4 SPEC - Spec not finalized
15 - Server instructions for OSX and Windows operators.
16 - Audit all changes to bandwidth buckets for integer over/underflow.
17 - whine if your socks port is an open proxy.
18 N - parse routerinfo->contactinfo into a string we can use.
19 - The goal is to log IP and ContactInfo when the dirserver refuses
20 an uploaded descriptor, so we have some idea of who to contact.
22 Refactoring and infrastructure:
24 N . Switch to libevent
25 - Hold-open-until-flushed now works by accident; it should work by
27 . The logic for reading from TLS sockets is likely to overrun the
28 bandwidth buckets under heavy load. (Really, the logic was
29 never right in the first place.) Also, we should audit all users
30 of get_pending_bytes().
33 - Make sure logged info is "safe"ish.
36 - Tests for new controller features
38 o Clean up NT service code even more.
39 o Enable it by default.
44 r - Correct and clarify the wiki entry on port forwarding.
45 o Document where OSX logs and torrc go.
46 o Document where windows logs and torrc go.
47 - (Make sure they actually go there.)
50 N - Vet all pending installer patches
51 - Win32 installer plus privoxy, sockscap/freecap, etc.
52 - Vet win32 systray helper code
53 N . Make logs go into platform default locations.
58 - how do ulimits work on win32, anyway? (We should handle WSAENOBUFS as
59 needed, look at the MaxConnections registry entry, look at the
60 MaxUserPort entry, and look at the TcpTimedWaitDelay entry. We may also
61 want to provide a way to set them as needed. See bug 98.)
64 - Bug: Why do idle cpuworkers sometimes get thought of as busy?
65 - IP-based blacklisting of which servers get recommended by dirservers.
68 N - tor-resolve script should use socks5 to get better error messages.
69 o Script to try pulling bytes through slow-seeming servers so they can
70 notice that they might be fast.
74 r - make min uptime a function of the available choices (say, choose 60th
75 percentile, not 1 day.)
76 r - kill dns workers more slowly
77 r - build testing circuits? going through non-verified nodes?
78 - config option to publish what ports you listen on, beyond ORPort/DirPort
79 N - It would be nice to have a FirewalledIPs thing that works like
81 - If we have a trusted directory on port 80, stop falling back to
82 forbidden ports when fascistfirewall blocks all good dirservers.
84 - Make configure.in handle cross-compilation
85 - Have NULL_REP_IS_ZERO_BYTES default to 1.
86 - Make with-ssl-dir disable search for ssl.
87 - Efficiency/speed improvements.
88 - Write limiting; configurable token buckets.
89 - Make it harder to circumvent bandwidth caps: look at number of bytes
90 sent across sockets, not number sent inside TLS stream.
91 o Hidden service improvements
92 o Investigate hidden service performance/reliability
93 - Add private:* alias in exit policies to make it easier to ban all the
94 fiddly little 192.168.foo addresses.
95 - controller should have an event to learn about new addressmappings?
99 Todo: when you connect and get a guy you didn't expect, tell him hey i wasn't
100 expecting you i'm going to go now bye, instead of just hanging up. This lets
101 him know that he's doing something funny.
102 - choose entry node to be one you're already connected to?
103 - Convert man pages to pod, or whatever's right.
104 - support hostnames as well as IPs for authdirservers.
105 - GPSLocation optional config string.
107 - Make millisecond accuracy work on win32
109 - teach connection_ap_handshake_socks_reply() about ipv6 and friends
110 so connection_ap_handshake_socks_resolved() doesn't also need
112 - Let more config options (e.g. ORPort) change dynamically.
113 - hidserv offerers shouldn't need to define a SocksPort
114 * figure out what breaks for this, and do it.
115 - Destroy and truncated cells should have reasons.
117 - Figure out how to make the rpm not strip the binaries it makes.
118 - Integrate an http proxy into Tor (maybe as a third class of worker
119 process), so we can stop shipping with the beast that is Privoxy.
120 - Implement If-Modified-Since for directories.
121 - Big, incompatible re-architecting and decentralization of directory
123 - Only the top of a directory needs to be signed.
125 - Get a controller to launch tor and keep it on the system tray.
133 - you've been running for an hour
134 - it's sufficiently satisfied with its bandwidth
135 - remove approval crap, add blacklisting by IP
136 - gather more permanent dirservers and put their keys into the code
137 - ship with a master key, and implement a way to query dirservers for
138 a blob which is a timestamped signed newest pile of dirservers. put
139 that on disk and use it on startup rather than the built-in default.
140 - threshold belief from clients about up-ness
141 - a way for clients to get fresh enough server descriptors
142 - a way for clients to partition the set of servers in a safe way:
143 so they don't have to learn all of them but so they're not easily
148 N - Handle rendezvousing with unverified nodes.
149 - Specify: Stick rendezvous point's key in INTRODUCE cell.
150 Bob should _always_ use key from INTRODUCE cell.
153 N - IPv6 support (For exit addresses)
154 - Spec issue: if a resolve returns an IP4 and an IP6 address,
156 - Add to exit policy code
157 - Make tor_gethostbyname into tor_getaddrinfo
158 - Make everything that uses uint32_t as an IP address change to use
159 a generalize address struct.
160 - Change relay cell types to accept new addresses.
161 - Add flag to serverdescs to tell whether IPv6 is supported.
164 - christian grothoff's attack of infinite-length circuit.
165 the solution is to have a separate 'extend-data' cell type
166 which is used for the first N data cells, and only
167 extend-data cells can be extend requests.
170 o fix router_get_by_* functions so they can get ourselves too ...
171 - and audit everything to make sure rend and intro points are
172 just as likely to be us as not.
174 - tor should be able to have a pool of outgoing IP addresses
175 that it is able to rotate through. (maybe)
177 Packaging, docs, etc:
178 - Exit node caching: tie into squid or other caching web proxy.
180 Deferred until needed:
181 - Do something to prevent spurious EXTEND cells from making middleman
182 nodes connect all over. Rate-limit failed connections, perhaps?
183 - Limit to 2 dir, 2 OR, N SOCKS connections per IP.
184 - Handle full buffers without totally borking
185 * do this eventually, no rush.
186 - Rate-limit OR and directory connections overall and per-IP and
188 - DoS protection: TLS puzzles, public key ops, bandwidth exhaustion.
189 - Have clients and dirservers preserve reputation info over
191 - authdirserver lists you as running iff:
192 - he can connect to you
193 - he has successfully extended to you
194 - you have sufficient mean-time-between-failures
195 * keep doing nothing for now.
196 - Include HTTP status messages in logging (see parse_http_response).
198 Blue sky or deferred indefinitely:
199 - Support egd or other non-OS-integrated strong entropy sources
200 - password protection for on-disk identity key
201 - Possible to get autoconf to easily install things into ~/.tor?
202 - server descriptor declares min log level, clients avoid servers
204 - put expiry date on onion-key, so people don't keep trying
205 old ones that they could know are expired?
206 - Add a notion of nickname->Pubkey binding that's not 'verification'
208 - Need a relay teardown cell, separate from one-way ends.
210 Big tasks that would demonstrate progress:
212 - Facility to automatically choose long-term helper nodes; perhaps
213 on by default for hidden services.
214 - patch privoxy and socks protocol to pass strings to the browser.
215 - patch tsocks with our current patches + gethostbyname, getpeername, etc.
216 - make freecap (or whichever) do what we want.
217 - scrubbing proxies for protocols other than http.
218 - Find an smtp proxy?
219 . Get socks4a support into Mozilla
220 - figure out enclaves, e.g. so we know what to recommend that people
221 do, and so running a tor server on your website is helpful.
222 - Do enclaves for same IP only.
223 - Resolve first, then if IP is an OR, extend to him first.
224 - implement a trivial fun gui to demonstrate our control interface.
226 ************************ Roadmap for 2004-2005 **********************
228 Hard problems that need to be solved:
230 - Separating node discovery from routing.
231 - Arranging membership management for independence.
232 Sybil defenses without having a human bottleneck.
233 How to gather random sample of nodes.
234 How to handle nodelist recommendations.
235 Consider incremental switches: a p2p tor with only 50 users has
236 different anonymity properties than one with 10k users, and should
237 be treated differently.
238 - Measuring performance of other nodes. Measuring whether they're up.
239 - Choosing exit node by meta-data, e.g. country.
240 - Incentives to relay; incentives to exit.
241 - Allowing dissidents to relay through Tor clients.
242 - How to intercept, or not need to intercept, dns queries locally.
243 - Improved anonymity:
244 - Experiment with mid-latency systems. How do they impact usability,
245 how do they impact safety?
246 - Understand how powerful fingerprinting attacks are, and experiment
247 with ways to foil them (long-range padding?).
248 - Come up with practical approximations to picking entry and exit in
249 different routing zones.
250 - Find ideal churn rate for helper nodes; how safe is it?
251 - What info squeaks by Privoxy? Are other scrubbers better?
252 - Attacking freenet-gnunet/timing-delay-randomness-arguments.
253 - Is abandoning the circuit the only option when an extend fails, or
254 can we do something without impacting anonymity too much?
255 - Is exiting from the middle of the circuit always a bad idea?
257 Sample Publicity Landmarks:
259 - we have N servers / N users
260 - we have servers at epic and aclu and foo
261 - hidden services are robust and fast
262 - a more decentralized design
263 - tor win32 installer works
264 - win32 tray icon for end-users
265 - tor server works on win32
266 - win32 service for servers
267 - mac installer works
269 ***************************Future tasks:****************************
271 Rendezvous and hidden services:
273 o preemptively build and start rendezvous circs.
274 o preemptively build n-1 hops of intro circs?
275 o cannibalize general circs?
277 - standby/hotswap/redundant services.
278 - store stuff to disk? dirservers forget service descriptors when
279 they restart; nodes offering hidden services forget their chosen
280 intro points when they restart.
282 - auth mechanisms to let midpoint and bob selectively choose
285 - robust decentralized storage for hidden service descriptors.
287 - web proxy gateways to let normal people browse hidden services.
290 Relax clique assumptions.
291 Redesign how directories are handled.
292 - Resolve directory agreement somehow.
293 Find and remove bottlenecks
294 - Address linear searches on e.g. circuit and connection lists.
295 Reputation/memory system, so dirservers can measure people,
296 and so other people can verify their measurements.
297 - Need to measure via relay, so it's not distinguishable.
298 Let dissidents get to Tor servers via Tor users. ("Backbone model")
300 Make it more correct:
301 Handle half-open connections: right now we don't support all TCP
302 streams, at least according to the protocol. But we handle all that
303 we've seen in the wild.
306 Efficiency/speed/robustness:
307 Congestion control. Is our current design sufficient once we have heavy
308 use? Need to measure and tweak, or maybe overhaul.
309 Allow small cells and large cells on the same network?
310 Cell buffering and resending. This will allow us to handle broken
311 circuits as long as the endpoints don't break, plus will allow
312 connection (tls session key) rotation.
313 Implement Morphmix, so we can compare its behavior, complexity, etc.
314 Use cpuworker for more heavy lifting.
315 - Signing (and verifying) hidserv descriptors
316 - Signing (and verifying) intro/rend requests
317 - Signing (and verifying) router descriptors
318 - Signing (and verifying) directories
319 - Doing TLS handshake (this is very hard to separate out, though)
320 Buffer size pool: allocate a maximum size for all buffers, not
321 a maximum size for each buffer. So we don't have to give up as
322 quickly (and kill the thickpipe!) when there's congestion.
323 Other transport. HTTP, udp, rdp, airhook, etc. May have to do our own
324 link crypto, unless we can bully openssl into it.