tor-spec.txt 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658
  1. $Id$
  2. Tor Spec
  3. Note: This is an attempt to specify Tor as it exists as implemented in
  4. early March, 2004. It is not recommended that others implement this
  5. design as it stands; future versions of Tor will implement improved
  6. protocols.
  7. This is not a design document; most design criteria are not examined. For
  8. more information on why Tor acts as it does, see tor-design.pdf.
  9. TODO: (very soon)
  10. - REASON_CONNECTFAILED should include an IP.
  11. - Copy prose from tor-design to make everything more readable.
  12. 0. Notation:
  13. PK -- a public key.
  14. SK -- a private key
  15. K -- a key for a symmetric cypher
  16. a|b -- concatenation of 'a' and 'b'.
  17. [A0 B1 C2] -- a three-byte sequence, containing the bytes with
  18. hexadecimal values A0, B1, and C2, in that order.
  19. All numeric values are encoded in network (big-endian) order.
  20. Unless otherwise specified, all symmetric ciphers are AES in counter
  21. mode, with an IV of all 0 bytes. Asymmetric ciphers are either RSA
  22. with 1024-bit keys and exponents of 65537, or DH with the safe prime
  23. from rfc2409, section 6.2, whose hex representation is:
  24. "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
  25. "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
  26. "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
  27. "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
  28. "49286651ECE65381FFFFFFFFFFFFFFFF"
  29. 1. System overview
  30. Onion Routing is a distributed overlay network designed to anonymize
  31. low-latency TCP-based applications such as web browsing, secure shell,
  32. and instant messaging. Clients choose a path through the network and
  33. build a ``circuit'', in which each node (or ``onion router'' or ``OR'')
  34. in the path knows its predecessor and successor, but no other nodes in
  35. the circuit. Traffic flowing down the circuit is sent in fixed-size
  36. ``cells'', which are unwrapped by a symmetric key at each node (like
  37. the layers of an onion) and relayed downstream.
  38. 2. Connections
  39. There are two ways to connect to an onion router (OR). The first is
  40. as an onion proxy (OP), which allows the OP to authenticate the OR
  41. without authenticating itself. The second is as another OR, which
  42. allows mutual authentication.
  43. Tor uses TLS for link encryption. All implementations MUST support
  44. the TLS ciphersuite "TLS_EDH_RSA_WITH_DES_192_CBC3_SHA", and SHOULD
  45. support "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" if it is available.
  46. Implementations MAY support other ciphersuites, but MUST NOT
  47. support any suite without ephemeral keys, symmetric keys of at
  48. least 128 bits, and digests of at least 160 bits.
  49. An OR always sends a two-certificate chain, consisting of a self-signed
  50. certificate containing the OR's identity key, and a second certificate
  51. using a short-term connection key. The commonName of the second
  52. certificate is the OR's nickname, and the commonName of the first
  53. certificate is the OR's nickname, followed by a space and the string
  54. "<identity>".
  55. All parties receiving certificates must confirm that the identity key is
  56. as expected. (When initiating a connection, the expected identity key is
  57. the one given in the directory; when creating a connection because of an
  58. EXTEND cell, the expected identity key is the one given in the cell.) If
  59. the key is not as expected, the party must close the connection.
  60. Once a TLS connection is established, the two sides send cells
  61. (specified below) to one another. Cells are sent serially. All
  62. cells are 512 bytes long. Cells may be sent embedded in TLS
  63. records of any size or divided across TLS records, but the framing
  64. of TLS records MUST NOT leak information about the type or contents
  65. of the cells.
  66. OR-to-OR connections are never deliberately closed. When an OR
  67. starts or receives a new directory, it tries to open new
  68. connections to any OR it is not already connected to.
  69. OR-to-OP connections are not permanent. An OP should close a
  70. connection to an OR if there are no circuits running over the
  71. connection, and an amount of time (KeepalivePeriod, defaults to 5
  72. minutes) has passed.
  73. 3. Cell Packet format
  74. The basic unit of communication for onion routers and onion
  75. proxies is a fixed-width "cell". Each cell contains the following
  76. fields:
  77. CircID [2 bytes]
  78. Command [1 byte]
  79. Payload (padded with 0 bytes) [509 bytes]
  80. [Total size: 512 bytes]
  81. The CircID field determines which circuit, if any, the cell is
  82. associated with.
  83. The 'Command' field holds one of the following values:
  84. 0 -- PADDING (Padding) (See Sec 6.2)
  85. 1 -- CREATE (Create a circuit) (See Sec 4)
  86. 2 -- CREATED (Acknowledge create) (See Sec 4)
  87. 3 -- RELAY (End-to-end data) (See Sec 5)
  88. 4 -- DESTROY (Stop using a circuit) (See Sec 4)
  89. The interpretation of 'Payload' depends on the type of the cell.
  90. PADDING: Payload is unused.
  91. CREATE: Payload contains the handshake challenge.
  92. CREATED: Payload contains the handshake response.
  93. RELAY: Payload contains the relay header and relay body.
  94. DESTROY: Payload is unused.
  95. Upon receiving any other value for the command field, an OR must
  96. drop the cell.
  97. The payload is padded with 0 bytes.
  98. PADDING cells are currently used to implement connection keepalive.
  99. If there is no other traffic, ORs and OPs send one another a PADDING
  100. cell every few minutes.
  101. CREATE, CREATED, and DESTROY cells are used to manage circuits;
  102. see section 4 below.
  103. RELAY cells are used to send commands and data along a circuit; see
  104. section 5 below.
  105. 4. Circuit management
  106. 4.1. CREATE and CREATED cells
  107. Users set up circuits incrementally, one hop at a time. To create a
  108. new circuit, OPs send a CREATE cell to the first node, with the
  109. first half of the DH handshake; that node responds with a CREATED
  110. cell with the second half of the DH handshake plus the first 20 bytes
  111. of derivative key data (see section 4.2). To extend a circuit past
  112. the first hop, the OP sends an EXTEND relay cell (see section 5)
  113. which instructs the last node in the circuit to send a CREATE cell
  114. to extend the circuit.
  115. The payload for a CREATE cell is an 'onion skin', which consists
  116. of the first step of the DH handshake data (also known as g^x).
  117. The data is encrypted to Bob's PK as follows: Suppose Bob's PK is
  118. L octets long. If the data to be encrypted is shorter than L-42,
  119. then it is encrypted directly (with OAEP padding). If the data is at
  120. least as long as L-42, then a randomly generated 16-byte symmetric
  121. key is prepended to the data, after which the first L-16-42 bytes
  122. of the data are encrypted with Bob's PK; and the rest of the data is
  123. encrypted with the symmetric key.
  124. So in this case, the onion skin on the wire looks like:
  125. RSA-encrypted:
  126. OAEP padding [42 bytes]
  127. Symmetric key [16 bytes]
  128. First part of g^x [70 bytes]
  129. Symmetrically encrypted:
  130. Second part of g^x [58 bytes]
  131. The relay payload for an EXTEND relay cell consists of:
  132. Address [4 bytes]
  133. Port [2 bytes]
  134. Onion skin [186 bytes]
  135. Public key hash [20 bytes]
  136. The port and address field denote the IPV4 address and port of the
  137. next onion router in the circuit; the public key hash is the SHA1 hash of
  138. the ASN1 encoding of the next onion router's identity key.
  139. [XXXX Before 0.0.8, EXTEND cells did not include the public key hash.
  140. Servers running 0.0.8 distinguish the old-style cells based on the
  141. length of payloads. (Servers running 0.0.7 blindly pass on the extend
  142. cell regardless of length.) In a future release, old-style EXTEND
  143. cells will not be supported.]
  144. The payload for a CREATED cell, or the relay payload for an
  145. EXTENDED cell, contains:
  146. DH data (g^y) [128 bytes]
  147. Derivative key data (KH) [20 bytes] <see 4.2 below>
  148. The CircID for a CREATE cell is an arbitrarily chosen 2-byte
  149. integer, selected by the node (OP or OR) that sends the CREATE
  150. cell. To prevent CircID collisions, when one OR sends a CREATE
  151. cell to another, it chooses from only one half of the possible
  152. values based on the ORs' nicknames: if the sending OR has a
  153. lexicographically earlier nickname, it chooses a CircID with a high
  154. bit of 0; otherwise, it chooses a CircID with a high bit of 1.
  155. 4.2. Setting circuit keys
  156. Once the handshake between the OP and an OR is completed, both
  157. servers can now calculate g^xy with ordinary DH. From the base key
  158. material g^xy, they compute derivative key material as follows.
  159. First, the server represents g^xy as a big-endian unsigned integer.
  160. Next, the server computes 100 bytes of key data as K = SHA1(g^xy |
  161. [00]) | SHA1(g^xy | [01]) | ... SHA1(g^xy | [04]) where "00" is
  162. a single octet whose value is zero, [01] is a single octet whose
  163. value is one, etc. The first 20 bytes of K form KH, bytes 21-40 form
  164. the forward digest Df, 41-60 form the backward digest Db, 61-76 form
  165. Kf, and 77-92 form Kb.
  166. KH is used in the handshake response to demonstrate knowledge of the
  167. computed shared key. Df is used to seed the integrity-checking hash
  168. for the stream of data going from the OP to the OR, and Db seeds the
  169. integrity-checking hash for the data stream from the OR to the OP. Kf
  170. is used to encrypt the stream of data going from the OP to the OR, and
  171. Kb is used to encrypt the stream of data going from the OR to the OP.
  172. 4.3. Creating circuits
  173. When creating a circuit through the network, the circuit creator
  174. (OP) performs the following steps:
  175. 1. Choose an onion router as an exit node (R_N), such that the onion
  176. router's exit policy does not exclude all pending streams
  177. that need a circuit.
  178. 2. Choose a chain of (N-1) chain of N onion routers
  179. (R_1...R_N-1) to constitute the path, such that no router
  180. appears in the path twice.
  181. 3. If not already connected to the first router in the chain,
  182. open a new connection to that router.
  183. 4. Choose a circID not already in use on the connection with the
  184. first router in the chain; send a CREATE cell along the
  185. connection, to be received by the first onion router.
  186. 5. Wait until a CREATED cell is received; finish the handshake
  187. and extract the forward key Kf_1 and the backward key Kb_1.
  188. 6. For each subsequent onion router R (R_2 through R_N), extend
  189. the circuit to R.
  190. To extend the circuit by a single onion router R_M, the OP performs
  191. these steps:
  192. 1. Create an onion skin, encrypted to R_M's public key.
  193. 2. Send the onion skin in a relay EXTEND cell along
  194. the circuit (see section 5).
  195. 3. When a relay EXTENDED cell is received, verify KH, and
  196. calculate the shared keys. The circuit is now extended.
  197. When an onion router receives an EXTEND relay cell, it sends a CREATE
  198. cell to the next onion router, with the enclosed onion skin as its
  199. payload. The initiating onion router chooses some circID not yet
  200. used on the connection between the two onion routers. (But see
  201. section 4.1. above, concerning choosing circIDs based on
  202. lexicographic order of nicknames.)
  203. As an extension (called router twins), if the desired next onion
  204. router R in the circuit is down, and some other onion router R'
  205. has the same public keys as R, then it's ok to extend to R' rather than R.
  206. When an onion router receives a CREATE cell, if it already has a
  207. circuit on the given connection with the given circID, it drops the
  208. cell. Otherwise, after receiving the CREATE cell, it completes the
  209. DH handshake, and replies with a CREATED cell. Upon receiving a
  210. CREATED cell, an onion router packs it payload into an EXTENDED relay
  211. cell (see section 5), and sends that cell up the circuit. Upon
  212. receiving the EXTENDED relay cell, the OP can retrieve g^y.
  213. (As an optimization, OR implementations may delay processing onions
  214. until a break in traffic allows time to do so without harming
  215. network latency too greatly.)
  216. 4.4. Tearing down circuits
  217. Circuits are torn down when an unrecoverable error occurs along
  218. the circuit, or when all streams on a circuit are closed and the
  219. circuit's intended lifetime is over. Circuits may be torn down
  220. either completely or hop-by-hop.
  221. To tear down a circuit completely, an OR or OP sends a DESTROY
  222. cell to the adjacent nodes on that circuit, using the appropriate
  223. direction's circID.
  224. Upon receiving an outgoing DESTROY cell, an OR frees resources
  225. associated with the corresponding circuit. If it's not the end of
  226. the circuit, it sends a DESTROY cell for that circuit to the next OR
  227. in the circuit. If the node is the end of the circuit, then it tears
  228. down any associated edge connections (see section 5.1).
  229. After a DESTROY cell has been processed, an OR ignores all data or
  230. destroy cells for the corresponding circuit.
  231. (The rest of this section is not currently used; on errors, circuits
  232. are destroyed, not truncated.)
  233. To tear down part of a circuit, the OP may send a RELAY_TRUNCATE cell
  234. signaling a given OR (Stream ID zero). That OR sends a DESTROY
  235. cell to the next node in the circuit, and replies to the OP with a
  236. RELAY_TRUNCATED cell.
  237. When an unrecoverable error occurs along one connection in a
  238. circuit, the nodes on either side of the connection should, if they
  239. are able, act as follows: the node closer to the OP should send a
  240. RELAY_TRUNCATED cell towards the OP; the node farther from the OP
  241. should send a DESTROY cell down the circuit.
  242. 4.5. Routing relay cells
  243. When an OR receives a RELAY cell, it checks the cell's circID and
  244. determines whether it has a corresponding circuit along that
  245. connection. If not, the OR drops the RELAY cell.
  246. Otherwise, if the OR is not at the OP edge of the circuit (that is,
  247. either an 'exit node' or a non-edge node), it de/encrypts the payload
  248. with AES/CTR, as follows:
  249. 'Forward' relay cell (same direction as CREATE):
  250. Use Kf as key; decrypt.
  251. 'Back' relay cell (opposite direction from CREATE):
  252. Use Kb as key; encrypt.
  253. The OR then decides whether it recognizes the relay cell, by
  254. inspecting the payload as described in section 5.1 below. If the OR
  255. recognizes the cell, it processes the contents of the relay cell.
  256. Otherwise, it passes the decrypted relay cell along the circuit if
  257. the circuit continues. If the OR at the end of the circuit
  258. encounters an unrecognized relay cell, an error has occurred: the OR
  259. sends a DESTROY cell to tear down the circuit.
  260. When a relay cell arrives at an OP, the OP decrypts the payload
  261. with AES/CTR as follows:
  262. OP receives data cell:
  263. For I=N...1,
  264. Decrypt with Kb_I. If the payload is recognized (see
  265. section 5.1), then stop and process the payload.
  266. For more information, see section 5 below.
  267. 5. Application connections and stream management
  268. 5.1. Relay cells
  269. Within a circuit, the OP and the exit node use the contents of
  270. RELAY packets to tunnel end-to-end commands and TCP connections
  271. ("Streams") across circuits. End-to-end commands can be initiated
  272. by either edge; streams are initiated by the OP.
  273. The payload of each unencrypted RELAY cell consists of:
  274. Relay command [1 byte]
  275. 'Recognized' [2 bytes]
  276. StreamID [2 bytes]
  277. Digest [4 bytes]
  278. Length [2 bytes]
  279. Data [498 bytes]
  280. The relay commands are:
  281. 1 -- RELAY_BEGIN
  282. 2 -- RELAY_DATA
  283. 3 -- RELAY_END
  284. 4 -- RELAY_CONNECTED
  285. 5 -- RELAY_SENDME
  286. 6 -- RELAY_EXTEND
  287. 7 -- RELAY_EXTENDED
  288. 8 -- RELAY_TRUNCATE
  289. 9 -- RELAY_TRUNCATED
  290. 10 -- RELAY_DROP
  291. 11 -- RELAY_RESOLVE
  292. 12 -- RELAY_RESOLVED
  293. The 'Recognized' field in any unencrypted relay payload is always
  294. set to zero; the 'digest' field is computed as the first four bytes
  295. of the running SHA-1 digest of all the bytes that have travelled
  296. over this circuit, seeded from Df or Db respectively (obtained in
  297. section 4.2 above), and including this RELAY cell's entire payload
  298. (taken with the digest field set to zero).
  299. When the 'recognized' field of a RELAY cell is zero, and the digest
  300. is correct, the cell is considered "recognized" for the purposes of
  301. decryption (see section 4.5 above).
  302. All RELAY cells pertaining to the same tunneled stream have the
  303. same stream ID. StreamIDs are chosen randomly by the OP. RELAY
  304. cells that affect the entire circuit rather than a particular
  305. stream use a StreamID of zero.
  306. The 'Length' field of a relay cell contains the number of bytes in
  307. the relay payload which contain real payload data. The remainder of
  308. the payload is padded with NUL bytes.
  309. 5.2. Opening streams and transferring data
  310. To open a new anonymized TCP connection, the OP chooses an open
  311. circuit to an exit that may be able to connect to the destination
  312. address, selects an arbitrary StreamID not yet used on that circuit,
  313. and constructs a RELAY_BEGIN cell with a payload encoding the address
  314. and port of the destination host. The payload format is:
  315. ADDRESS | ':' | PORT | [00]
  316. where ADDRESS is be a DNS hostname, or an IPv4 address in
  317. dotted-quad format; and where PORT is encoded in decimal.
  318. [What is the [00] for? -NM]
  319. [It's so the payload is easy to parse out with string funcs -RD]
  320. Upon receiving this cell, the exit node resolves the address as
  321. necessary, and opens a new TCP connection to the target port. If the
  322. address cannot be resolved, or a connection can't be established, the
  323. exit node replies with a RELAY_END cell. (See 5.4 below.)
  324. Otherwise, the exit node replies with a RELAY_CONNECTED cell, whose
  325. payload is the 4-byte IP address to which the connection was made.
  326. The OP waits for a RELAY_CONNECTED cell before sending any data.
  327. Once a connection has been established, the OP and exit node
  328. package stream data in RELAY_DATA cells, and upon receiving such
  329. cells, echo their contents to the corresponding TCP stream.
  330. RELAY_DATA cells sent to unrecognized streams are dropped.
  331. Relay RELAY_DROP cells are long-range dummies; upon receiving such
  332. a cell, the OR or OP must drop it.
  333. 5.3. Closing streams
  334. When an anonymized TCP connection is closed, or an edge node
  335. encounters error on any stream, it sends a 'RELAY_END' cell along the
  336. circuit (if possible) and closes the TCP connection immediately. If
  337. an edge node receives a 'RELAY_END' cell for any stream, it closes
  338. the TCP connection completely, and sends nothing more along the
  339. circuit for that stream.
  340. The payload of a RELAY_END cell begins with a single 'reason' byte to
  341. describe why the stream is closing, plus optional data (depending on
  342. the reason.) The values are:
  343. 1 -- REASON_MISC (catch-all for unlisted reasons)
  344. 2 -- REASON_RESOLVEFAILED (couldn't look up hostname)
  345. 3 -- REASON_CONNECTFAILED (couldn't connect to host/port)
  346. 4 -- REASON_EXITPOLICY (OR refuses to connect to host or port)
  347. 5 -- REASON_DESTROY (circuit is being destroyed [???-NM])
  348. 6 -- REASON_DONE (anonymized TCP connection was closed)
  349. 7 -- REASON_TIMEOUT (OR timed out while connecting [???-NM])
  350. (With REASON_EXITPOLICY, the 4-byte IP address forms the optional
  351. data; no other reason currently has extra data.)
  352. *** [The rest of this section describes unimplemented functionality.]
  353. Because TCP connections can be half-open, we follow an equivalent
  354. to TCP's FIN/FIN-ACK/ACK protocol to close streams.
  355. An exit connection can have a TCP stream in one of three states:
  356. 'OPEN', 'DONE_PACKAGING', and 'DONE_DELIVERING'. For the purposes
  357. of modeling transitions, we treat 'CLOSED' as a fourth state,
  358. although connections in this state are not, in fact, tracked by the
  359. onion router.
  360. A stream begins in the 'OPEN' state. Upon receiving a 'FIN' from
  361. the corresponding TCP connection, the edge node sends a 'RELAY_FIN'
  362. cell along the circuit and changes its state to 'DONE_PACKAGING'.
  363. Upon receiving a 'RELAY_FIN' cell, an edge node sends a 'FIN' to
  364. the corresponding TCP connection (e.g., by calling
  365. shutdown(SHUT_WR)) and changing its state to 'DONE_DELIVERING'.
  366. When a stream in already in 'DONE_DELIVERING' receives a 'FIN', it
  367. also sends a 'RELAY_FIN' along the circuit, and changes its state
  368. to 'CLOSED'. When a stream already in 'DONE_PACKAGING' receives a
  369. 'RELAY_FIN' cell, it sends a 'FIN' and changes its state to
  370. 'CLOSED'.
  371. If an edge node encounters an error on any stream, it sends a
  372. 'RELAY_END' cell (if possible) and closes the stream immediately.
  373. 5.4. Remote hostname lookup
  374. To find the address associated with a hostname, the OP sends a
  375. RELAY_RESOLVE cell containing the hostname to be resolved. The OR
  376. replies with a RELAY_RESOLVED cell containing a status byte, and any
  377. number of answers. Each answer is of the form:
  378. Type (1 octet)
  379. Length (1 octet)
  380. Value (variable-width)
  381. "Length" is the length of the Value field.
  382. "Type" is one of:
  383. 0x04 -- IPv4 address
  384. 0x06 -- IPv6 address
  385. 0xF0 -- Error, transient
  386. 0xF1 -- Error, nontransient
  387. If any answer has a type of 'Error', then no other answer may be given.
  388. The RELAY_RESOLVE cell must use a nonzero, distinct streamID; the
  389. corresponding RELAY_RESOLVED cell must use the same streamID. No stream
  390. is actually created by the OR when resolving the name.
  391. 6. Flow control
  392. 6.1. Link throttling
  393. Each node should do appropriate bandwidth throttling to keep its
  394. user happy.
  395. Communicants rely on TCP's default flow control to push back when they
  396. stop reading.
  397. 6.2. Link padding
  398. Currently nodes are not required to do any sort of link padding or
  399. dummy traffic. Because strong attacks exist even with link padding,
  400. and because link padding greatly increases the bandwidth requirements
  401. for running a node, we plan to leave out link padding until this
  402. tradeoff is better understood.
  403. 6.3. Circuit-level flow control
  404. To control a circuit's bandwidth usage, each OR keeps track of
  405. two 'windows', consisting of how many RELAY_DATA cells it is
  406. allowed to package for transmission, and how many RELAY_DATA cells
  407. it is willing to deliver to streams outside the network.
  408. Each 'window' value is initially set to 1000 data cells
  409. in each direction (cells that are not data cells do not affect
  410. the window). When an OR is willing to deliver more cells, it sends a
  411. RELAY_SENDME cell towards the OP, with Stream ID zero. When an OR
  412. receives a RELAY_SENDME cell with stream ID zero, it increments its
  413. packaging window.
  414. Each of these cells increments the corresponding window by 100.
  415. The OP behaves identically, except that it must track a packaging
  416. window and a delivery window for every OR in the circuit.
  417. An OR or OP sends cells to increment its delivery window when the
  418. corresponding window value falls under some threshold (900).
  419. If a packaging window reaches 0, the OR or OP stops reading from
  420. TCP connections for all streams on the corresponding circuit, and
  421. sends no more RELAY_DATA cells until receiving a RELAY_SENDME cell.
  422. [this stuff is badly worded; copy in the tor-design section -RD]
  423. 6.4. Stream-level flow control
  424. Edge nodes use RELAY_SENDME cells to implement end-to-end flow
  425. control for individual connections across circuits. Similarly to
  426. circuit-level flow control, edge nodes begin with a window of cells
  427. (500) per stream, and increment the window by a fixed value (50)
  428. upon receiving a RELAY_SENDME cell. Edge nodes initiate RELAY_SENDME
  429. cells when both a) the window is <= 450, and b) there are less than
  430. ten cell payloads remaining to be flushed at that edge.
  431. 7. Directories and routers
  432. 7.1. Extensible information format
  433. Router descriptors and directories both obey the following lightweight
  434. extensible information format.
  435. The highest level object is a Document, which consists of one or more Items.
  436. Every Item begins with a KeywordLine, followed by one or more Objects. A
  437. KeywordLine begins with a Keyword, optionally followed by a space and more
  438. non-newline characters, and ends with a newline. A Keyword is a sequence of
  439. one or more characters in the set [A-Za-z0-9-]. An Object is a block of
  440. encoded data in pseudo-Open-PGP-style armor. (cf. RFC 2440)
  441. More formally:
  442. Document ::= (Item | NL)+
  443. Item ::= KeywordLine Object*
  444. KeywordLine ::= Keyword NL | Keyword SP ArgumentsChar+ NL
  445. Keyword = KeywordChar+
  446. KeywordChar ::= 'A' ... 'Z' | 'a' ... 'z' | '0' ... '9' | '-'
  447. ArgumentChar ::= any printing ASCII character except NL.
  448. Object ::= BeginLine Base-64-encoded-data EndLine
  449. BeginLine ::= "-----BEGIN " Keyword "-----" NL
  450. EndLine ::= "-----END " Keyword "-----" NL
  451. The BeginLine and EndLine of an Object must use the same keyword.
  452. When interpreting a Document, software MUST reject any document containing a
  453. KeywordLine that starts with a keyword it doesn't recognize.
  454. 7.1. Router descriptor format.
  455. Every router descriptor MUST start with a "router" Item; MUST end with a
  456. "router-signature" Item and an extra NL; and MUST contain exactly one
  457. instance of each of the following Items: "published" "onion-key" "link-key"
  458. "signing-key". Additionally, a router descriptor MAY contain any number of
  459. "accept", "reject", and "opt" Items. Other than "router" and
  460. "router-signature", the items may appear in any order.
  461. The items' formats are as follows:
  462. "router" nickname address (ORPort SocksPort DirPort)?
  463. "ports" ORPort SocksPort DirPort
  464. "bandwidth" bandwidth-avg bandwidth-burst
  465. "platform" string
  466. "published" YYYY-MM-DD HH:MM:SS
  467. "onion-key" NL a public key in PEM format
  468. "signing-key" NL a public key in PEM format
  469. "accept" string
  470. "reject" string
  471. "router-signature" NL "-----BEGIN SIGNATURE-----" NL Signature NL
  472. "-----END SIGNATURE-----"
  473. "opt" SP keyword string? NL,Object?
  474. ORport ::= port where the router listens for routers/proxies (speaking cells)
  475. SocksPort ::= where the router listens for applications (speaking socks)
  476. DirPort ::= where the router listens for directory download requests
  477. bandwidth-avg ::= maximum average bandwidth, in bytes/s
  478. bandwidth-burst ::= maximum bandwidth spike, in bytes/s
  479. nickname ::= between 1 and 19 alphanumeric characters, case-insensitive.
  480. Bandwidth and ports are required; if they are not included in the router
  481. line, they must appear in "bandwidth" and "ports" lines.
  482. "opt" is reserved for non-critical future extensions.
  483. 7.2. Directory format
  484. A Directory begins with a "signed-directory" item, followed by one each of
  485. the following, in any order: "recommended-software", "published",
  486. "running-routers". It may include any number of "opt" items. After these
  487. items, a directory includes any number of router descriptors, and a single
  488. "directory-signature" item.
  489. "signed-directory"
  490. "published" YYYY-MM-DD HH:MM:SS
  491. "recommended-software" comma-separated-version-list
  492. "running-routers" comma-separated-nickname-list
  493. "directory-signature" nickname-of-dirserver NL Signature
  494. Note: The router descriptor for the directory server must appear first.
  495. The signature is computed by computing the SHA-1 hash of the
  496. directory, from the characters "signed-directory", through the newline
  497. after "directory-signature". This digest is then padded with PKCS.1,
  498. and signed with the directory server's signing key.
  499. If software encounters an unrecognized keyword in a single router descriptor,
  500. it should reject only that router descriptor, and continue using the
  501. others. If it encounters an unrecognized keyword in the directory header,
  502. it should reject the entire directory.
  503. 7.3. Behavior of a directory server
  504. lists nodes that are connected currently
  505. speaks http on a socket, spits out directory on request
  506. -----------
  507. (for emacs)
  508. Local Variables:
  509. mode:text
  510. indent-tabs-mode:nil
  511. fill-column:77
  512. End: