TODO 13.9 KB
Newer Older
Roger Dingledine's avatar
Roger Dingledine committed
1

2
3
4
5
6
7
8
9
10
11
12
13
Legend:
SPEC!!  - Not specified
SPEC    - Spec not finalized
NICK    - nick claims
ARMA    - arma claims
        - Not done
        * Top priority
        . Partially done
        o Done
        D Deferred
        X Abandoned

14
      0.0.9pre2:
15
R       . bandwidth buckets for write as well as read.
16
17
        o switch dirservers entries to config lines.
        o add three default dirplaces if we parse the whole torrc and
Roger Dingledine's avatar
Roger Dingledine committed
18
          no dirplaces are specified.
Nick Mathewson's avatar
Nick Mathewson committed
19
20
N       - Handle rendezvousing with unverified nodes.
          - Specify: Stick rendezvous point's key in INTRODUCE cell.
21
22
            Bob should _always_ use key from INTRODUCE cell.
          - Implement.
Nick Mathewson's avatar
Nick Mathewson committed
23
24
N       - node 'groups' that are known to be in the same zone of control.
          - Nodes can list their coadministrated nodes.
Roger Dingledine's avatar
Roger Dingledine committed
25
            - If A lists B, it only counts if B also lists A
26
          - Users can list other coadministrated nodes if they like.
Roger Dingledine's avatar
Roger Dingledine committed
27
          . Never choose two coadministrated nodes in the same circuit.
Nick Mathewson's avatar
Nick Mathewson committed
28
R       - figure out enclaves, e.g. so we know what to recommend that people
29
          do, and so running a tor server on your website is helpful.
30
31
          - Do enclaves for same IP only.
          - Resolve first, then if IP is an OR, connect to next guy.
Roger Dingledine's avatar
Roger Dingledine committed
32
33
34
N       - let tor servers use proxies for port 80 exits
          - Use generic port redirector for IP/bits:Port->IP:Port .
          - Make use of them when we're doing exit connections.
Nick Mathewson's avatar
Nick Mathewson committed
35
36
N	- Make "tor -V" or "tor [-]-version" print the version and exit.
 
Roger Dingledine's avatar
Roger Dingledine committed
37

38
      0.0.9pre3:
Roger Dingledine's avatar
Roger Dingledine committed
39
40
41
42
43
44
45
N       - per-month byte allowances.
          - Based on bandwidth and per-month allowance, choose a
            window within month to be up.  Stay up until allowance is
            used.  Adjust next month's window based on outcome.  Hibernate
            when we're not up.
          - Hibernate means "stop accepting connections, and start sleeping"
N       - Pure C tor_resolve
Nick Mathewson's avatar
Nick Mathewson committed
46
N       - the user interface interface
47
48
          - Skeleton only.
          - Implement parts along with trivial fun gui.
Nick Mathewson's avatar
Nick Mathewson committed
49
50
51
52
N       - add ipv6 support.
          - Spec issue: if a resolve returns an IP4 and an IP6 address,
            which to use?
R       - learn from ben about his openssl-reinitialization-trick to
53
          rotate tls keys without making new connections.
54
          - (Roger grabs Ben next time he sees him on IRC) 
Roger Dingledine's avatar
Roger Dingledine committed
55
56
57

        D let tor clients use http proxies for dir fetching
          - have a config entry to specify where to go
58
        D nt services on win32.
59

Roger Dingledine's avatar
Roger Dingledine committed
60
      0.0.9 and beyond:
61
        - fix sprintf's to snprintf's?
Nick Mathewson's avatar
Nick Mathewson committed
62
        . Make intro points and rendezvous points accept $KEYID in addition
Roger Dingledine's avatar
Roger Dingledine committed
63
          to nicknames.
Nick Mathewson's avatar
Nick Mathewson committed
64
                o Specify
Nick Mathewson's avatar
Nick Mathewson committed
65
                o Implement parsing
66
                - Generate new formats (Not till 007 is dead)
Roger Dingledine's avatar
Roger Dingledine committed
67
68
69
70
        - christian grothoff's attack of infinite-length circuit.
          the solution is to have a separate 'extend-data' cell type
          which is used for the first N data cells, and only
          extend-data cells can be extend requests.
Roger Dingledine's avatar
Roger Dingledine committed
71
        - make loglevel info less noisy
72
73
        - put expiry date on onion-key, so people don't keep trying
          old ones that they could know are expired?
74
* Leave on todo list, see if pre3 onion fixes helped enough.
75
76
        - should the running-routers list put unverified routers at the
          end?
Roger Dingledine's avatar
Roger Dingledine committed
77
* Cosmetic, don't do it yet.
78
        - make advertised_server_mode() ORs fetch dirs more often.
Roger Dingledine's avatar
Roger Dingledine committed
79
80
81
* not necessary yet.
        - Add a notion of nickname->Pubkey binding that's not 'verification'
* eventually, only when needed
82
        - ORs use uniquer default nicknames
Roger Dingledine's avatar
Roger Dingledine committed
83
* Don't worry about this for now
84
        - Handle full buffers without totally borking
Roger Dingledine's avatar
Roger Dingledine committed
85
* do this eventually, no rush.
86
87
        - have a pool of circuits available, cannibalize them
          for your purposes (e.g. rendezvous, etc).
Roger Dingledine's avatar
Roger Dingledine committed
88
89
90
91
92
        - do resolve before trying to attach the stream
* don't do this for now.
        - if destination IP is running a tor node, extend a circuit there
          before sending begin.
* don't do this for now. figure out how enclaves work. but do enclaves soon.
Nick Mathewson's avatar
Nick Mathewson committed
93
        - Support egd or other non-OS-integrated strong entropy sources
94

95
      more features, complex:
96
        - Switch dirservers entries to config lines:
97
98
99
100
101
102
103
104
105
106
107
          - read in and parse each TrustedDir config line.
          - stop reading dirservers file.
          - add some default TrustedDir lines if none defined, or if
            no torrc.
          - remove notion of ->is_trusted_dir from the routerlist. that's
            no longer where you look.
            - clean up router parsing flow, since it's simpler now?
          - when checking signature on a directory, look it up in
            options.TrustedDirs, and make sure there's a descriptor
            with that nickname, whose key hashes to the fingerprint,
            and who correctly signed the directory.
Roger Dingledine's avatar
Roger Dingledine committed
108
* nick will do the above
109
110
111
112
113
          - when fetching a directory, if you want a trusted one,
            choose from the trusteddir list.
            - which means keeping track of which ones are "up"
          - if you don't need a trusted one, choose from the routerinfo
            list if you have one, else from the trusteddir list.
Roger Dingledine's avatar
Roger Dingledine committed
114
* roger will do the above
115
        - add a listener for a ui
Roger Dingledine's avatar
Roger Dingledine committed
116
* nick chats with weasel
117
          - and a basic gui
Roger Dingledine's avatar
Roger Dingledine committed
118
119
        - Have clients and dirservers preserve reputation info over
          reboots.
Roger Dingledine's avatar
Roger Dingledine committed
120
* continue not doing until we have something we need to preserve
Roger Dingledine's avatar
Roger Dingledine committed
121
        - round detected bandwidth up to nearest 10KB?
Roger Dingledine's avatar
Roger Dingledine committed
122
123
124
125
126
127
128
        - client software not upload descriptor until:
          - you've been running for an hour
          - it's sufficiently satisfied with its bandwidth
          - it decides it is reachable
          - start counting again if your IP ever changes.
          - never regenerate identity keys, for now.
          - you can set a bit for not-being-an-OR.
Roger Dingledine's avatar
Roger Dingledine committed
129
* no need to do this yet. few people define their ORPort.
Roger Dingledine's avatar
Roger Dingledine committed
130
131
132
133
        - authdirserver lists you as running iff:
          - he can connect to you
          - he has successfully extended to you
          - you have sufficient mean-time-between-failures
Roger Dingledine's avatar
Roger Dingledine committed
134
* keep doing nothing for now.
135

136
137
      blue sky:
        - Possible to get autoconf to easily install things into ~/.tor?
138
139
140

      ongoing:
        . rename/rearrange functions for what file they're in
141
142
        - generalize our transport: add transport.c in preparation for
          http, airhook, etc transport.
Roger Dingledine's avatar
Roger Dingledine committed
143
NICK    - investigate sctp for alternate transport.
144

Roger Dingledine's avatar
Roger Dingledine committed
145
For September:
Nick Mathewson's avatar
Nick Mathewson committed
146
NICK    . Windows port
147
          o works as client
Roger Dingledine's avatar
Roger Dingledine committed
148
            - deal with pollhup / reached_eof on all platforms
149
          . robust as a client
150
          . works as server
Roger Dingledine's avatar
Roger Dingledine committed
151
152
            - can be configured
          - robust as a server
153
          . Usable as NT service
Roger Dingledine's avatar
Roger Dingledine committed
154
          - docs for building in win
Nick Mathewson's avatar
Nick Mathewson committed
155
          - installer, including all needed libs.  
Roger Dingledine's avatar
Roger Dingledine committed
156
157

        - Docs
Roger Dingledine's avatar
Roger Dingledine committed
158
          . FAQ
159
          o overview of tor. how does it work, what's it do, pros and
Roger Dingledine's avatar
Roger Dingledine committed
160
161
            cons of using it, why should I use it, etc.
          - a howto tutorial with examples
Roger Dingledine's avatar
Roger Dingledine committed
162
* put a stub on the wiki
163
          o tutorial: how to set up your own tor network
164
            - (need to not hardcode dirservers file in config.c)
Roger Dingledine's avatar
Roger Dingledine committed
165
166
167
* this will be solved when we put dirservers in config lines
          - port forwarding howto for ipchains, etc
* roger add to wiki of requests
168
          . correct, update, polish spec
Roger Dingledine's avatar
Roger Dingledine committed
169
          - document the exposed function api?
170
          o document what we mean by socks.
Roger Dingledine's avatar
Roger Dingledine committed
171

172
173
NICK    . packages
          . rpm
Roger Dingledine's avatar
Roger Dingledine committed
174
* nick will look at the spec file
Roger Dingledine's avatar
Roger Dingledine committed
175
          - find a long-term rpm maintainer
Roger Dingledine's avatar
Roger Dingledine committed
176
* roger will start guilting people
Roger Dingledine's avatar
Roger Dingledine committed
177
178
179

        - code
          - better warn/info messages
180
181
182
          o let tor do resolves.
          o extend socks4 to do resolves?
          o make script to ask tor for resolves
Roger Dingledine's avatar
Roger Dingledine committed
183
184
185
          - write howto for setting up tsocks, socat.
            - including on osx and win32
          - freecap handling
Roger Dingledine's avatar
Roger Dingledine committed
186
          - tsocks
187
            o gather patches, submit to maintainer
Roger Dingledine's avatar
Roger Dingledine committed
188
* send him a reminder mail and see what's up.
189
            - intercept gethostbyname and others
Roger Dingledine's avatar
Roger Dingledine committed
190
* add this to tsocks
191
            o do resolve via tor
Roger Dingledine's avatar
Roger Dingledine committed
192
193
194
195
196
197
198
          - redesign and thorough code revamp, with particular eye toward:
            - support half-open tcp connections
            - conn key rotation
            - other transports -- http, airhook
            - modular introduction mechanism
            - allow non-clique topology

Roger Dingledine's avatar
Roger Dingledine committed
199
200
201
202
Other details and small and hard things:
        - tor should be able to have a pool of outgoing IP addresses
          that it is able to rotate through. (maybe)
        - tie into squid
203
        - hidserv offerers shouldn't need to define a SocksPort
Roger Dingledine's avatar
Roger Dingledine committed
204
* figure out what breaks for this, and do it.
205
206
        - when the client fails to pick an intro point for a hidserv,
          it should refetch the hidserv desc.
Roger Dingledine's avatar
Roger Dingledine committed
207
        . should maybe make clients exit(1) when bad things happen?
208
          e.g. clock skew.
Roger Dingledine's avatar
Roger Dingledine committed
209
210
        - should retry exitpolicy end streams even if the end cell didn't
          resolve the address for you
Roger Dingledine's avatar
Roger Dingledine committed
211
        . Make logs handle it better when writing to them fails.
212
        o Dirserver shouldn't put you in running-routers list if you haven't
213
          uploaded a descriptor recently
Roger Dingledine's avatar
Roger Dingledine committed
214
215
216
        . Refactor: add own routerinfo to routerlist.  Right now, only
          router_get_by_nickname knows about 'this router', as a hack to
          get circuit_launch_new to do the right thing.
217
218
219
        . Scrubbing proxies
                - Find an smtp proxy?
                . Get socks4a support into Mozilla
Roger Dingledine's avatar
Roger Dingledine committed
220
221
222
        - Need a relay teardown cell, separate from one-way ends.
        - Make it harder to circumvent bandwidth caps: look at number of bytes
          sent across sockets, not number sent inside TLS stream.
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
        - fix router_get_by_* functions so they can get ourselves too,
          and audit everything to make sure rend and intro points are
          just as likely to be us as not.


***************************Future tasks:****************************

Rendezvous and hidden services:
  make it fast:
    - preemptively build and start rendezvous circs.
    - preemptively build n-1 hops of intro circs?
    - cannibalize general circs?
  make it reliable:
    - standby/hotswap/redundant services.
    - store stuff to disk? dirservers forget service descriptors when
      they restart; nodes offering hidden services forget their chosen
      intro points when they restart.
  make it robust:
    - auth mechanisms to let midpoint and bob selectively choose
      connection requests.
  make it scalable:
    - right now the hidserv store/lookup system is run by the dirservers;
      this won't scale.

Tor scalability:
  Relax clique assumptions.
  Redesign how directories are handled.
    - Separate running-routers lookup from descriptor list lookup.
    - Resolve directory agreement somehow.
    - Cache directory on all servers.
  Find and remove bottlenecks
    - Address linear searches on e.g. circuit and connection lists.
  Reputation/memory system, so dirservers can measure people,
    and so other people can verify their measurements.
    - Need to measure via relay, so it's not distinguishable.
  Bandwidth-aware path selection. So people with T3's are picked
    more often than people with DSL.
  Reliability-aware node selection. So people who are stable are
    preferred for long-term circuits such as intro and rend circs,
    and general circs for irc, aim, ssh, etc.
  Let dissidents get to Tor servers via Tor users. ("Backbone model")

Anonymity improvements:
266
  Is abandoning the circuit the only option when an extend fails, or
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
    can we do something without impacting anonymity too much?
  Is exiting from the middle of the circuit always a bad idea?
  Helper nodes. Decide how to use them to improve safety.
  DNS resolution: need to make tor support resolve requests. Need to write
    a script and an interface (including an extension to the socks
    protocol) so we can ask it to do resolve requests. Need to patch
    tsocks to intercept gethostbyname, else we'll continue leaking it.
  Improve path selection algorithms based on routing-zones paper. Be sure
    to start and end circuits in different ASs. Ideally, consider AS of
    source and destination -- maybe even enter and exit via nearby AS.
  Intermediate model, with some delays and mixing.
  Add defensive dropping regime?

Make it more correct:
  Handle half-open connections: right now we don't support all TCP
    streams, at least according to the protocol. But we handle all that
    we've seen in the wild.
  Support IPv6.

Efficiency/speed/robustness:
  Congestion control. Is our current design sufficient once we have heavy
    use? Need to measure and tweak, or maybe overhaul.
  Allow small cells and large cells on the same network?
  Cell buffering and resending. This will allow us to handle broken
    circuits as long as the endpoints don't break, plus will allow
    connection (tls session key) rotation.
  Implement Morphmix, so we can compare its behavior, complexity, etc.
  Use cpuworker for more heavy lifting.
    - Signing (and verifying) hidserv descriptors
    - Signing (and verifying) intro/rend requests
    - Signing (and verifying) router descriptors
    - Signing (and verifying) directories
    - Doing TLS handshake (this is very hard to separate out, though)
  Buffer size pool: allocate a maximum size for all buffers, not
    a maximum size for each buffer. So we don't have to give up as
    quickly (and kill the thickpipe!) when there's congestion.
  Exit node caching: tie into squid or other caching web proxy.
  Other transport. HTTP, udp, rdp, airhook, etc. May have to do our own
    link crypto, unless we can bully openssl into it.

P2P Tor:
  Do all the scalability stuff above, first.
  Incentives to relay. Not so hard.
  Incentives to allow exit. Possibly quite hard.
  Sybil defenses without having a human bottleneck.
  How to gather random sample of nodes.
  How to handle nodelist recommendations.
  Consider incremental switches: a p2p tor with only 50 users has
    different anonymity properties than one with 10k users, and should
    be treated differently.
317