TODO 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306
  1. Legend:
  2. SPEC!! - Not specified
  3. SPEC - Spec not finalized
  4. NICK - nick claims
  5. ARMA - arma claims
  6. - Not done
  7. * Top priority
  8. . Partially done
  9. o Done
  10. D Deferred
  11. X Abandoned
  12. Tor 0.0.9rc1:
  13. - Weasel wants to say 50GB rather than 50000000 in config ints.
  14. - Nick wants to say "1 hour" instead of 3600 in config ints.
  15. - Better hibernation flexibility
  16. - Add hibernation intervals for weeks, days.
  17. - Start at a time other than 0:00 GMT.
  18. - Integrate NT service patch
  19. - make loglevels info,debug less noisy
  20. Beyond 0.0.9:
  21. - controller should have 'getinfo' command to query about rephist,
  22. about rendezvous status, etc.
  23. - allow transition from ORPort to !ORPort, and back
  24. R . bandwidth buckets for write as well as read.
  25. - Limit to 2 dir, 2 OR, N SOCKS connections per IP.
  26. - Implement If-Modified-Since for directories.
  27. - Make more configuration variables into CSVs.
  28. N - Handle rendezvousing with unverified nodes.
  29. - Specify: Stick rendezvous point's key in INTRODUCE cell.
  30. Bob should _always_ use key from INTRODUCE cell.
  31. - Implement.
  32. R - figure out enclaves, e.g. so we know what to recommend that people
  33. do, and so running a tor server on your website is helpful.
  34. - Do enclaves for same IP only.
  35. - Resolve first, then if IP is an OR, connect to next guy.
  36. N - the user interface interface
  37. - Implement a trivial fun gui.
  38. N - add ipv6 support.
  39. - Spec issue: if a resolve returns an IP4 and an IP6 address,
  40. which to use?
  41. N&R - Update Spec
  42. R - learn from ben about his openssl-reinitialization-trick to
  43. rotate tls keys without making new connections.
  44. - (Roger grabs Ben next time he sees him on IRC)
  45. - christian grothoff's attack of infinite-length circuit.
  46. the solution is to have a separate 'extend-data' cell type
  47. which is used for the first N data cells, and only
  48. extend-data cells can be extend requests.
  49. - have a pool of circuits available, cannibalize them
  50. for your purposes (e.g. rendezvous, etc).
  51. - Once we have a trusted directory on port 80, stop falling back to
  52. forbidden ports when fascistfirewall blocks all good dirservers.
  53. o fix sprintf's to snprintf's?
  54. . Make intro points and rendezvous points accept $KEYID in addition
  55. to nicknames.
  56. o Specify
  57. o Implement parsing
  58. - Generate new formats (Not till 007 is dead)
  59. - Facility to automatically choose long-term helper nodes; perhaps
  60. on by default for hidden services.
  61. o Make command-line strict about checking options; make only certain
  62. option prefixes work.
  63. - Rate-limit OR and directory connections overall and per-IP and
  64. maybe per subnet.
  65. D put expiry date on onion-key, so people don't keep trying
  66. old ones that they could know are expired?
  67. * Leave on todo list, see if pre3 onion fixes helped enough.
  68. D should the running-routers list put unverified routers at the
  69. end?
  70. * Cosmetic, don't do it yet.
  71. D make advertised_server_mode() ORs fetch dirs more often.
  72. * not necessary yet.
  73. D Add a notion of nickname->Pubkey binding that's not 'verification'
  74. * eventually, only when needed
  75. D ORs use uniquer default nicknames
  76. * Don't worry about this for now
  77. D Handle full buffers without totally borking
  78. * do this eventually, no rush.
  79. D if destination IP is running a tor node, extend a circuit there
  80. before sending begin.
  81. * don't do this for now. figure out how enclaves work. but do
  82. enclaves soon.
  83. - Support egd or other non-OS-integrated strong entropy sources
  84. more features, complex:
  85. - password protection for on-disk identity key
  86. . Switch dirservers entries to config lines:
  87. o read in and parse each TrustedDir config line.
  88. o stop reading dirservers file.
  89. o add some default TrustedDir lines if none defined, or if
  90. no torrc.
  91. o remove notion of ->is_trusted_dir from the routerlist. that's
  92. no longer where you look.
  93. o clean up router parsing flow, since it's simpler now?
  94. o when checking signature on a directory, look it up in
  95. options.TrustedDirs, and make sure there's a descriptor
  96. with that nickname, whose key hashes to the fingerprint,
  97. and who correctly signed the directory.
  98. o when fetching a directory, if you want a trusted one,
  99. choose from the trusteddir list.
  100. o which means keeping track of which ones are "up"
  101. ? if you don't need a trusted one, choose from the routerinfo
  102. list if you have one, else from the trusteddir list.
  103. * roger will do the above
  104. - Have clients and dirservers preserve reputation info over
  105. reboots.
  106. * continue not doing until we have something we need to preserve
  107. - round detected bandwidth up to nearest 10KB?
  108. - client software not upload descriptor until:
  109. - you've been running for an hour
  110. - it's sufficiently satisfied with its bandwidth
  111. - it decides it is reachable
  112. - start counting again if your IP ever changes.
  113. - never regenerate identity keys, for now.
  114. - you can set a bit for not-being-an-OR.
  115. * no need to do this yet. few people define their ORPort.
  116. - authdirserver lists you as running iff:
  117. - he can connect to you
  118. - he has successfully extended to you
  119. - you have sufficient mean-time-between-failures
  120. * keep doing nothing for now.
  121. - Include HTTP status messages in logging (see parse_http_response).
  122. blue sky:
  123. - Possible to get autoconf to easily install things into ~/.tor?
  124. ongoing:
  125. . rename/rearrange functions for what file they're in
  126. - generalize our transport: add transport.c in preparation for
  127. http, airhook, etc transport.
  128. o investigate sctp for alternate transport.
  129. For September:
  130. N . Windows port
  131. o works as client
  132. - deal with pollhup / reached_eof on all platforms
  133. . robust as a client
  134. . works as server
  135. - can be configured
  136. - robust as a server
  137. . Usable as NT service
  138. - docs for building in win
  139. - installer, including all needed libs.
  140. - Docs
  141. . FAQ
  142. o overview of tor. how does it work, what's it do, pros and
  143. cons of using it, why should I use it, etc.
  144. - a howto tutorial with examples
  145. * put a stub on the wiki
  146. o tutorial: how to set up your own tor network
  147. o (need to not hardcode dirservers file in config.c)
  148. o Make tutorial reflect this.
  149. . port forwarding howto for ipchains, etc
  150. * roger add to wiki of requests
  151. . correct, update, polish spec
  152. - document the exposed function api?
  153. o document what we mean by socks.
  154. - Document where we differ from tor-design
  155. . packages
  156. R - find a long-term rpm maintainer
  157. * roger will start guilting people
  158. - code
  159. - better warn/info messages
  160. o let tor do resolves.
  161. o extend socks4 to do resolves?
  162. o make script to ask tor for resolves
  163. - write howto for setting up tsocks, socat.
  164. - including on osx and win32
  165. - freecap handling
  166. - tsocks
  167. o gather patches, submit to maintainer
  168. * send him a reminder mail and see what's up.
  169. - intercept gethostbyname and others
  170. * add this to tsocks
  171. o do resolve via tor
  172. - redesign and thorough code revamp, with particular eye toward:
  173. - support half-open tcp connections
  174. - conn key rotation
  175. - other transports -- http, airhook
  176. - modular introduction mechanism
  177. - allow non-clique topology
  178. Other details and small and hard things:
  179. - tor should be able to have a pool of outgoing IP addresses
  180. that it is able to rotate through. (maybe)
  181. - tie into squid
  182. - hidserv offerers shouldn't need to define a SocksPort
  183. * figure out what breaks for this, and do it.
  184. - when the client fails to pick an intro point for a hidserv,
  185. it should refetch the hidserv desc.
  186. . should maybe make clients exit(1) when bad things happen?
  187. e.g. clock skew.
  188. - should retry exitpolicy end streams even if the end cell didn't
  189. resolve the address for you
  190. . Make logs handle it better when writing to them fails.
  191. o Dirserver shouldn't put you in running-routers list if you haven't
  192. uploaded a descriptor recently
  193. . Refactor: add own routerinfo to routerlist. Right now, only
  194. router_get_by_nickname knows about 'this router', as a hack to
  195. get circuit_launch_new to do the right thing.
  196. . Scrubbing proxies
  197. - Find an smtp proxy?
  198. . Get socks4a support into Mozilla
  199. - Need a relay teardown cell, separate from one-way ends.
  200. - Make it harder to circumvent bandwidth caps: look at number of bytes
  201. sent across sockets, not number sent inside TLS stream.
  202. - fix router_get_by_* functions so they can get ourselves too,
  203. and audit everything to make sure rend and intro points are
  204. just as likely to be us as not.
  205. ***************************Future tasks:****************************
  206. Rendezvous and hidden services:
  207. make it fast:
  208. - preemptively build and start rendezvous circs.
  209. - preemptively build n-1 hops of intro circs?
  210. - cannibalize general circs?
  211. make it reliable:
  212. - standby/hotswap/redundant services.
  213. - store stuff to disk? dirservers forget service descriptors when
  214. they restart; nodes offering hidden services forget their chosen
  215. intro points when they restart.
  216. make it robust:
  217. - auth mechanisms to let midpoint and bob selectively choose
  218. connection requests.
  219. make it scalable:
  220. - right now the hidserv store/lookup system is run by the dirservers;
  221. this won't scale.
  222. Tor scalability:
  223. Relax clique assumptions.
  224. Redesign how directories are handled.
  225. - Separate running-routers lookup from descriptor list lookup.
  226. - Resolve directory agreement somehow.
  227. - Cache directory on all servers.
  228. Find and remove bottlenecks
  229. - Address linear searches on e.g. circuit and connection lists.
  230. Reputation/memory system, so dirservers can measure people,
  231. and so other people can verify their measurements.
  232. - Need to measure via relay, so it's not distinguishable.
  233. Bandwidth-aware path selection. So people with T3's are picked
  234. more often than people with DSL.
  235. Reliability-aware node selection. So people who are stable are
  236. preferred for long-term circuits such as intro and rend circs,
  237. and general circs for irc, aim, ssh, etc.
  238. Let dissidents get to Tor servers via Tor users. ("Backbone model")
  239. Anonymity improvements:
  240. Is abandoning the circuit the only option when an extend fails, or
  241. can we do something without impacting anonymity too much?
  242. Is exiting from the middle of the circuit always a bad idea?
  243. Helper nodes. Decide how to use them to improve safety.
  244. DNS resolution: need to make tor support resolve requests. Need to write
  245. a script and an interface (including an extension to the socks
  246. protocol) so we can ask it to do resolve requests. Need to patch
  247. tsocks to intercept gethostbyname, else we'll continue leaking it.
  248. Improve path selection algorithms based on routing-zones paper. Be sure
  249. to start and end circuits in different ASs. Ideally, consider AS of
  250. source and destination -- maybe even enter and exit via nearby AS.
  251. Intermediate model, with some delays and mixing.
  252. Add defensive dropping regime?
  253. Make it more correct:
  254. Handle half-open connections: right now we don't support all TCP
  255. streams, at least according to the protocol. But we handle all that
  256. we've seen in the wild.
  257. Support IPv6.
  258. Efficiency/speed/robustness:
  259. Congestion control. Is our current design sufficient once we have heavy
  260. use? Need to measure and tweak, or maybe overhaul.
  261. Allow small cells and large cells on the same network?
  262. Cell buffering and resending. This will allow us to handle broken
  263. circuits as long as the endpoints don't break, plus will allow
  264. connection (tls session key) rotation.
  265. Implement Morphmix, so we can compare its behavior, complexity, etc.
  266. Use cpuworker for more heavy lifting.
  267. - Signing (and verifying) hidserv descriptors
  268. - Signing (and verifying) intro/rend requests
  269. - Signing (and verifying) router descriptors
  270. - Signing (and verifying) directories
  271. - Doing TLS handshake (this is very hard to separate out, though)
  272. Buffer size pool: allocate a maximum size for all buffers, not
  273. a maximum size for each buffer. So we don't have to give up as
  274. quickly (and kill the thickpipe!) when there's congestion.
  275. Exit node caching: tie into squid or other caching web proxy.
  276. Other transport. HTTP, udp, rdp, airhook, etc. May have to do our own
  277. link crypto, unless we can bully openssl into it.
  278. P2P Tor:
  279. Do all the scalability stuff above, first.
  280. Incentives to relay. Not so hard.
  281. Incentives to allow exit. Possibly quite hard.
  282. Sybil defenses without having a human bottleneck.
  283. How to gather random sample of nodes.
  284. How to handle nodelist recommendations.
  285. Consider incremental switches: a p2p tor with only 50 users has
  286. different anonymity properties than one with 10k users, and should
  287. be treated differently.