tor-spec.txt 43 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992
  1. $Id$
  2. Tor Protocol Specification
  3. Roger Dingledine
  4. Nick Mathewson
  5. Note: This is an attempt to specify Tor as currently implemented. Future
  6. versions of Tor will implement improved protocols, and compatibility is not
  7. guaranteed.
  8. This is not a design document; most design criteria are not examined. For
  9. more information on why Tor acts as it does, see tor-design.pdf.
  10. TODO: (very soon)
  11. - REASON_CONNECTFAILED should include an IP.
  12. - Copy prose from tor-design to make everything more readable.
  13. when do we rotate which keys (tls, link, etc)?
  14. 0. Notation:
  15. PK -- a public key.
  16. SK -- a private key
  17. K -- a key for a symmetric cypher
  18. a|b -- concatenation of 'a' and 'b'.
  19. [A0 B1 C2] -- a three-byte sequence, containing the bytes with
  20. hexadecimal values A0, B1, and C2, in that order.
  21. All numeric values are encoded in network (big-endian) order.
  22. Unless otherwise specified, all symmetric ciphers are AES in counter
  23. mode, with an IV of all 0 bytes. Asymmetric ciphers are either RSA
  24. with 1024-bit keys and exponents of 65537, or DH where the generator (g)
  25. is 2 and the modulus (p) is the 1024-bit safe prime from rfc2409,
  26. section 6.2, whose hex representation is:
  27. "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
  28. "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
  29. "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
  30. "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
  31. "49286651ECE65381FFFFFFFFFFFFFFFF"
  32. As an optimization, implementations SHOULD choose DH private keys (x) of
  33. 320 bits. Implementations that do this MUST never use any DH key more
  34. than once.
  35. All "hashes" are 20-byte SHA1 cryptographic digests.
  36. When we refer to "the hash of a public key", we mean the SHA1 hash of the
  37. DER encoding of an ASN.1 RSA public key (as specified in PKCS.1).
  38. 1. System overview
  39. Onion Routing is a distributed overlay network designed to anonymize
  40. low-latency TCP-based applications such as web browsing, secure shell,
  41. and instant messaging. Clients choose a path through the network and
  42. build a ``circuit'', in which each node (or ``onion router'' or ``OR'')
  43. in the path knows its predecessor and successor, but no other nodes in
  44. the circuit. Traffic flowing down the circuit is sent in fixed-size
  45. ``cells'', which are unwrapped by a symmetric key at each node (like
  46. the layers of an onion) and relayed downstream.
  47. 2. Connections
  48. There are two ways to connect to an onion router (OR). The first is
  49. as an onion proxy (OP), which allows the OP to authenticate the OR
  50. without authenticating itself. The second is as another OR, which
  51. allows mutual authentication.
  52. Tor uses TLS for link encryption. All implementations MUST support
  53. the TLS ciphersuite "TLS_EDH_RSA_WITH_DES_192_CBC3_SHA", and SHOULD
  54. support "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" if it is available.
  55. Implementations MAY support other ciphersuites, but MUST NOT
  56. support any suite without ephemeral keys, symmetric keys of at
  57. least 128 bits, and digests of at least 160 bits.
  58. An OP or OR always sends a two-certificate chain, consisting of a
  59. certificate using a short-term connection key and a second, self-
  60. signed certificate containing the OR's identity key. The commonName of the
  61. first certificate is the OR's nickname, and the commonName of the second
  62. certificate is the OR's nickname, followed by a space and the string
  63. "<identity>".
  64. All parties receiving certificates must confirm that the identity key is
  65. as expected. (When initiating a connection, the expected identity key is
  66. the one given in the directory; when creating a connection because of an
  67. EXTEND cell, the expected identity key is the one given in the cell.) If
  68. the key is not as expected, the party must close the connection.
  69. All parties SHOULD reject connections to or from ORs that have malformed
  70. or missing certificates. ORs MAY accept or reject connections from OPs
  71. with malformed or missing certificates.
  72. Once a TLS connection is established, the two sides send cells
  73. (specified below) to one another. Cells are sent serially. All
  74. cells are 512 bytes long. Cells may be sent embedded in TLS
  75. records of any size or divided across TLS records, but the framing
  76. of TLS records MUST NOT leak information about the type or contents
  77. of the cells.
  78. TLS connections are not permanent. An OP or an OR may close a
  79. connection to an OR if there are no circuits running over the
  80. connection, and an amount of time (KeepalivePeriod, defaults to 5
  81. minutes) has passed.
  82. (As an exception, directory servers may try to stay connected to all of
  83. the ORs.)
  84. 3. Cell Packet format
  85. The basic unit of communication for onion routers and onion
  86. proxies is a fixed-width "cell". Each cell contains the following
  87. fields:
  88. CircID [2 bytes]
  89. Command [1 byte]
  90. Payload (padded with 0 bytes) [509 bytes]
  91. [Total size: 512 bytes]
  92. The CircID field determines which circuit, if any, the cell is
  93. associated with.
  94. The 'Command' field holds one of the following values:
  95. 0 -- PADDING (Padding) (See Sec 6.2)
  96. 1 -- CREATE (Create a circuit) (See Sec 4)
  97. 2 -- CREATED (Acknowledge create) (See Sec 4)
  98. 3 -- RELAY (End-to-end data) (See Sec 5)
  99. 4 -- DESTROY (Stop using a circuit) (See Sec 4)
  100. 5 -- CREATE_FAST (Create a circuit, no PK) (See sec 4)
  101. 6 -- CREATED_FAST (Circtuit created, no PK) (See Sec 4)
  102. The interpretation of 'Payload' depends on the type of the cell.
  103. PADDING: Payload is unused.
  104. CREATE: Payload contains the handshake challenge.
  105. CREATED: Payload contains the handshake response.
  106. RELAY: Payload contains the relay header and relay body.
  107. DESTROY: Payload is unused.
  108. Upon receiving any other value for the command field, an OR must
  109. drop the cell.
  110. The payload is padded with 0 bytes.
  111. PADDING cells are currently used to implement connection keepalive.
  112. If there is no other traffic, ORs and OPs send one another a PADDING
  113. cell every few minutes.
  114. CREATE, CREATED, and DESTROY cells are used to manage circuits;
  115. see section 4 below.
  116. RELAY cells are used to send commands and data along a circuit; see
  117. section 5 below.
  118. 4. Circuit management
  119. 4.1. CREATE and CREATED cells
  120. Users set up circuits incrementally, one hop at a time. To create a
  121. new circuit, OPs send a CREATE cell to the first node, with the
  122. first half of the DH handshake; that node responds with a CREATED
  123. cell with the second half of the DH handshake plus the first 20 bytes
  124. of derivative key data (see section 4.2). To extend a circuit past
  125. the first hop, the OP sends an EXTEND relay cell (see section 5)
  126. which instructs the last node in the circuit to send a CREATE cell
  127. to extend the circuit.
  128. The payload for a CREATE cell is an 'onion skin', which consists
  129. of the first step of the DH handshake data (also known as g^x).
  130. The data is encrypted to Bob's PK as follows: Suppose Bob's PK
  131. modulus is L octets long. If the data to be encrypted is shorter
  132. than L-42, then it is encrypted directly (with OAEP padding: see
  133. ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.pdf). If the
  134. data is at least as long as L-42, then a randomly generated 16-byte
  135. symmetric key is prepended to the data, after which the first L-16-42
  136. bytes of the data are encrypted with Bob's PK; and the rest of the
  137. data is encrypted with the symmetric key.
  138. So in this case, the onion skin on the wire looks like:
  139. RSA-encrypted:
  140. OAEP padding [42 bytes]
  141. Symmetric key [16 bytes]
  142. First part of g^x [70 bytes]
  143. Symmetrically encrypted:
  144. Second part of g^x [58 bytes]
  145. The relay payload for an EXTEND relay cell consists of:
  146. Address [4 bytes]
  147. Port [2 bytes]
  148. Onion skin [186 bytes]
  149. Identity fingerprint [20 bytes]
  150. The port and address field denote the IPV4 address and port of the next
  151. onion router in the circuit; the public key hash is the SHA1 hash of the
  152. PKCS#1 ASN1 encoding of the next onion router's identity (signing) key.
  153. (Including this hash allows the extending OR verify that it is indeed
  154. connected to the correct target OR, and prevents certain man-in-the-middle
  155. attacks.)
  156. The payload for a CREATED cell, or the relay payload for an
  157. EXTENDED cell, contains:
  158. DH data (g^y) [128 bytes]
  159. Derivative key data (KH) [20 bytes] <see 4.2 below>
  160. The CircID for a CREATE cell is an arbitrarily chosen 2-byte integer,
  161. selected by the node (OP or OR) that sends the CREATE cell. To prevent
  162. CircID collisions, when one OR sends a CREATE cell to another, it chooses
  163. from only one half of the possible values based on the ORs' public
  164. identity keys: if the sending OR has a lower key, it chooses a CircID with
  165. an MSB of 0; otherwise, it chooses a CircID with an MSB of 1.
  166. Public keys are compared numerically by modulus.
  167. As usual with DH, x and y MUST be generated randomly.
  168. (Older versions of Tor compared OR nicknames, and did it in a broken and
  169. unreliable way. To support versions of Tor earlier than 0.0.9pre6,
  170. implementations should notice when the other side of a connection is
  171. sending CREATE cells with the "wrong" MSB, and switch accordingly.)
  172. 4.1.1. CREATE_FAST/CREATED_FAST cells
  173. When initializing the first hop of a circuit, the OP has already
  174. established the OR's identity and negotiated a secret key using TLS.
  175. Because of this, it is not always necessary for the OP to perform the
  176. public key operations to create a circuit. In this case, the
  177. OP MAY send a CREATE_FAST cell instead of a CREATE cell for the first
  178. hop only. The OR responds with a CREATED_FAST cell, and the circuit is
  179. created.
  180. A CREATE_FAST cell contains:
  181. Key material (X) [20 bytes]
  182. A CREATED_FAST cell contains:
  183. Key material (Y) [20 bytes]
  184. Derivative key data [20 bytes] (See 4.2 below)
  185. The values of X and Y must be generated randomly.
  186. [Versions of Tor before 0.1.0.6-rc did not support these cell types;
  187. clients should not send CREATE_FAST cells to older Tor servers.]
  188. 4.2. Setting circuit keys
  189. Once the handshake between the OP and an OR is completed, both can
  190. now calculate g^xy with ordinary DH. Before computing g^xy, both client
  191. and server MUST verify that the received g^x or g^y value is not degenerate;
  192. that is, it must be strictly greater than 1 and strictly less than p-1
  193. where p is the DH modulus. Implementations MUST NOT complete a handshake
  194. with degenerate keys. Implementions MAY discard other "weak" g^x values.
  195. (Discarding degenerate keys is critical for security; if bad keys are not
  196. discarded, an attacker can substitute the server's CREATED cell's g^y with
  197. 0 or 1, thus creating a known g^xy and impersonating the server.)
  198. (The mainline Tor implementation, in the 0.1.1.x-alpha series, discarded
  199. all g^x values less than 2^24, greater than p-2^24, or having more than
  200. 1024-16 identical bits. This served no useful purpose, and we stopped.)
  201. If CREATE or EXTEND is used to extend a circuit, the client and server
  202. base their key material on K0=g^xy, represented as a big-endian unsigned
  203. integer.
  204. If CREATE_FAST is used, the client and server base their key material on
  205. K0=X|Y.
  206. From the base key material g^xy, they compute derivative key material as
  207. follows. Next, the server computes 100 bytes of key data as K = SHA1(K0
  208. | [00]) | SHA1(K0 | [01]) | ... SHA1(K0 | [04]) where "00" is a single
  209. octet whose value is zero, [01] is a single octet whose value is one, etc.
  210. The first 20 bytes of K form KH, bytes 21-40 form the forward digest Df,
  211. 41-60 form the backward digest Db, 61-76 form Kf, and 77-92 form Kb.
  212. KH is used in the handshake response to demonstrate knowledge of the
  213. computed shared key. Df is used to seed the integrity-checking hash
  214. for the stream of data going from the OP to the OR, and Db seeds the
  215. integrity-checking hash for the data stream from the OR to the OP. Kf
  216. is used to encrypt the stream of data going from the OP to the OR, and
  217. Kb is used to encrypt the stream of data going from the OR to the OP.
  218. The fast-setup case uses the same formula, except that X|Y is used
  219. in place of g^xy in determining K. That is,
  220. K = SHA1(X|Y | [00]) | SHA1(X|Y | [01]) | ... SHA1(X|Y| | [04])
  221. The values KH, Kf, Kb, Df, and Db are established and used as before.
  222. 4.3. Creating circuits
  223. When creating a circuit through the network, the circuit creator
  224. (OP) performs the following steps:
  225. 1. Choose an onion router as an exit node (R_N), such that the onion
  226. router's exit policy does not exclude every pending stream
  227. that needs a circuit.
  228. 2. Choose a chain of (N-1) onion routers
  229. (R_1...R_N-1) to constitute the path, such that no router
  230. appears in the path twice.
  231. 3. If not already connected to the first router in the chain,
  232. open a new connection to that router.
  233. 4. Choose a circID not already in use on the connection with the
  234. first router in the chain; send a CREATE cell along the
  235. connection, to be received by the first onion router.
  236. 5. Wait until a CREATED cell is received; finish the handshake
  237. and extract the forward key Kf_1 and the backward key Kb_1.
  238. 6. For each subsequent onion router R (R_2 through R_N), extend
  239. the circuit to R.
  240. To extend the circuit by a single onion router R_M, the OP performs
  241. these steps:
  242. 1. Create an onion skin, encrypted to R_M's public key.
  243. 2. Send the onion skin in a relay EXTEND cell along
  244. the circuit (see section 5).
  245. 3. When a relay EXTENDED cell is received, verify KH, and
  246. calculate the shared keys. The circuit is now extended.
  247. When an onion router receives an EXTEND relay cell, it sends a CREATE
  248. cell to the next onion router, with the enclosed onion skin as its
  249. payload. The initiating onion router chooses some circID not yet
  250. used on the connection between the two onion routers. (But see
  251. section 4.1. above, concerning choosing circIDs based on
  252. lexicographic order of nicknames.)
  253. When an onion router receives a CREATE cell, if it already has a
  254. circuit on the given connection with the given circID, it drops the
  255. cell. Otherwise, after receiving the CREATE cell, it completes the
  256. DH handshake, and replies with a CREATED cell. Upon receiving a
  257. CREATED cell, an onion router packs it payload into an EXTENDED relay
  258. cell (see section 5), and sends that cell up the circuit. Upon
  259. receiving the EXTENDED relay cell, the OP can retrieve g^y.
  260. (As an optimization, OR implementations may delay processing onions
  261. until a break in traffic allows time to do so without harming
  262. network latency too greatly.)
  263. 4.4. Tearing down circuits
  264. Circuits are torn down when an unrecoverable error occurs along
  265. the circuit, or when all streams on a circuit are closed and the
  266. circuit's intended lifetime is over. Circuits may be torn down
  267. either completely or hop-by-hop.
  268. To tear down a circuit completely, an OR or OP sends a DESTROY
  269. cell to the adjacent nodes on that circuit, using the appropriate
  270. direction's circID.
  271. Upon receiving an outgoing DESTROY cell, an OR frees resources
  272. associated with the corresponding circuit. If it's not the end of
  273. the circuit, it sends a DESTROY cell for that circuit to the next OR
  274. in the circuit. If the node is the end of the circuit, then it tears
  275. down any associated edge connections (see section 5.1).
  276. After a DESTROY cell has been processed, an OR ignores all data or
  277. destroy cells for the corresponding circuit.
  278. (The rest of this section is not currently used; on errors, circuits
  279. are destroyed, not truncated.)
  280. To tear down part of a circuit, the OP may send a RELAY_TRUNCATE cell
  281. signaling a given OR (Stream ID zero). That OR sends a DESTROY
  282. cell to the next node in the circuit, and replies to the OP with a
  283. RELAY_TRUNCATED cell.
  284. When an unrecoverable error occurs along one connection in a
  285. circuit, the nodes on either side of the connection should, if they
  286. are able, act as follows: the node closer to the OP should send a
  287. RELAY_TRUNCATED cell towards the OP; the node farther from the OP
  288. should send a DESTROY cell down the circuit.
  289. 4.5. Routing relay cells
  290. When an OR receives a RELAY cell, it checks the cell's circID and
  291. determines whether it has a corresponding circuit along that
  292. connection. If not, the OR drops the RELAY cell.
  293. Otherwise, if the OR is not at the OP edge of the circuit (that is,
  294. either an 'exit node' or a non-edge node), it de/encrypts the payload
  295. with AES/CTR, as follows:
  296. 'Forward' relay cell (same direction as CREATE):
  297. Use Kf as key; decrypt.
  298. 'Back' relay cell (opposite direction from CREATE):
  299. Use Kb as key; encrypt.
  300. Note that in counter mode, decrypt and encrypt are the same operation.
  301. The OR then decides whether it recognizes the relay cell, by
  302. inspecting the payload as described in section 5.1 below. If the OR
  303. recognizes the cell, it processes the contents of the relay cell.
  304. Otherwise, it passes the decrypted relay cell along the circuit if
  305. the circuit continues. If the OR at the end of the circuit
  306. encounters an unrecognized relay cell, an error has occurred: the OR
  307. sends a DESTROY cell to tear down the circuit.
  308. When a relay cell arrives at an OP, the OP decrypts the payload
  309. with AES/CTR as follows:
  310. OP receives data cell:
  311. For I=N...1,
  312. Decrypt with Kb_I. If the payload is recognized (see
  313. section 5.1), then stop and process the payload.
  314. For more information, see section 5 below.
  315. 5. Application connections and stream management
  316. 5.1. Relay cells
  317. Within a circuit, the OP and the exit node use the contents of
  318. RELAY packets to tunnel end-to-end commands and TCP connections
  319. ("Streams") across circuits. End-to-end commands can be initiated
  320. by either edge; streams are initiated by the OP.
  321. The payload of each unencrypted RELAY cell consists of:
  322. Relay command [1 byte]
  323. 'Recognized' [2 bytes]
  324. StreamID [2 bytes]
  325. Digest [4 bytes]
  326. Length [2 bytes]
  327. Data [498 bytes]
  328. The relay commands are:
  329. 1 -- RELAY_BEGIN [forward]
  330. 2 -- RELAY_DATA [forward or backward]
  331. 3 -- RELAY_END [forward or backward]
  332. 4 -- RELAY_CONNECTED [backward]
  333. 5 -- RELAY_SENDME [forward or backward]
  334. 6 -- RELAY_EXTEND [forward]
  335. 7 -- RELAY_EXTENDED [backward]
  336. 8 -- RELAY_TRUNCATE [forward]
  337. 9 -- RELAY_TRUNCATED [backward]
  338. 10 -- RELAY_DROP [forward or backward]
  339. 11 -- RELAY_RESOLVE [forward]
  340. 12 -- RELAY_RESOLVED [backward]
  341. Commands labelled as "forward" must only be sent by the originator
  342. of the circuit. Commands labelled as "backward" must only be sent by
  343. other nodes in the circuit back to the originator. Commands marked
  344. as either can be sent either by the originator or other nodes.
  345. The 'recognized' field in any unencrypted relay payload is always set
  346. to zero; the 'digest' field is computed as the first four bytes of
  347. the running SHA-1 digest of all the bytes that have been destined for
  348. this hop of the circuit or originated from this hop of the circuit,
  349. seeded from Df or Db respectively (obtained in section 4.2 above),
  350. and including this RELAY cell's entire payload (taken with the digest
  351. field set to zero).
  352. When the 'recognized' field of a RELAY cell is zero, and the digest
  353. is correct, the cell is considered "recognized" for the purposes of
  354. decryption (see section 4.5 above).
  355. (The digest does not include any bytes from relay cells that do
  356. not start or end at this hop of the circuit. That is, it does not
  357. include forwarded data. Therefore if 'recognized' is zero but the
  358. digest does not match, the running digest at that node should
  359. not be updated, and the cell should be forwarded on.)
  360. All RELAY cells pertaining to the same tunneled stream have the
  361. same stream ID. StreamIDs are chosen arbitrarily by the OP. RELAY
  362. cells that affect the entire circuit rather than a particular
  363. stream use a StreamID of zero.
  364. The 'Length' field of a relay cell contains the number of bytes in
  365. the relay payload which contain real payload data. The remainder of
  366. the payload is padded with NUL bytes.
  367. If the RELAY cell is recognized but the relay command is not
  368. understood, the cell must be dropped and ignored. Its contents
  369. still count with respect to the digests, though. [Up until
  370. 0.1.1.10, Tor closed circuits when it received an unknown relay
  371. command. Perhaps this will be more forward-compatible. -RD]
  372. 5.2. Opening streams and transferring data
  373. To open a new anonymized TCP connection, the OP chooses an open
  374. circuit to an exit that may be able to connect to the destination
  375. address, selects an arbitrary StreamID not yet used on that circuit,
  376. and constructs a RELAY_BEGIN cell with a payload encoding the address
  377. and port of the destination host. The payload format is:
  378. ADDRESS | ':' | PORT | [00]
  379. where ADDRESS can be a DNS hostname, or an IPv4 address in
  380. dotted-quad format, or an IPv6 address surrounded by square brackets;
  381. and where PORT is encoded in decimal.
  382. [What is the [00] for? -NM]
  383. [It's so the payload is easy to parse out with string funcs -RD]
  384. Upon receiving this cell, the exit node resolves the address as
  385. necessary, and opens a new TCP connection to the target port. If the
  386. address cannot be resolved, or a connection can't be established, the
  387. exit node replies with a RELAY_END cell. (See 5.4 below.)
  388. Otherwise, the exit node replies with a RELAY_CONNECTED cell, whose
  389. payload is in one of the following formats:
  390. The IPv4 address to which the connection was made [4 octets]
  391. A number of seconds (TTL) for which the address may be cached [4 octets]
  392. or
  393. Four zero-valued octets [4 octets]
  394. An address type (6) [1 octet]
  395. The IPv6 address to which the connection was made [16 octets]
  396. A number of seconds (TTL) for which the address may be cached [4 octets]
  397. [XXXX Versions of Tor before 0.1.1.6 ignore and do not generate the TTL
  398. field. No version of Tor currently generates the IPv6 format.]
  399. The OP waits for a RELAY_CONNECTED cell before sending any data.
  400. Once a connection has been established, the OP and exit node
  401. package stream data in RELAY_DATA cells, and upon receiving such
  402. cells, echo their contents to the corresponding TCP stream.
  403. RELAY_DATA cells sent to unrecognized streams are dropped.
  404. Relay RELAY_DROP cells are long-range dummies; upon receiving such
  405. a cell, the OR or OP must drop it.
  406. 5.3. Closing streams
  407. When an anonymized TCP connection is closed, or an edge node
  408. encounters error on any stream, it sends a 'RELAY_END' cell along the
  409. circuit (if possible) and closes the TCP connection immediately. If
  410. an edge node receives a 'RELAY_END' cell for any stream, it closes
  411. the TCP connection completely, and sends nothing more along the
  412. circuit for that stream.
  413. The payload of a RELAY_END cell begins with a single 'reason' byte to
  414. describe why the stream is closing, plus optional data (depending on
  415. the reason.) The values are:
  416. 1 -- REASON_MISC (catch-all for unlisted reasons)
  417. 2 -- REASON_RESOLVEFAILED (couldn't look up hostname)
  418. 3 -- REASON_CONNECTREFUSED (remote host refused connection) [*]
  419. 4 -- REASON_EXITPOLICY (OR refuses to connect to host or port)
  420. 5 -- REASON_DESTROY (Circuit is being destroyed)
  421. 6 -- REASON_DONE (Anonymized TCP connection was closed)
  422. 7 -- REASON_TIMEOUT (Connection timed out, or OR timed out
  423. while connecting)
  424. 8 -- (unallocated) [**]
  425. 9 -- REASON_HIBERNATING (OR is temporarily hibernating)
  426. 10 -- REASON_INTERNAL (Internal error at the OR)
  427. 11 -- REASON_RESOURCELIMIT (OR has no resources to fulfill request)
  428. 12 -- REASON_CONNRESET (Connection was unexpectedly reset)
  429. 13 -- REASON_TORPROTOCOL (Sent when closing connection because of
  430. Tor protocol violations.)
  431. (With REASON_EXITPOLICY, the 4-byte IPv4 address or 16-byte IPv6 address
  432. forms the optional data; no other reason currently has extra data.
  433. As of 0.1.1.6, the body also contains a 4-byte TTL.)
  434. OPs and ORs MUST accept reasons not on the above list, since future
  435. versions of Tor may provide more fine-grained reasons.
  436. [*] Older versions of Tor also send this reason when connections are
  437. reset.
  438. [**] Due to a bug in versions of Tor through 0095, error reason 8 must
  439. remain allocated until that version is obsolete.
  440. --- [The rest of this section describes unimplemented functionality.]
  441. Because TCP connections can be half-open, we follow an equivalent
  442. to TCP's FIN/FIN-ACK/ACK protocol to close streams.
  443. An exit connection can have a TCP stream in one of three states:
  444. 'OPEN', 'DONE_PACKAGING', and 'DONE_DELIVERING'. For the purposes
  445. of modeling transitions, we treat 'CLOSED' as a fourth state,
  446. although connections in this state are not, in fact, tracked by the
  447. onion router.
  448. A stream begins in the 'OPEN' state. Upon receiving a 'FIN' from
  449. the corresponding TCP connection, the edge node sends a 'RELAY_FIN'
  450. cell along the circuit and changes its state to 'DONE_PACKAGING'.
  451. Upon receiving a 'RELAY_FIN' cell, an edge node sends a 'FIN' to
  452. the corresponding TCP connection (e.g., by calling
  453. shutdown(SHUT_WR)) and changing its state to 'DONE_DELIVERING'.
  454. When a stream in already in 'DONE_DELIVERING' receives a 'FIN', it
  455. also sends a 'RELAY_FIN' along the circuit, and changes its state
  456. to 'CLOSED'. When a stream already in 'DONE_PACKAGING' receives a
  457. 'RELAY_FIN' cell, it sends a 'FIN' and changes its state to
  458. 'CLOSED'.
  459. If an edge node encounters an error on any stream, it sends a
  460. 'RELAY_END' cell (if possible) and closes the stream immediately.
  461. 5.4. Remote hostname lookup
  462. To find the address associated with a hostname, the OP sends a
  463. RELAY_RESOLVE cell containing the hostname to be resolved. (For a reverse
  464. lookup, the OP sends a RELAY_RESOLVE cell containing an in-addr.arpa
  465. address.) The OR replies with a RELAY_RESOLVED cell containing a status
  466. byte, and any number of answers. Each answer is of the form:
  467. Type (1 octet)
  468. Length (1 octet)
  469. Value (variable-width)
  470. TTL (4 octets)
  471. "Length" is the length of the Value field.
  472. "Type" is one of:
  473. 0x00 -- Hostname
  474. 0x04 -- IPv4 address
  475. 0x06 -- IPv6 address
  476. 0xF0 -- Error, transient
  477. 0xF1 -- Error, nontransient
  478. If any answer has a type of 'Error', then no other answer may be given.
  479. The RELAY_RESOLVE cell must use a nonzero, distinct streamID; the
  480. corresponding RELAY_RESOLVED cell must use the same streamID. No stream
  481. is actually created by the OR when resolving the name.
  482. 6. Flow control
  483. 6.1. Link throttling
  484. Each node should do appropriate bandwidth throttling to keep its
  485. user happy.
  486. Communicants rely on TCP's default flow control to push back when they
  487. stop reading.
  488. 6.2. Link padding
  489. Currently nodes are not required to do any sort of link padding or
  490. dummy traffic. Because strong attacks exist even with link padding,
  491. and because link padding greatly increases the bandwidth requirements
  492. for running a node, we plan to leave out link padding until this
  493. tradeoff is better understood.
  494. 6.3. Circuit-level flow control
  495. To control a circuit's bandwidth usage, each OR keeps track of
  496. two 'windows', consisting of how many RELAY_DATA cells it is
  497. allowed to package for transmission, and how many RELAY_DATA cells
  498. it is willing to deliver to streams outside the network.
  499. Each 'window' value is initially set to 1000 data cells
  500. in each direction (cells that are not data cells do not affect
  501. the window). When an OR is willing to deliver more cells, it sends a
  502. RELAY_SENDME cell towards the OP, with Stream ID zero. When an OR
  503. receives a RELAY_SENDME cell with stream ID zero, it increments its
  504. packaging window.
  505. Each of these cells increments the corresponding window by 100.
  506. The OP behaves identically, except that it must track a packaging
  507. window and a delivery window for every OR in the circuit.
  508. An OR or OP sends cells to increment its delivery window when the
  509. corresponding window value falls under some threshold (900).
  510. If a packaging window reaches 0, the OR or OP stops reading from
  511. TCP connections for all streams on the corresponding circuit, and
  512. sends no more RELAY_DATA cells until receiving a RELAY_SENDME cell.
  513. [this stuff is badly worded; copy in the tor-design section -RD]
  514. 6.4. Stream-level flow control
  515. Edge nodes use RELAY_SENDME cells to implement end-to-end flow
  516. control for individual connections across circuits. Similarly to
  517. circuit-level flow control, edge nodes begin with a window of cells
  518. (500) per stream, and increment the window by a fixed value (50)
  519. upon receiving a RELAY_SENDME cell. Edge nodes initiate RELAY_SENDME
  520. cells when both a) the window is <= 450, and b) there are less than
  521. ten cell payloads remaining to be flushed at that edge.
  522. 7. Directories and routers
  523. 7.1. Extensible information format
  524. Router descriptors and directories both obey the following lightweight
  525. extensible information format.
  526. The highest level object is a Document, which consists of one or more Items.
  527. Every Item begins with a KeywordLine, followed by one or more Objects. A
  528. KeywordLine begins with a Keyword, optionally followed by whitespace and more
  529. non-newline characters, and ends with a newline. A Keyword is a sequence of
  530. one or more characters in the set [A-Za-z0-9-]. An Object is a block of
  531. encoded data in pseudo-Open-PGP-style armor. (cf. RFC 2440)
  532. More formally:
  533. Document ::= (Item | NL)+
  534. Item ::= KeywordLine Object*
  535. KeywordLine ::= Keyword NL | Keyword WS ArgumentsChar+ NL
  536. Keyword = KeywordChar+
  537. KeywordChar ::= 'A' ... 'Z' | 'a' ... 'z' | '0' ... '9' | '-'
  538. ArgumentChar ::= any printing ASCII character except NL.
  539. WS = (SP | TAB)+
  540. Object ::= BeginLine Base-64-encoded-data EndLine
  541. BeginLine ::= "-----BEGIN " Keyword "-----" NL
  542. EndLine ::= "-----END " Keyword "-----" NL
  543. The BeginLine and EndLine of an Object must use the same keyword.
  544. When interpreting a Document, software MUST reject any document containing a
  545. KeywordLine that starts with a keyword it doesn't recognize.
  546. The "opt" keyword is reserved for non-critical future extensions. All
  547. implementations MUST ignore any item of the form "opt keyword ....." when
  548. they would not recognize "keyword ....."; and MUST treat "opt keyword ....."
  549. as synonymous with "keyword ......" when keyword is recognized.
  550. 7.2. Router descriptor format.
  551. Every router descriptor MUST start with a "router" Item; MUST end with a
  552. "router-signature" Item and an extra NL; and MUST contain exactly one
  553. instance of each of the following Items: "published" "onion-key" "link-key"
  554. "signing-key" "bandwidth". Additionally, a router descriptor MAY contain any
  555. number of "accept", "reject", "fingerprint", "uptime", and "opt" Items.
  556. Other than "router" and "router-signature", the items may appear in any
  557. order.
  558. The items' formats are as follows:
  559. "router" nickname address ORPort SocksPort DirPort
  560. Indicates the beginning of a router descriptor. "address"
  561. must be an IPv4 address in dotted-quad format. The last
  562. three numbers indicate the TCP ports at which this OR exposes
  563. functionality. ORPort is a port at which this OR accepts TLS
  564. connections for the main OR protocol; SocksPort is deprecated and
  565. should always be 0; and DirPort is the port at which this OR accepts
  566. directory-related HTTP connections. If any port is not supported,
  567. the value 0 is given instead of a port number.
  568. "bandwidth" bandwidth-avg bandwidth-burst bandwidth-observed
  569. Estimated bandwidth for this router, in bytes per second. The
  570. "average" bandwidth is the volume per second that the OR is willing
  571. to sustain over long periods; the "burst" bandwidth is the volume
  572. that the OR is willing to sustain in very short intervals. The
  573. "observed" value is an estimate of the capacity this server can
  574. handle. The server remembers the max bandwidth sustained output
  575. over any ten second period in the past day, and another sustained
  576. input. The "observed" value is the lesser of these two numbers.
  577. "platform" string
  578. A human-readable string describing the system on which this OR is
  579. running. This MAY include the operating system, and SHOULD include
  580. the name and version of the software implementing the Tor protocol.
  581. "published" YYYY-MM-DD HH:MM:SS
  582. The time, in GMT, when this descriptor was generated.
  583. "fingerprint"
  584. A fingerprint (20 byte SHA1 hash of asn1 encoded public key, encoded
  585. in hex, with a single space after every 4 characters) for this router's
  586. identity key.
  587. [We didn't start parsing this line until Tor 0.1.0.6-rc; it should
  588. be marked with "opt" until earlier versions of Tor are obsolete.]
  589. "hibernating" 0|1
  590. If the value is 1, then the Tor server was hibernating when the
  591. descriptor was published, and shouldn't be used to build circuits.
  592. [We didn't start parsing this line until Tor 0.1.0.6-rc; it should
  593. be marked with "opt" until earlier versions of Tor are obsolete.]
  594. "uptime"
  595. The number of seconds that this OR process has been running.
  596. "onion-key" NL a public key in PEM format
  597. This key is used to encrypt EXTEND cells for this OR. The key MUST
  598. be accepted for at least XXXX hours after any new key is published in
  599. a subsequent descriptor.
  600. "signing-key" NL a public key in PEM format
  601. The OR's long-term identity key.
  602. "accept" exitpattern
  603. "reject" exitpattern
  604. These lines, in order, describe the rules that an OR follows when
  605. deciding whether to allow a new stream to a given address. The
  606. 'exitpattern' syntax is described below.
  607. "router-signature" NL Signature NL
  608. The "SIGNATURE" object contains a signature of the PKCS1-padded SHA1
  609. hash of the entire router descriptor, taken from the beginning of the
  610. "router" line, through the newline after the "router-signature" line.
  611. The router descriptor is invalid unless the signature is performed
  612. with the router's identity key.
  613. "contact" info NL
  614. Describes a way to contact the server's administrator, preferably
  615. including an email address and a PGP key fingerprint.
  616. "family" names NL
  617. 'Names' is a whitespace-separated list of server nicknames. If two ORs
  618. list one another in their "family" entries, then OPs should treat them
  619. as a single OR for the purpose of path selection.
  620. For example, if node A's descriptor contains "family B", and node B's
  621. descriptor contains "family A", then node A and node B should never
  622. be used on the same circuit.
  623. "read-history" YYYY-MM-DD HH:MM:SS (NSEC s) NUM,NUM,NUM,NUM,NUM... NL
  624. "write-history" YYYY-MM-DD HH:MM:SS (NSEC s) NUM,NUM,NUM,NUM,NUM... NL
  625. Declare how much bandwidth the OR has used recently. Usage is divided
  626. into intervals of NSEC seconds. The YYYY-MM-DD HH:MM:SS field defines
  627. the end of the most recent interval. The numbers are the number of
  628. bytes used in the most recent intervals, ordered from oldest to newest.
  629. [We didn't start parsing these lines until Tor 0.1.0.6-rc; they should
  630. be marked with "opt" until earlier versions of Tor are obsolete.]
  631. nickname ::= between 1 and 19 alphanumeric characters, case-insensitive.
  632. exitpattern ::= addrspec ":" portspec
  633. portspec ::= "*" | port | port "-" port
  634. port ::= an integer between 1 and 65535, inclusive.
  635. addrspec ::= "*" | ip4spec | ip6spec
  636. ipv4spec ::= ip4 | ip4 "/" num_ip4_bits | ip4 "/" ip4mask
  637. ip4 ::= an IPv4 address in dotted-quad format
  638. ip4mask ::= an IPv4 mask in dotted-quad format
  639. num_ip4_bits ::= an integer between 0 and 32
  640. ip6spec ::= ip6 | ip6 "/" num_ip6_bits
  641. ip6 ::= an IPv6 address, surrounded by square brackets.
  642. num_ip6_bits ::= an integer between 0 and 128
  643. Ports are required; if they are not included in the router
  644. line, they must appear in the "ports" lines.
  645. 7.3. Directory format
  646. A Directory begins with a "signed-directory" item, followed by one each of
  647. the following, in any order: "recommended-software", "published",
  648. "router-status", "dir-signing-key". It may include any number of "opt"
  649. items. After these items, a directory includes any number of router
  650. descriptors, and a single "directory-signature" item.
  651. "signed-directory"
  652. Indicates the start of a directory.
  653. "published" YYYY-MM-DD HH:MM:SS
  654. The time at which this directory was generated and signed, in GMT.
  655. "dir-signing-key"
  656. The key used to sign this directory; see "signing-key" for format.
  657. "recommended-software" comma-separated-version-list
  658. A list of which versions of which implementations are currently
  659. believed to be secure and compatible with the network.
  660. "running-routers" whitespace-separated-list
  661. A description of which routers are currently believed to be up or
  662. down. Every entry consists of an optional "!", followed by either an
  663. OR's nickname, or "$" followed by a hexadecimal encoding of the hash
  664. of an OR's identity key. If the "!" is included, the router is
  665. believed not to be running; otherwise, it is believed to be running.
  666. If a router's nickname is given, exactly one router of that nickname
  667. will appear in the directory, and that router is "approved" by the
  668. directory server. If a hashed identity key is given, that OR is not
  669. "approved". [XXXX The 'running-routers' line is only provided for
  670. backward compatibility. New code should parse 'router-status'
  671. instead.]
  672. "router-status" whitespace-separated-list
  673. A description of which routers are currently believed to be up or
  674. down, and which are verified or unverified. Contains one entry for
  675. every router that the directory server knows. Each entry is of the
  676. format:
  677. !name=$digest [Verified router, currently not live.]
  678. name=$digest [Verified router, currently live.]
  679. !$digest [Unverified router, currently not live.]
  680. or $digest [Unverified router, currently live.]
  681. (where 'name' is the router's nickname and 'digest' is a hexadecimal
  682. encoding of the hash of the routers' identity key).
  683. When parsing this line, clients should only mark a router as
  684. 'verified' if its nickname AND digest match the one provided.
  685. "directory-signature" nickname-of-dirserver NL Signature
  686. The signature is computed by computing the SHA-1 hash of the
  687. directory, from the characters "signed-directory", through the newline
  688. after "directory-signature". This digest is then padded with PKCS.1,
  689. and signed with the directory server's signing key.
  690. If software encounters an unrecognized keyword in a single router descriptor,
  691. it MUST reject only that router descriptor, and continue using the
  692. others. Because this mechanism is used to add 'critical' extensions to
  693. future versions of the router descriptor format, implementation should treat
  694. it as a normal occurrence and not, for example, report it to the user as an
  695. error. [Versions of Tor prior to 0.1.1 did this.]
  696. If software encounters an unrecognized keyword in the directory header,
  697. it SHOULD reject the entire directory.
  698. 7.4. Network-status descriptor
  699. A "network-status" (a.k.a "running-routers") document is a truncated
  700. directory that contains only the current status of a list of nodes, not
  701. their actual descriptors. It contains exactly one of each of the following
  702. entries.
  703. "network-status"
  704. Must appear first.
  705. "published" YYYY-MM-DD HH:MM:SS
  706. (see 7.3 above)
  707. "router-status" list
  708. (see 7.3 above)
  709. "directory-signature" NL signature
  710. (see 7.3 above)
  711. 7.5. Behavior of a directory server
  712. lists nodes that are connected currently
  713. speaks HTTP on a socket, spits out directory on request
  714. Directory servers listen on a certain port (the DirPort), and speak a
  715. limited version of HTTP 1.0. Clients send either GET or POST commands.
  716. The basic interactions are:
  717. "%s %s HTTP/1.0\r\nContent-Length: %lu\r\nHost: %s\r\n\r\n",
  718. command, url, content-length, host.
  719. Get "/tor/" to fetch a full directory.
  720. Get "/tor/dir.z" to fetch a compressed full directory.
  721. Get "/tor/running-routers" to fetch a network-status descriptor.
  722. Post "/tor/" to post a server descriptor, with the body of the
  723. request containing the descriptor.
  724. "host" is used to specify the address:port of the dirserver, so
  725. the request can survive going through HTTP proxies.
  726. A.1. Differences between spec and implementation
  727. - The current specification requires all ORs to have IPv4 addresses, but
  728. allows servers to exit and resolve to IPv6 addresses, and to declare IPv6
  729. addresses in their exit policies. The current codebase has no IPv6
  730. support at all.
  731. B. Things that should change in a later version of the Tor protocol
  732. B.1. ... but which will require backward-incompatible change
  733. - Circuit IDs should be longer.
  734. - IPv6 everywhere.
  735. - Maybe, keys should be longer.
  736. - Drop backward compatibility.
  737. - We should use a 128-bit subgroup of our DH prime.
  738. - Handshake should use HMAC.
  739. - Multiple cell lengths
  740. - Ability to split circuits across paths (If this is useful.)
  741. - SENDME windows should be dynamic.
  742. - Directory
  743. - Stop ever mentioning socks ports
  744. B.1. ... and that will require no changes
  745. - Mention multiple addr/port combos
  746. - Advertised outbound IP?
  747. - Migrate streams across circuits.
  748. B.2. ... and that we have no idea how to do.
  749. - UDP (as transport)
  750. - UDP (as content)
  751. - Use a better AES mode that has built-in integrity checking,
  752. doesn't grow with the number of hops, is not patented, and
  753. is implemented and maintained by smart people.