TODO 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309
  1. Legend:
  2. SPEC!! - Not specified
  3. SPEC - Spec not finalized
  4. NICK - nick claims
  5. ARMA - arma claims
  6. - Not done
  7. * Top priority
  8. . Partially done
  9. o Done
  10. D Deferred
  11. X Abandoned
  12. For 0.0.2pre17:
  13. o Put a H(K | handshake) into the onionskin response
  14. o Make cells 512 bytes
  15. o Reduce streamid footprint from 7 bytes to 2 bytes
  16. X Check for collisions in streamid (now possible with
  17. just 2 bytes), and back up & replace with padding if so
  18. o Use the 4 reserved bytes in each cell header to keep 1/5
  19. of a sha1 of the ongoing relay payload (move into stream header)
  20. o Move length into the stream header too
  21. o Make length 2 bytes
  22. D increase DH key length
  23. D increase RSA key length
  24. D Spec the stream_id stuff. Clarify that nobody on the backward
  25. stream should look at stream_id.
  26. Cell:
  27. ACI (anonymous circuit identifier) [2 bytes]
  28. Command [1 byte]
  29. Payload (padded with 0 bytes) [509 bytes]
  30. Relay payload:
  31. Relay command [1 byte]
  32. Stream ID [7 bytes]
  33. Partial SHA-1 [4 bytes]
  34. Length [2 bytes]
  35. Relay payload [495 bytes]
  36. For 0.0.2pre15:
  37. o don't pick exit nodes which will certainly reject all things.
  38. o don't pick nodes that the directory says are down
  39. o choose randomly from running dirservers, not just first one
  40. o install the man page
  41. o warn when client-side tries an address/port which no router in the dir accepts.
  42. For 0.0.2pre14:
  43. o More flexible exit policies (18.*, 18.0.0.0/8)
  44. o Work to succeed in the precense of exit policy violation
  45. o Replace desired_path_len with opaque path-selection specifier
  46. o Client-side DNS caching
  47. o Add entries to client DNS cache based on END cells
  48. o Remove port from END_REASON_EXITPOLICY cells
  49. o Start building new circuits when we get an exit-policy
  50. failure. (Defer exiting from the middle of existing
  51. circuits or extending existing circuits for later.)
  52. o Implement function to check whether a routerinfo_t
  53. supports a given exit addr.
  54. o Choose the exit node of an in-progress circuit based on
  55. pending AP connections.
  56. o Choose the exit node _first_, then beginning, then
  57. middle nodes.
  58. Short-term:
  59. - improve how it behaves when i remove a line from the approved-routers files
  60. - Make tls connections tls_close intentionally
  61. o Rename ACI to circID
  62. . integrate rep_ok functions, see what breaks
  63. - update tor faq
  64. o obey SocksBindAddress, ORBindAddress
  65. o warn if we're running as root
  66. o make connection_flush_buf() more obviously obsolete
  67. o let hup reread the config file, eg so we can get new exit
  68. policies without restarting
  69. o Put recommended_versions in a config entry
  70. X use times(2) rather than gettimeofday to measure how long it
  71. takes to process a cell
  72. o Separate trying to rebuild a circuit because you have none from trying
  73. to rebuild a circuit because the current one is stale
  74. X Continue reading from socks port even while waiting for connect.
  75. o Exit policies
  76. o Spec how to write the exit policies
  77. o Path selection algorithms
  78. o Choose path more incrementally
  79. o Let user request first/last node
  80. o And disallow certain nodes
  81. D Choose path by jurisdiction, etc?
  82. o Make relay end cells have failure status and payload attached
  83. X let non-approved routers handshake.
  84. - Dirserver shouldn't put you in running-routers list if you haven't
  85. uploaded a descriptor recently
  86. . migrate to using nickname rather than addr:port for routers
  87. o decide_aci_type
  88. - generate onion skins
  89. - circuit_send_next_onion_skin
  90. - circuit_extend
  91. - onion_generate_cpath
  92. - get_unique_aci_by_addr_port
  93. - circ->n_addr and circ->n_port
  94. - circuit_enumerate_by_naddr_nport
  95. - cpath layers
  96. - connection_or_connect
  97. - connection_exact_get_by_addr_port
  98. - connection_twin_get_by_addr_port
  99. - router_get_by_addr_port
  100. - connection_or_init_conn_from_router
  101. - tag_pack, tag_unpack, connection_cpu_process_inbuf
  102. - directory_initiate_command
  103. . Move from onions to ephemeral DH
  104. o incremental path building
  105. o transition circuit-level sendmes to hop-level sendmes
  106. o implement truncate, truncated
  107. o move from 192byte DH to 128byte DH, so it isn't so damn slow
  108. - exiting from not-last hop
  109. - OP logic to decide to extend/truncate a path
  110. - make sure exiting from the not-last hop works
  111. - logic to find last *open* hop, not last hop, in cpath
  112. o Remember address and port when beginning.
  113. - Extend by nickname/hostname/something, not by IP.
  114. - Need a relay teardown cell, separate from one-way ends.
  115. - Make it harder to circumvent bandwidth caps: look at number of bytes
  116. sent across sockets, not number sent inside TLS stream.
  117. On-going
  118. . Better comments for functions!
  119. . Go through log messages, reduce confusing error messages.
  120. . make the logs include more info (fd, etc)
  121. . Unit tests
  122. . Update the spec so it matches the code
  123. Mid-term:
  124. - Rotate tls-level connections -- make new ones, expire old ones.
  125. So we get actual key rotation, not just symmetric key rotation
  126. o Are there anonymity issues with sequential streamIDs? Sequential
  127. circIDs? Eg an attacker can learn how many there have been.
  128. The fix is to initialize them randomly rather than at 1.
  129. - Look at having smallcells and largecells
  130. . Redo scheduler
  131. o fix SSL_read bug for buffered records
  132. - make round-robining more fair
  133. - What happens when a circuit's length is 1? What breaks?
  134. . streams / circuits
  135. o Implement streams
  136. o Rotate circuits after N minutes?
  137. X Circuits should expire when circuit->expire triggers
  138. NICK . Handle half-open connections
  139. o openssh is an application that uses half-open connections
  140. o Figure out what causes connections to close, standardize
  141. when we mark a connection vs when we tear it down
  142. o Look at what ssl does to keep from mutating data streams
  143. o Put CPU workers in separate processes
  144. o Handle multiple cpu workers (one for each cpu, plus one)
  145. o Queue for pending tasks if all workers full
  146. o Support the 'process this onion' task
  147. D Merge dnsworkers and cpuworkers to some extent
  148. o Handle cpuworkers dying
  149. . Scrubbing proxies
  150. - Find an smtp proxy?
  151. - Check the old smtp proxy code
  152. o Find an ftp proxy? wget --passive
  153. D Wait until there are packet redirectors for Linux
  154. . Get socks4a support into Mozilla
  155. . Develop rendezvous points
  156. X Handle socks commands other than connect, eg, bind?
  157. o Design
  158. - Spec
  159. - Implement
  160. . Tests
  161. o Testing harness/infrastructure
  162. D System tests (how?)
  163. - Performance tests, so we know when we've improved
  164. . webload infrastructure (Bruce)
  165. . httperf infrastructure (easy to set up)
  166. . oprofile (installed in RH >8.0)
  167. NICK . Daemonize and package
  168. o Teach it to fork and background
  169. - Red Hat spec file
  170. - Debian spec file equivalent
  171. . Portability
  172. . Which .h files are we actually using?
  173. . Port to:
  174. o Linux
  175. o BSD
  176. . Solaris
  177. o Cygwin
  178. . Win32
  179. o OS X
  180. - deal with pollhup / reached_eof on all platforms
  181. o openssl randomness
  182. o inet_ntoa
  183. o stdint.h
  184. - Make a script to set up a local network on your machine
  185. o More flexibility in node addressing
  186. D Support IPv6 rather than just 4
  187. o Handle multihomed servers (config variable to set IP)
  188. In the distant future:
  189. D Load balancing between router twins
  190. D Keep track of load over links/nodes, to
  191. know who's hosed
  192. SPEC!! D Non-clique topologies
  193. D Implement our own memory management, at least for common structs
  194. (Not ever necessary?)
  195. D Advanced directory servers
  196. D Automated reputation management
  197. SPEC!! D Figure out how to do threshold directory servers
  198. D jurisdiction info in dirserver entries? other info?
  199. Older (done) todo stuff:
  200. o Get tor to act like a socks server
  201. o socks4, socks4a
  202. o socks5
  203. o routers have identity key, link key, onion key.
  204. o link key certs are
  205. D signed by identity key
  206. D not in descriptor
  207. o not in config
  208. D not on disk
  209. o identity and onion keys are in descriptor (and disk)
  210. o upon boot, if it doesn't find identity key, generate it and write it.
  211. o also write a file with the identity key fingerprint in it
  212. o router generates descriptor: flesh out router_get_my_descriptor()
  213. o Routers sign descriptors with identity key
  214. o routers put version number in descriptor
  215. o routers should maybe have `uname -a` in descriptor?
  216. o Give nicknames to routers
  217. o in config
  218. o in descriptors
  219. o router posts descriptor
  220. o when it boots
  221. o every DirFetchPostPeriod seconds
  222. D when it changes
  223. o change tls stuff so certs don't get written to disk, or read from disk
  224. o make directory.c 'thread'safe
  225. o dirserver parses descriptor
  226. o dirserver checks signature
  227. D client checks signature?
  228. o dirserver writes directory to file
  229. o reads that file upon boot
  230. o directory includes all routers, up and down
  231. o add "up" line to directory, listing nicknames
  232. o instruments ORs to report stats
  233. o average cell fullness
  234. o average bandwidth used
  235. o configure log files. separate log file, separate severities.
  236. o what assumptions break if we fclose(0) when we daemonize?
  237. o make buffer struct elements opaque outside buffers.c
  238. o add log convention to the HACKING file
  239. o make 'make install' do the right thing
  240. o change binary name to tor
  241. o change config files so you look at commandline, else look in
  242. /etc/torrc. no cascading.
  243. o have an absolute datadir with fixed names for files, and fixed-name
  244. keydir under that with fixed names
  245. o Move (most of) the router/directory code out of main.c
  246. o Simple directory servers
  247. o Include key in source; sign directories
  248. o Signed directory backend
  249. o Document
  250. o Integrate
  251. o Add versions to code
  252. o Have directories list recommended-versions
  253. o Include line in directories
  254. o Check for presence of line.
  255. o Quit if running the wrong version
  256. o Command-line option to override quit
  257. o Add more information to directory server entries
  258. o Exit policies
  259. o Clearer bandwidth management
  260. o Do we want to remove bandwidth from OR handshakes?
  261. o What about OP handshakes?
  262. X Move away from openssl
  263. o Abstract out crypto calls
  264. X Look at nss, others? Just include code?
  265. o Use a stronger cipher
  266. o aes now, by including the code ourselves
  267. X On the fly compression of each stream
  268. o Clean up the event loop (optimize and sanitize)
  269. o Remove that awful concept of 'roles'
  270. o Terminology
  271. o Circuits, topics, cells stay named that
  272. o 'Connection' gets divided, or renamed, or something?
  273. o DNS farm
  274. o Distribute queries onto the farm, get answers
  275. o Preemptively grow a new worker before he's needed
  276. o Prune workers when too many are idle
  277. o DNS cache
  278. o Clear DNS cache over time
  279. D Honor DNS TTL info (how??)
  280. o Have strategy when all workers are busy
  281. o Keep track of which connections are in dns_wait
  282. o Need to cache positives/negatives on the tor side
  283. o Keep track of which queries have been asked
  284. o Better error handling when
  285. o An address doesn't resolve
  286. o We have max workers running
  287. o Consider taking the master out of the loop?
  288. X Implement reply onions
  289. o Total rate limiting
  290. o Look at OR handshake in more detail
  291. o Spec it
  292. o Merge OR and OP handshakes
  293. o rearrange connection_or so it doesn't suck so much to read
  294. D Periodic link key rotation. Spec?
  295. o wrap malloc with something that explodes when it fails
  296. o Clean up the number of places that get to look at prkey