0

Things I know: I have been using Tor for like a few years now, and I have a good idea of how "Tor/Onion routing" works. I have gone through the Tor's original paper (by Nick and Roger) and learned about relay cells and control cells and how Hidden services work with an OnionV3 pub key or how Onion TLD is, which have encoded info about introduction points and HSDir relays and used by Tor to go through a destination and I understand the layers of encryption to the actual application layer's payload and all those good stuff.

Things I have researched about: A few months ago I wanna know how HTTP servers work and finally figured out that the HTTP or other application payload is written in a certain format as per the RFC and send off using write() syscall like write(FD, HTTP_payload_in_certain_format, length) and I understood that filling in that text in certain format is pretty much most of these servers do (of course asides from actually processing the sent/recv data) and the response is also coming in a certain way which we can use to do some text processing to read the actual payload from a response (and I implemented a simple static HTTP server with C for better understanding).

Here is my question: But I have a general understanding of how these application servers like HTTP and such work, but with Tor, I don't really have an idea of how it routes the packet and how an overlay of network nodes like entry/middle/exit is actually formed and communicating data. I know that Tor uses 512 bytes packet size as control and relay cells and here is my understanding considering I'm sending HTTP packet through Tor.

+-------From a user----------------------------------+
|From: actual source IP                              |
|To: middle relay's IP                               |
|<Payload offset>                                    |
|<Actual encrypted data with middle relay's pub key  |
+----------------------------------------------------+
|From: entry node's IP                               |
|To: exit node's IP                                  |
|<payload offset>                                    |
|<Actual encrypted data with exit relay's pub key>   |
+----------------------------------------------------+
|From: middle node's IP                              |
|To: Clearnet server's IP                            |
|<payload offset>                                    |
|<HTTP Packet or any application packet like SSH etc>|
+----------------------------------------------------+

And now the Tor's exit node will establish a TCP connection with Clearnet sever and fill in this application packet and sendoff like:

+----------------To http://www.site.com from Exit node--+
|From: Exit node's IP                                   |
|To: Clearnet server's IP and Port 80                   |
|<HTTP Packet from the "actual source">                 |
+-------------------------------------------------------+

Now I actually don't understand is how can someone build something like the Tor's circuit and how the actual HTTP payload is routed through three relays (of course on my example I used 3).

Like I'm asking Does Tor fills in their 512 bytes cells into read() and write() syscall? Or how does it actually work and fit in? I'm asking practically how they work on the code level with all syscalls and filling the 512-byte cells onto the write() syscall and file descriptors and so on, I have an understanding of how they work (diagrams and stuff) and some crypto like RSA they use between the relays. (Please don't tell me to go and read the code, It's very huge for me and those replies are not helpful either). It would be really great if someone could explain in brief (better if you could provide code examples, much appreciated) how they actually fit in code level, syscalls, socket programming and such and how they fit in with Tor's overlay which is data transfer between UNIX processes through the internet and How the Hidden services on the Tor works and all those fit in.

1
  • If you want programming level questions answered and you aren't able to read the source code, my suggestion would be to ask the programmers directly. There are both mailing lists and IRC chats available where you can ask your questions. Sometimes the Tor developers help here, but not so much anymore. See torproject.org/contact and lists.torproject.org – JSEvans Aug 1 '20 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.