[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: Blocking child pornography exits
Scott Bennett wrote:
> Not AFAIK. It blocks exits for whatever ports you tell it to
> for. The sample torrc that comes with the package has several
> that you can uncomment or that you can simply use as examples for
> writing your own ExitPolicy statements. One of those may be an
> reject *:25", but it starts out, IIRC, having only an "ExitPolicy
> statement uncommented for those who want to dabble in running a
For quite a few versions, Tor has come with a significant number of
ports blocked, including standard ports for email, exploits, and p2p
filesharing. I don't know if this is still the case, but if not, it's
The relevant code, which seems to still be active, starts at line 542 in
policies.c, and I'll copy the exit policy itself and relevant comment in:
#define DEFAULT_EXIT_POLICY \
"reject *:25,reject *:119,reject *:135-139,reject *:445," \
"reject *:465,reject *:563,reject *:587," \
"reject *:1214,reject *:4661-4666," \
"reject *:6346-6429,reject *:6699,reject *:6881-6999,accept *:*"
/** Parse the exit policy <b>cfg</b> into the linked list *<b>dest</b>. If
* cfg doesn't end in an absolute accept or reject, add the default exit
* policy afterwards. If <b>rejectprivate</b> is true, prepend
* "reject private:*" to the policy. Return -1 if we can't parse cfg,
* else return 0.
So chances are that if you haven't explicitly added an absolute accept
or reject to the end of your cfg, you're blocking a large number of
ports that the tor developers have decided they don't want on their network.
Last I heard, the tor developers did this solely to keep the network
usable, and not for moral reasons. But I may be wrong on that.
Nevertheless, trying to block something as nebulous and illdefined as
"child pornography" is obviously a far, far different thing than simply
blocking a pile of ports frequently used for p2p traffic. Tor doesn't
even try to recognize common p2p packets, so hey.