How does a OR know that it is the cells final destination?

Question

As far as i understood the payload is encrypted in layers and each relay router decrypts its layer as the cell passes along its way to the exit router. Contained within this payload is also the relay header and the relay routers just replace the circuit id according to their tables.

My question is how does the "last" node, the exit router know that it is the final destination of the cell? Is it because it has no entry in it's forwarding table for this circuit id?

Answer 1

All the nodes after the initial circuit starter are doing rougly the same thing : unwrapping the message by their-and-circuit-starter very own pre-negotiated key ant takig a look at the next layer. After this point four scenario's are in action :

1. The node is an intermediate, it sees "an envelope with address" in tor network and just passes it by to the receiver. It does not care about the contents, because it is unable to read it : it's encrypted by the key the intermediate node does not have, because it was not negotiated with it.
2. The node is an exit node. It sees "an envelope with an Internet address and port", and just by seeing this AND because of his role it starts to process the addressee via 'ExitPolicy' directives. If it passes, then an ordinary TCP connection is made, and a tunnel begins to work just like a multi-layer VPN, sort of.
3. The node is a hidden service host. It sees "an envelope with it's own hodden onion service address", and the node starts to act just like an old good Stunnel app : it tunnels the request to the hidden service itself via TCP tunnel, usually via localhost
4. The node is a rendezvouz point for hidden service communication. In this case node already knows about his role, it was pre-negotiated with it, and he sees a message, that he will pass back through another circuit leading to the hidden service host as a starting point of this second circle.

Roughly, that's it, simply putting the things. If you need more details or have further questions - feel free to ask!

Answer 2

Tor: The Second-Generation Onion Router explains it pretty well in section 4.2 Circuits and Streams, subsection Relay cells:

Once Alice has established the circuit (so she shares keys with each OR on the circuit), she can send relay cells. Upon receiving a relay cell, an OR looks up the corresponding circuit, and decrypts the relay header and payload with the session key for that circuit. If the cell is headed away from Alice the OR then checks whether the decrypted cell has a valid digest (as an optimization, the first two bytes of the integrity check are zero, so in most cases we can avoid computing the hash). If valid, it accepts the relay cell and processes it as described below. Otherwise, the OR looks up the circID and OR for the next step in the circuit, replaces the circID as appropriate, and sends the decrypted relay cell to the next OR. (If the OR at the end of the circuit receives an unrecognized relay cell, an error has occurred, and the circuit is torn down.)