Bypassing GFW's SNI filter

Posted on 2019-10-19 , Tags: networking

I’ve just read though this paper Efficiently bypassing SNI-based HTTPS filtering [1] which gave us some interesting insights into how to bypass GFW’s HTTPS filter.

The paper discussed 2 ways of bypassing SNI-based firewalls:

  1. Connecting to the host with SNI disabled.
  2. Using a unfiltered fake server_name when establishing TLS connections with server while sending the true host in the http request after connected. This is commonly known as “domain fronting”.

Since TLS is designed to be backward compatiable to clients that do not have SNI implemented, in theory the first method should always work, though you might get a certificate error when the default certificate does not match the host you are accessing. But in practice most CDNs don’t allow TLS hanshakes without a server_name so this method doesn’t work for websites behind CDNs.

The second method, domain fronting, exploits bugs of webservers. RFC6606 specified that HTTP Host(or any application layer host) must be the same as server_name though many webservers don’t to this check. This allows us to “trick” the firewall to believe that we are establishing a connection with a harmless host. This method is less general than the previous one because the server_name needed to establish connection varies from host to host and any bugfix might render it useless.

Both methods can help us hiding our real host from the firewall but I prefer the first since it’s more consistent. Luckily there’s a program to do just that: sni-modifier. This is a simple MITM proxy that modifis your HTTPS request’s SNI header. It first tries to connect to the host with SNI disabled, if that failed, it will then fallback to normal connection method.

It’s suprising to me that with this proxy I’m able to access most censored websites including dropbox.com, facebook.com(ipv6), nytimes.com, duckduckgo.com, pixiv.net…. Of course, it definitely won’t work if the ip is blackholed (e.g. google and youtube).

This is clearly not a perfect solution, that’s why I’m looking forward to the new extension to SNI – ESNI. Together with ecrypted DNS (DoT/DoH), it well solve the problem of privacy once and for all. I believe that the future of censorship evading will be a combination of ipv6 proxies, DNS over TLS and ESNI.

References

[1] W.M. Shbair, T. Cholez, A. Goichot, I. Chrisment, Efficiently bypassing sni-based https filtering, in: 2015 Ifip/Ieee International Symposium on Integrated Network Management (Im), IEEE, 2015: pp. 990–995.

License

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License
Creative Commons License