3

Relay setting in Vidalia has two options for relaying: "for the Tor network" and "inside the Tor network". The options enable relaying either just inside the Tor network or additionally out of the Tor network (exit).

How does the Tor relay recognize if the incoming/outgoing packets are going to leave the Tor network (exit)? Do non-exit packets have a special form different from the exit packets?

Improve this question

3 Answers 3

Reset to default
2

Here's a somewhat simplified description: When a relay receives an incoming packet, it first decrypts the outmost encryption layer of that packet to see what it's supposed to do with the packet. It finds a command, which can be, among other things, a) "send this still-encrypted packet along the circuit to the next relay" or b) "send this possibly-plain-text request to the following server". In case a the relay checks that the stated circuit exists and relays the packet. In case b the relay checks whether its own exit policy permits exiting to the server and then sends the request out to the server.

If you want to know all the details of the tor protocol, you might like the specification document: https://gitweb.torproject.org/torspec.git/blob/HEAD:/tor-spec.txt

Improve this answer
2
  • how it knows stated circuit exists ?(i mean how they know next destination is an exit node or a server ? it check Tor directory server to see if destination is listed as a relay or not ? how exactly vidalia know receiver of this packet is a Tor relay or a Server ? if vidalia don't know then abusers may use internal only relays for exit relaying... am i right ?
    – roby
    Commented Oct 11, 2013 at 8:23
  • The stated circuit exists in the example, because the relay extended it on behalf of the client sending the incoming packet. All tor clients and relays speak the OR protocol which specifies how to create and extend circuits. If the client asks the relay in the example to extend the circuit to a server that doesn't speak the OR protocol, that extension won't work and the circuit will fail. (Also note that Vidalia is just a user interface and that the tor process is responsible for all this.)
    – karsten
    Commented Oct 11, 2013 at 8:45
2

The routing used in the Tor network is called onion routing because the mechanism for maintaining anonymity in it is based on multiple layers of encryption which resemble layers of an onion.

Inside the Tor client it is hard-coded that the traffic will pass through three relays: entry node, middle node and exit node. There are multiple layers of encryption because the relays are allowed to know only the preceding node, and the following node so that the anonymity from end to end is maintained.

How is the communication routed?

Simplified description:

  1. The Tor client selects the routing path consisting of three relays, and encrypts each packet with three nested layers of encryption (one layer for each of the three relays).
  2. The client sends the three times encrypted packet to the entry node which removes the first layer.
  3. The twice encrypted packet continues to the next node which removes the second layer.
  4. Then the packet with the last layer of encryption continues to the exit node which removes the last layer of encryption. Inside of the packet the exit node checks a field indicating that it was the last layer and the clear-text content should be sent to the Internet.
  5. If the destination conforms the exit policy of the relay the clear-text packet leaves the exit node and is normally delivered in the Internet.

Briefly said: The Tor client decides which node will be the exit relay. The exit relay recognizes its role for a packet after decrypting the last layer of encryption. It checks ID of the Tor stream and a field which indicates that the last layer of encryption was removed. The exit relay must be configured as an exit relay by its policy.

Improve this answer
2
  • i was mean if a relay choose only internal relaying (not exit relaying) is that possible we trick this node to act as a exit node for us ? if packet have no special form they don't know the next node they giving packet to is an exit relay or destination site... i think also there is no way to analysis packet's content is plaintext or ciphertext (even if there be such pattern then destination site simply remove that pattern to get data correctly)? so looks to me its possible to use internal only relays for exit packets, isn't it?
    – roby
    Commented Oct 11, 2013 at 6:47
  • @roby: -- No, non-exit node will not send plain-text traffic to the Internet. The plain-text traffic will be discarded. As Karsten wrote the nodes have an exit policy. On non-exit nodes the policy discards all traffic which would leave the Tor network. -- In the packet there is a field Recognized which contains 0 when the decrypted data had the last encryption layer removed so they are the plain-text to leave the Tor network (either on the exit node or on the client). -- The plain-text is not being analysed in any way. It is not business of the nodes to look at the payload being transferred.
    – pabouk - Ukraine stay strong
    Commented Oct 11, 2013 at 21:26
0

Messages are encrypted with the exit, second then lastly the first relay's public key, when the first layer of the "onion skin" is decrypted, it reveals instruction for forwarding to the next relay.

dsfdfsfs In addition to that, there is such server called directory server, which is a compilation of guard, midpoint and exit relays.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .