Support ESNI on All of Cloudflare-Enabled Sites

[ameshkov]

@DitFranXX commented on Mon Feb 11 2019

This is Feature Request, CC: https://blog.cloudflare.com/encrypted-sni/ https://encryptedsni.com/

All of CF-Enabled domain enabled ESNI as default. also Firefox has ESNI Implements which can be enabled by set network.security.esni.enabled to true (But it is not work with ADGuard with HTTPS Filtering because Site cert is Adguard Personal CA instead Cloudflare's cert.)

May this is issue of something called CoreLibs .

Steps to reproduce

1. Access any cloudflare enabled domain with /cdn-cgi/trace path
2. Access https://encryptedsni.com/

Expected behavior

1. sni=encrypted
2. SNI section has green check mark.

Actual behavior

1. sni=plaintext
2. SNI section has red X mark.

Your environment

• ALL of HTTPS Filtering-able enviroment(Window, Mac, and Android)

[ameshkov]

@DitFranXX

We actually have another issue about it, but most likely we will have to split it into smaller tasks: #553

Supporting the CloudFlare's draft implementation would be a good first step.

[DitFranXX]

It's been 7 months. CoreLibs now 1.5. High priority, And milestone is targeting 1.4. When this feature implemented?

[ameshkov]

@DitFranXX

The milestone was set to v2.0, I don't know why in the GH history it shows v1.4.

The first pre-requisite is to start supporting DNS filtering and DNS encryption in desktop AdGuard products which is a huge task by itself. We cannot rely on plain DNS in ESNI.

Only after that, we can start working on ESNI. The problem is that the work on the ESNI specification draft is still a work-in-progress, and it seems that supporting the draft version by Firefox and Cloudflare does not make much sense now.

[sfionov]

Closing as duplicate of #1565 which is already done