What happens with TCP connections on SIGNAL NEWNYM?

Question

When I send the NEWNYM command tor will build new circuits. I'm wondering what happens with open TCP connections. Will tor wait a certain timeout to give them a chance to close, or do I break those connections?

Answer 1

Requesting a NEWNYM over the control port will tell Tor to consider the currently used circuits "dirty" (this normally happens after 10 minutes, with a few exceptions), at this point it will no longer attach new streams (connections) to the "dirty" circuit, and instead will attach them to a "clean" circuit (it doesn't normally build a fresh one at the time, it has some pre-built and waiting for use).

It will not break the existing connections, it only ensures that new connections, that are made after the NEWNYM signal, are attached to a "clean" circuit.

https://gitweb.torproject.org/torspec.git/tree/control-spec.txt#n415

  NEWNYM    -- Switch to clean circuits, so new application requests
               don't share any circuits with old ones.  Also clears
               the client-side DNS cache.  (Tor MAY rate-limit its
               response to this signal.)

---

Resources:

src/or/main.c:signewnym_impl is called to handle NEWNYM signals, which does the following

src/or/circuitlist.c:circuit_mark_all_dirty_circs_as_unusable marks any previously used (dirty) circuits as unusable, so that subsequent connections will not use them

src/or/addressmap.c:addressmap_clear_transient this clears the client-side DNS cache, as mentioned in the spec (any mapping between address and IP)

src/or/rendclient.c:rend_client_purge_state clears the state of the rendezvous client (hidden services) to avoid possible links between the old and new nym because of the new nym starting with the end state of the old nym.

It then updates information about when and how often it has performed a NEWNYM signal, as the spec mentions it may rate-limit it, which Tor does by default.

The resource to go by should be the control-spec definition for the NEWNYM signal, the implementation is subject to change.

Answer 2

You break those connections.

Tor will not wait.

To be clear, you would start your own apache and hidden service inside or better "open-net" service, thereafter open something like:

<?php echo "One";sleep(100000);echo "Two" ?>

And try to play with NewNym.

Tor must not send "RST" after each NewNym. However, this practice would be much peaceful to the server's sides.