TODO.021 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386
  1. $Id: TODO 16258 2008-07-30 13:04:38Z nickm $
  2. Legend:
  3. SPEC!! - Not specified
  4. SPEC - Spec not finalized
  5. N - nick claims
  6. R - arma claims
  7. P - phobos claims
  8. S - Steven claims
  9. E - Matt claims
  10. M - Mike claims
  11. J - Jeff claims
  12. I - ioerror claims
  13. W - weasel claims
  14. K - Karsten claims
  15. - Not done
  16. * Top priority
  17. . Partially done
  18. o Done
  19. d Deferrable
  20. D Deferred
  21. X Abandoned
  22. =======================================================================
  23. Things Roger would be excited to see:
  24. Nick
  25. * Look at Roger's proposal 141 discussions on or-dev, and help us
  26. decide how to proceed.
  27. . Tors start believing the contents of NETINFO cells.
  28. - respond to Steven's red-team TLS testing (a.k.a, look at a packet
  29. dump and compare)
  30. Matt
  31. - Fit Vidalia in 640x480 again.
  32. - Vidalia should avoid stomping on your custom exit policy lines
  33. just because you click on 'save' for a totally different config thing.
  34. - How much space do we save in TBB by stripping symbols from Vidalia
  35. first? Good idea or crazy idea?
  36. ioerror
  37. * weather.torproject.org should go live.
  38. - Keep advocating new Tor servers and working with orgs like Mozilla
  39. to let them like Tor.
  40. - Find out what happened to the buildbot and get it back up:
  41. http://tor-buildbot.freehaven.net:8010/
  42. - Learn about locking memory pages that have sensitive content. Get
  43. that started in Tor.
  44. - Translation portal
  45. - Vidalia html help files
  46. - should we i18nize polipo's error messages too?
  47. - how to get our diagrams translated, and how to get our screenshots
  48. from the right language?
  49. - Some of our translated wml files are very old -- so old that they
  50. are harmful to leave in place. We need some sort of way to notice
  51. this and disable them.
  52. Steven
  53. - Move proposal 131 or equivalent forward.
  54. - Keep bugging us about exploits on the .exit notation.
  55. - Mike's question #3 on https://www.torproject.org/volunteer#Research
  56. - Worthwhile shipping TBB with some local html help files that come
  57. as bookmarks?
  58. Andrew
  59. - Which bundles include Torbutton? Change the docs/tor-doc-foo pages
  60. so they admit that Torbutton is in them too. Change the download
  61. page too.
  62. - The OS X bundle screenshots are from forever ago -- they don't
  63. include Torbutton, they still say it's tor.eff.org, etc.
  64. - Should we still be telling you how to use Safari on OS X for Tor,
  65. given all the holes that Torbutton-dev solves on Firefox?
  66. Weasel
  67. - Figure out how to make Vidalia and Tor play nicely on Debian, make
  68. the necessary modifications, and make some Vidalia debs that pass
  69. muster.
  70. - Fix bug 393.
  71. - Get oftc to switch to Tor dns bulk exitlist. Or tell us why it's
  72. not suitable yet.
  73. - Move proposal 134 forward.
  74. - putting port predictions in state file
  75. - if tor hasn't been used in a while it stops fetching consensus
  76. documents. Retain that state over restarts.
  77. Roger
  78. - Finish tor-doc-bridge.wml
  79. . Fix FAQ entry on setting up private Tor network
  80. - Did we actually apply Steven's dkimproxy patch?
  81. - Brainstorm about safe but effective ways for vidalia to
  82. auto-update its user's bridges via Tor in the background.
  83. - it doesn't count as successfully opening a circuit if it's not
  84. an exit circuit.
  85. Mike:
  86. - Roger wants to get an email every time there's a blog change,
  87. e.g. a comment. That way spam doesn't go undetected for weeks.
  88. - Or, maybe just disable linking from blog comments entirely?
  89. =======================================================================
  90. Bugs/issues for Tor 0.2.0.x:
  91. . we should have an off-by-default way for relays to dump geoip data to
  92. a file in their data directory, for measurement purposes.
  93. o Basic implementation
  94. N - Include probability-of-selection
  95. R d let bridges set relaybandwidthrate as low as 5kb
  96. R - bridge communities
  97. . spec
  98. . deploy
  99. - man page entries for Alternate*Authority config options
  100. Documentation for Tor 0.2.0.x:
  101. o Proposals:
  102. o 111: Prioritize local traffic over relayed.
  103. o 113: mark as closed close.
  104. o document the "3/4 and 7/8" business in the clients fetching consensus
  105. documents timeline.
  106. R - then document the bridge user download timeline.
  107. - HOWTO for DNSPort. See tup's wiki page.
  108. . Document transport and natdport in a good HOWTO.
  109. - Quietly document NT Service options: revise (or create) FAQ entry
  110. =======================================================================
  111. For 0.2.1.x-alpha:
  112. R d bug: if we launch using bridges, and then stop using bridges, we
  113. still have our bridges in our entryguards section, and may use them.
  114. R d add an event to report geoip summaries to vidalia for bridge relays,
  115. so vidalia can say "recent activity (1-8 users) from sa".
  116. R - investigate: it looks like if the bridge authority is unreachable,
  117. we're not falling back on querying bridges directly?
  118. R - if "no running bridges known", an application request should make
  119. us retry all our bridges.
  120. R d Setting DirPort when acting as bridge will give false Warnings
  121. For 0.2.1.x:
  122. - Proposals to do:
  123. o 110: avoid infinite-length circuits
  124. * Figure out the right value for max RELAY_EARLY cells (Bug 878)
  125. - 117: IPv6 Exits
  126. - Internal code support for ipv6:
  127. o Clone ipv6 functions (inet_ntop, inet_pton) where they don't exist.
  128. o Many address variables need to become tor_addr_t
  129. o addr in connection_t
  130. o n_addr in extend_info_t
  131. - Teach resolving code how to handle ipv6.
  132. . Teach exit policies about ipv6 (consider ipv4/ipv6 interaction!)
  133. o Use IPv6 in connect/connected/failed-exitpolicy cells
  134. o accept ipv6 from socks
  135. o Generate END_REASON_EXITPOLICY cells right
  136. . ... and parse them right
  137. . Generate new BEGIN cell types and parse them right
  138. - Detect availability of ipv6
  139. - Advertise availability of ipv6.
  140. - Geoip support, if only to add a zone called "ipv6"
  141. K . 121: Hidden service authentication:
  142. - missing: delayed descriptor publication for 'stealth' mode.
  143. R o 128: families of private bridges
  144. o 135: simplify configuration of private tor networks.
  145. K - 143: Improvements of Distributed Hidden Service Descriptor Storage:
  146. only easy parts for 0.2.1.x, defer complex ones to 0.2.2.x.
  147. o 148: Stream end reasons from the client side should be uniform.
  148. K o 155: Four Improvements of Hidden Service Performance
  149. - 145: Separate "suitable from a guard" from "suitable as a new guard"
  150. - 146: Adding new flag to reflect long-term stability
  151. - 149: Using data from NETINFO cells
  152. o Don't extend a circuit over a noncanonical connection with
  153. mismatched address.
  154. o Apply rovv's bugfixes wrt preferring canonical connections.
  155. o Make sure that having a non-canonical connection doesn't count
  156. as _having_ a connection for the purpose of connecting to others,
  157. and that when no canonical connection exists, we make one.
  158. - Learn our outgoing IP address from netinfo cells?
  159. - Learn skew from netinfo cells?
  160. o 157: Make certificate downloads specific.
  161. - Proposals to write:
  162. - Fix voting to handle bug 608 case when multiple servers get
  163. Named.
  164. N . Draft proposal for GeoIP aggregation (see external constraints *)
  165. . Figure out how to make good use of the fallback consensus file. Right
  166. now many of the addresses in the fallback consensus will be stale,
  167. so it will take dozens of minutes to bootstrap from it. This is a
  168. bad first Tor experience. But if we check the fallback consensus
  169. file *after* we fail to connect to any authorities, then it may
  170. still be valuable as a blocking-resistance step.
  171. o Write the proposal.
  172. - Patch our tor.spec rpm package so it knows where to put the fallback
  173. consensus file.
  174. . Put bandwidth weights in the networkstatus? So clients get weight
  175. their choices even before they have the descriptors; and so
  176. authorities can put in more accurate numbers in the future.
  177. - Spec compliance:
  178. * Make sure that clients could do the new handshake without sending any
  179. certs, if they wanted.
  180. - Tiny designs to write:
  181. - If a relay publishes a new descriptor with a significantly lower
  182. uptime or with a new IP address, then we should consider its current
  183. "running" interval to have ended even if it hadn't yet failed its
  184. third reachability test. the interval ended when the new descriptor
  185. appeared, and a new interval began then too.
  186. - Authority improvements:
  187. R - authorities should initiate a reachability test upon first
  188. glimpsing a new descriptor.
  189. - Use less bandwidth
  190. - Use if-modified-since to download consensuses
  191. - Testing
  192. - Better unit test coverage
  193. - Verify that write limits to linked connections work.
  194. - Security improvements
  195. - make is-consensus-fresh-enough check tighter.
  196. - If we haven't tried downloading a consensus for ages since we're tired,
  197. try getting a new one before we use old descriptors for a circuit.
  198. Related to bug 401. [What does "since we're tired" mean? -RD]
  199. [I don't know. -NM]
  200. - Feature removals and deprecations:
  201. - Get rid of the v1 directory stuff (making, serving, and caching)
  202. . First verify that the caches won't flip out?
  203. o If they will, just stop the caches from caching for now
  204. . perhaps replace it with a "this is a tor server" stock webpage.
  205. - Get the debs to set DirPortFrontPage in the default.
  206. - Decide how to handle DirPortFrontPage files with image links.
  207. - Can we deprecate controllers that don't use both features?
  208. - Both TorK and Vidalia use VERBOSE_NAMES.
  209. - TorK uses EXTENDED_EVENTS. Vidalia does not. (As of 9 Dec.)
  210. - Matt is checking whether Vidalia would break if we started to use
  211. EXTENDED_EVENTS by default. He says no.
  212. External tool improvements:
  213. - Get IOCP patches into libevent
  214. Nice to have for 0.2.1.x:
  215. - Proposals, time permitting
  216. - 134: handle authority fragmentation.
  217. - 140: Provide diffs betweeen consensuses
  218. - Handle multi-core cpus better
  219. - Split circuit AES across cores
  220. - Split cell_queue_t into a new structure with a processed subqueue,
  221. an unprocessed subqueue, and a symmetric key.
  222. - Write a function to pull cells from the unprocessed subqueue,
  223. en/decrypt them, and place them on the processed subqueue.
  224. - When a cell is added to a queue that previously had no
  225. unprocessed cells, put that queue into a set of queues that
  226. need to be processed. When the last cell is processed in a
  227. queue, remove it from the set of queues that need to be
  228. processed.
  229. - Worker code to process queues in round-robin fashion.
  230. - Think about how to be fair to differet circuits _and_ about to get
  231. CPU-affinity, if that matters.
  232. - When a cell is processed and placed onto a processed subqueue
  233. that was previously empty, _and_ the or_conn output buffer
  234. that the queue is targetting is empty, stick the buffer onto a
  235. list of buffers that need attention and notify the main
  236. thread if it was not already on the list.
  237. - When the main thread gets notified, it pumps those buffers.
  238. (i.e., it puts cells onto them from some of their circuits).
  239. - To free a queue that is not currently processing, grab its lock
  240. and free it.
  241. - To free a queue that _is_ processing, .... ?
  242. - Documentation
  243. P - Make documentation realize that location of system configuration file
  244. will depend on location of system defaults, and isn't always /etc/torrc.
  245. - Small controller features
  246. - A status event for when tor decides to stop fetching directory info
  247. if the client hasn't clicked recently: then make the onion change too.
  248. o Add a status event when new consensus arrives
  249. - Windows build
  250. P - Figure out why dll's compiled in mingw don't work right in WinXP.
  251. P - create a "make win32-bundle" for vidalia-privoxy-tor-torbutton bundle
  252. - Refactor bad code:
  253. - connection_or_get_by_identity_digest() and connection_good_enough_for
  254. _extend() could be merged into a smarter variant, perhaps.
  255. - Refactor the HTTP logic so the functions aren't so large.
  256. - Refactor buf_read and buf_write to have sensible ways to return
  257. error codes after partial writes
  258. - deprecate router_digest_is_trusted_dir() in favor of
  259. router_get_trusteddirserver_by_digest()
  260. - Should be trivial
  261. - Tor logs the libevent version on startup, for debugging purposes.
  262. This is great. But it does this before configuring the logs, so
  263. it only goes to stdout and is then lost.
  264. - Deprecations
  265. - Even clients run rep_hist_load_mtbf_data(). This doesn't waste memory
  266. unless they had previously been non-clients collecting MTBF data.
  267. Dump it anyway?
  268. - Unless we start using ftime functions, dump them.
  269. - can we deprecate the FastFirstHopPK config option?
  270. - The v2dir flag isn't used for anything anymore, right? If so, dump it.
  271. - can we deprecate 'getinfo network-status'?
  272. - Dump most uint32_t addr functions.
  273. Defer:
  274. - Proposals
  275. - 118: Listen on and advertise multiple ports:
  276. - Tor should be able to have a pool of outgoing IP addresses that it is
  277. able to rotate through. (maybe. Possible overlap with proposal 118.)
  278. - config option to publish what ports you listen on, beyond
  279. ORPort/DirPort. It should support ranges and bit prefixes (?) too.
  280. - Need to figure out the right format for routerinfo_t on this.
  281. - 147: Eliminate the need for v2 directories in generating v3 directories
  282. - Proposals to write.
  283. d Something for bug 469, to limit connections per IP.
  284. R d Do we want to maintain our own set of entryguards that we use as
  285. next hop after the bridge?
  286. d Possibly: revise link protocol to allow big circuit IDs,
  287. variable-length cells, proposal-110 stuff, and versioned CREATES?
  288. d Fetch an updated geoip file from the directory authorities.
  289. - Tiny designs to write
  290. - Better estimate of clock skew; has anonymity implications. Clients
  291. should estimate their skew as median of skew from servers over last
  292. N seconds, but for servers this is not so easy, since a server does
  293. not choose who it connects to.
  294. - Do TLS connection rotation more often than "once a week" in the
  295. extra-stable case.
  296. (One reason not to do it more often is because the old TLS conn
  297. probably has a circuit on it, and we don't really want to build up
  298. dozens of TCP connections to all the other extra-stable relays.)
  299. - Use less RAM
  300. - Optimize cell pool allocation.
  301. - Support (or just always use) jemalloc (if it helps)
  302. - mmap more files.
  303. - Pull serverdescs off buffers as they arrive.
  304. - Allocate routerstatus_t objects on a per-networkstatus memchunk.
  305. - Split TLS across multiple cores
  306. - Use more mid-level and high-level libevent APIs
  307. - For dns?
  308. - For http?
  309. - For buffers?
  310. - Proposals to write
  311. - steven's plan for replacing check.torproject.org with a built-in
  312. answer by tor itself.
  313. - Refactor bad code:
  314. - Streamline how we pick entry nodes: Make choose_random_entry() have
  315. less magic and less control logic.
  316. - Move all status info out of routerinfo into local_routerstatus. Make
  317. "who can change what" in local_routerstatus explicit. Make
  318. local_routerstatus (or equivalent) subsume all places to go for "what
  319. router is this?"
  320. o Don't call time(NULL) so much; instead have a static time_t field
  321. that gets updated only a handful of times per second.
  322. - Refactor unit tests into multiple files
  323. - Make Tor able to chroot itself
  324. o allow it to load an entire config file from control interface
  325. - document LOADCONF
  326. - log rotation (and FD passing) via control interface
  327. - chroot yourself, including inhibit trying to read config file
  328. and reopen logs, unless they are under datadir.
  329. - Should be trivial:
  330. - Base relative control socket paths (and other stuff in torrc) on datadir.
  331. o enforce a lower limit on MaxCircuitDirtiness and CircuitBuildTimeout.
  332. - Make 'safelogging' extend to info-level logs too.
  333. - don't do dns hijacking tests if we're reject *:* exit policy?
  334. (deferred until 0.1.1.x is less common)
  335. - More consistent error checking in router_parse_entry_from_string().
  336. I can say "banana" as my bandwidthcapacity, and it won't even squeak.
  337. d Interface for letting SOAT modify flags that authorities assign.
  338. (How to keep the authority from clobbering them afterwards?