Opened 7 years ago

Closed 7 years ago

#8080 closed defect (invalid)

ExitNodes statement not honoured by tor

Reported by: mr-4 Owned by:
Priority: Medium Milestone:
Component: Core Tor/Tor Version: Tor: 0.2.4.9-alpha
Severity: Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

If I have the following sequence in my torrc file:
StrictNodes 1
ExitNodes <single_exit_node_fingerprint>
ExcludeNodes <large_list>

My understanding is that Tor is supposed to only open (exit) circuits by using the ExitNode specified above, with the obvious caveat that the node in question is fully functional (otherwise I am bound to get a rather cryptic message as the one I submitted in Bug #7890).

That does not appear to happen though:

[circ] 16 BUILT (3): BridgeNode1->IntermediateNode1->ExitNodeAsSpecified
[circ] 15 BUILT (3): BridgeNode2->IntermediateNode2->ExitNodeAsSpecified
[circ] 14 BUILT (3): BridgeNode1->IntermediateNode3->ExitNodeAsSpecified
[circ] 13 BUILT (3): BridgeNode2->IntermediateNode2->ExitNodeAsSpecified
[circ] 12 BUILT (3): BridgeNode2->IntermediateNode3->ExitNodeAsSpecified
[circ] 11 BUILT (3): BridgeNode1->IntermediateNode4->xxx.xxx.xxx.xxx(GB)
[circ] 10 BUILT (3): BridgeNode1->IntermediateNode4->yyy.yyy.yyy.yyy(NL)
[circ] 9 BUILT (3): BridgeNode2->IntermediateNode1->ExitNodeAsSpecified

where "ExitNodeAsSpecified" is the IP address of the node fingerprint specified in my ExitNode statement, "BridgeNodeX" is the IP address of my entry bridges, "IntermediateNodeX" is the IP address of the intermediate nodes.

"xxx.xxx.xxx.xxx(GB)" and "yyy.yyy.yyy.yyy(NL)" are the (offending) IP addresses of exit nodes I have *not* specified anywhere in my torrc and did not expect tor to create/open/use exit node circuits involving these nodes.

Child Tickets

Change History (3)

comment:1 in reply to:  description ; Changed 7 years ago by rransom

Status: newneeds_information

Replying to mr-4:

[circ] 11 BUILT (3): BridgeNode1->IntermediateNode4->xxx.xxx.xxx.xxx(GB)
[circ] 10 BUILT (3): BridgeNode1->IntermediateNode4->yyy.yyy.yyy.yyy(NL)

"xxx.xxx.xxx.xxx(GB)" and "yyy.yyy.yyy.yyy(NL)" are the (offending) IP addresses of exit nodes I have *not* specified anywhere in my torrc and did not expect tor to create/open/use exit node circuits involving these nodes.

What are the PURPOSE and BUILD_FLAGS for those circuits?

comment:2 in reply to:  1 Changed 7 years ago by mr-4

Replying to rransom:

What are the PURPOSE and BUILD_FLAGS for those circuits?

If by the above you mean the node's flags, this is what onionoo has to say (that's the only way to retrieve that information since the microdescriptors won't contain this anymore):
xxx.xxx.xxx.xxx(GB): "flags":["Exit","Fast","Guard","HSDir","Running","Stable","Unnamed","V2Dir","Valid"]
yyy.yyy.yyy.yyy(NL): "flags":["Fast","Named","Running","Stable","Valid"]

Interesting to note that the NL node is not an exit (unless that status changed when I submitted this report).

comment:3 Changed 7 years ago by rransom

Resolution: invalid
Status: needs_informationclosed

The PURPOSE and BUILD_FLAGS that I asked for are properties of the circuits, not the ‘exits’. (See section 4.1.1 of control-spec.txt.) Since you didn't know what those were, you don't have them for the circuits you specified (and there's no way to find out now).

Not every circuit that Tor builds will be used for exit traffic. It is more likely that the circuits that you are complaining about were internal or HS-related circuits than that a recent version of Tor built exit circuits using excluded exit relays.

Note: See TracTickets for help on using tickets.