Authors: Anonymous
中文版: 中国的防火长城屏蔽了google.com及其所有的子域名
We confirm that the Great Firewall of China has blocked google.com and all its subdomains *.google.com, affecting more than 1,100 domains and a large number of popular services. In this post, we introduce the two major censorship actions we observed. We share instructions on detecting common website censorship in China, encouraging more people to detect and expose censorship independently.
The censors first started SNI-based censorship on google.com and *.google.com on Thursday, September 22, 2022, sometime between 6:23 AM and 7:33 PM Beijing Time (UTC+8). Specifically, the censor looks for SNI values in TLS ClientHello messages, and when an SNI value matches the blacklist rules, the censor sends forged TCP RST packets to tear down the connections.
Eight days later, the censors started DNS-based censorship on google.com and *.google.com on Friday, September 30, 2022, sometime between 1:56 PM and 2:35 PM Beijing Time (UTC+8). That is, the censor checks the query name in DNS queries against the blacklist rules and injects forged DNS responses containing wrong IP addresses.
Below is a list of frequently asked questions:
Any domain that matches google.com or *.google.com is censored. For example, translate.google.com has been censored.
We also confirm that *google.com and google.com.* are not part of the blacklist rules. For example, madgoogle.com and translate.google.com.co are not censored in China.
More than 1,100 domains are censored, including a large number of popular services, for example: firebase.google.com, translate.google.com, maps.google.com, scholar.google.com, feedburner.google.com, and ads.google.com.
We attached a list of affected domains to this post.
No. All 1,147 *.google.com domains we tested were blocked without exception.
google.com is censored by all three DNS injectors; *.google.com is censored by DNS Injectors 2 and 3, but not Injector 1. (See Table 3 in this paper for each injector’s fingerprint.)We have been continuously monitoring website censorship in China by sending DNS queries with different query names and ClientHello messages with different SNI values. We thus keep a record of newly censored domains.
We encourage you to test and monitor censorship independently because the more people keep an eye on censorship, the quicker we can collectively spot a censorship event.
To monitor DNS-based censorship, you can send a DNS query to a non-DNS server that passes through the GFW. Because the destination server is not a DNS server, if you receive any DNS responses, they must be forged (by the GFW). For example, if you are inside China and want to test whether google.com is censored, you can try:
dig @23.197.152.0 google.com
If you receive any DNS response, it means google.com is censored.
To monitor SNI-based censorship from inside China, you can send a TLS ClientHello message to an open port on a server outside China. If you receive TCP RST packets, the connection was likely censored. For example, if you are inside China and want to test whether google.com is censored, you can try:
openssl s_client -servername google.com -tlsextdebug -msg -connect 96.17.116.205:80
If you receive the message write:errno=104, it means your connection was reset and it is likely that google.com is censored. We say “likely” because there may be false positives. You should use a control group with SNI set to a non-censored domain, for example baidu.com, and see whether you receive any TCP RST packets from the same port on the same server.