FINDING · DETECTION

The GFW's HTTP injection for 1.1.1.1:80 does not suppress the real Cloudflare response: the legitimate 301 from the actual server arrives after the injected packet, confirming the GFW operates as a race-condition injector rather than a transparent drop-and-replace proxy.

From 2023-gfw-blocking-1111 — The blocking of 1.1.1.1 in China, starting from 2023-10-01 · Analysis on the injection to 1.1.1.1:80 · 2023 · gfw.report

Implications

A client that reads only the first response will be deceived; implement response-validation logic that checks for duplicate or contradictory HTTP responses on the same connection as a detection signal.
Race-condition injection is inherently probabilistic — designing bootstrap flows that retry on suspicious first-response redirects (especially to government-hosted IPs) can recover from injection events.

The GFW's HTTP injection for 1.1.1.1:80 does not suppress the real Cloudflare response: the legitimate 301 from the actual server arrives after the injected packet, confirming the GFW operates as a race-condition injector rather than a transparent drop-and-replace proxy.

Implications

Tags