4 SPEC - Spec not finalized
15 - Server instructions for OSX and Windows operators.
16 - Audit all changes to bandwidth buckets for integer over/underflow.
20 o pick the whole path when you start the circuit.
21 o and then the controller can call that for extendcircuit
22 o finish messing with reachability stuff
23 o if we jump in time a lot, then mark our circs and note that we
24 haven't made a circ yet.
25 o actually give http reason phrases to dir clients, so they know why
27 o have a separate config option which caps bandwidth-to-advertise.
28 o Make list_server_status work right on non-directories, so that
29 getinfo("network-status") control message can work there.
30 - Forward-port changes related to checking sockaddrs set by accept() on OS
31 X, once we know what the bug was to begin with.
32 - whine if your socks port is an open proxy.
36 Refactoring and infrastructure:
38 N . Switch to libevent
39 - Hold-open-until-flushed now works by accident; it should work by
41 - The logic for reading from TLS sockets is likely to overrun the
42 bandwidth buckets under heavy load. (Really, the logic was
43 never right in the first place.) Also, we should audit all users
44 of get_pending_bytes().
45 o Find a way to make sure we have libevent 1.0 or later.
46 o Implement patch to libevent
47 o Submit patch to niels making this possible.
48 o Implement Tor side once patch is accepted.
49 o Log which poll method we're using.
50 o Implement patch to libevent
51 o Submit patch to niels making this possible.
52 o Implement Tor side once patch is accepted.
53 o Intercept libevent's "log" messages.
54 o Ask Niels whether a patch would be accepted.
55 o Implement patch, if so.
56 o Implement Tor side once patch is accepted.
57 o Check return from event_set, event_add, event_del.
58 o Keep pushing to get a windows patch accepted.
59 o After about 26 March, check back with Niels; he should be back
63 - Make sure logged info is "safe"ish.
66 R o Reset uptime when IP changes.
69 o Implement pending controller features.
70 o Stubs for new functions.
74 o Individual descriptors
75 o Need to remember descriptors for all routers.
76 o Replace everything else that remembers serverdescs with
78 o List of address mappings
83 o Reuse mappings when asked to map DontCare->B for the same B.
84 o But only when the DontCare is of the same type. :/
85 o Way to handle overlong messages
86 o Specify fragmented format
87 o Implement fragmented format
88 o Event for "new descriptors"
90 o Stream status changed: "new" state.
92 o revised circ selection stuff.
93 o Implement controller interface.
95 o Make streams have an 'unattached and not-automatically-attachable'
96 state. ("Controller managed.")
97 o Add support to put new streams into this state rather than try to
98 attach them automatically. ("Hidden" config option.)
99 o Implement 'attach stream X to circuit Y' logic.
100 o Time out never-attached streams.
101 o If we never get a CONNECTED back, we should put the stream back in
102 CONTROLLER_WAIT, not in CIRCUIT_WAIT.
103 o Add a way for the controller to say, "Hey, nuke this stream."
106 o Add a way for the controller to say, "Hey, nuke this circuit."
109 - Tests for new controller features
110 R o HTTPS proxy for OR CONNECT stuff. (For outgoing SSL connections to
112 o Changes for forward compatibility
113 o If a version is later than the last in its series, but a version
114 in the next series is recommended, that doesn't mean it's bad.
115 o Do end reasons better
116 o Start using RESOURCELIMIT more.
117 o Try to use MISC a lot less.
118 o bug: if the exit node fails to create a socket (e.g. because it
119 has too many open), we will get a generic stream end response.
120 o Fix on platforms with set_max_file_descriptors.
121 o niels's "did it fail because conn refused or timeout or what"
123 o Realize that unrecognized end reasons are probably features rather than
124 bugs. (backport to 009x)
125 o Push the work of sending the end cell deeper into package_raw_inbuf.
126 (Turns out, if package_raw_inbuf fails, it *can't* send an end cell.)
127 o Check for any place where we can close an edge connection without
128 sending an end; see if we should send an end.
129 o Feed end reason back into SOCK5 as reasonable.
130 R o cache .foo.exit names better, or differently, or not.
131 o make !advertised_server_mode() ORs fetch dirs less often.
133 o Clean up NT service code even more.
134 o Enable it by default.
135 o Make sure it works.
139 o Document new version system.
140 r - Correct and clarify the wiki entry on port forwarding.
141 o Document where OSX logs and torrc go.
142 o Document where windows logs and torrc go.
143 - (Make sure they actually go there.)
146 N - Vet all pending installer patches
147 - Win32 installer plus privoxy, sockscap/freecap, etc.
148 - Vet win32 systray helper code
149 o Make OSX man pages go into man directory.
150 N . Make logs go into platform default locations.
156 o when we haven't explicitly sent a socks reject, sending one in
157 connection_about_to_close_connection() fails because we never give it
158 a chance to flush. right answer is to do the socks reply manually in
159 each appropriate case, and then about-to-close-connection can simply
160 warn us if we forgot one. [Tag this 010 in flyspray.]
161 o should retry exitpolicy end streams even if the end cell didn't
162 resolve the address for you
163 o Figure out when to reset addressmaps (on hup, on reconfig, etc)
164 - how do ulimits work on win32, anyway? (We should handle WSAENOBUFS as
165 needed, look at the MaxConnections registry entry, look at the
166 MaxUserPort entry, and look at the TcpTimedWaitDelay entry. We may also
167 want to provide a way to set them as needed. See bug 98.)
169 Improvements to self-measurement.
170 R X round detected bandwidth up to nearest 10KB?
171 R o client software not upload descriptor until:
172 . it decides it is reachable
175 - rule for now: "If you process a CREATE cell that did not come from
176 your own IP, you are reachable."
177 o start counting again if your IP ever changes.
178 o never regenerate identity keys, for now.
179 o you can set a bit for not-being-an-OR.
182 - Bug: Why do idle cpuworkers sometimes get thought of as busy?
183 - IP-based blacklisting of which servers get recommended by dirservers.
186 Apr 05 23:19:54.222 [notice] dirserv_add_descriptor(): Router with nickname 'Anon321' has invalid address '192.168.0.2'. Not adding.
188 N - tor-resolve script should use socks5 to get better error messages.
189 N - Script to try pulling bytes through slow-seeming servers so they can
190 notice that they might be fast.
194 r - make min uptime a function of the available choices (say, choose 60th
195 percentile, not 1 day.)
196 r - kill dns workers more slowly
197 r - build testing circuits? going through non-verified nodes?
198 - config option to publish what ports you listen on, beyond ORPort/DirPort
199 N - It would be nice to have a FirewalledIPs thing that works like
201 - If we have a trusted directory on port 80, stop falling back to
202 forbidden ports when fascistfirewall blocks all good dirservers.
204 - Make configure.in handle cross-compilation
205 - Have NULL_REP_IS_ZERO_BYTES default to 1.
206 - Make with-ssl-dir disable search for ssl.
207 - Efficiency/speed improvements.
208 - Write limiting; configurable token buckets.
209 - Make it harder to circumvent bandwidth caps: look at number of bytes
210 sent across sockets, not number sent inside TLS stream.
211 o Hidden service improvements
212 o Investigate hidden service performance/reliability
213 - Add private:* alias in exit policies to make it easier to ban all the
214 fiddly little 192.168.foo addresses.
215 - controller should have an event to learn about new addressmappings?
219 Todo: when you connect and get a guy you didn't expect, tell him hey i wasn't
220 expecting you i'm going to go now bye, instead of just hanging up. This lets
221 him let that he's doing something funny.
222 - choose entry node to be one you're already connected to?
223 - Convert man pages to pod, or whatever's right.
224 - support hostnames as well as IPs for authdirservers.
225 - GPSLocation optional config string.
227 - Make millisecond accuracy work on win32
229 - teach connection_ap_handshake_socks_reply() about ipv6 and friends
230 so connection_ap_handshake_socks_resolved() doesn't also need
232 - Let more config options (e.g. ORPort) change dynamically.
233 - hidserv offerers shouldn't need to define a SocksPort
234 * figure out what breaks for this, and do it.
235 - Destroy and truncated cells should have reasons.
237 - Figure out how to make the rpm not strip the binaries it makes.
238 - Integrate an http proxy into Tor (maybe as a third class of worker
239 process), so we can stop shipping with the beast that is Privoxy.
240 - Implement If-Modified-Since for directories.
241 - Big, incompatible re-architecting and decentralization of directory
243 - Only the top of a directory needs to be signed.
245 - Get a controller to launch tor and keep it on the system tray.
253 - you've been running for an hour
254 - it's sufficiently satisfied with its bandwidth
255 - remove approval crap, add blacklisting by IP
256 - gather more permanent dirservers and put their keys into the code
257 - ship with a master key, and implement a way to query dirservers for
258 a blob which is a timestamped signed newest pile of dirservers. put
259 that on disk and use it on startup rather than the built-in default.
260 - threshold belief from clients about up-ness
261 - a way for clients to get fresh enough server descriptors
262 - a way for clients to partition the set of servers in a safe way:
263 so they don't have to learn all of them but so they're not easily
268 N - Handle rendezvousing with unverified nodes.
269 - Specify: Stick rendezvous point's key in INTRODUCE cell.
270 Bob should _always_ use key from INTRODUCE cell.
273 N - IPv6 support (For exit addresses)
274 - Spec issue: if a resolve returns an IP4 and an IP6 address,
276 - Add to exit policy code
277 - Make tor_gethostbyname into tor_getaddrinfo
278 - Make everything that uses uint32_t as an IP address change to use
279 a generalize address struct.
280 - Change relay cell types to accept new addresses.
281 - Add flag to serverdescs to tell whether IPv6 is supported.
284 - christian grothoff's attack of infinite-length circuit.
285 the solution is to have a separate 'extend-data' cell type
286 which is used for the first N data cells, and only
287 extend-data cells can be extend requests.
290 o fix router_get_by_* functions so they can get ourselves too ...
291 - and audit everything to make sure rend and intro points are
292 just as likely to be us as not.
294 - tor should be able to have a pool of outgoing IP addresses
295 that it is able to rotate through. (maybe)
297 Packaging, docs, etc:
298 - Exit node caching: tie into squid or other caching web proxy.
300 Deferred until needed:
301 - Do something to prevent spurious EXTEND cells from making middleman
302 nodes connect all over. Rate-limit failed connections, perhaps?
303 - Limit to 2 dir, 2 OR, N SOCKS connections per IP.
304 - Handle full buffers without totally borking
305 * do this eventually, no rush.
306 - Rate-limit OR and directory connections overall and per-IP and
308 - DoS protection: TLS puzzles, public key ops, bandwidth exhaustion.
309 - Have clients and dirservers preserve reputation info over
311 - authdirserver lists you as running iff:
312 - he can connect to you
313 - he has successfully extended to you
314 - you have sufficient mean-time-between-failures
315 * keep doing nothing for now.
316 - Include HTTP status messages in logging (see parse_http_response).
318 Blue sky or deferred indefinitely:
319 - Support egd or other non-OS-integrated strong entropy sources
320 - password protection for on-disk identity key
321 - Possible to get autoconf to easily install things into ~/.tor?
322 - server descriptor declares min log level, clients avoid servers
324 - put expiry date on onion-key, so people don't keep trying
325 old ones that they could know are expired?
326 - Add a notion of nickname->Pubkey binding that's not 'verification'
328 - Need a relay teardown cell, separate from one-way ends.
330 Big tasks that would demonstrate progress:
332 - Facility to automatically choose long-term helper nodes; perhaps
333 on by default for hidden services.
334 - patch privoxy and socks protocol to pass strings to the browser.
335 - patch tsocks with our current patches + gethostbyname, getpeername, etc.
336 - make freecap (or whichever) do what we want.
337 - scrubbing proxies for protocols other than http.
338 - Find an smtp proxy?
339 . Get socks4a support into Mozilla
340 - figure out enclaves, e.g. so we know what to recommend that people
341 do, and so running a tor server on your website is helpful.
342 - Do enclaves for same IP only.
343 - Resolve first, then if IP is an OR, extend to him first.
344 - implement a trivial fun gui to demonstrate our control interface.
346 ************************ Roadmap for 2004-2005 **********************
348 Hard problems that need to be solved:
350 - Separating node discovery from routing.
351 - Arranging membership management for independence.
352 Sybil defenses without having a human bottleneck.
353 How to gather random sample of nodes.
354 How to handle nodelist recommendations.
355 Consider incremental switches: a p2p tor with only 50 users has
356 different anonymity properties than one with 10k users, and should
357 be treated differently.
358 - Measuring performance of other nodes. Measuring whether they're up.
359 - Choosing exit node by meta-data, e.g. country.
360 - Incentives to relay; incentives to exit.
361 - Allowing dissidents to relay through Tor clients.
362 - How to intercept, or not need to intercept, dns queries locally.
363 - Improved anonymity:
364 - Experiment with mid-latency systems. How do they impact usability,
365 how do they impact safety?
366 - Understand how powerful fingerprinting attacks are, and experiment
367 with ways to foil them (long-range padding?).
368 - Come up with practical approximations to picking entry and exit in
369 different routing zones.
370 - Find ideal churn rate for helper nodes; how safe is it?
371 - What info squeaks by Privoxy? Are other scrubbers better?
372 - Attacking freenet-gnunet/timing-delay-randomness-arguments.
373 - Is abandoning the circuit the only option when an extend fails, or
374 can we do something without impacting anonymity too much?
375 - Is exiting from the middle of the circuit always a bad idea?
377 Sample Publicity Landmarks:
379 - we have N servers / N users
380 - we have servers at epic and aclu and foo
381 - hidden services are robust and fast
382 - a more decentralized design
383 - tor win32 installer works
384 - win32 tray icon for end-users
385 - tor server works on win32
386 - win32 service for servers
387 - mac installer works
389 ***************************Future tasks:****************************
391 Rendezvous and hidden services:
393 o preemptively build and start rendezvous circs.
394 o preemptively build n-1 hops of intro circs?
395 o cannibalize general circs?
397 - standby/hotswap/redundant services.
398 - store stuff to disk? dirservers forget service descriptors when
399 they restart; nodes offering hidden services forget their chosen
400 intro points when they restart.
402 - auth mechanisms to let midpoint and bob selectively choose
405 - robust decentralized storage for hidden service descriptors.
407 - web proxy gateways to let normal people browse hidden services.
410 Relax clique assumptions.
411 Redesign how directories are handled.
412 - Resolve directory agreement somehow.
413 Find and remove bottlenecks
414 - Address linear searches on e.g. circuit and connection lists.
415 Reputation/memory system, so dirservers can measure people,
416 and so other people can verify their measurements.
417 - Need to measure via relay, so it's not distinguishable.
418 Let dissidents get to Tor servers via Tor users. ("Backbone model")
420 Make it more correct:
421 Handle half-open connections: right now we don't support all TCP
422 streams, at least according to the protocol. But we handle all that
423 we've seen in the wild.
426 Efficiency/speed/robustness:
427 Congestion control. Is our current design sufficient once we have heavy
428 use? Need to measure and tweak, or maybe overhaul.
429 Allow small cells and large cells on the same network?
430 Cell buffering and resending. This will allow us to handle broken
431 circuits as long as the endpoints don't break, plus will allow
432 connection (tls session key) rotation.
433 Implement Morphmix, so we can compare its behavior, complexity, etc.
434 Use cpuworker for more heavy lifting.
435 - Signing (and verifying) hidserv descriptors
436 - Signing (and verifying) intro/rend requests
437 - Signing (and verifying) router descriptors
438 - Signing (and verifying) directories
439 - Doing TLS handshake (this is very hard to separate out, though)
440 Buffer size pool: allocate a maximum size for all buffers, not
441 a maximum size for each buffer. So we don't have to give up as
442 quickly (and kill the thickpipe!) when there's congestion.
443 Other transport. HTTP, udp, rdp, airhook, etc. May have to do our own
444 link crypto, unless we can bully openssl into it.