TODO List for netfilter / iptables. Currently maintained by Harald Welte Please inform me, if you want to work on any of the TODO items, so I can update this list and thus prevent two people doing the same work. CVS ID: $Id: TODO,v 1.36 2001/05/23 23:07:33 laforge Exp $ IMPORTANT issues: - solution for nostate / notrack (we don't want to track specific conn's) - multiple related connections [HW] - ip_conntrack rmmod loop (sometimes, Yan's patch?) - conntrack helper not called for first packet (udp!) - why is nat_helper's expect() function called for all helpers? [HW] X full tcp window tracking incompatibility with nat helpers [HW] ? Hard lockup with ip_queue under heavy load (was possibly some unrelated 2.3 problem) [JM] - mangle table should use all five netfilter hooks [HW] X merge EPRT / EPSV ftp stuff [RR] (reimplemented in ftp-fixes, included 2.4.4) X runme error with IPv6 stuff! [HW] - wrong 'Out of window' error message from tcp-windowtracking [HW] X SMP conntrack race [RR] (ftp-fixes, included in 2.4.4) - static compiling/linking of iptables (for router-on-a-disk) [HW] - IPv6 testing (MARK, LOG, REJECT) [HW] x iptables-save doesn't work with eth+ style multiple IF stuff [HW] X reject-with on REJECT target doesn't work [HW] - IPv6 REJECT target doesn't have extension plugin ?!? - colon inside prefix doesn't work - pending minor ip_queue updates [JM] NICE to have: - multicast connection tracking - sysctl support for ftp-multi, irc-conntrack/nat, ftp-fxp - integrate HOPLIMIT for ipv6 in patch-o-matic [HW] X static 1:1 NAT (only ip address NAT in both directions) (NETMAP target) - u32 classifier (port from tc -> iptables) [YU] X pktlen match (not needed, when u32 available) [FM] - MARK match / target with boolean OR / AND (to use nfmark bitwise) - documentation for libiptc - port conntrack to IPv6 (code reuse?) [BB] X port matches (owner, limit, multiport, owner) to IPv6 [RJ] - make patch-o-matic more generic (any subdir), and reversible - CONFIG_NF_IP_NAT_LOCAL - fix and test the netfilter bridging stuff X integrate the ipt_NETLINK target from gianni@ecsc.co.uk [HW] X integrate PSD target / port it as match [HW] - various NAT performance optimizations possible! (which? ask HW) - ip_nat_ident module [FM] - provide daily CVS snapshots via ftp [HW] - 10.1.2.3.4 is accepted as a valid IP address by iptables -s / -d ? - make iptables / ip6tables use the same codebase (as libiptc) [KA] - string_to_number() does not work correctly for unsigned ints [JM] - libipq reentrancy [JM] - libipq asynchronousness [JM] FUTURE extensions: - dealing with fragmented expectation-causes (i.e. DCC chat split over two packets, etc.) - conntrack / nat failover [HW] - brainstorming about 2.5 conntrack code - netlink interface for conntrack manipulation from userspace [HW] - unified nfnetlink for queue,ulog,conntrack (and more?) (2.5 issue) ====================================================================== [RR] Paul 'Rusty' Russel [MB] Marc Boucher [JM] James Morris [HW] Harald Welte [YU] Yon Uriarte [RJ] Jan Rekorajski [BB] Bastian Blank [FM] Fabrice Marie [KA] Kiz-Szabo Andras