Opened 4 years ago

Last modified 6 weeks ago

#14979 new enhancement

Option to close circuit

Reported by: intrigeri Owned by: atagar
Priority: Low Milestone:
Component: Core Tor/Nyx Version:
Severity: Normal Keywords: connections
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Vidalia allows that, and that's one thing we at Tails will be missing when we remove it. The main use case is debugging potentially buggy or malicious exit nodes. For example, you get an unexpected HTTPS or SSH warning, write down the info about your exit node, and close that circuit to get a fresh one and confirm your suspicions.

Child Tickets

Change History (4)

comment:1 Changed 4 years ago by atagar

Good idea. I've been meaning to expand stem's client usage tutorial with an example of manual path selection (#8728), but this would be a great feature to include in arm too.

Will definitely try to slip it into the next release (... whenever I get back to it).

comment:2 Changed 4 years ago by sajolida

Another use case would be to try to get pass connection failures on chat servers or websites which might ban an IP but not all exit nodes. Like OFTC does for me lately...

comment:3 Changed 3 years ago by atagar

Keywords: connections added
Priority: MediumLow
Severity: Normal
Summary: Please make it possible to close an arbitrary circuitOption to close circuit

comment:4 Changed 6 weeks ago by wagon

you get an unexpected HTTPS or SSH warning, write down the info about your exit node, and close that circuit to get a fresh one and confirm your suspicions.

You can already do it with tor-prompt, but it is not straightforward:

  1. Run GETINFO stream-status and get a number of the circuit associated to your SSH connection (IP or hostname will be written). It is the third parameter in each stream.
  2. Run GETINFO circuit-status and look for the circuit which has that circuit's number (from the step 1). It is the first parameter in each circuit.
  3. If you look at the line with the right circuit from the step 2, you can see fingerprint and nickname of your exit node (it was used for your SSH connection).
  4. To get more information on the exit node from the step 3, run the command GETINFO ns/id/FINGERPRINT. It will give you IP address. If you want to know also its country, run GETINFO ip-to-country/IP_ADDRESS.

Now, if you want to change that circuit, you can either mark all already used circuits as dirty by typing SIGNAL NEWNYM command, or close only that particular circuit with the command CLOSECIRCUIT CircuitNumber, where CircuitNumber is taken from the step 1 (tor will create new circuit that stream automatically).

You cannot do it with the help of the control interpreter of nyx because the bug #28297 prevents you from learning your exit node.

It could be done easily in nyx if its list of circuits include associated streams (somebody already proposed it in #5186).

Potentially, you can create a custom circuit for your tests with the help of commands EXTENDCIRCUIT, SETCIRCUITPURPOSE, and ATTACHSTREAM, but if you haven't already automated this task, it may be simpler to temporarily fix your exit node globally (using ExitNodes option in torrc).

Note: See TracTickets for help on using tickets.