3 SPEC - Spec not finalized
14 N - clients now have certs, which means we warn when their certs have
15 incorrect times. we need to stop that.
16 - Oct 20 16:45:10.237 [warn] parse_addr_port(): Port '0' out of range
17 o clean up parse_*_policy code
18 o when you hup, they're not getting re-parsed
19 o stop calling a *_policy an exit_policy_t
20 N - Regenerate our server descriptor when a relevant option is changed from
22 . Writing out the machine-readable torrc file
23 o Function to check whether an option has changed.
24 o Function to generate the contents for a torrc file.
25 - Function to safely replace a torrc file.
27 - Download and use running-routers
28 R - document signals in man page
29 N - Document all undocumented configuration options.
31 - Control interface authentication
34 o Merge changes from jbash
35 - Figure out versioning
37 R - Review website; make important info more prominent.
38 R - merge in the contributed tor.sh
43 - controller should have 'getinfo' command to query about rephist,
44 about rendezvous status, etc.
45 - weasel wants to say 50GB rather than 50000000 in config ints.
46 - allow transition from ORPort to !ORPort, and back
47 R . bandwidth buckets for write as well as read.
48 - Limit to 2 dir, 2 OR, N SOCKS connections per IP.
49 o Check getrlimit(RLIMIT_[N]OFILE), sysconf(OPEN_MAX) on start-up, and
50 warn if we're running as a server with a low limit.
51 - Implement If-Modified-Since for directories.
52 - Make more configuration variables into CSVs.
53 N - Handle rendezvousing with unverified nodes.
54 - Specify: Stick rendezvous point's key in INTRODUCE cell.
55 Bob should _always_ use key from INTRODUCE cell.
57 R - figure out enclaves, e.g. so we know what to recommend that people
58 do, and so running a tor server on your website is helpful.
59 - Do enclaves for same IP only.
60 - Resolve first, then if IP is an OR, connect to next guy.
61 N - the user interface interface
62 - Implement a trivial fun gui.
64 - Spec issue: if a resolve returns an IP4 and an IP6 address,
67 R - learn from ben about his openssl-reinitialization-trick to
68 rotate tls keys without making new connections.
69 - (Roger grabs Ben next time he sees him on IRC)
70 - christian grothoff's attack of infinite-length circuit.
71 the solution is to have a separate 'extend-data' cell type
72 which is used for the first N data cells, and only
73 extend-data cells can be extend requests.
74 - have a pool of circuits available, cannibalize them
75 for your purposes (e.g. rendezvous, etc).
76 D nt services on win32.
77 - Once we have a trusted directory on port 80, stop falling back to
78 forbidden ports when fascistfirewall blocks all good dirservers.
80 o fix sprintf's to snprintf's?
81 . Make intro points and rendezvous points accept $KEYID in addition
85 - Generate new formats (Not till 007 is dead)
86 - make loglevel info less noisy
87 - Facility to automatically choose long-term helper nodes; perhaps
88 on by default for hidden services.
89 o Make command-line strict about checking options; make only certain
91 - Rate-limit OR and directory connections overall and per-IP and
93 D put expiry date on onion-key, so people don't keep trying
94 old ones that they could know are expired?
95 * Leave on todo list, see if pre3 onion fixes helped enough.
96 D should the running-routers list put unverified routers at the
98 * Cosmetic, don't do it yet.
99 D make advertised_server_mode() ORs fetch dirs more often.
101 D Add a notion of nickname->Pubkey binding that's not 'verification'
102 * eventually, only when needed
103 D ORs use uniquer default nicknames
104 * Don't worry about this for now
105 D Handle full buffers without totally borking
106 * do this eventually, no rush.
107 D if destination IP is running a tor node, extend a circuit there
108 before sending begin.
109 * don't do this for now. figure out how enclaves work. but do
111 - Support egd or other non-OS-integrated strong entropy sources
113 more features, complex:
114 - password protection for on-disk identity key
115 . Switch dirservers entries to config lines:
116 o read in and parse each TrustedDir config line.
117 o stop reading dirservers file.
118 o add some default TrustedDir lines if none defined, or if
120 o remove notion of ->is_trusted_dir from the routerlist. that's
121 no longer where you look.
122 o clean up router parsing flow, since it's simpler now?
123 o when checking signature on a directory, look it up in
124 options.TrustedDirs, and make sure there's a descriptor
125 with that nickname, whose key hashes to the fingerprint,
126 and who correctly signed the directory.
127 o when fetching a directory, if you want a trusted one,
128 choose from the trusteddir list.
129 o which means keeping track of which ones are "up"
130 ? if you don't need a trusted one, choose from the routerinfo
131 list if you have one, else from the trusteddir list.
132 * roger will do the above
133 - Have clients and dirservers preserve reputation info over
135 * continue not doing until we have something we need to preserve
136 - round detected bandwidth up to nearest 10KB?
137 - client software not upload descriptor until:
138 - you've been running for an hour
139 - it's sufficiently satisfied with its bandwidth
140 - it decides it is reachable
141 - start counting again if your IP ever changes.
142 - never regenerate identity keys, for now.
143 - you can set a bit for not-being-an-OR.
144 * no need to do this yet. few people define their ORPort.
145 - authdirserver lists you as running iff:
146 - he can connect to you
147 - he has successfully extended to you
148 - you have sufficient mean-time-between-failures
149 * keep doing nothing for now.
150 - Include HTTP status messages in logging (see parse_http_response).
153 - Possible to get autoconf to easily install things into ~/.tor?
156 . rename/rearrange functions for what file they're in
157 - generalize our transport: add transport.c in preparation for
158 http, airhook, etc transport.
159 o investigate sctp for alternate transport.
164 - deal with pollhup / reached_eof on all platforms
169 . Usable as NT service
170 - docs for building in win
171 - installer, including all needed libs.
175 o overview of tor. how does it work, what's it do, pros and
176 cons of using it, why should I use it, etc.
177 - a howto tutorial with examples
178 * put a stub on the wiki
179 o tutorial: how to set up your own tor network
180 o (need to not hardcode dirservers file in config.c)
181 o Make tutorial reflect this.
182 . port forwarding howto for ipchains, etc
183 * roger add to wiki of requests
184 . correct, update, polish spec
185 - document the exposed function api?
186 o document what we mean by socks.
187 - Document where we differ from tor-design
190 R - find a long-term rpm maintainer
191 * roger will start guilting people
194 - better warn/info messages
195 o let tor do resolves.
196 o extend socks4 to do resolves?
197 o make script to ask tor for resolves
198 - write howto for setting up tsocks, socat.
199 - including on osx and win32
202 o gather patches, submit to maintainer
203 * send him a reminder mail and see what's up.
204 - intercept gethostbyname and others
207 - redesign and thorough code revamp, with particular eye toward:
208 - support half-open tcp connections
210 - other transports -- http, airhook
211 - modular introduction mechanism
212 - allow non-clique topology
214 Other details and small and hard things:
215 - tor should be able to have a pool of outgoing IP addresses
216 that it is able to rotate through. (maybe)
218 - hidserv offerers shouldn't need to define a SocksPort
219 * figure out what breaks for this, and do it.
220 - when the client fails to pick an intro point for a hidserv,
221 it should refetch the hidserv desc.
222 . should maybe make clients exit(1) when bad things happen?
224 - should retry exitpolicy end streams even if the end cell didn't
225 resolve the address for you
226 . Make logs handle it better when writing to them fails.
227 o Dirserver shouldn't put you in running-routers list if you haven't
228 uploaded a descriptor recently
229 . Refactor: add own routerinfo to routerlist. Right now, only
230 router_get_by_nickname knows about 'this router', as a hack to
231 get circuit_launch_new to do the right thing.
233 - Find an smtp proxy?
234 . Get socks4a support into Mozilla
235 - Need a relay teardown cell, separate from one-way ends.
236 - Make it harder to circumvent bandwidth caps: look at number of bytes
237 sent across sockets, not number sent inside TLS stream.
238 - fix router_get_by_* functions so they can get ourselves too,
239 and audit everything to make sure rend and intro points are
240 just as likely to be us as not.
242 ***************************Future tasks:****************************
244 Rendezvous and hidden services:
246 - preemptively build and start rendezvous circs.
247 - preemptively build n-1 hops of intro circs?
248 - cannibalize general circs?
250 - standby/hotswap/redundant services.
251 - store stuff to disk? dirservers forget service descriptors when
252 they restart; nodes offering hidden services forget their chosen
253 intro points when they restart.
255 - auth mechanisms to let midpoint and bob selectively choose
258 - right now the hidserv store/lookup system is run by the dirservers;
262 Relax clique assumptions.
263 Redesign how directories are handled.
264 - Separate running-routers lookup from descriptor list lookup.
265 - Resolve directory agreement somehow.
266 - Cache directory on all servers.
267 Find and remove bottlenecks
268 - Address linear searches on e.g. circuit and connection lists.
269 Reputation/memory system, so dirservers can measure people,
270 and so other people can verify their measurements.
271 - Need to measure via relay, so it's not distinguishable.
272 Bandwidth-aware path selection. So people with T3's are picked
273 more often than people with DSL.
274 Reliability-aware node selection. So people who are stable are
275 preferred for long-term circuits such as intro and rend circs,
276 and general circs for irc, aim, ssh, etc.
277 Let dissidents get to Tor servers via Tor users. ("Backbone model")
279 Anonymity improvements:
280 Is abandoning the circuit the only option when an extend fails, or
281 can we do something without impacting anonymity too much?
282 Is exiting from the middle of the circuit always a bad idea?
283 Helper nodes. Decide how to use them to improve safety.
284 DNS resolution: need to make tor support resolve requests. Need to write
285 a script and an interface (including an extension to the socks
286 protocol) so we can ask it to do resolve requests. Need to patch
287 tsocks to intercept gethostbyname, else we'll continue leaking it.
288 Improve path selection algorithms based on routing-zones paper. Be sure
289 to start and end circuits in different ASs. Ideally, consider AS of
290 source and destination -- maybe even enter and exit via nearby AS.
291 Intermediate model, with some delays and mixing.
292 Add defensive dropping regime?
294 Make it more correct:
295 Handle half-open connections: right now we don't support all TCP
296 streams, at least according to the protocol. But we handle all that
297 we've seen in the wild.
300 Efficiency/speed/robustness:
301 Congestion control. Is our current design sufficient once we have heavy
302 use? Need to measure and tweak, or maybe overhaul.
303 Allow small cells and large cells on the same network?
304 Cell buffering and resending. This will allow us to handle broken
305 circuits as long as the endpoints don't break, plus will allow
306 connection (tls session key) rotation.
307 Implement Morphmix, so we can compare its behavior, complexity, etc.
308 Use cpuworker for more heavy lifting.
309 - Signing (and verifying) hidserv descriptors
310 - Signing (and verifying) intro/rend requests
311 - Signing (and verifying) router descriptors
312 - Signing (and verifying) directories
313 - Doing TLS handshake (this is very hard to separate out, though)
314 Buffer size pool: allocate a maximum size for all buffers, not
315 a maximum size for each buffer. So we don't have to give up as
316 quickly (and kill the thickpipe!) when there's congestion.
317 Exit node caching: tie into squid or other caching web proxy.
318 Other transport. HTTP, udp, rdp, airhook, etc. May have to do our own
319 link crypto, unless we can bully openssl into it.
322 Do all the scalability stuff above, first.
323 Incentives to relay. Not so hard.
324 Incentives to allow exit. Possibly quite hard.
325 Sybil defenses without having a human bottleneck.
326 How to gather random sample of nodes.
327 How to handle nodelist recommendations.
328 Consider incremental switches: a p2p tor with only 50 users has
329 different anonymity properties than one with 10k users, and should
330 be treated differently.