3 Tor Protocol Specification
8 Note: This document aims to specify Tor as implemented in 0.1.2.x
9 and earlier. Future versions of Tor may implement improved protocols, and
10 compatibility is not guaranteed.
12 This specification is not a design document; most design criteria
13 are not examined. For more information on why Tor acts as it does,
18 0.1. Notation and encoding
22 K -- a key for a symmetric cypher.
24 a|b -- concatenation of 'a' and 'b'.
26 [A0 B1 C2] -- a three-byte sequence, containing the bytes with
27 hexadecimal values A0, B1, and C2, in that order.
29 All numeric values are encoded in network (big-endian) order.
31 H(m) -- a cryptographic hash of m.
33 0.2. Security parameters
35 Tor uses a stream cipher, a public-key cipher, the Diffie-Hellman
36 protocol, and a hash function.
38 KEY_LEN -- the length of the stream cipher's key, in bytes.
40 PK_ENC_LEN -- the length of a public-key encrypted message, in bytes.
41 PK_PAD_LEN -- the number of bytes added in padding for public-key
42 encryption, in bytes. (The largest number of bytes that can be encrypted
43 in a single public-key operation is therefore PK_ENC_LEN-PK_PAD_LEN.)
45 DH_LEN -- the number of bytes used to represent a member of the
47 DH_SEC_LEN -- the number of bytes used in a Diffie-Hellman private key (x).
49 HASH_LEN -- the length of the hash function's output, in bytes.
51 PAYLOAD_LEN -- The longest allowable cell payload, in bytes. (509)
53 CELL_LEN -- The length of a Tor cell, in bytes.
57 For a stream cipher, we use 128-bit AES in counter mode, with an IV of all
60 For a public-key cipher, we use RSA with 1024-bit keys and a fixed
61 exponent of 65537. We use OAEP-MGF1 padding, with SHA-1 as its digest
62 function. We leave optional the "Label" parameter unset. (For OAEP
63 padding, see ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.pdf)
65 For Diffie-Hellman, we use a generator (g) of 2. For the modulus (p), we
66 use the 1024-bit safe prime from rfc2409 section 6.2 whose hex
69 "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
70 "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
71 "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
72 "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
73 "49286651ECE65381FFFFFFFFFFFFFFFF"
75 As an optimization, implementations SHOULD choose DH private keys (x) of
76 320 bits. Implementations that do this MUST never use any DH key more
78 [May other implementations reuse their DH keys?? -RD]
79 [Probably not. Conceivably, you could get away with changing DH keys once
80 per second, but there are too many oddball attacks for me to be
81 comfortable that this is safe. -NM]
83 For a hash function, we use SHA-1.
86 DH_LEN=128; DH_SEC_LEN=40.
87 PK_ENC_LEN=128; PK_PAD_LEN=42.
90 When we refer to "the hash of a public key", we mean the SHA-1 hash of the
91 DER encoding of an ASN.1 RSA public key (as specified in PKCS.1).
93 All "random" values should be generated with a cryptographically strong
94 random number generator, unless otherwise noted.
96 The "hybrid encryption" of a byte sequence M with a public key PK is
98 1. If M is less than PK_ENC_LEN-PK_PAD_LEN, pad and encrypt M with PK.
99 2. Otherwise, generate a KEY_LEN byte random key K.
100 Let M1 = the first PK_ENC_LEN-PK_PAD_LEN-KEY_LEN bytes of M,
101 and let M2 = the rest of M.
102 Pad and encrypt K|M1 with PK. Encrypt M2 with our stream cipher,
103 using the key K. Concatenate these encrypted values.
104 [XXX Note that this "hybrid encryption" approach does not prevent
105 an attacker from adding or removing bytes to the end of M. It also
106 allows attackers to modify the bytes not covered by the OAEP --
107 see Goldberg's PET2006 paper for details. We will add a MAC to this
110 0.4. Other parameter values
116 Tor is a distributed overlay network designed to anonymize
117 low-latency TCP-based applications such as web browsing, secure shell,
118 and instant messaging. Clients choose a path through the network and
119 build a ``circuit'', in which each node (or ``onion router'' or ``OR'')
120 in the path knows its predecessor and successor, but no other nodes in
121 the circuit. Traffic flowing down the circuit is sent in fixed-size
122 ``cells'', which are unwrapped by a symmetric key at each node (like
123 the layers of an onion) and relayed downstream.
127 Every Tor server has multiple public/private keypairs:
129 - A long-term signing-only "Identity key" used to sign documents and
130 certificates, and used to establish server identity.
131 - A medium-term "Onion key" used to decrypt onion skins when accepting
132 circuit extend attempts. (See 5.1.) Old keys MUST be accepted for at
133 least one week after they are no longer advertised. Because of this,
134 servers MUST retain old keys for a while after they're rotated.
135 - A short-term "Connection key" used to negotiate TLS connections.
136 Tor implementations MAY rotate this key as often as they like, and
137 SHOULD rotate this key at least once a day.
139 Tor servers are also identified by "nicknames"; these are specified in
144 Tor uses TLS for link authentication and encryption. All implementations
146 the TLS ciphersuite "TLS_EDH_RSA_WITH_DES_192_CBC3_SHA", and SHOULD
147 support "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" if it is available.
148 Implementations MAY support other ciphersuites, but MUST NOT
149 support any suite without ephemeral keys, symmetric keys of at
150 least KEY_LEN bits, and digests of at least HASH_LEN bits.
152 Even though the connection protocol is identical, we think of the
153 initiator as either an onion router (OR) if it is willing to relay
154 traffic for other Tor users, or an onion proxy (OP) if it only handles
155 local requests. Onion proxies SHOULD NOT provide long-term-trackable
156 identifiers in their handshakes.
158 During the TLS handshake, the connection initiator always sends a
159 two-certificate chain, consisting of an X.509 certificate using a
160 short-term connection public key and a second, self- signed X.509
161 certificate containing its identity key. The commonName of the first
162 certificate is the OR's nickname, and the commonName of the second
163 certificate is the OR's nickname, followed by a space and the string
164 "<identity>". The other party sends a similar certificate chain.
166 Implementations running Protocol 1 and earlier use an
167 organizationName of "Tor" or "TOR". Future implementations (which
168 support the version negotiation protocol in section 4.1) MUST NOT
169 have either of these values for their organizationName.
171 All parties receiving certificates must confirm that the identity key is
172 as expected. (When initiating a connection, the expected identity key is
173 the one given in the directory; when creating a connection because of an
174 EXTEND cell, the expected identity key is the one given in the cell.) If
175 the key is not as expected, the party must close the connection.
177 All parties SHOULD reject connections to or from ORs that have malformed
178 or missing certificates. ORs MAY accept or reject connections from OPs
179 with malformed or missing certificates.
181 Once a TLS connection is established, the two sides send cells
182 (specified below) to one another. Cells are sent serially. All
183 cells are CELL_LEN bytes long. Cells may be sent embedded in TLS
184 records of any size or divided across TLS records, but the framing
185 of TLS records MUST NOT leak information about the type or contents
188 TLS connections are not permanent. Either side may close a connection
189 if there are no circuits running over it and an amount of time
190 (KeepalivePeriod, defaults to 5 minutes) has passed.
192 (As an exception, directory servers may try to stay connected to all of
193 the ORs -- though this will be phased out for the Tor 0.1.2.x release.)
195 3. Cell Packet format
197 The basic unit of communication for onion routers and onion
198 proxies is a fixed-width "cell".
200 On a version 1 connection, each cell contains the following
205 Payload (padded with 0 bytes) [PAYLOAD_LEN bytes]
207 The CircID field determines which circuit, if any, the cell is
210 The 'Command' field holds one of the following values:
211 0 -- PADDING (Padding) (See Sec 7.2)
212 1 -- CREATE (Create a circuit) (See Sec 5.1)
213 2 -- CREATED (Acknowledge create) (See Sec 5.1)
214 3 -- RELAY (End-to-end data) (See Sec 5.5 and 6)
215 4 -- DESTROY (Stop using a circuit) (See Sec 5.4)
216 5 -- CREATE_FAST (Create a circuit, no PK) (See Sec 5.1)
217 6 -- CREATED_FAST (Circuit created, no PK) (See Sec 5.1)
219 The interpretation of 'Payload' depends on the type of the cell.
220 PADDING: Payload is unused.
221 CREATE: Payload contains the handshake challenge.
222 CREATED: Payload contains the handshake response.
223 RELAY: Payload contains the relay header and relay body.
224 DESTROY: Payload contains a reason for closing the circuit.
226 Upon receiving any other value for the command field, an OR must
227 drop the cell. [XXXX Versions prior to 0.1.0.?? logged a warning
228 when dropping the cell; this is bad behavior. -NM]
230 The payload is padded with 0 bytes.
232 PADDING cells are currently used to implement connection keepalive.
233 If there is no other traffic, ORs and OPs send one another a PADDING
234 cell every few minutes.
236 CREATE, CREATED, and DESTROY cells are used to manage circuits;
239 RELAY cells are used to send commands and data along a circuit; see
242 4. [This section deliberately left blank.]
244 5. Circuit management
246 5.1. CREATE and CREATED cells
248 Users set up circuits incrementally, one hop at a time. To create a
249 new circuit, OPs send a CREATE cell to the first node, with the
250 first half of the DH handshake; that node responds with a CREATED
251 cell with the second half of the DH handshake plus the first 20 bytes
252 of derivative key data (see section 5.2). To extend a circuit past
253 the first hop, the OP sends an EXTEND relay cell (see section 5)
254 which instructs the last node in the circuit to send a CREATE cell
255 to extend the circuit.
257 The payload for a CREATE cell is an 'onion skin', which consists
258 of the first step of the DH handshake data (also known as g^x).
259 This value is hybrid-encrypted (see 0.3) to Bob's onion key, giving
262 Padding padding [PK_PAD_LEN bytes]
263 Symmetric key [KEY_LEN bytes]
264 First part of g^x [PK_ENC_LEN-PK_PAD_LEN-KEY_LEN bytes]
265 Symmetrically encrypted:
266 Second part of g^x [DH_LEN-(PK_ENC_LEN-PK_PAD_LEN-KEY_LEN)
269 The relay payload for an EXTEND relay cell consists of:
272 Onion skin [DH_LEN+KEY_LEN+PK_PAD_LEN bytes]
273 Identity fingerprint [HASH_LEN bytes]
275 The port and address field denote the IPV4 address and port of the next
276 onion router in the circuit; the public key hash is the hash of the PKCS#1
277 ASN1 encoding of the next onion router's identity (signing) key. (See 0.3
278 above.) (Including this hash allows the extending OR verify that it is
279 indeed connected to the correct target OR, and prevents certain
280 man-in-the-middle attacks.)
282 The payload for a CREATED cell, or the relay payload for an
283 EXTENDED cell, contains:
284 DH data (g^y) [DH_LEN bytes]
285 Derivative key data (KH) [HASH_LEN bytes] <see 5.2 below>
287 The CircID for a CREATE cell is an arbitrarily chosen 2-byte integer,
288 selected by the node (OP or OR) that sends the CREATE cell. To prevent
289 CircID collisions, when one OR sends a CREATE cell to another, it chooses
290 from only one half of the possible values based on the ORs' public
291 identity keys: if the sending OR has a lower key, it chooses a CircID with
292 an MSB of 0; otherwise, it chooses a CircID with an MSB of 1.
294 Public keys are compared numerically by modulus.
296 As usual with DH, x and y MUST be generated randomly.
299 To implement backward-compatible version negotiation, parties MUST
300 drop CREATE cells with all-[00] onion-skins.
303 5.1.1. CREATE_FAST/CREATED_FAST cells
305 When initializing the first hop of a circuit, the OP has already
306 established the OR's identity and negotiated a secret key using TLS.
307 Because of this, it is not always necessary for the OP to perform the
308 public key operations to create a circuit. In this case, the
309 OP MAY send a CREATE_FAST cell instead of a CREATE cell for the first
310 hop only. The OR responds with a CREATED_FAST cell, and the circuit is
313 A CREATE_FAST cell contains:
315 Key material (X) [HASH_LEN bytes]
317 A CREATED_FAST cell contains:
319 Key material (Y) [HASH_LEN bytes]
320 Derivative key data [HASH_LEN bytes] (See 5.2 below)
322 The values of X and Y must be generated randomly.
324 [Versions of Tor before 0.1.0.6-rc did not support these cell types;
325 clients should not send CREATE_FAST cells to older Tor servers.]
327 If an OR sees a circuit created with CREATE_FAST, the OR is sure to be the
328 first hop of a circuit. ORs SHOULD reject attempts to create streams with
329 RELAY_BEGIN exiting the circuit at the first hop: letting Tor be used as a
330 single hop proxy makes exit nodes a more attractive target for compromise.
332 5.2. Setting circuit keys
334 Once the handshake between the OP and an OR is completed, both can
335 now calculate g^xy with ordinary DH. Before computing g^xy, both client
336 and server MUST verify that the received g^x or g^y value is not degenerate;
337 that is, it must be strictly greater than 1 and strictly less than p-1
338 where p is the DH modulus. Implementations MUST NOT complete a handshake
339 with degenerate keys. Implementations MUST NOT discard other "weak"
342 (Discarding degenerate keys is critical for security; if bad keys
343 are not discarded, an attacker can substitute the server's CREATED
344 cell's g^y with 0 or 1, thus creating a known g^xy and impersonating
345 the server. Discarding other keys may allow attacks to learn bits of
348 (The mainline Tor implementation, in the 0.1.1.x-alpha series, discarded
349 all g^x values less than 2^24, greater than p-2^24, or having more than
350 1024-16 identical bits. This served no useful purpose, and we stopped.)
352 If CREATE or EXTEND is used to extend a circuit, the client and server
353 base their key material on K0=g^xy, represented as a big-endian unsigned
356 If CREATE_FAST is used, the client and server base their key material on
359 From the base key material K0, they compute KEY_LEN*2+HASH_LEN*3 bytes of
360 derivative key data as
361 K = H(K0 | [00]) | H(K0 | [01]) | H(K0 | [02]) | ...
363 The first HASH_LEN bytes of K form KH; the next HASH_LEN form the forward
364 digest Df; the next HASH_LEN 41-60 form the backward digest Db; the next
365 KEY_LEN 61-76 form Kf, and the final KEY_LEN form Kb. Excess bytes from K
368 KH is used in the handshake response to demonstrate knowledge of the
369 computed shared key. Df is used to seed the integrity-checking hash
370 for the stream of data going from the OP to the OR, and Db seeds the
371 integrity-checking hash for the data stream from the OR to the OP. Kf
372 is used to encrypt the stream of data going from the OP to the OR, and
373 Kb is used to encrypt the stream of data going from the OR to the OP.
375 5.3. Creating circuits
377 When creating a circuit through the network, the circuit creator
378 (OP) performs the following steps:
380 1. Choose an onion router as an exit node (R_N), such that the onion
381 router's exit policy includes at least one pending stream that
382 needs a circuit (if there are any).
384 2. Choose a chain of (N-1) onion routers
385 (R_1...R_N-1) to constitute the path, such that no router
386 appears in the path twice.
388 3. If not already connected to the first router in the chain,
389 open a new connection to that router.
391 4. Choose a circID not already in use on the connection with the
392 first router in the chain; send a CREATE cell along the
393 connection, to be received by the first onion router.
395 5. Wait until a CREATED cell is received; finish the handshake
396 and extract the forward key Kf_1 and the backward key Kb_1.
398 6. For each subsequent onion router R (R_2 through R_N), extend
401 To extend the circuit by a single onion router R_M, the OP performs
404 1. Create an onion skin, encrypted to R_M's public onion key.
406 2. Send the onion skin in a relay EXTEND cell along
407 the circuit (see section 5).
409 3. When a relay EXTENDED cell is received, verify KH, and
410 calculate the shared keys. The circuit is now extended.
412 When an onion router receives an EXTEND relay cell, it sends a CREATE
413 cell to the next onion router, with the enclosed onion skin as its
414 payload. The initiating onion router chooses some circID not yet
415 used on the connection between the two onion routers. (But see
416 section 5.1. above, concerning choosing circIDs based on
417 lexicographic order of nicknames.)
419 When an onion router receives a CREATE cell, if it already has a
420 circuit on the given connection with the given circID, it drops the
421 cell. Otherwise, after receiving the CREATE cell, it completes the
422 DH handshake, and replies with a CREATED cell. Upon receiving a
423 CREATED cell, an onion router packs it payload into an EXTENDED relay
424 cell (see section 5), and sends that cell up the circuit. Upon
425 receiving the EXTENDED relay cell, the OP can retrieve g^y.
427 (As an optimization, OR implementations may delay processing onions
428 until a break in traffic allows time to do so without harming
429 network latency too greatly.)
431 5.4. Tearing down circuits
433 Circuits are torn down when an unrecoverable error occurs along
434 the circuit, or when all streams on a circuit are closed and the
435 circuit's intended lifetime is over. Circuits may be torn down
436 either completely or hop-by-hop.
438 To tear down a circuit completely, an OR or OP sends a DESTROY
439 cell to the adjacent nodes on that circuit, using the appropriate
442 Upon receiving an outgoing DESTROY cell, an OR frees resources
443 associated with the corresponding circuit. If it's not the end of
444 the circuit, it sends a DESTROY cell for that circuit to the next OR
445 in the circuit. If the node is the end of the circuit, then it tears
446 down any associated edge connections (see section 6.1).
448 After a DESTROY cell has been processed, an OR ignores all data or
449 destroy cells for the corresponding circuit.
451 To tear down part of a circuit, the OP may send a RELAY_TRUNCATE cell
452 signaling a given OR (Stream ID zero). That OR sends a DESTROY
453 cell to the next node in the circuit, and replies to the OP with a
454 RELAY_TRUNCATED cell.
456 When an unrecoverable error occurs along one connection in a
457 circuit, the nodes on either side of the connection should, if they
458 are able, act as follows: the node closer to the OP should send a
459 RELAY_TRUNCATED cell towards the OP; the node farther from the OP
460 should send a DESTROY cell down the circuit.
462 The payload of a RELAY_TRUNCATED or DESTROY cell contains a single octet,
463 describing why the circuit is being closed or truncated. When sending a
464 TRUNCATED or DESTROY cell because of another TRUNCATED or DESTROY cell,
465 the error code should be propagated. The origin of a circuit always sets
466 this error code to 0, to avoid leaking its version.
469 0 -- NONE (No reason given.)
470 1 -- PROTOCOL (Tor protocol violation.)
471 2 -- INTERNAL (Internal error.)
472 3 -- REQUESTED (A client sent a TRUNCATE command.)
473 4 -- HIBERNATING (Not currently operating; trying to save bandwidth.)
474 5 -- RESOURCELIMIT (Out of memory, sockets, or circuit IDs.)
475 6 -- CONNECTFAILED (Unable to reach server.)
476 7 -- OR_IDENTITY (Connected to server, but its OR identity was not
478 8 -- OR_CONN_CLOSED (The OR connection that was carrying this circuit
480 9 -- FINISHED (The circuit has expired for being dirty or old.)
481 10 -- TIMEOUT (Circuit construction took too long)
482 11 -- DESTROYED (The circuit was destroyed w/o client TRUNCATE)
483 12 -- NOSUCHSERVICE (Request for unknown hidden service)
485 [Versions of Tor prior to 0.1.0.11 didn't send reasons; implementations
486 MUST accept empty TRUNCATED and DESTROY cells.]
488 5.5. Routing relay cells
490 When an OR receives a RELAY cell, it checks the cell's circID and
491 determines whether it has a corresponding circuit along that
492 connection. If not, the OR drops the RELAY cell.
494 Otherwise, if the OR is not at the OP edge of the circuit (that is,
495 either an 'exit node' or a non-edge node), it de/encrypts the payload
496 with the stream cipher, as follows:
497 'Forward' relay cell (same direction as CREATE):
498 Use Kf as key; decrypt.
499 'Back' relay cell (opposite direction from CREATE):
500 Use Kb as key; encrypt.
501 Note that in counter mode, decrypt and encrypt are the same operation.
503 The OR then decides whether it recognizes the relay cell, by
504 inspecting the payload as described in section 6.1 below. If the OR
505 recognizes the cell, it processes the contents of the relay cell.
506 Otherwise, it passes the decrypted relay cell along the circuit if
507 the circuit continues. If the OR at the end of the circuit
508 encounters an unrecognized relay cell, an error has occurred: the OR
509 sends a DESTROY cell to tear down the circuit.
511 When a relay cell arrives at an OP, the OP decrypts the payload
512 with the stream cipher as follows:
513 OP receives data cell:
515 Decrypt with Kb_I. If the payload is recognized (see
516 section 6..1), then stop and process the payload.
518 For more information, see section 6 below.
520 6. Application connections and stream management
524 Within a circuit, the OP and the exit node use the contents of
525 RELAY packets to tunnel end-to-end commands and TCP connections
526 ("Streams") across circuits. End-to-end commands can be initiated
527 by either edge; streams are initiated by the OP.
529 The payload of each unencrypted RELAY cell consists of:
530 Relay command [1 byte]
531 'Recognized' [2 bytes]
535 Data [CELL_LEN-14 bytes]
537 The relay commands are:
538 1 -- RELAY_BEGIN [forward]
539 2 -- RELAY_DATA [forward or backward]
540 3 -- RELAY_END [forward or backward]
541 4 -- RELAY_CONNECTED [backward]
542 5 -- RELAY_SENDME [forward or backward] [sometimes control]
543 6 -- RELAY_EXTEND [forward] [control]
544 7 -- RELAY_EXTENDED [backward] [control]
545 8 -- RELAY_TRUNCATE [forward] [control]
546 9 -- RELAY_TRUNCATED [backward] [control]
547 10 -- RELAY_DROP [forward or backward] [control]
548 11 -- RELAY_RESOLVE [forward]
549 12 -- RELAY_RESOLVED [backward]
550 13 -- RELAY_BEGIN_DIR [forward]
552 Commands labelled as "forward" must only be sent by the originator
553 of the circuit. Commands labelled as "backward" must only be sent by
554 other nodes in the circuit back to the originator. Commands marked
555 as either can be sent either by the originator or other nodes.
557 The 'recognized' field in any unencrypted relay payload is always set
558 to zero; the 'digest' field is computed as the first four bytes of
559 the running digest of all the bytes that have been destined for
560 this hop of the circuit or originated from this hop of the circuit,
561 seeded from Df or Db respectively (obtained in section 5.2 above),
562 and including this RELAY cell's entire payload (taken with the digest
565 When the 'recognized' field of a RELAY cell is zero, and the digest
566 is correct, the cell is considered "recognized" for the purposes of
567 decryption (see section 5.5 above).
569 (The digest does not include any bytes from relay cells that do
570 not start or end at this hop of the circuit. That is, it does not
571 include forwarded data. Therefore if 'recognized' is zero but the
572 digest does not match, the running digest at that node should
573 not be updated, and the cell should be forwarded on.)
575 All RELAY cells pertaining to the same tunneled stream have the
576 same stream ID. StreamIDs are chosen arbitrarily by the OP. RELAY
577 cells that affect the entire circuit rather than a particular
578 stream use a StreamID of zero -- they are marked in the table above
579 as "[control]" style cells. (Sendme cells are marked as "sometimes
580 control" because they can take include a StreamID or not depending
581 on their purpose -- see Section 7.)
583 The 'Length' field of a relay cell contains the number of bytes in
584 the relay payload which contain real payload data. The remainder of
585 the payload is padded with NUL bytes.
587 If the RELAY cell is recognized but the relay command is not
588 understood, the cell must be dropped and ignored. Its contents
589 still count with respect to the digests, though. [Before
590 0.1.1.10, Tor closed circuits when it received an unknown relay
591 command. Perhaps this will be more forward-compatible. -RD]
593 6.2. Opening streams and transferring data
595 To open a new anonymized TCP connection, the OP chooses an open
596 circuit to an exit that may be able to connect to the destination
597 address, selects an arbitrary StreamID not yet used on that circuit,
598 and constructs a RELAY_BEGIN cell with a payload encoding the address
599 and port of the destination host. The payload format is:
601 ADDRESS | ':' | PORT | [00]
603 where ADDRESS can be a DNS hostname, or an IPv4 address in
604 dotted-quad format, or an IPv6 address surrounded by square brackets;
605 and where PORT is encoded in decimal.
607 [What is the [00] for? -NM]
608 [It's so the payload is easy to parse out with string funcs -RD]
610 Upon receiving this cell, the exit node resolves the address as
611 necessary, and opens a new TCP connection to the target port. If the
612 address cannot be resolved, or a connection can't be established, the
613 exit node replies with a RELAY_END cell. (See 6.4 below.)
614 Otherwise, the exit node replies with a RELAY_CONNECTED cell, whose
615 payload is in one of the following formats:
616 The IPv4 address to which the connection was made [4 octets]
617 A number of seconds (TTL) for which the address may be cached [4 octets]
619 Four zero-valued octets [4 octets]
620 An address type (6) [1 octet]
621 The IPv6 address to which the connection was made [16 octets]
622 A number of seconds (TTL) for which the address may be cached [4 octets]
623 [XXXX Versions of Tor before 0.1.1.6 ignore and do not generate the TTL
624 field. No version of Tor currently generates the IPv6 format.
626 Tor servers before 0.1.2.0 set the TTL field to a fixed value. Later
627 versions set the TTL to the last value seen from a DNS server, and expire
628 their own cached entries after a fixed interval. This prevents certain
631 The OP waits for a RELAY_CONNECTED cell before sending any data.
632 Once a connection has been established, the OP and exit node
633 package stream data in RELAY_DATA cells, and upon receiving such
634 cells, echo their contents to the corresponding TCP stream.
635 RELAY_DATA cells sent to unrecognized streams are dropped.
637 Relay RELAY_DROP cells are long-range dummies; upon receiving such
638 a cell, the OR or OP must drop it.
640 6.2.1. Opening a directory stream
642 If a Tor server is a directory server, it should respond to a
643 RELAY_BEGIN_DIR cell as if it had received a BEGIN cell requesting a
644 connection to its directory port. RELAY_BEGIN_DIR cells ignore exit
645 policy, since the stream is local to the Tor process.
647 If the Tor server is not running a directory service, it should respond
648 with a REASON_NOTDIRECTORY RELAY_END cell.
650 Clients MUST generate an all-zero payload for RELAY_BEGIN_DIR cells,
651 and servers MUST ignore the payload.
653 [RELAY_BEGIN_DIR was not supported before Tor 0.1.2.2-alpha; clients
654 SHOULD NOT send it to routers running earlier versions of Tor.]
658 When an anonymized TCP connection is closed, or an edge node
659 encounters error on any stream, it sends a 'RELAY_END' cell along the
660 circuit (if possible) and closes the TCP connection immediately. If
661 an edge node receives a 'RELAY_END' cell for any stream, it closes
662 the TCP connection completely, and sends nothing more along the
663 circuit for that stream.
665 The payload of a RELAY_END cell begins with a single 'reason' byte to
666 describe why the stream is closing, plus optional data (depending on
667 the reason.) The values are:
669 1 -- REASON_MISC (catch-all for unlisted reasons)
670 2 -- REASON_RESOLVEFAILED (couldn't look up hostname)
671 3 -- REASON_CONNECTREFUSED (remote host refused connection) [*]
672 4 -- REASON_EXITPOLICY (OR refuses to connect to host or port)
673 5 -- REASON_DESTROY (Circuit is being destroyed)
674 6 -- REASON_DONE (Anonymized TCP connection was closed)
675 7 -- REASON_TIMEOUT (Connection timed out, or OR timed out
677 8 -- (unallocated) [**]
678 9 -- REASON_HIBERNATING (OR is temporarily hibernating)
679 10 -- REASON_INTERNAL (Internal error at the OR)
680 11 -- REASON_RESOURCELIMIT (OR has no resources to fulfill request)
681 12 -- REASON_CONNRESET (Connection was unexpectedly reset)
682 13 -- REASON_TORPROTOCOL (Sent when closing connection because of
683 Tor protocol violations.)
684 14 -- REASON_NOTDIRECTORY (Client sent RELAY_BEGIN_DIR to a
685 non-directory server.)
687 (With REASON_EXITPOLICY, the 4-byte IPv4 address or 16-byte IPv6 address
688 forms the optional data; no other reason currently has extra data.
689 As of 0.1.1.6, the body also contains a 4-byte TTL.)
691 OPs and ORs MUST accept reasons not on the above list, since future
692 versions of Tor may provide more fine-grained reasons.
694 [*] Older versions of Tor also send this reason when connections are
696 [**] Due to a bug in versions of Tor through 0095, error reason 8 must
697 remain allocated until that version is obsolete.
699 --- [The rest of this section describes unimplemented functionality.]
701 Because TCP connections can be half-open, we follow an equivalent
702 to TCP's FIN/FIN-ACK/ACK protocol to close streams.
704 An exit connection can have a TCP stream in one of three states:
705 'OPEN', 'DONE_PACKAGING', and 'DONE_DELIVERING'. For the purposes
706 of modeling transitions, we treat 'CLOSED' as a fourth state,
707 although connections in this state are not, in fact, tracked by the
710 A stream begins in the 'OPEN' state. Upon receiving a 'FIN' from
711 the corresponding TCP connection, the edge node sends a 'RELAY_FIN'
712 cell along the circuit and changes its state to 'DONE_PACKAGING'.
713 Upon receiving a 'RELAY_FIN' cell, an edge node sends a 'FIN' to
714 the corresponding TCP connection (e.g., by calling
715 shutdown(SHUT_WR)) and changing its state to 'DONE_DELIVERING'.
717 When a stream in already in 'DONE_DELIVERING' receives a 'FIN', it
718 also sends a 'RELAY_FIN' along the circuit, and changes its state
719 to 'CLOSED'. When a stream already in 'DONE_PACKAGING' receives a
720 'RELAY_FIN' cell, it sends a 'FIN' and changes its state to
723 If an edge node encounters an error on any stream, it sends a
724 'RELAY_END' cell (if possible) and closes the stream immediately.
726 6.4. Remote hostname lookup
728 To find the address associated with a hostname, the OP sends a
729 RELAY_RESOLVE cell containing the hostname to be resolved. (For a reverse
730 lookup, the OP sends a RELAY_RESOLVE cell containing an in-addr.arpa
731 address.) The OR replies with a RELAY_RESOLVED cell containing a status
732 byte, and any number of answers. Each answer is of the form:
735 Value (variable-width)
737 "Length" is the length of the Value field.
742 0xF0 -- Error, transient
743 0xF1 -- Error, nontransient
745 If any answer has a type of 'Error', then no other answer may be given.
747 The RELAY_RESOLVE cell must use a nonzero, distinct streamID; the
748 corresponding RELAY_RESOLVED cell must use the same streamID. No stream
749 is actually created by the OR when resolving the name.
755 Each node should do appropriate bandwidth throttling to keep its
758 Communicants rely on TCP's default flow control to push back when they
763 Link padding can be created by sending PADDING cells along the
764 connection; relay cells of type "DROP" can be used for long-range
767 Currently nodes are not required to do any sort of link padding or
768 dummy traffic. Because strong attacks exist even with link padding,
769 and because link padding greatly increases the bandwidth requirements
770 for running a node, we plan to leave out link padding until this
771 tradeoff is better understood.
773 7.3. Circuit-level flow control
775 To control a circuit's bandwidth usage, each OR keeps track of
776 two 'windows', consisting of how many RELAY_DATA cells it is
777 allowed to package for transmission, and how many RELAY_DATA cells
778 it is willing to deliver to streams outside the network.
779 Each 'window' value is initially set to 1000 data cells
780 in each direction (cells that are not data cells do not affect
781 the window). When an OR is willing to deliver more cells, it sends a
782 RELAY_SENDME cell towards the OP, with Stream ID zero. When an OR
783 receives a RELAY_SENDME cell with stream ID zero, it increments its
786 Each of these cells increments the corresponding window by 100.
788 The OP behaves identically, except that it must track a packaging
789 window and a delivery window for every OR in the circuit.
791 An OR or OP sends cells to increment its delivery window when the
792 corresponding window value falls under some threshold (900).
794 If a packaging window reaches 0, the OR or OP stops reading from
795 TCP connections for all streams on the corresponding circuit, and
796 sends no more RELAY_DATA cells until receiving a RELAY_SENDME cell.
797 [this stuff is badly worded; copy in the tor-design section -RD]
799 7.4. Stream-level flow control
801 Edge nodes use RELAY_SENDME cells to implement end-to-end flow
802 control for individual connections across circuits. Similarly to
803 circuit-level flow control, edge nodes begin with a window of cells
804 (500) per stream, and increment the window by a fixed value (50)
805 upon receiving a RELAY_SENDME cell. Edge nodes initiate RELAY_SENDME
806 cells when both a) the window is <= 450, and b) there are less than
807 ten cell payloads remaining to be flushed at that edge.
810 A.1. Differences between spec and implementation
812 - The current specification requires all ORs to have IPv4 addresses, but
813 allows servers to exit and resolve to IPv6 addresses, and to declare IPv6
814 addresses in their exit policies. The current codebase has no IPv6