TODO 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299
  1. $Id$
  2. Legend:
  3. SPEC!! - Not specified
  4. SPEC - Spec not finalized
  5. NICK - nick claims
  6. ARMA - arma claims
  7. PHOBOS - phobos claims
  8. - Not done
  9. * Top priority
  10. . Partially done
  11. o Done
  12. D Deferred
  13. X Abandoned
  14. Non-Coding, Soon:
  15. N - Mark up spec; note unclear points about servers
  16. N - Clean up dir spec.
  17. N . contact umass folks
  18. N - Mention controller libs someplace.
  19. D FAQ entry: why gnutls is bad/not good for tor
  20. P - flesh out the rest of the section 6 of the faq
  21. P - gather pointers to livecd distros that include tor
  22. - put the logo on the website, in source form, so people can put it on
  23. stickers directly, etc.
  24. R . more pictures from ren. he wants to describe the tor handshake, i want to
  25. talk about hidden services.
  26. * clean up the places where our docs are redundant (or worse, obsolete in
  27. one file and correct elsewhere). agl has a start on a global
  28. list-of-tor-docs.
  29. P - update windows docs to clarify which versions of windows, and why a
  30. DOS window, how it's used, for the less technical users
  31. NR- write a spec appendix for 'being nice with tor'
  32. - tor-in-the-media page
  33. - Ask schanzle@cas.homelinux.org about a patch for rpm spec fixes against
  34. tor-0.1.0.7.rc
  35. - Remove need for HACKING file.
  36. for 0.1.1.10-alpha:
  37. N - if they're trying to be a tor server and they're running
  38. win 98 or win me, don't let them be a server.
  39. o ReachableAddresses doesn't do what we want wrt dir fetches.
  40. for 0.1.1.x:
  41. N . Additional controller features
  42. o Find a way to make event info more extensible
  43. - change circuit status events to give more details, like purpose,
  44. whether they're internal, when they become dirty, when they become
  45. too dirty for further circuits, etc.
  46. R - What do we want here, exactly?
  47. N - Specify and implement it.
  48. - Change stream status events analogously.
  49. R - What do we want here, exactly?
  50. N - Specify and implement it.
  51. - Make other events "better".
  52. - Change stream status events analogously.
  53. R - What do we want here, exactly?
  54. N - Specify and implement it.
  55. - Make other events "better" analogously
  56. R - What do we want here, exactly?
  57. N - Specify and implement it.
  58. . Expose more information via getinfo:
  59. - import and export rendezvous descriptors
  60. - Review all static fields for additional candidates
  61. - Allow EXTENDCIRCUIT to unknown server.
  62. - We need some way to adjust server status, and to tell tor not to
  63. download directories/network-status, and a way to force a download.
  64. - It would be nice to request address lookups from the controller
  65. without using SOCKS.
  66. . Helper nodes
  67. . More testing and debugging
  68. o On sighup, if usehelpernodes changed to 1, use new circuits?
  69. - If your helper nodes are unavailable, don't abandon them unless
  70. other nodes *are* reachable.
  71. o If you think an OR conn is open but you can never establish a circuit
  72. to it, reconsider whether it's actually open.
  73. - switch accountingmax to count total in+out, not either in or
  74. out. it's easy to move in this direction (not risky), but hard to
  75. back out if we decide we prefer it the way it already is. hm.
  76. - Christian Grothoff's attack of infinite-length circuit.
  77. the solution is to have a separate 'extend-data' cell type
  78. which is used for the first N data cells, and only
  79. extend-data cells can be extend requests.
  80. - Specify, including thought about
  81. - Implement
  82. - Bind to random port when making outgoing connections to Tor servers,
  83. to reduce remote sniping attacks.
  84. - When we connect to a Tor server, it sends back a signed cell listing
  85. the IP it believes it is using. Use this to block dvorak's attack.
  86. N - Destroy and truncated cells should have reasons.
  87. N - Add private:* alias in exit policies to make it easier to ban all the
  88. fiddly little 192.168.foo addresses.
  89. (AGL had a patch; consider applying it.)
  90. N - warn if listening for SOCKS on public IP.
  91. - cpu fixes:
  92. - see if we should make use of truncate to retry
  93. o hardware accelerator support (configure engines.)
  94. o hardware accelerator support (use instead of aes.c when reasonable)
  95. - Benchmark this somehow to see whether using EVP_foo is slower in the
  96. non-engine case than AES_foo. If so, check for AES engine and fall
  97. back to AES_foo when it's not found.
  98. R - kill dns workers more slowly
  99. . Directory changes
  100. o recommended-versions for client / server ?
  101. . Some back-out mechanism for auto-approval
  102. o dirservers have blacklist of IPs and keys they hate
  103. - a way of rolling back approvals to before a timestamp
  104. - have new people be in limbo and need to demonstrate usefulness
  105. before we approve them
  106. R . Dirservers verify reachability claims
  107. o basic reachability testing, influencing network-status list.
  108. X rate-limiting the reporting of trouble servers
  109. R - check reachability as soon as you hear about a new server
  110. - Decentralization
  111. - Figure out what to do about hidden service descriptors.
  112. - find 10 dirservers.
  113. - (what are criteria to be a dirserver?)
  114. o Dirservers publish compressed network-status objects.
  115. o Support retrieving several-at-once
  116. o Everyone downloads network-status objects
  117. o Clients: from all directories, round-robin
  118. o Basic implementation: disable until 0.1.1.x is out.
  119. o On failure, mark trusted_dir_server as having failed
  120. o Retry, up to a point.
  121. - Launch retry immediately on failure.
  122. o Parse them
  123. o Cache them, reload on restart
  124. o Serve cached directories
  125. o Directories expose individual descriptors
  126. X By 'if-newer-than' (Does the spec require this??)
  127. o Support compression.
  128. o Alice acts on network-status objects
  129. o Alice downloads descriptors as needed.
  130. o Figure out what's needed
  131. o Store it
  132. o Implement store
  133. o Implement reload-from-store
  134. o Store downloaded descriptors
  135. o Download it
  136. o As-needed if we have 2 network-status objs.
  137. o Download "all" if we have less than 2 network-status objs.
  138. (This has vulnerabilities if we're not careful)
  139. o Call directory_has_arrived as needed; rename it.
  140. o Set has_fetched_directory properly.
  141. o Retry descriptors on failure
  142. o Give up after a while.
  143. - But try again after a long while (???)
  144. o Check software versions according to some sane plan.
  145. - Warn again after 24 hours.
  146. o Alice sets descriptor status from network-status
  147. o Implement
  148. o Use
  149. N . Routerdesc download changes
  150. o Refactor combined-status to be its own type.
  151. o Change rule from "do not launch new connections when one exists" to
  152. "do not request any fingerprint that we're currently requesting."
  153. o Launch connections every minute, or whenever a download fails
  154. o Retry failed routerdescs after 0, 1, 5, 10 minutes.
  155. o Mirrors retry harder and more often. (0, 0, 1, 1, 2, 5, and 15)
  156. o Reset failure count every 60 minutes
  157. o Drop fallback to download-all. Also, always split download.
  158. - Only use a routerdesc if you recognize its hash.
  159. - (Must defer till dirservers are upgraded to latest code, which
  160. actually generates these hashes.)
  161. - Of course, authdirservers must not do this.
  162. - Should directory mirrors do something else entirely?
  163. - Use has_fetched_directory sanely, whatever that means.
  164. - What *does* that mean?
  165. o If we have a routerdesc for Bob, and he says, "I'm 0.1.0.x", don't
  166. fetch a new one if it was published in the last 2 hours.
  167. - How does this interact with the 'recognized hash' rule?
  168. . Downgrade new directory events from notice to info
  169. - Clients should estimate their skew as median of skew from directory
  170. connections over last N seconds.
  171. o Call dirport_is_reachable from somewhere else.
  172. o Networkstatus should list who's an authority.
  173. o Add nickname element to dirserver line. Log this along with IP:Port.
  174. o Warn when using non-default directory servers.
  175. o When giving up on a non-finished dir request, log how many bytes
  176. dropped, to see whether it's worthwhile to use partial info.
  177. - Security
  178. - Alices avoid duplicate class C nodes.
  179. - Analyze how bad the partitioning is or isn't.
  180. - Flags
  181. - Clients use Stable and Fast instead of uptime and bandwidth to
  182. pick which servers are stable/fast.
  183. - Make authorities rate-limit logging their complaints about given
  184. servers?
  185. - packaging and ui stuff:
  186. . multiple sample torrc files
  187. - uninstallers
  188. . for os x
  189. . figure out how to make nt service stuff work?
  190. . Document it.
  191. . Add version number to directory.
  192. N - Vet all pending installer patches
  193. - Win32 installer plus privoxy, sockscap/freecap, etc.
  194. - Vet win32 systray helper code
  195. - document:
  196. - torcp needs more attention in the tor-doc-win32.
  197. - recommend gaim.
  198. - unrecommend IE because of ftp:// bug.
  199. - torrc.complete.in needs attention?
  200. Reach (deferrable) items for 0.1.1.x:
  201. - Start using create-fast cells as clients
  202. o Let more config options (e.g. ORPort) change dynamically.
  203. - start handling server descriptors without a socksport?
  204. o Add TTLs to DNS-related replies, and use them (when present) to adjust
  205. addressmap values.
  206. . Update the hidden service stuff for the new dir approach.
  207. - switch to an ascii format.
  208. - authdirservers publish blobs of them.
  209. - other authdirservers fetch these blobs.
  210. - hidserv people have the option of not uploading their blobs.
  211. - you can insert a blob via the controller.
  212. - and there's some amount of backwards compatibility.
  213. - teach clients, intro points, and hidservs about auth mechanisms.
  214. - come up with a few more auth mechanisms.
  215. . Come up with a coherent strategy for bandwidth buckets and TLS. (The
  216. logic for reading from TLS sockets is likely to overrun the bandwidth
  217. buckets under heavy load. (Really, the logic was never right in the
  218. first place.) Also, we should audit all users of get_pending_bytes().)
  219. - Make it harder to circumvent bandwidth caps: look at number of bytes
  220. sent across sockets, not number sent inside TLS stream.
  221. . Research memory use on Linux: what's happening?
  222. - Is it threading? (Maybe, maybe not)
  223. - Is it the buf_shrink bug? (Quite possibly)
  224. - Instrument the 0.1.1 code to figure out where our memory is going;
  225. apply the results. (all platforms?)
  226. - Make router_is_general_exit() a bit smarter once we're sure what it's for.
  227. For 0.1.1.x, if we can figure out how:
  228. - rewrite how libevent does select() on win32 so it's not so very slow.
  229. o enclaves (at least preliminary)
  230. - Write limiting; separate token bucket for write
  231. - Audit everything to make sure rend and intro points are just as likely to
  232. be us as not.
  233. - Do something to prevent spurious EXTEND cells from making middleman
  234. nodes connect all over. Rate-limit failed connections, perhaps?
  235. Future version:
  236. - Limit to 2 dir, 2 OR, N SOCKS connections per IP.
  237. - Handle full buffers without totally borking
  238. - Rate-limit OR and directory connections overall and per-IP and
  239. maybe per subnet.
  240. - Hold-open-until-flushed now works by accident; it should work by
  241. design.
  242. - DoS protection: TLS puzzles, public key ops, bandwidth exhaustion.
  243. - Specify?
  244. - tor-resolve script should use socks5 to get better error messages.
  245. - make min uptime a function of the available choices (say, choose 60th
  246. percentile, not 1 day.)
  247. - config option to publish what ports you listen on, beyond ORPort/DirPort
  248. - hidserv offerers shouldn't need to define a SocksPort
  249. * figure out what breaks for this, and do it.
  250. - auth mechanisms to let hidden service midpoint and responder filter
  251. connection requests.
  252. - Relax clique assumptions.
  253. - tor should be able to have a pool of outgoing IP addresses
  254. that it is able to rotate through. (maybe)
  255. Blue-sky:
  256. - Patch privoxy and socks protocol to pass strings to the browser.
  257. - Standby/hotswap/redundant hidden services.
  258. - Robust decentralized storage for hidden service descriptors.
  259. - The "China problem"
  260. - Allow small cells and large cells on the same network?
  261. - Cell buffering and resending. This will allow us to handle broken
  262. circuits as long as the endpoints don't break, plus will allow
  263. connection (tls session key) rotation.
  264. - Implement Morphmix, so we can compare its behavior, complexity, etc.
  265. - Other transport. HTTP, udp, rdp, airhook, etc. May have to do our own
  266. link crypto, unless we can bully openssl into it.
  267. . Conn key rotation (we switch to a new one after a week, but
  268. old circuits don't get any benefit from this).
  269. - Need a relay teardown cell, separate from one-way ends.
  270. (Pending a user who needs this)
  271. - Handle half-open connections: right now we don't support all TCP
  272. streams, at least according to the protocol. But we handle all that
  273. we've seen in the wild.
  274. (Pending a user who needs this)