1

Tor Browser Bundle has "New Circuit for this Site" button (or Ctrl/Cmd + Shift + L shortcut), doing what it says: changing circuit for specific domain. screenshot of button and circuit changing The question is: how TBB do it? And how can I emulate\send such command, using control protocol? Preferably not only for custom domain, but also for custom SocksPort (which is maybe not possible, since TBB uses single 9050?).

Improve this question
2
  • I don't know if Tor Browser's behaviour is actually documented anywhere. But there are several ways to get new tor circuits. You may be interested in looking at the NEWNYM control port signal (or you can just send a SIGHUP to the tor process on Linux) and the SocksPort isolation flags in the tor man page (for example SOCKS connections with different usernames/passwords will use different circuits).
    – Steve
    Nov 7, 2020 at 21:41
  • @Steve, thanks. NYWNYM forces to use new circuits across all SocksPort's and all domains. TBB sends it on "Request new identity" button, not "New Circuit for this Site". It seems TBB (torbutton part of it) uses different socks connections for isolation purposes, I'll post more info on it in my answer soon. All the mechanisms are sort of documented in source files using code comments... (domain-isolator.js and torbutton.js)
    – verb0
    Nov 8, 2020 at 13:22

1 Answer 1

Reset to default
2

Short: it does not send a command. It creates new connection to SocksPort, using different credentials, and sends new requests to domain through it.

Details: Tor do isolates streams to different domains through different circuits. I don't know why exactly, but TBB tries to harden isolation by

// __tor.isolateCircuitsByDomain()__.
// For every HTTPChannel, replaces the default SOCKS proxy with one that authenticates
// to the SOCKS server (the tor client process) with a username (the first party domain)
// and a nonce password. Tor provides a separate circuit for each username+password
// combination.

So, to get a "New Circuit for this Site" all what's needed is generate some other credentials:

tor.newCircuitForDomain = function(domain) {
  // Re-generate the nonce for the domain.
  if (domain === "") {
    domain = "--unknown--";
  }
  tor.noncesForDomains[domain] = tor.nonce();
  logger.eclog(3, "New domain isolation for " + domain + ": " + tor.noncesForDomains[domain]);
};

...and reconnect with new login and password. IsolateSocksAuth is on by default, and you're getting new circuit for this domain. Tor allows to connect with any login and password, unless other is specified in config or arguments (Socks5ProxyUsername and Socks5ProxyPassword):

root@host:~# curl -x socks5h://random_login123:random_password123@localhost:9050 https://ifconfig.me
185.220.101.203
root@host:~# curl -x socks5h://random_login123:random_password124@localhost:9050 https://ifconfig.me
147.135.105.62
Improve this answer
2
  • I am new to Tor extensions and want to use newCircuitForDomain in extension js code under certain circumstances, if you know, please explain me how to use (domain-isolator.js and torbutton.js) in extension codes?
    – fedrbodr
    Feb 6, 2021 at 17:22
  • Regarding the other question that was asked in a comment, checkout my extension at gitlab.torproject.org/lansi90/google-captcha-bypass-extension, you can use it as a basis if you want to use the newCircuitForDomain function in a regular browser extension. It is public domain under CC0.
    – Light
    Aug 21, 2021 at 1:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .