2005-06-08 04:10:20 +02:00
|
|
|
$Id$
|
2003-03-18 00:19:25 +01:00
|
|
|
Legend:
|
|
|
|
SPEC!! - Not specified
|
|
|
|
SPEC - Spec not finalized
|
2005-12-07 22:45:53 +01:00
|
|
|
N - nick claims
|
|
|
|
R - arma claims
|
|
|
|
P - phobos claims
|
2003-03-18 00:19:25 +01:00
|
|
|
- Not done
|
|
|
|
* Top priority
|
|
|
|
. Partially done
|
|
|
|
o Done
|
|
|
|
D Deferred
|
|
|
|
X Abandoned
|
|
|
|
|
2006-04-23 23:36:52 +02:00
|
|
|
Non-Coding:
|
|
|
|
- Mark up spec; note unclear points about servers
|
|
|
|
- Mention controller libs someplace.
|
2005-06-11 06:38:12 +02:00
|
|
|
P - flesh out the rest of the section 6 of the faq
|
2006-04-23 23:36:52 +02:00
|
|
|
. more pictures from ren. he wants to describe the tor handshake
|
2006-04-09 08:38:01 +02:00
|
|
|
R - make a page with the hidden service diagrams.
|
2005-06-11 06:38:12 +02:00
|
|
|
NR- write a spec appendix for 'being nice with tor'
|
|
|
|
- tor-in-the-media page
|
|
|
|
- Remove need for HACKING file.
|
2006-04-23 23:36:52 +02:00
|
|
|
- Figure out licenses for website material.
|
2005-06-11 06:38:12 +02:00
|
|
|
|
2005-12-24 05:02:29 +01:00
|
|
|
Website:
|
|
|
|
- and remove home and make the "Tor" picture be the link to home.
|
|
|
|
- put the logo on the website, in source form, so people can put it on
|
|
|
|
stickers directly, etc.
|
2005-08-27 05:20:51 +02:00
|
|
|
|
2006-03-11 19:44:11 +01:00
|
|
|
for 0.1.1.x-final:
|
2006-04-23 23:36:52 +02:00
|
|
|
- building on freebsd 6.0: (with multiple openssl installations)
|
2006-02-11 09:25:40 +01:00
|
|
|
. <nickm> "Let's try to find a way to make it run and make the version
|
|
|
|
match, but if not, let's just make it run."
|
|
|
|
- <arma> should we detect if we have a --with-ssl-dir and try the -R
|
|
|
|
by default, if it works?
|
2006-02-05 10:37:02 +01:00
|
|
|
|
2006-01-24 05:31:46 +01:00
|
|
|
- support dir 503s better
|
2006-02-05 06:43:47 +01:00
|
|
|
o clients don't log as loudly when they receive them
|
2006-01-24 05:31:46 +01:00
|
|
|
- they don't count toward the 3-strikes rule
|
|
|
|
- should there be some threshold of 503's after which we give up?
|
|
|
|
- think about how to split "router is down" from "dirport shouldn't
|
|
|
|
be tried for a while"?
|
|
|
|
- authorities should *never* 503 a cache, but *should* 503 clients
|
|
|
|
when they feel like it.
|
|
|
|
- update dir-spec with what we decided for each of these
|
2005-12-15 21:41:34 +01:00
|
|
|
|
2006-02-20 03:40:31 +01:00
|
|
|
- are there other options that we haven't documented so far?
|
2006-04-09 08:38:01 +02:00
|
|
|
. look at the proposed os x uninstaller:
|
2006-02-20 03:40:31 +01:00
|
|
|
http://archives.seul.org/or/talk/Jan-2006/msg00038.html
|
|
|
|
|
2006-03-28 09:34:19 +02:00
|
|
|
- Interim things:
|
|
|
|
- provide no-cache no-index headers from the dirport?
|
2006-04-09 08:38:01 +02:00
|
|
|
o remove down/useless descriptors from v1 directory?
|
2006-04-09 13:51:50 +02:00
|
|
|
- exitlist should avoid outputting the same IP address twice.
|
2006-04-10 11:43:30 +02:00
|
|
|
- if we have no predicted ports, don't fetch router descriptors.
|
|
|
|
this way we are more dormant.
|
2006-03-28 09:34:19 +02:00
|
|
|
|
2006-04-23 23:36:52 +02:00
|
|
|
Must-have items for 0.1.2.x:
|
2006-02-20 03:40:31 +01:00
|
|
|
|
2006-04-23 23:36:52 +02:00
|
|
|
- Directory guards
|
|
|
|
R - Server usability
|
|
|
|
N - Better hidden service performance, with possible redesign.
|
|
|
|
- Asynchronous DNS
|
|
|
|
- Better estimates in the directory of whether servers have good uptime
|
|
|
|
(high expected time to failure) or good guard qualities (high
|
|
|
|
fractional uptime).
|
|
|
|
- memory usage on dir servers.
|
|
|
|
copy less!
|
|
|
|
N - oprofile including kernel time on multiple platforms
|
2006-04-10 07:47:03 +02:00
|
|
|
|
2006-04-23 23:36:52 +02:00
|
|
|
Items for 0.1.2:
|
|
|
|
- Improve controller
|
|
|
|
- change circuit status events to give more details, like purpose,
|
|
|
|
whether they're internal, when they become dirty, when they become
|
|
|
|
too dirty for further circuits, etc.
|
|
|
|
- What do we want here, exactly?
|
|
|
|
- Specify and implement it.
|
|
|
|
- Change stream status events analogously.
|
|
|
|
- What do we want here, exactly?
|
|
|
|
- Specify and implement it.
|
|
|
|
- Make other events "better".
|
|
|
|
- Change stream status events analogously.
|
|
|
|
- What do we want here, exactly?
|
|
|
|
- Specify and implement it.
|
|
|
|
- Make other events "better" analogously
|
|
|
|
- What do we want here, exactly?
|
|
|
|
- Specify and implement it.
|
|
|
|
. Expose more information via getinfo:
|
|
|
|
- import and export rendezvous descriptors
|
|
|
|
- Review all static fields for additional candidates
|
|
|
|
- Allow EXTENDCIRCUIT to unknown server.
|
|
|
|
- We need some way to adjust server status, and to tell tor not to
|
|
|
|
download directories/network-status, and a way to force a download.
|
|
|
|
- It would be nice to request address lookups from the controller
|
|
|
|
without using SOCKS.
|
|
|
|
- Make everything work with hidden services
|
|
|
|
|
|
|
|
- Clients should refer to avoid exit nodes for non-exit path positions.
|
|
|
|
(bug 200)
|
2006-03-09 02:47:31 +01:00
|
|
|
- Make "setconf" and "hup" behavior cleaner for LINELIST config
|
|
|
|
options (e.g. Log). Bug 238.
|
2006-04-23 23:36:52 +02:00
|
|
|
|
|
|
|
- We need a way for the authorities to declare that nodes are
|
|
|
|
in a family. Also, it kinda sucks that family declarations use O(N^2)
|
|
|
|
space in the descriptors.
|
|
|
|
- Design
|
|
|
|
- Implement
|
|
|
|
|
|
|
|
- Have a "ReallyFast" status flag that means it.
|
2006-02-20 03:40:31 +01:00
|
|
|
|
|
|
|
R - look into "uncounting" bytes spent on local connections. so
|
|
|
|
we can bandwidthrate but still have fast downloads.
|
|
|
|
|
2006-04-23 23:36:52 +02:00
|
|
|
- When we connect to a Tor server, it sends back a cell listing
|
2005-12-15 21:41:34 +01:00
|
|
|
the IP it believes it is using. Use this to block dvorak's attack.
|
|
|
|
Also, this is a fine time to say what time you think it is.
|
2006-04-23 23:36:52 +02:00
|
|
|
o Verify that a new cell type is okay with deployed codebase
|
2005-12-15 21:41:34 +01:00
|
|
|
- Specify
|
|
|
|
- Implement
|
|
|
|
|
2006-04-23 23:36:52 +02:00
|
|
|
R - Failed rend desc fetches sometimes don't get retried.
|
2006-02-13 08:36:15 +01:00
|
|
|
|
2006-04-23 23:36:52 +02:00
|
|
|
- Directory system improvements
|
|
|
|
- config option to publish what ports you listen on, beyond
|
|
|
|
ORPort/DirPort. It should support ranges and bit prefixes (?) too.
|
|
|
|
- Parse this.
|
|
|
|
- Relay this in networkstatus.
|
|
|
|
|
|
|
|
- Non-directories don't need to keep descriptors in memory.
|
|
|
|
- Remember file and offset.
|
|
|
|
- Keep a journal FD for appending router descriptors
|
|
|
|
|
2006-04-23 23:40:15 +02:00
|
|
|
- Make reverse DNS work.
|
|
|
|
|
2006-04-23 23:36:52 +02:00
|
|
|
Topics to think about during 0.1.2.x development:
|
|
|
|
- Figure out non-clique.
|
|
|
|
- Figure out partial network knowledge.
|
|
|
|
- Figure out incentives.
|
|
|
|
- Figure out hidden services.
|
|
|
|
|
|
|
|
Minor items for 0.1.2.x as time permits.
|
|
|
|
- Streamline how we define a guard node as 'up'. document it
|
|
|
|
somewhere.
|
|
|
|
- Better installers and build processes.
|
|
|
|
- Commit edmanm's win32 makefil eto tor cvs contrib, or write a new one.
|
|
|
|
- Can we cross-compile?
|
|
|
|
R - Christian Grothoff's attack of infinite-length circuit.
|
|
|
|
the solution is to have a separate 'extend-data' cell type
|
|
|
|
which is used for the first N data cells, and only
|
|
|
|
extend-data cells can be extend requests.
|
|
|
|
- Specify, including thought about anonymity implications.
|
|
|
|
- Implement
|
2006-02-13 08:36:15 +01:00
|
|
|
N - Display the reasons in 'destroy' and 'truncated' cells under some
|
|
|
|
circumstances?
|
2006-02-12 01:13:27 +01:00
|
|
|
- If the server is spewing complaints about raising your ulimit -n,
|
|
|
|
we should add a note about this to the server descriptor so other
|
|
|
|
people can notice too.
|
2006-01-28 10:05:48 +01:00
|
|
|
- We need a getrlimit equivalent on Windows so we can reserve some
|
|
|
|
file descriptors for saving files, etc. Otherwise we'll trigger
|
|
|
|
asserts when we're out of file descriptors and crash.
|
2006-01-12 00:27:47 +01:00
|
|
|
- the tor client can do the "automatic proxy config url" thing?
|
2005-12-16 01:14:33 +01:00
|
|
|
- Automatically determine what ports are reachable and start using
|
|
|
|
those, if circuits aren't working and it's a pattern we recognize
|
|
|
|
("port 443 worked once and port 9001 keeps not working").
|
2006-01-05 22:23:03 +01:00
|
|
|
N - Should router info have a pointer to routerstatus?
|
|
|
|
- We should at least do something about the duplicated fields.
|
|
|
|
|
2005-12-07 22:45:53 +01:00
|
|
|
X switch accountingmax to count total in+out, not either in or
|
2005-11-12 22:42:55 +01:00
|
|
|
out. it's easy to move in this direction (not risky), but hard to
|
|
|
|
back out if we decide we prefer it the way it already is. hm.
|
2005-08-27 05:20:51 +02:00
|
|
|
|
2005-06-07 22:48:47 +02:00
|
|
|
- cpu fixes:
|
|
|
|
- see if we should make use of truncate to retry
|
2005-08-23 09:36:55 +02:00
|
|
|
R - kill dns workers more slowly
|
2005-08-27 05:20:51 +02:00
|
|
|
|
|
|
|
. Directory changes
|
2005-09-20 21:30:48 +02:00
|
|
|
. Some back-out mechanism for auto-approval
|
2005-06-08 23:22:36 +02:00
|
|
|
- a way of rolling back approvals to before a timestamp
|
2005-12-07 22:45:53 +01:00
|
|
|
- Consider minion-like fingerprint file/log combination.
|
2005-08-27 05:20:51 +02:00
|
|
|
|
2005-06-07 22:48:47 +02:00
|
|
|
- packaging and ui stuff:
|
2005-08-23 09:36:55 +02:00
|
|
|
. multiple sample torrc files
|
2005-06-07 22:48:47 +02:00
|
|
|
- uninstallers
|
2005-06-10 08:30:11 +02:00
|
|
|
. for os x
|
2005-08-23 09:36:55 +02:00
|
|
|
. figure out how to make nt service stuff work?
|
2005-06-10 08:30:11 +02:00
|
|
|
. Document it.
|
2006-04-09 08:38:01 +02:00
|
|
|
o Add version number to directory.
|
2005-06-11 06:38:12 +02:00
|
|
|
N - Vet all pending installer patches
|
|
|
|
- Win32 installer plus privoxy, sockscap/freecap, etc.
|
|
|
|
- Vet win32 systray helper code
|
|
|
|
|
2005-11-12 22:41:24 +01:00
|
|
|
- document:
|
2006-04-09 08:38:01 +02:00
|
|
|
o torcp needs more attention in the tor-doc-win32.
|
2005-11-12 22:41:24 +01:00
|
|
|
- recommend gaim.
|
|
|
|
- unrecommend IE because of ftp:// bug.
|
|
|
|
- torrc.complete.in needs attention?
|
|
|
|
|
2005-12-07 22:45:53 +01:00
|
|
|
- Bind to random port when making outgoing connections to Tor servers,
|
|
|
|
to reduce remote sniping attacks.
|
|
|
|
- Have new people be in limbo and need to demonstrate usefulness
|
|
|
|
before we approve them.
|
|
|
|
- Clients should estimate their skew as median of skew from servers
|
|
|
|
over last N seconds.
|
|
|
|
- Security
|
|
|
|
- Alices avoid duplicate class C nodes.
|
|
|
|
- Analyze how bad the partitioning is or isn't.
|
2005-06-07 22:48:47 +02:00
|
|
|
|
2005-11-12 22:41:24 +01:00
|
|
|
. Update the hidden service stuff for the new dir approach.
|
2005-12-07 22:45:53 +01:00
|
|
|
- switch to an ascii format, maybe sexpr?
|
2005-11-12 22:41:24 +01:00
|
|
|
- authdirservers publish blobs of them.
|
|
|
|
- other authdirservers fetch these blobs.
|
|
|
|
- hidserv people have the option of not uploading their blobs.
|
|
|
|
- you can insert a blob via the controller.
|
|
|
|
- and there's some amount of backwards compatibility.
|
|
|
|
- teach clients, intro points, and hidservs about auth mechanisms.
|
|
|
|
- come up with a few more auth mechanisms.
|
2006-04-09 08:38:01 +02:00
|
|
|
- auth mechanisms to let hidden service midpoint and responder filter
|
|
|
|
connection requests.
|
2005-11-12 22:41:24 +01:00
|
|
|
|
|
|
|
. Come up with a coherent strategy for bandwidth buckets and TLS. (The
|
|
|
|
logic for reading from TLS sockets is likely to overrun the bandwidth
|
|
|
|
buckets under heavy load. (Really, the logic was never right in the
|
|
|
|
first place.) Also, we should audit all users of get_pending_bytes().)
|
|
|
|
- Make it harder to circumvent bandwidth caps: look at number of bytes
|
|
|
|
sent across sockets, not number sent inside TLS stream.
|
|
|
|
|
2005-09-21 06:02:54 +02:00
|
|
|
- Make router_is_general_exit() a bit smarter once we're sure what it's for.
|
|
|
|
|
2005-06-11 06:38:12 +02:00
|
|
|
- rewrite how libevent does select() on win32 so it's not so very slow.
|
|
|
|
- Write limiting; separate token bucket for write
|
|
|
|
- Audit everything to make sure rend and intro points are just as likely to
|
|
|
|
be us as not.
|
|
|
|
- Do something to prevent spurious EXTEND cells from making middleman
|
|
|
|
nodes connect all over. Rate-limit failed connections, perhaps?
|
|
|
|
|
|
|
|
Future version:
|
|
|
|
- Limit to 2 dir, 2 OR, N SOCKS connections per IP.
|
|
|
|
- Handle full buffers without totally borking
|
|
|
|
- Rate-limit OR and directory connections overall and per-IP and
|
|
|
|
maybe per subnet.
|
|
|
|
- Hold-open-until-flushed now works by accident; it should work by
|
|
|
|
design.
|
|
|
|
- DoS protection: TLS puzzles, public key ops, bandwidth exhaustion.
|
2005-08-23 09:36:55 +02:00
|
|
|
- Specify?
|
2005-06-11 06:38:12 +02:00
|
|
|
- tor-resolve script should use socks5 to get better error messages.
|
2005-12-07 22:45:53 +01:00
|
|
|
- Track uptime as %-of-time-up, as well as time-since-last-down.
|
2005-02-23 22:59:09 +01:00
|
|
|
- hidserv offerers shouldn't need to define a SocksPort
|
|
|
|
* figure out what breaks for this, and do it.
|
2005-06-11 06:38:12 +02:00
|
|
|
- Relax clique assumptions.
|
2006-01-05 22:32:33 +01:00
|
|
|
X start handling server descriptors without a socksport?
|
2005-06-11 07:25:21 +02:00
|
|
|
- tor should be able to have a pool of outgoing IP addresses
|
|
|
|
that it is able to rotate through. (maybe)
|
2006-04-09 08:19:23 +02:00
|
|
|
- let each hidden service (or other thing) specify its own
|
|
|
|
OutboundBindAddress?
|
2005-06-11 06:38:12 +02:00
|
|
|
|
|
|
|
Blue-sky:
|
|
|
|
- Patch privoxy and socks protocol to pass strings to the browser.
|
|
|
|
- Standby/hotswap/redundant hidden services.
|
|
|
|
- Robust decentralized storage for hidden service descriptors.
|
|
|
|
- The "China problem"
|
|
|
|
- Allow small cells and large cells on the same network?
|
|
|
|
- Cell buffering and resending. This will allow us to handle broken
|
|
|
|
circuits as long as the endpoints don't break, plus will allow
|
|
|
|
connection (tls session key) rotation.
|
|
|
|
- Implement Morphmix, so we can compare its behavior, complexity, etc.
|
|
|
|
- Other transport. HTTP, udp, rdp, airhook, etc. May have to do our own
|
|
|
|
link crypto, unless we can bully openssl into it.
|
2005-06-11 07:25:21 +02:00
|
|
|
- Need a relay teardown cell, separate from one-way ends.
|
|
|
|
(Pending a user who needs this)
|
|
|
|
- Handle half-open connections: right now we don't support all TCP
|
|
|
|
streams, at least according to the protocol. But we handle all that
|
|
|
|
we've seen in the wild.
|
|
|
|
(Pending a user who needs this)
|