TODO 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288
  1. improve how it behaves when i remove a line from the approved-routers files
  2. Legend:
  3. SPEC!! - Not specified
  4. SPEC - Spec not finalized
  5. NICK - nick claims
  6. ARMA - arma claims
  7. - Not done
  8. * Top priority
  9. . Partially done
  10. o Done
  11. D Deferred
  12. X Abandoned
  13. For 0.0.2pre15:
  14. o don't pick exit nodes which will certainly reject all things.
  15. o don't pick nodes that the directory says are down
  16. o choose randomly from running dirservers, not just first one
  17. o install the man page
  18. o warn when client-side tries an address/port which no router in the dir accepts.
  19. For 0.0.2pre14:
  20. o More flexible exit policies (18.*, 18.0.0.0/8)
  21. o Work to succeed in the precense of exit policy violation
  22. o Replace desired_path_len with opaque path-selection specifier
  23. o Client-side DNS caching
  24. o Add entries to client DNS cache based on END cells
  25. o Remove port from END_REASON_EXITPOLICY cells
  26. o Start building new circuits when we get an exit-policy
  27. failure. (Defer exiting from the middle of existing
  28. circuits or extending existing circuits for later.)
  29. o Implement function to check whether a routerinfo_t
  30. supports a given exit addr.
  31. o Choose the exit node of an in-progress circuit based on
  32. pending AP connections.
  33. o Choose the exit node _first_, then beginning, then
  34. middle nodes.
  35. Short-term:
  36. - Make tls connections tls_close intentionally
  37. o Rename ACI to circID
  38. . integrate rep_ok functions, see what breaks
  39. - update tor faq
  40. o obey SocksBindAddress, ORBindAddress
  41. o warn if we're running as root
  42. o make connection_flush_buf() more obviously obsolete
  43. o let hup reread the config file, eg so we can get new exit
  44. policies without restarting
  45. o Put recommended_versions in a config entry
  46. X use times(2) rather than gettimeofday to measure how long it
  47. takes to process a cell
  48. o Separate trying to rebuild a circuit because you have none from trying
  49. to rebuild a circuit because the current one is stale
  50. X Continue reading from socks port even while waiting for connect.
  51. o Exit policies
  52. o Spec how to write the exit policies
  53. o Path selection algorithms
  54. o Choose path more incrementally
  55. o Let user request first/last node
  56. o And disallow certain nodes
  57. D Choose path by jurisdiction, etc?
  58. o Make relay end cells have failure status and payload attached
  59. X let non-approved routers handshake.
  60. - Dirserver shouldn't put you in running-routers list if you haven't
  61. uploaded a descriptor recently
  62. . migrate to using nickname rather than addr:port for routers
  63. o decide_aci_type
  64. - generate onion skins
  65. - circuit_send_next_onion_skin
  66. - circuit_extend
  67. - onion_generate_cpath
  68. - get_unique_aci_by_addr_port
  69. - circ->n_addr and circ->n_port
  70. - circuit_enumerate_by_naddr_nport
  71. - cpath layers
  72. - connection_or_connect
  73. - connection_exact_get_by_addr_port
  74. - connection_twin_get_by_addr_port
  75. - router_get_by_addr_port
  76. - connection_or_init_conn_from_router
  77. - tag_pack, tag_unpack, connection_cpu_process_inbuf
  78. - directory_initiate_command
  79. . Move from onions to ephemeral DH
  80. o incremental path building
  81. o transition circuit-level sendmes to hop-level sendmes
  82. o implement truncate, truncated
  83. o move from 192byte DH to 128byte DH, so it isn't so damn slow
  84. - exiting from not-last hop
  85. - OP logic to decide to extend/truncate a path
  86. - make sure exiting from the not-last hop works
  87. - logic to find last *open* hop, not last hop, in cpath
  88. o Remember address and port when beginning.
  89. - Extend by nickname/hostname/something, not by IP.
  90. - Need a relay teardown cell, separate from one-way ends.
  91. On-going
  92. . Better comments for functions!
  93. . Go through log messages, reduce confusing error messages.
  94. . make the logs include more info (fd, etc)
  95. . Unit tests
  96. Mid-term:
  97. - Rotate tls-level connections -- make new ones, expire old ones.
  98. So we get actual key rotation, not just symmetric key rotation
  99. - Are there anonymity issues with sequential streamIDs? Sequential
  100. circIDs? Eg an attacker can learn how many there have been.
  101. The fix is to initialize them randomly rather than at 1.
  102. - Look at having smallcells and largecells
  103. . Redo scheduler
  104. o fix SSL_read bug for buffered records
  105. - make round-robining more fair
  106. - What happens when a circuit's length is 1? What breaks?
  107. . streams / circuits
  108. o Implement streams
  109. o Rotate circuits after N minutes?
  110. X Circuits should expire when circuit->expire triggers
  111. NICK . Handle half-open connections
  112. o openssh is an application that uses half-open connections
  113. o Figure out what causes connections to close, standardize
  114. when we mark a connection vs when we tear it down
  115. o Look at what ssl does to keep from mutating data streams
  116. ARMA - Reduce streamid footprint from 7 bytes to 2 bytes
  117. - Check for collisions in streamid (now possible with
  118. just 2 bytes), and back up & replace with padding if so
  119. - Use the 3 saved bytes to put pseudorandomness in each relay cell
  120. - Use the 4 reserved bytes in each cell header to keep 1/5
  121. of a sha1 of the relay payload (move into stream header)
  122. - Move length into the stream header too
  123. - Spec the stream_id stuff. Clarify that nobody on the backward
  124. stream should look at stream_id.
  125. o Put CPU workers in separate processes
  126. o Handle multiple cpu workers (one for each cpu, plus one)
  127. o Queue for pending tasks if all workers full
  128. o Support the 'process this onion' task
  129. D Merge dnsworkers and cpuworkers to some extent
  130. o Handle cpuworkers dying
  131. . Scrubbing proxies
  132. - Find an smtp proxy?
  133. - Check the old smtp proxy code
  134. o Find an ftp proxy? wget --passive
  135. D Wait until there are packet redirectors for Linux
  136. . Get socks4a support into Mozilla
  137. . Develop rendezvous points
  138. X Handle socks commands other than connect, eg, bind?
  139. o Design
  140. - Spec
  141. - Implement
  142. - Tests
  143. o Testing harness/infrastructure
  144. D System tests (how?)
  145. - Performance tests, so we know when we've improved
  146. . webload infrastructure (Bruce)
  147. . httperf infrastructure (easy to set up)
  148. . oprofile (installed in RH >8.0)
  149. NICK . Daemonize and package
  150. o Teach it to fork and background
  151. - Red Hat spec file
  152. - Debian spec file equivalent
  153. . Portability
  154. . Which .h files are we actually using?
  155. . Port to:
  156. o Linux
  157. o BSD
  158. . Solaris
  159. o Cygwin
  160. . Win32
  161. o OS X
  162. - deal with pollhup / reached_eof on all platforms
  163. o openssl randomness
  164. o inet_ntoa
  165. o stdint.h
  166. - Make a script to set up a local network on your machine
  167. o More flexibility in node addressing
  168. D Support IPv6 rather than just 4
  169. o Handle multihomed servers (config variable to set IP)
  170. In the distant future:
  171. D Load balancing between router twins
  172. D Keep track of load over links/nodes, to
  173. know who's hosed
  174. SPEC!! D Non-clique topologies
  175. D Implement our own memory management, at least for common structs
  176. (Not ever necessary?)
  177. D Advanced directory servers
  178. D Automated reputation management
  179. SPEC!! D Figure out how to do threshold directory servers
  180. D jurisdiction info in dirserver entries? other info?
  181. Older (done) todo stuff:
  182. o Get tor to act like a socks server
  183. o socks4, socks4a
  184. o socks5
  185. o routers have identity key, link key, onion key.
  186. o link key certs are
  187. D signed by identity key
  188. D not in descriptor
  189. o not in config
  190. D not on disk
  191. o identity and onion keys are in descriptor (and disk)
  192. o upon boot, if it doesn't find identity key, generate it and write it.
  193. o also write a file with the identity key fingerprint in it
  194. o router generates descriptor: flesh out router_get_my_descriptor()
  195. o Routers sign descriptors with identity key
  196. o routers put version number in descriptor
  197. o routers should maybe have `uname -a` in descriptor?
  198. o Give nicknames to routers
  199. o in config
  200. o in descriptors
  201. o router posts descriptor
  202. o when it boots
  203. o every DirFetchPostPeriod seconds
  204. D when it changes
  205. o change tls stuff so certs don't get written to disk, or read from disk
  206. o make directory.c 'thread'safe
  207. o dirserver parses descriptor
  208. o dirserver checks signature
  209. D client checks signature?
  210. o dirserver writes directory to file
  211. o reads that file upon boot
  212. o directory includes all routers, up and down
  213. o add "up" line to directory, listing nicknames
  214. o instruments ORs to report stats
  215. o average cell fullness
  216. o average bandwidth used
  217. o configure log files. separate log file, separate severities.
  218. o what assumptions break if we fclose(0) when we daemonize?
  219. o make buffer struct elements opaque outside buffers.c
  220. o add log convention to the HACKING file
  221. o make 'make install' do the right thing
  222. o change binary name to tor
  223. o change config files so you look at commandline, else look in
  224. /etc/torrc. no cascading.
  225. o have an absolute datadir with fixed names for files, and fixed-name
  226. keydir under that with fixed names
  227. o Move (most of) the router/directory code out of main.c
  228. o Simple directory servers
  229. o Include key in source; sign directories
  230. o Signed directory backend
  231. o Document
  232. o Integrate
  233. o Add versions to code
  234. o Have directories list recommended-versions
  235. o Include line in directories
  236. o Check for presence of line.
  237. o Quit if running the wrong version
  238. o Command-line option to override quit
  239. o Add more information to directory server entries
  240. o Exit policies
  241. o Clearer bandwidth management
  242. o Do we want to remove bandwidth from OR handshakes?
  243. o What about OP handshakes?
  244. X Move away from openssl
  245. o Abstract out crypto calls
  246. X Look at nss, others? Just include code?
  247. o Use a stronger cipher
  248. o aes now, by including the code ourselves
  249. X On the fly compression of each stream
  250. o Clean up the event loop (optimize and sanitize)
  251. o Remove that awful concept of 'roles'
  252. o Terminology
  253. o Circuits, topics, cells stay named that
  254. o 'Connection' gets divided, or renamed, or something?
  255. o DNS farm
  256. o Distribute queries onto the farm, get answers
  257. o Preemptively grow a new worker before he's needed
  258. o Prune workers when too many are idle
  259. o DNS cache
  260. o Clear DNS cache over time
  261. D Honor DNS TTL info (how??)
  262. o Have strategy when all workers are busy
  263. o Keep track of which connections are in dns_wait
  264. o Need to cache positives/negatives on the tor side
  265. o Keep track of which queries have been asked
  266. o Better error handling when
  267. o An address doesn't resolve
  268. o We have max workers running
  269. o Consider taking the master out of the loop?
  270. X Implement reply onions
  271. o Total rate limiting
  272. o Look at OR handshake in more detail
  273. o Spec it
  274. o Merge OR and OP handshakes
  275. o rearrange connection_or so it doesn't suck so much to read
  276. D Periodic link key rotation. Spec?
  277. o wrap malloc with something that explodes when it fails
  278. o Clean up the number of places that get to look at prkey