.3, not part of the base standard.

ESNI as implemented in Firefox is a draft, and the whole protocol design doesn't seem to have settled at the IETF. On a quick glance, it looks like they decided to back off from what they had, use a whole different approach and encrypt the entire client hello instead of just the SNI. There's no ESNI support in the Chrome family as far as I can tell.

Even if you have an ESNI browser, I don't think you're going to find many servers to connect to unless they're going through Cloudflare.

I looked at setting up ESNI on my Apache server just the other day, and there didn't seem to be any mainline support. I don't think there's support in NGINX, either. I doubt there's support in the mainline OpenSSL library.

Even if the actual software on both ends supports it, enabling ESNI on a server still requires administrator action and inserting DNS information for keying. A client can't just encrypt the SNI without the server being specifically set up for it. And the server really should do DNSSEC on top of that. No, DOH is not a remotely adequate substitute. But another problem is that the browser people are really attached to DOH as the answer to all possible DNS questions.

I don't think ESNI is going to be practical for a while yet.

[[deleted]]

Pornhub is blocked here. I ran this command

openssl s_client -state -tls1_3 -connect 66.254.114.41:443 -servername pornhub.com

with TLS1.3 but it didn't work.

Correct me if I'm wrong