tor-spec.txt 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610
  1. sw$Id$
  2. Tor Spec
  3. Note: This is an attempt to specify Tor as it exists as implemented in
  4. early March, 2004. It is not recommended that others implement this
  5. design as it stands; future versions of Tor will implement improved
  6. protocols.
  7. This is not a design document; most design criteria are not examined. For
  8. more information on why Tor acts as it does, see tor-design.pdf.
  9. TODO: (very soon)
  10. - EXTEND cells should have hostnames or nicknames, so that OPs never
  11. resolve OR hostnames. Else DNS servers can give different answers to
  12. different OPs, and compromise their anonymity.
  13. - Alternatively, directories should include IPs.
  14. - REASON_CONNECTFAILED should include an IP.
  15. - Copy prose from tor-design to make everything more readable.
  16. 0. Notation:
  17. PK -- a public key.
  18. SK -- a private key
  19. K -- a key for a symmetric cypher
  20. a|b -- concatenation of 'a' and 'b'.
  21. [A0 B1 C2] -- a three-byte sequence, containing the bytes with
  22. hexadecimal values A0, B1, and C2, in that order.
  23. All numeric values are encoded in network (big-endian) order.
  24. Unless otherwise specified, all symmetric ciphers are AES in counter
  25. mode, with an IV of all 0 bytes. Asymmetric ciphers are either RSA
  26. with 1024-bit keys and exponents of 65537, or DH with the safe prime
  27. from rfc2409, section 6.2, whose hex representation is:
  28. "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E08"
  29. "8A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B"
  30. "302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9"
  31. "A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE6"
  32. "49286651ECE65381FFFFFFFFFFFFFFFF"
  33. 1. System overview
  34. Onion Routing is a distributed overlay network designed to anonymize
  35. low-latency TCP-based applications such as web browsing, secure shell,
  36. and instant messaging. Clients choose a path through the network and
  37. build a ``circuit'', in which each node (or ``onion router'' or ``OR'')
  38. in the path knows its predecessor and successor, but no other nodes in
  39. the circuit. Traffic flowing down the circuit is sent in fixed-size
  40. ``cells'', which are unwrapped by a symmetric key at each node (like
  41. the layers of an onion) and relayed downstream.
  42. 2. Connections
  43. There are two ways to connect to an onion router (OR). The first is
  44. as an onion proxy (OP), which allows the OP to authenticate the OR
  45. without authenticating itself. The second is as another OR, which
  46. allows mutual authentication.
  47. Tor uses TLS for link encryption. All implementations MUST support
  48. the TLS ciphersuite "TLS_EDH_RSA_WITH_DES_192_CBC3_SHA", and SHOULD
  49. support "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" if it is available.
  50. Implementations MAY support other ciphersuites, but MUST NOT
  51. support any suite without ephemeral keys, symmetric keys of at
  52. least 128 bits, and digests of at least 160 bits.
  53. An OR always sends a self-signed X.509 certificate whose commonName
  54. is the server's nickname, and whose public key is in the server
  55. directory.
  56. All parties receiving certificates must confirm that the public
  57. key is as it appears in the server directory, and close the
  58. connection if it is not.
  59. Once a TLS connection is established, the two sides send cells
  60. (specified below) to one another. Cells are sent serially. All
  61. cells are 512 bytes long. Cells may be sent embedded in TLS
  62. records of any size or divided across TLS records, but the framing
  63. of TLS records MUST NOT leak information about the type or contents
  64. of the cells.
  65. OR-to-OR connections are never deliberately closed. When an OR
  66. starts or receives a new directory, it tries to open new
  67. connections to any OR it is not already connected to.
  68. OR-to-OP connections are not permanent. An OP should close a
  69. connection to an OR if there are no circuits running over the
  70. connection, and an amount of time (KeepalivePeriod, defaults to 5
  71. minutes) has passed.
  72. 3. Cell Packet format
  73. The basic unit of communication for onion routers and onion
  74. proxies is a fixed-width "cell". Each cell contains the following
  75. fields:
  76. CircID [2 bytes]
  77. Command [1 byte]
  78. Payload (padded with 0 bytes) [509 bytes]
  79. [Total size: 512 bytes]
  80. The CircID field determines which circuit, if any, the cell is
  81. associated with.
  82. The 'Command' field holds one of the following values:
  83. 0 -- PADDING (Padding) (See Sec 6.2)
  84. 1 -- CREATE (Create a circuit) (See Sec 4)
  85. 2 -- CREATED (Acknowledge create) (See Sec 4)
  86. 3 -- RELAY (End-to-end data) (See Sec 5)
  87. 4 -- DESTROY (Stop using a circuit) (See Sec 4)
  88. The interpretation of 'Payload' depends on the type of the cell.
  89. PADDING: Payload is unused.
  90. CREATE: Payload contains the handshake challenge.
  91. CREATED: Payload contains the handshake response.
  92. RELAY: Payload contains the relay header and relay body.
  93. DESTROY: Payload is unused.
  94. Upon receiving any other value for the command field, an OR must
  95. drop the cell.
  96. The payload is padded with 0 bytes.
  97. PADDING cells are currently used to implement connection keepalive.
  98. ORs and OPs send one another a PADDING cell every few minutes.
  99. CREATE, CREATED, and DESTROY cells are used to manage circuits;
  100. see section 4 below.
  101. RELAY cells are used to send commands and data along a circuit; see
  102. section 5 below.
  103. 4. Circuit management
  104. 4.1. CREATE and CREATED cells
  105. Users set up circuits incrementally, one hop at a time. To create a
  106. new circuit, OPs send a CREATE cell to the first node, with the
  107. first half of the DH handshake; that node responds with a CREATED
  108. cell with the second half of the DH handshake plus the first 20 bytes
  109. of derivative key data (see section 4.2). To extend a circuit past
  110. the first hop, the OP sends an EXTEND relay cell (see section 5)
  111. which instructs the last node in the circuit to send a CREATE cell
  112. to extend the circuit.
  113. The payload for a CREATE cell is an 'onion skin', consisting of:
  114. RSA-encrypted data [128 bytes]
  115. Symmetrically-encrypted data [16 bytes]
  116. The RSA-encrypted portion contains:
  117. Symmetric key [16 bytes]
  118. First part of DH data (g^x) [112 bytes]
  119. The symmetrically encrypted portion contains:
  120. Second part of DH data (g^x) [16 bytes]
  121. The two parts of DH data, once decrypted and concatenated, form
  122. g^x as calculated by the client.
  123. The relay payload for an EXTEND relay cell consists of:
  124. Address [4 bytes]
  125. Port [2 bytes]
  126. Onion skin [144 bytes]
  127. The port and address field denote the IPV4 address and port of the
  128. next onion router in the circuit.
  129. The payload for a CREATED cell, or the relay payload for an
  130. EXTENDED cell, contains:
  131. DH data (g^y) [128 bytes]
  132. Derivative key data (KH) [20 bytes] <see 4.2 below>
  133. The CircID for a CREATE cell is an arbitrarily chosen 2-byte
  134. integer, selected by the node (OP or OR) that sends the CREATE
  135. cell. To prevent CircID collisions, when one OR sends a CREATE
  136. cell to another, it chooses from only one half of the possible
  137. values based on the ORs' nicknames: if the sending OR has a
  138. lexicographically earlier nickname, it chooses a CircID with a high
  139. bit of 0; otherwise, it chooses a CircID with a high bit of 1.
  140. 4.2. Setting circuit keys
  141. Once the handshake between the OP and an OR is completed, both
  142. servers can now calculate g^xy with ordinary DH. From the base key
  143. material g^xy, they compute derivative key material as follows.
  144. First, the server represents g^xy as a big-endian unsigned integer.
  145. Next, the server computes 60 bytes of key data as K = SHA1(g^xy |
  146. [00]) | SHA1(g^xy | [01]) | SHA1(g^xy | [02]) where "00" is a single
  147. octet whose value is zero, [01] is a single octet whose value is
  148. one, etc. The first 20 bytes of K form KH, the next 16 bytes of K
  149. form Kf, and the next 16 bytes of K form Kb.
  150. KH is used in the handshake response to demonstrate knowledge of the
  151. computed shared key. Kf is used to encrypt the stream of data going
  152. from the OP to the OR, and Kb is used to encrypt the stream of data
  153. going from the OR to the OP.
  154. 4.3. Creating circuits
  155. When creating a circuit through the network, the circuit creator
  156. (OP) performs the following steps:
  157. 1. Choose an onion router as an exit node (R_N), such that the onion
  158. router's exit policy does not exclude all pending streams
  159. that need a circuit.
  160. 2. Choose a chain of (N-1) chain of N onion routers
  161. (R_1...R_N-1) to constitute the path, such that no router
  162. appears in the path twice.
  163. 3. If not already connected to the first router in the chain,
  164. open a new connection to that router.
  165. 4. Choose a circID not already in use on the connection with the
  166. first router in the chain; send a CREATE cell along the
  167. connection, to be received by the first onion router.
  168. 5. Wait until a CREATED cell is received; finish the handshake
  169. and extract the forward key Kf_1 and the backward key Kb_1.
  170. 6. For each subsequent onion router R (R_2 through R_N), extend
  171. the circuit to R.
  172. To extend the circuit by a single onion router R_M, the OP performs
  173. these steps:
  174. 1. Create an onion skin, encrypting the RSA-encrypted part with
  175. R's public key.
  176. 2. Encrypt and send the onion skin in a relay EXTEND cell along
  177. the circuit (see section 5).
  178. 3. When a relay EXTENDED cell is received, verify KH, and
  179. calculate the shared keys. The circuit is now extended.
  180. When an onion router receives an EXTEND relay cell, it sends a CREATE
  181. cell to the next onion router, with the enclosed onion skin as its
  182. payload. The initiating onion router chooses some circID not yet
  183. used on the connection between the two onion routers. (But see
  184. section 4.1. above, concerning choosing circIDs based on
  185. lexicographic order of nicknames.)
  186. As an extension (called router twins), if the desired next onion
  187. router R in the circuit is down, and some other onion router R'
  188. has the same public keys as R, then it's ok to extend to R' rather than R.
  189. When an onion router receives a CREATE cell, if it already has a
  190. circuit on the given connection with the given circID, it drops the
  191. cell. Otherwise, after receiving the CREATE cell, it completes the
  192. DH handshake, and replies with a CREATED cell. Upon receiving a
  193. CREATED cell, an onion router packs it payload into an EXTENDED relay
  194. cell (see section 5), and sends that cell up the circuit. Upon
  195. receiving the EXTENDED relay cell, the OP can retrieve g^y.
  196. (As an optimization, OR implementations may delay processing onions
  197. until a break in traffic allows time to do so without harming
  198. network latency too greatly.)
  199. 4.4. Tearing down circuits
  200. Circuits are torn down when an unrecoverable error occurs along
  201. the circuit, or when all streams on a circuit are closed and the
  202. circuit's intended lifetime is over. Circuits may be torn down
  203. either completely or hop-by-hop.
  204. To tear down a circuit completely, an OR or OP sends a DESTROY
  205. cell to the adjacent nodes on that circuit, using the appropriate
  206. direction's circID.
  207. Upon receiving an outgoing DESTROY cell, an OR frees resources
  208. associated with the corresponding circuit. If it's not the end of
  209. the circuit, it sends a DESTROY cell for that circuit to the next OR
  210. in the circuit. If the node is the end of the circuit, then it tears
  211. down any associated edge connections (see section 5.1).
  212. After a DESTROY cell has been processed, an OR ignores all data or
  213. destroy cells for the corresponding circuit.
  214. (The rest of this section is not currently used; on errors, circuits
  215. are destroyed, not truncated.)
  216. To tear down part of a circuit, the OP may send a RELAY_TRUNCATE cell
  217. signaling a given OR (Stream ID zero). That OR sends a DESTROY
  218. cell to the next node in the circuit, and replies to the OP with a
  219. RELAY_TRUNCATED cell.
  220. When an unrecoverable error occurs along one connection in a
  221. circuit, the nodes on either side of the connection should, if they
  222. are able, act as follows: the node closer to the OP should send a
  223. RELAY_TRUNCATED cell towards the OP; the node farther from the OP
  224. should send a DESTROY cell down the circuit.
  225. 4.5. Routing relay cells
  226. When an OR receives a RELAY cell, it checks the cell's circID and
  227. determines whether it has a corresponding circuit along that
  228. connection. If not, the OR drops the RELAY cell.
  229. Otherwise, if the OR is not at the OP edge of the circuit (that is,
  230. either an 'exit node' or a non-edge node), it de/encrypts the payload
  231. with AES/CTR, as follows:
  232. 'Forward' relay cell (same direction as CREATE):
  233. Use Kf as key; encrypt.
  234. 'Back' relay cell (opposite direction from CREATE):
  235. Use Kb as key; decrypt.
  236. The OR then decides whether it recognizes the relay cell, by
  237. inspecting the payload as described in section 5.1 below. If the OR
  238. recognizes the cell, it processes the contents of the relay cell.
  239. Otherwise, it passes the decrypted relay cell along the circuit if
  240. the circuit continues. If the OR at the end of the circuit
  241. encounters an unrecognized relay cell, an error has occurred: the OR
  242. sends a DESTROY cell to tear down the circuit.
  243. When a relay cell arrives at an OP, it the OP encrypts the length and
  244. payload fields with AES/CTR as follows:
  245. OP receives data cell:
  246. For I=N...1,
  247. Encrypt with Kb_I. If the payload is recognized (see
  248. section 5.1), then stop and process the payload.
  249. For more information, see section 5 below.
  250. 5. Application connections and stream management
  251. 5.1. Relay cells
  252. Within a circuit, the OP and the exit node use the contents of
  253. RELAY packets to tunnel end-to-end commands and TCP connections
  254. ("Streams") across circuits. End-to-end commands can be initiated
  255. by either edge; streams are initiated by the OP.
  256. The payload of each unencrypted RELAY cell consists of:
  257. Relay command [1 byte]
  258. 'Recognized' [2 bytes]
  259. StreamID [2 bytes]
  260. Digest [4 bytes]
  261. Length [2 bytes]
  262. Data [498 bytes]
  263. The relay commands are:
  264. 1 -- RELAY_BEGIN
  265. 2 -- RELAY_DATA
  266. 3 -- RELAY_END
  267. 4 -- RELAY_CONNECTED
  268. 5 -- RELAY_SENDME
  269. 6 -- RELAY_EXTEND
  270. 7 -- RELAY_EXTENDED
  271. 8 -- RELAY_TRUNCATE
  272. 9 -- RELAY_TRUNCATED
  273. 10 -- RELAY_DROP
  274. The 'Recognized' field in any unencrypted relay payload is always set
  275. to zero; the 'digest' field is computed as the first four bytes of a
  276. SHA-1 digest of the rest of the RELAY cell's payload, taken with the
  277. digest field set to zero.
  278. When the 'recognized' field of a RELAY cell is zero, and the digest
  279. is correct, the cell is considered "recognized" for the purposes of
  280. decryption (see section 4.5 above).
  281. All RELAY cells pertaining to the same tunneled stream have the
  282. same stream ID. StreamIDs are chosen randomly by the OP. RELAY
  283. cells that affect the entire circuit rather than a particular
  284. stream use a StreamID of zero.
  285. The 'Length' field of a relay cell contains the number of bytes in
  286. the relay payload which contain real payload data. The remainder of
  287. the payload is padded with random bytes.
  288. 5.2. Opening streams and transferring data
  289. To open a new anonymized TCP connection, the OP chooses an open
  290. circuit to an exit that may be able to connect to the destination
  291. address, selects an arbitrary StreamID not yet used on that circuit,
  292. and constructs a RELAY_BEGIN cell with a payload encoding the address
  293. and port of the destination host. The payload format is:
  294. ADDRESS | ':' | PORT | [00]
  295. where ADDRESS is be a DNS hostname, or an IPv4 address in
  296. dotted-quad format; and where PORT is encoded in decimal.
  297. [What is the [00] for? -NM]
  298. Upon receiving this cell, the exit node resolves the address as
  299. necessary, and opens a new TCP connection to the target port. If the
  300. address cannot be resolved, or a connection can't be established, the
  301. exit node replies with a RELAY_END cell. (See 5.4 below.)
  302. Otherwise, the exit node replies with a RELAY_CONNECTED cell, whose
  303. payload is the 4-byte IP address to which the connection was made.
  304. The OP waits for a RELAY_CONNECTED cell before sending any data.
  305. Once a connection has been established, the OP and exit node
  306. package stream data in RELAY_DATA cells, and upon receiving such
  307. cells, echo their contents to the corresponding TCP stream.
  308. RELAY_DATA cells sent to unrecognized streams are dropped.
  309. Relay RELAY_DROP cells are long-range dummies; upon receiving such
  310. a cell, the OR or OP must drop it.
  311. 5.3. Closing streams
  312. When an anonymized TCP connection is closed, or an edge node
  313. encounters error on any stream, it sends a 'RELAY_END' cell along the
  314. circuit (if possible) and closes the TCP connection immediately. If
  315. an edge node receives a 'RELAY_END' cell for any stream, it closes
  316. the TCP connection completely, and sends nothing more along the
  317. circuit for that stream.
  318. The payload of a RELAY_END cell begins with a single 'reason' byte to
  319. describe why the stream is closing, plus optional data (depending on
  320. the reason.) The values are:
  321. 1 -- REASON_MISC (catch-all for unlisted reasons)
  322. 2 -- REASON_RESOLVEFAILED (couldn't look up hostname)
  323. 3 -- REASON_CONNECTFAILED (couldn't connect to host/port)
  324. 4 -- REASON_EXITPOLICY (OR refuses to connect to host or port)
  325. 5 -- REASON_DESTROY (circuit is being destroyed [???-NM])
  326. 6 -- REASON_DONE (anonymized TCP connection was closed)
  327. 7 -- REASON_TIMEOUT (OR timed out while connecting [???-NM])
  328. (With REASON_EXITPOLICY, the 4-byte IP address forms the optional
  329. data; no other reason currently has extra data.)
  330. *** [The rest of this section describes unimplemented functionality.]
  331. Because TCP connections can be half-open, we follow an equivalent
  332. to TCP's FIN/FIN-ACK/ACK protocol to close streams.
  333. An exit connection can have a TCP stream in one of three states:
  334. 'OPEN', 'DONE_PACKAGING', and 'DONE_DELIVERING'. For the purposes
  335. of modeling transitions, we treat 'CLOSED' as a fourth state,
  336. although connections in this state are not, in fact, tracked by the
  337. onion router.
  338. A stream begins in the 'OPEN' state. Upon receiving a 'FIN' from
  339. the corresponding TCP connection, the edge node sends a 'RELAY_FIN'
  340. cell along the circuit and changes its state to 'DONE_PACKAGING'.
  341. Upon receiving a 'RELAY_FIN' cell, an edge node sends a 'FIN' to
  342. the corresponding TCP connection (e.g., by calling
  343. shutdown(SHUT_WR)) and changing its state to 'DONE_DELIVERING'.
  344. When a stream in already in 'DONE_DELIVERING' receives a 'FIN', it
  345. also sends a 'RELAY_FIN' along the circuit, and changes its state
  346. to 'CLOSED'. When a stream already in 'DONE_PACKAGING' receives a
  347. 'RELAY_FIN' cell, it sends a 'FIN' and changes its state to
  348. 'CLOSED'.
  349. If an edge node encounters an error on any stream, it sends a
  350. 'RELAY_END' cell (if possible) and closes the stream immediately.
  351. 6. Flow control
  352. 6.1. Link throttling
  353. Each node should do appropriate bandwidth throttling to keep its
  354. user happy.
  355. Communicants rely on TCP's default flow control to push back when they
  356. stop reading.
  357. 6.2. Link padding
  358. Currently nodes are not required to do any sort of link padding or
  359. dummy traffic. Because strong attacks exist even with link padding,
  360. and because link padding greatly increases the bandwidth requirements
  361. for running a node, we plan to leave out link padding until this
  362. tradeoff is better understood.
  363. 6.3. Circuit-level flow control
  364. To control a circuit's bandwidth usage, each OR keeps track of
  365. two 'windows', consisting of how many RELAY_DATA cells it is
  366. allowed to package for transmission, and how many RELAY_DATA cells
  367. it is willing to deliver to streams outside the network.
  368. Each 'window' value is initially set to 1000 data cells
  369. in each direction (cells that are not data cells do not affect
  370. the window). When an OR is willing to deliver more cells, it sends a
  371. RELAY_SENDME cell towards the OP, with Stream ID zero. When an OR
  372. receives a RELAY_SENDME cell with stream ID zero, it increments its
  373. packaging window.
  374. Each of these cells increments the corresponding window by 100.
  375. The OP behaves identically, except that it must track a packaging
  376. window and a delivery window for every OR in the circuit.
  377. An OR or OP sends cells to increment its delivery window when the
  378. corresponding window value falls under some threshold (900).
  379. If a packaging window reaches 0, the OR or OP stops reading from
  380. TCP connections for all streams on the corresponding circuit, and
  381. sends no more RELAY_DATA cells until receiving a RELAY_SENDME cell.
  382. [this stuff is badly worded; copy in the tor-design section -RD]
  383. 6.4. Stream-level flow control
  384. Edge nodes use RELAY_SENDME cells to implement end-to-end flow
  385. control for individual connections across circuits. Similarly to
  386. circuit-level flow control, edge nodes begin with a window of cells
  387. (500) per stream, and increment the window by a fixed value (50)
  388. upon receiving a RELAY_SENDME cell. Edge nodes initiate RELAY_SENDME
  389. cells when both a) the window is <= 450, and b) there are less than
  390. ten cell payloads remaining to be flushed at that edge.
  391. 7. Directories and routers
  392. 7.1. Extensible information format
  393. Router descriptors and directories both obey the following lightweight
  394. extensible information format.
  395. The highest level object is a Document, which consists of one or more Items.
  396. Every Item begins with a KeywordLine, followed by one or more Objects. A
  397. KeywordLine begins with a Keyword, optionally followed by a space and more
  398. non-newline characters, and ends with a newline. A Keyword is a sequence of
  399. one or more characters in the set [A-Za-z0-9-]. An Object is a block of
  400. encoded data in pseudo-Open-PGP-style armor. (cf. RFC 2440)
  401. More formally:
  402. Document ::= (Item | NL)+
  403. Item ::= KeywordLine Object*
  404. KeywordLine ::= Keyword NL | Keyword SP ArgumentsChar+ NL
  405. Keyword = KeywordChar+
  406. KeywordChar ::= 'A' ... 'Z' | 'a' ... 'z' | '0' ... '9' | '-'
  407. ArgumentChar ::= any printing ASCII character except NL.
  408. Object ::= BeginLine Base-64-encoded-data EndLine
  409. BeginLine ::= "-----BEGIN " Keyword "-----" NL
  410. EndLine ::= "-----END " Keyword "-----" NL
  411. The BeginLine and EndLine of an Object must use the same keyword.
  412. When interpreting a Document, software MUST reject any document containing a
  413. KeywordLine that starts with a keyword it doesn't recognize.
  414. 7.1. Router descriptor format.
  415. Every router descriptor MUST start with a "router" Item; MUST end with a
  416. "router-signature" Item and an extra NL; and MUST contain exactly one
  417. instance of each of the following Items: "published" "onion-key" "link-key"
  418. "signing-key". Additionally, a router descriptor MAY contain any number of
  419. "accept", "reject", and "opt" Items.
  420. The items' formats are as follows:
  421. "router" nickname address (ORPort SocksPort DirPort bandwidth)?
  422. "ports" ORPort SocksPort DirPort
  423. "bandwidth" bandwidth
  424. "platform" string
  425. "published" YYYY-MM-DD HH:MM:SS
  426. "onion-key" NL a public key in PEM format
  427. "link-key" NL a public key in PEM format
  428. "signing-key" NL a public key in PEM format
  429. "accept" string
  430. "reject" string
  431. "router-signature" NL "-----BEGIN SIGNATURE-----" NL Signature NL
  432. "-----END SIGNATURE-----"
  433. "opt" SP keyword string? NL,Object?
  434. ORport ::= port where the router listens for routers/proxies (speaking cells)
  435. SocksPort ::= where the router listens for applications (speaking socks)
  436. DirPort ::= where the router listens for directory download requests
  437. bandwidth ::= maximum bandwidth, in bytes/s
  438. nickname ::= between 1 and 32 alphanumeric characters. case-insensitive.
  439. Bandwidth and ports are required; if they are not included in the router
  440. line, they must appear in "bandwidth" and "ports" lines.
  441. "opt" is reserved for non-critical future extensions.
  442. 7.2. Directory format
  443. A Directory begins with a "signed-directory" item, followed by one each of
  444. the following, in any order: "recommended-software". It may include any
  445. number of "opt" items. After these items, a directory includes any number
  446. of router descriptors, and a singer "directory-signature" item.
  447. "signed-directory"
  448. "recommended-software" comma-separated-version-list
  449. "directory-signature" NL Signature
  450. Note: The router descriptor for the directory server must appear first.
  451. The signature is computed by computing the SHA-1 hash of the
  452. directory, from the characters "signed-directory", through the newline
  453. after "directory-signature". This digest is then padded with PKCS.1,
  454. and signed with the directory server's signing key.
  455. If software encounters an unrecognized keyword in a single router descriptor,
  456. it should reject only that router descriptor, and continue using the
  457. others. If it encounters an unrecognized keyword in the directory header,
  458. it should reject the entire directory.
  459. 7.3. Behavior of a directory server
  460. lists nodes that are connected currently
  461. speaks http on a socket, spits out directory on request
  462. -----------
  463. (for emacs)
  464. Local Variables:
  465. mode:text
  466. indent-tabs-mode:nil
  467. fill-column:77
  468. End: