Tor can only handle TCP connections, but DNS is a UDP protocol. How does Tor route DNS requests over its TCP based network? Why can the same approach not be used to route all UDP traffic over Tor?
weasel - Peter Palfrader
5,1481 gold badge24 silver badges39 bronze badges
asked Sep 25, 2013 at 18:50
-
1Important: DNS attacks TOR ..– PacerierCommented Dec 28, 2016 at 7:09
-
DNSCRYPT, Introducing DNSCrypt, Background: The need for a better DNS security. Granted, without a proxy - this can affirm a client, without repudiation - as all encrypted connections can. A binding court order can compel OpenDNS to monitor particular IP addresses and have to reveal DNS request history. So, there is still a legal engineering hack vulnerability.– elika kohenCommented Aug 15, 2017 at 23:02
Add a comment
|
3 Answers
Short answer: Tor transports the hostname (inside the Tor protocol) to the exit relay, which resolves it for you.
Tor clients do not, in general, directly do DNS requests. When you open a connection through the tor network you usually ask your client (on its socks ports) to connect you to a hostname and port, say www.example.com:80.
Your tor client, once it has created a circuit, will send that hostname and port to the exit node in its RELAY_BEGIN cell.
The exit node will then do a DNS resolve and open a TCP connection to the target. Once that's established it will tell your client that the connection is open, and for informational purposes will also tell your client what address that hostname resolved to.
Tor, in addition to that, has some sort of "remote DNS resolve" protocol built in. This support allows clients to query for certain resource types, like IPv4 or IPv6 addresses. Here too, the exit node does the actual DNS packet sending and receiving and just relays the answer to the client.
No UDP packets are actually ever routed from the client.
There's also a proposal to add more full featured DNS support to Tor. So far it hasn't been implemented.
Tor Protocol Specification references
answered Sep 25, 2013 at 20:00
-
25Right. The short version of the answer is "Tor transports the hostname (inside the Tor protocol) to the exit relay, which resolves it for you." Commented Sep 25, 2013 at 20:28
-
Could you confirm that the exit node sends the address back to the client? I'm familiar with SOCKS and that doesn't happen at that level so just curious why it would on TOR's level.– DavidCommented Sep 26, 2013 at 3:50
-
Socks only happens between your application and the Tor instance running on your computer -- the so-called onion proxy, OP for short. The OP and the exit node communicate using the Tor protocol and section 6.2 from the document I linked specifies that the RELAY_CONNECTED cell contain the IPv4 or IPv6 address of the hostname. That means the address makes it to the OP which can use it, for instance, to pick a better exit node next time. The information would not usually make it to the application that initiated the socks connection however. Commented Sep 26, 2013 at 6:18
-
-
Yes, tor-resolve uses the remote hostname lookup feature mentioned in section 6.4 of tor-spec. Commented Sep 27, 2013 at 5:38
You have to remember, that Tor is a PROXY. Proxies act on behalf of another, and therefore, theoretically you would only need to "resolve" the address of the first node of the circuit. But you don't have to do that, because Tor already has that information in its configuration files.
What happens is that the exit node "handles" everything, including DNS, for the nodes behind it, because of the nature of being a proxy server. It then transmits the DNS information backwards through a Tor circuit. Given that Tor circuits for a specific machine change every few minutes, this is what makes it difficult and next to impossible for anyone to track a machine through the nodes, because ALL of the traffic though Tor is encrypted, with the exception of the exit node's handling of the original request which it will then encrypt on its way backwards through the Tor. This is because it takes, even in a simple hypothetical case, at least several attempts and a good few minutes to decrypt anything without having direct knowledge of BOTH keys required for decyrption, and this depends largely on the encryption method.
The exception to this is the .onion domain, i.e. the hidden services. Wherein Tor itself handles the DNS issue in a manner that, while is in fact DNS request in CONCEPT, tor does not follow the conventional "Rules" for DNS when it comes to hidden services. Because of the rendezvous server, which is a random Tor server, in a way "fakes" being the real host of the .onion site, for the purposes of concealing the IP of the machine the .onion server is running on.
TOR is not capable of routing UDP traffic as far as I know. But for DNS it makes an exception. This can be done because of the way SOCKS5 works.
When establishing a SOCKS5 connection the client sends either the IP address or a DNS. When TOR receives the DNS it uses the backend to resolve it (I don't really know exactly how it does it but I guess it's really similar to TCP and an endpoint resolves it for you) and then it can continue using the regular TCP/IP tor connection.
This way TOR is able to provide hidden services as .onion DNS, as it is receiving DNS connections over SOCKS5. This is the reason why you leak DNS (and it is not possible to use .onion DNS) over SOCKS4 (it does not support DNS resolution).
-
It's the part where Tor resolves the Domain Name using DNS over its own backend that I'm really interested in. Your answer answers how the Web Browser sends the DNS request to the Tor Client, but no more (as it stands). Commented Sep 25, 2013 at 19:32
-
I think this answer is wrong. See my answer below. UDP has security issues, so Tor has chosen to use TCP only.– zkilnbqiCommented Sep 25, 2013 at 19:33
-
3