4

There is a comment in the torrc man page that exit policies can target the local machine or private networks, like say : 

ExitPolicy accept 127.0.0.1:80
ExitPolicy reject private:*

Does anyone actually do this? How would one actually exploit it?

There are no ip address limits specified in the consensus according to : 

egrep "^p6? " /var/lib/tor/cached-microdescs | grep ':'

I suppose this means "Tor does not bother to list such exits", or their operators somehow suppress inclusion, or nobody does this.

If someone configures this, how does one use the access the local exit created? Does the server need to set Nickname foobar or whatever. And the client need to set AllowDotExit 1 and then access localhost.foobar.exit:80? Is there an easier way?

Is this a viable approach to making a private exit useful for pinning an exit for a specific site?

Also, what is the difference between ExitPolicy and ReachableAddresses?

Improve this question

2 Answers 2

Reset to default
2

Please see the ExitPolicyRejectPrivate torrc option. As the ExitPolicy man page entry says...

These addresses are rejected by default [...] unless
you set the ExitPolicyRejectPrivate config option to 0.

It's very much not suggested but if your goal in all this is to use your own relay as a single-hop exit see AllowSingleHopCircuits

Improve this answer
2
  • Yes, you disable ExitPolicyRejectPrivate obviously, but how does that answer the questions of : Does anyone use private exits? How to use them effectively? Can the be indexed? I should rephrase the question focusing on the last point.
    – Jeff Burdges
    Commented Jun 17, 2015 at 13:01
  • Not many people allow exiting to localhost since it's a security risk. You can figure out which relays allow it by getting the server descriptors, then checking their exit policies (stem.torproject.org/tutorials/mirror_mirror_on_the_wall.html).
    – Damian
    Commented Jun 18, 2015 at 16:01
1

I've found a partial answer although browsing the tor source code, although reading the man page more closely would've sufficed. lol

There is a FetchUselessDescriptors option that, if you set it, causes Tor to fetch the old style full descriptors, not just the current microdescriptors. At that point, there are many reject lines for specific domains, but not currently any accept lines :

grep ":\*" /var/lib/tor/cached-descriptors

There is a script at contrib/or-tools/exitlist that helps you find exits for specific IP ranges.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .