[tor-project] Changes to the Tor Exit List service

[Iain Learmonth]

Hi,

We will shortly be decommissioning the server that ran TorDNSEL and Tor
Check until now. The TorDNSEL software will be replaced on the new
server with software we will be able to more easily maintain going
forward. Service operators using the Tor Exit List service may need to
take action to avoid service interruption, details are contained later
in this post.

## For exit relay operators:

The primary change that comes with the new software is that exit
policies are no longer considered when deciding if an IP address is to
be included in the list. If we have observed an exit relay using an IP
address through our active measurements, this will be listed as an exit
relay in the new service regardless of the exit policy.

For exit relay operators that also route their own traffic via their
exit relay's IP address and have exit policies specifically to deny
access to services that block Tor traffic, such that those services will
allow you to connect without Tor, this will no longer work. We recommend
using a dedicated IP address for your exit relay. That allows your ISP
to more easily recognize that abuse complaints and DMCA notices can be
forwarded to you to be quickly responded to with a boilerplate response,
as opposed to cutting off your Internet access or providing your
personal information to the copyright cartels.

## For service operators:

Depending on how you obtain exit address information, you may need to
take action to avoid service interruption. If you are using CollecTor or
Onionoo, these interfaces will remain unchanged and are already
compatible with the new setup. If you are using the DNS exit list
service or the bulk exit list exporter then you may need to make changes.

### DNS exit list

The good news is that this service now behaves closer to a typical
DNS-based list service and so it may be easier to integrate into your
use-case now, and no longer require a custom implementation.

The old DNS exit list would have lookups that look like: <reverse client
ip>.<server port>.<reverse server ip>.ip-port.exitlist.torproject.org

For services that are accessed via multiple IP addresses, e.g. IRC
networks with multiple servers or websites behind load balancers, this
leads to service operators needing to perform multiple lookups in order
to have confidence that an IP address is not an exit relay. Instead,
services can now use this simplified service: <reverse client
ip>.dnsel.torproject.org, just like other DNS list services
(https://en.wikipedia.org/wiki/Domain_Name_System-based_Blackhole_List ).

If a client IP address is a Tor exit relay, the service will return with
an A record of 127.0.0.2. You'll also be able to look up a TXT record
with the fingerprint of the relay to learn more about the individual
relay. Note that some IP addresses are shared between multiple exit
relays, they will still only have one A record but may have multiple TXT
records, one for each fingerprint. If an IP address is not known in the
Tor network, the response will contain a NXDOMAIN (no such domain) status.

For example:

------------------------------------------------------------------------
$ dig +noall +comments +answer 199.72.247.162.dnsel.torproject.org
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46707
199.72.247.162.dnsel.torproject.org. 1080 IN A        127.0.0.2
------------------------------------------------------------------------
$ dig +noall +comments +answer 199.72.247.162.dnsel.torproject.org txt
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29451
199.72.247.162.dnsel.torproject.org. 1095 IN TXT
"B34CC9056250847D1980F08285B01CF0B718C0B6"
------------------------------------------------------------------------
dig +noall +comments +answer 198.81.40.188.dnsel.torproject.org txt
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2678
------------------------------------------------------------------------

*The old DNS exit list service will be turned off on the 1st April 2020.
Please ensure you have updated to the new service before this time.*

### Bulk exit list changes

The bulk exit list exporter also used to consider exit policies, but
will now return all exit relay IP addresses regardless of the query
made. You should not need to make any modifications if you are using
this service but you may find that you can remove some complexity from
your client if you were filtering by service before. You can fetch a
list of all exit IP addresses seen from:

https://check.torproject.org/torbulkexitlist

This list is updated at most once every 40 minutes depending on the
number of exit relays in the network at the time, fetching it every hour
would be reasonable.

Thanks,
Iain.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-project/attachments/20200309/45affb00/attachment.sig>