Crazy with Exit nodes

Wed May 2 10:00:33 UTC 2007

Benjamin Schieder <blindcoder at scavenger.homeip.net> wrote:

> On 02.05.2007 10:46:28, Fabian Keil wrote:
> > "Mr. Blue" <trashdsfg at yahoo.com> wrote:
> > 
> > > When I go to: 
> > > http://www.whatismyipaddress.com.tamaribuchi.exit/
> > > I get expected response AND IP.
> > > But when I go to majority sites in form like:
> > > http://www.domain.net.tamaribuchi.exit/
> > > I get:
> > > Index of /
> > 
> > Web servers that are responsible for more than one
> > domain rely on the HTTP "Host" header to decide which
> > content you're interested in.
> > 
> > If you use Tor's exit node notation in the URL,
> > the browser will also append it to the Host header.
> > 
> > ...
> > 
> > The latter can be done automatically with Privoxy's
> > hide-tor-exit-notation filter, you can also do it
> > manually with Firefox extensions like "Tamper data".
> 
> The privoxy rule by itself won't work in most cases. At least my
> installation of firefox does use this:
> 
> GET http://www.example.com.node.exit/path/to/somewhere HTTP/1.1
> Host: www.example.com.node.exit
> X-SomeHeaders: value
> 
> The Host: will be modified, but not the GET. This is still futile since
> I encountered many a webserver ignoring the Host: header with the query
> as above.

Please name at least one example of a web server that
expects or relies on the host being part of the request line.

The request you cited above is a proxy request,
the last HTTP proxy in the proxy chain will strip
the "http://www.example.com.node.exit" before connecting
to the target server. As a result the target server should
never see the exit node notation in the request line.

Privoxy's hide-tor-exit-notation filter doesn't modify the
request line because Privoxy will be either the last
HTTP proxy in the chain in which case there's nothing to
filter, or there will be another HTTP proxy behind
Privoxy which has to see the Tor exit node notation
to forward it to Tor.

The hide-tor-exit-notation filter should work as
long as Privoxy is the last HTTP proxy in the proxy
chain, or no HTTP proxy behind Privoxy rebuilds the
Host header based on the request line.

Here's an example request:

fk at TP51 ~ $curl -X HEAD -v http://tor.eff.org.zwiebelsuppe.exit/
* About to connect() to proxy 10.0.0.1 port 8118 (#0)
*   Trying 10.0.0.1... connected
* Connected to 10.0.0.1 (10.0.0.1) port 8118 (#0)
> HEAD http://tor.eff.org.zwiebelsuppe.exit/ HTTP/1.1
> User-Agent: curl/7.16.0 (i386-portbld-freebsd6.2) libcurl/7.16.0 OpenSSL/0.9.7e zlib/1.2.3
> Host: tor.eff.org.zwiebelsuppe.exit
> Pragma: no-cache              
> Accept: */*                   
> Proxy-Connection: Keep-Alive  
>                               
< HTTP/1.1 200 OK               
< Date: Wed, 02 May 2007 09:51:37 GMT
< Server: Apache                
< Content-Location: index.html.en
< Vary: negotiate,accept-language,Accept-Encoding
< TCN: choice                   
< Accept-Ranges: bytes
< Content-Length: 6789
< Connection: close
< Content-Type: text/html
< Content-Language: en
* transfer closed with 6789 bytes remaining to read
curl: (18) transfer closed with 6789 bytes remaining to read
* Closing connection #0

And here's what Privoxy did with it:

11:51:25.138 08160600 Header: New HTTP Request-Line: HEAD / HTTP/1.1
11:51:25.139 08160600 Header: HEAD / HTTP/1.1
11:51:25.139 08160600 Header: Tagger 'http-method' added tag 'HEAD'. No action bits update necessary.
11:51:25.139 08160600 Header: Tagger 'variable-test' added tag 'Complete URL is http://tor.eff.org.zwiebelsuppe.exit/, host is tor.eff.org.zwiebelsuppe.exit and the request came from 10.0.0.1'. No action bits update necessary.
11:51:25.139 08160600 Header: Tagger 'client-ip-address' added tag 'IP-ADDRESS: 10.0.0.1'. No action bits update necessary.
11:51:25.139 08160600 Header: scan: User-Agent: curl/7.16.0 (i386-portbld-freebsd6.2) libcurl/7.16.0 OpenSSL/0.9.7e zlib/1.2.3
11:51:25.139 08160600 Header: Tagger 'user-agent' added tag 'User-Agent: curl/7.16.0 (i386-portbld-freebsd6.2) libcurl/7.16.0 OpenSSL/0.9.7e zlib/1.2.3'. No action bits update necessary.
11:51:25.139 08160600 Header: scan: Host: tor.eff.org.zwiebelsuppe.exit
11:51:25.139 08160600 Header: scan: Pragma: no-cache
11:51:25.140 08160600 Header: scan: Accept: */*
11:51:25.140 08160600 Header: scan: Proxy-Connection: Keep-Alive
11:51:25.140 08160600 Header: Modified: User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; de-CH; rv:1.8.1.2) Gecko/20070327 Firefox/2.0.0.2
11:51:25.140 08160600 Header: crumble crunched: Proxy-Connection: Keep-Alive!
11:51:25.140 08160600 Header: Transforming "Host: tor.eff.org.zwiebelsuppe.exit" to "Host: tor.eff.org"
11:51:25.140 08160600 Re-Filter: 'hide-tor-exit-notation' hit 1 time, changing size from 35 to 17
11:51:25.140 08160600 Header: Adding: Connection: close
11:51:25.140 08160600 Redirect: Decoding / if necessary.
11:51:25.140 08160600 Redirect: Checking / for redirects.
11:51:25.140 08160600 Request: tor.eff.org.zwiebelsuppe.exit/
11:51:25.140 08160600 Connect: to tor.eff.org.zwiebelsuppe.exit
11:51:48.215 08160600 Header: scan: HTTP/1.1 200 OK
11:51:48.215 08160600 Header: scan: Date: Wed, 02 May 2007 09:51:37 GMT
11:51:48.216 08160600 Header: scan: Server: Apache
11:51:48.216 08160600 Header: scan: Content-Location: index.html.en
11:51:48.216 08160600 Header: scan: Vary: negotiate,accept-language,Accept-Encoding
11:51:48.216 08160600 Header: scan: TCN: choice
11:51:48.216 08160600 Header: scan: Accept-Ranges: bytes
11:51:48.216 08160600 Header: scan: Content-Length: 6789
11:51:48.216 08160600 Header: scan: Connection: close
11:51:48.216 08160600 Header: scan: Content-Type: text/html
11:51:48.217 08160600 Header: Tagger 'content-type' added tag 'text/html'. No action bits update necessary.
11:51:48.217 08160600 Header: scan: Content-Language: en

Fabian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20070502/f1cd076d/attachment.pgp>