4 ms·

Domain Shadowing is neat but it seems to involve a bit of DNS work from the censored website, too. With edge compute, I would instead prefer to run a http rever

Domain Shadowing is neat but it seems to involve a bit of DNS work from the censored website, too. With edge compute, I would instead prefer to run a http reverse proxy over Cloudflare Workers or Lambda@Edge to the censored servers. In fact, with 100K requests in their free tier, Workers would likely work for every user that can create a Cloudflare account. I can see it work nicely for text-heavy, non-interactive websites just fine. I run a F/OSS DoH resolver, which uses Workers to IP-front itself. Not many censors block Cloudflare's anycast IPs as the collateral damage that occurs from blocking other web properties (behind those shared IPs) isn't worth it for some. As for domain-shadowing / domain-fronting (which Signal once employed pretty effectively), the imminent ECH (encrypted client hello) standard is going to make the very many censors that rely on SNI inspection obsolete for web properties that implement it anyway. I'm also most excited about Tor's support for Snowflake (WebRTC bridges): https://snowflake.torproject.org/ https://snowflake.torproject.org/. Literally, anyone on an uncensored network can run a Tor proxy-node from within their web browser to which other clients from behind censors can connect to. WebRTC isn't usually blocked either due to the ubiquity of web video and audio chatrooms.

1vuio0pswjnm7 6y ago
If the DoH server is hosted on Cloudflare we can use ESNI to send DoH queries. Below is simple example using ESNI-enabled openssl.^1 Cloudflare ESNI works nicely for me. Very fast. YMMV. 1. https://github.com/sftcd/openssl/tree/master/esnistuff https://github.com/sftcd/openssl/tree/master/esnistuff # requirements: openssl-esni-2019-08-30 drill sed grep od tr # get an ESNI key ( printf 'GET /dns-query?name=_esni.www.cloudflare.com&type=TXT&ct=application/dns-json HTTP/1.1\r\n'; printf 'Host: cloudflare-dns.com\r\n'; printf 'Connection: close\r\n'; printf '\r\n'; ) |openssl s_client -4 -noservername -ign_eof -connect 104.16.249.249:443 2>/dev/null \ |grep -o "data\":\"[^}]*"|sed -n s'/.\{9\}//;s/=.*/=/;wESNIRR' # make a DNS request for the name "doh.crypto.sx" over HTTPS using GET method read k < ESNIRR; h=doh.crypto.sx; ( printf 'GET /dns-query?dns=AAABAAABAAAAAAAAA2RvaAZjcnlwdG8Cc3gAAAEAAQ HTTP/1.1\r\n'; printf 'Host: doh.crypto.sx\r\n'; printf 'Connection: close\r\n'; printf 'Accept: application/dns-message\r\n'; printf '\r\n' )|LD_LIBRARY_PATH=./openssl-esni-2019-08-30 ./openssl-esni-2019-08-30/apps/openssl \ s_client -4 -tls1_3 -noservername -ign_eof -connect 104.16.249.249:443 -esni $h -esnirr $k 2>/dev/null > pkt od -An -tx1 -vw3000000 < pkt|tr -d '\40'|sed 's/00008[15]8[03]000[01]00/\ &/g'|drill -i/dev/stdin 2>/dev/null; rm pkt ESNIRR; unset h;
Thorrez 6y ago
>but it seems to involve a bit of DNS work from the censored website Could you explain? I didn't see anything like that in the article.
- ignoramous 6y ago
  May bad. I meant to write, per* censored website. And here's the relevant bit from the post: > Complexity: The user must config the frontend and backend domains in their CDN account for every censored domain they want to visit. Although such configuration can be automated using the CDN’s API.

1vuio0pswjnm7 6y ago

If the DoH server is hosted on Cloudflare we can use ESNI to send DoH queries. Below is simple example using ESNI-enabled openssl.^1 Cloudflare ESNI works nicely for me. Very fast. YMMV. 1. https://github.com/sftcd/openssl/tree/master/esnistuff https://github.com/sftcd/openssl/tree/master/esnistuff # requirements: openssl-esni-2019-08-30 drill sed grep od tr # get an ESNI key ( printf 'GET /dns-query?name=_esni.www.cloudflare.com&type=TXT&ct=application/dns-json HTTP/1.1\r\n'; printf 'Host: cloudflare-dns.com\r\n'; printf 'Connection: close\r\n'; printf '\r\n'; ) |openssl s_client -4 -noservername -ign_eof -connect 104.16.249.249:443 2>/dev/null \ |grep -o "data\":\"[^}]*"|sed -n s'/.\{9\}//;s/=.*/=/;wESNIRR' # make a DNS request for the name "doh.crypto.sx" over HTTPS using GET method read k < ESNIRR; h=doh.crypto.sx; ( printf 'GET /dns-query?dns=AAABAAABAAAAAAAAA2RvaAZjcnlwdG8Cc3gAAAEAAQ HTTP/1.1\r\n'; printf 'Host: doh.crypto.sx\r\n'; printf 'Connection: close\r\n'; printf 'Accept: application/dns-message\r\n'; printf '\r\n' )|LD_LIBRARY_PATH=./openssl-esni-2019-08-30 ./openssl-esni-2019-08-30/apps/openssl \ s_client -4 -tls1_3 -noservername -ign_eof -connect 104.16.249.249:443 -esni $h -esnirr $k 2>/dev/null > pkt od -An -tx1 -vw3000000 < pkt|tr -d '\40'|sed 's/00008[15]8[03]000[01]00/\ &/g'|drill -i/dev/stdin 2>/dev/null; rm pkt ESNIRR; unset h;

Thorrez 6y ago

>but it seems to involve a bit of DNS work from the censored website Could you explain? I didn't see anything like that in the article.

ignoramous 6y ago
May bad. I meant to write, per* censored website. And here's the relevant bit from the post: > Complexity: The user must config the frontend and backend domains in their CDN account for every censored domain they want to visit. Although such configuration can be automated using the CDN’s API.