wkrp
commented
4 years ago My first thought was that this may be a manifestation of the new protocol filter on ports 53, 80, and 443: https://geneva.cs.umd.edu/posts/iran-whitelister/. The protocol filter report also says that interference is intermittent and does not affect all IP addresses equally. But on closer inspection, this seems to be something different, as the protocol filter doesn't look at the part of the ClientHello that would change with ESNI:
After the first 5 bytes of the packet (the type, the version, and the length, 1, 2, and 2 bytes respectively), the whitelister does not look at any contents of the Client Hello. Writing garbage bytes to the remaining bytes of the Client Hello does not trip the whitelister.
In the Shatel capture, you are right, the PSH/ACK with a different TTL and a IP ID copied from the client's ClientHello packet is weird and looks like an injection. There's no ServerHello, but interestingly 15 seconds later the server sends a FIN with what looks like a legitimate TTL.
I am not sure what the purpose is served by injecting a 0-length ACK packet, after the connection is already established. I thought it might be an attempt at sequence number desynchronization, but you would expect to see the legitimate server response as well, if that were the attack. Instead, it looks like the client→server data packet is never reaching the server; and therefore the server never responds and eventually FINs.
xhdix
Kkevsterrr
mokhtarabadi
For several months now, there has been evidence that some ISPs in Iran are intermittently blocking ESNI. The highest blockage was observed in MCI (AS197207) and then in Shatel (AS31549). Because behaviors are different for each request and for each ISP, no definite conclusion can be drawn, but severe disorders are certain! Probably the main problem is this: https://github.com/net4people/bbs/issues/10#issuecomment-532035677
The following two addresses are used for testing: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/cdn-cgi/trace
TCI (AS58224) :
Strange behavior is observed in TCI, that sometimes in a single moment, you can access a website with one browser and you can't with another browser!
In Apr 14th :
In May 4th :
Now :
Irancell (AS44244) :
In Apr 15th :
Now :
Shatel (AS31549) :
In Apr 15th :
Now in Shatel, it is almost impossible to open the Cloudflare site after activating ESNI!
Capture for opening: https://blog.cloudflare.com/encrypted-sni/
The packet with TTL 47 has a duplicate IP.ID of the previous packet. I've seen this behavior before in TCI, but with TTL 114:
MCI (AS197207) :
In MCI, the situation is worse than what we saw in Shatel! There is no stability!
In Apr 14th :
Now :
This capture is related to an Outline server that is blocked in MCI! (The Outline app manually closed after 300 seconds.)
(Updated : 3:04 PM, Friday, July 3, 2020)