From 3666e0e686639b95c91d82b90e8296a5b77a49f2 Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Thu, 12 Apr 2001 22:24:29 +0000 Subject: todo reorganization faq update (dropped table now required, doesn't break) --- TODO | 40 +++++++++++++++++++++------------------- 1 file changed, 21 insertions(+), 19 deletions(-) (limited to 'TODO') diff --git a/TODO b/TODO index 91b330c6..65affc5e 100644 --- a/TODO +++ b/TODO @@ -4,39 +4,35 @@ Currently maintained by Harald Welte Please inform me, if you want to work on any of the TODO items, so I can update this list and thus prevent two people doing the same work. -CVS ID: $Id: TODO,v 1.25 2001/03/16 13:40:51 laforge Exp $ +CVS ID: $Id: TODO,v 1.26 2001/03/26 18:06:04 laforge Exp $ -IMPORTANT before iptables-1.2.1 release: -X generic tcp sequence number offset support for nat helpers [HW] -X prerelease make target (for applying certain p-o-m stuff) [RR] -X header files in seperate directory, build all extensions, even - when current kernel not patched [RR] -X restore counters for individual rules (iptables / iptables-restore) [HW] -X add libipulog / libiptc to DEVEL target [RR] +IMPORTANT issues: +- solution for nostate / notrack (we don't want to track specific conn's) +- multiple related connections [HW] +- ip_conntrack rmmod loop (sometimes, Yan's patch?) +- conntrack helper not called for first packet (udp!) +- why is nat_helper's expect() function called for all helpers? +X full tcp window tracking incompatibility with nat helpers [HW] +- Hard lockup with ip_queue under heavy load (still valid ???) +- mangle table should use all five netfilter hooks [HW] +- merge EPRT / EPSV ftp stuff +- runme error with IPv6 stuff! -INDEPENDENT from iptables-1.2.1 release: -- netlink interface for conntrack manipulation from userspace [HW] -- unified nfnetlink for queue,ulog,conntrack (and more?) (2.5 issue) +NICE to have: +- multicast connection tracking - sysctl support for ftp-multi, irc-conntrack/nat, ftp-fxp - integrate HOPLIMIT for ipv6 in patch-o-matic [HW] - static 1:1 NAT (only ip address NAT in both directions) - u32 classifier (port from tc -> iptables) [YU] - pktlen match (not needed, when u32 available) -- SMP locking for IRC buggy? - MARK match / target with boolean OR / AND (to use nfmark bitwise) -X full tcp window tracking incompatibility with nat helpers [HW] -X multiple related connections [HW] - documentation for libiptc - port conntrack to IPv6 (code reuse?) [BB] X port matches (owner, limit, multiport, owner) to IPv6 [RJ] -- multicast connection tracking -- conntrack / nat failover [HW] -- Hard lockup with ip_queue under heavy load -- mangle table should use all five netfilter hooks - make patch-o-matic more generic (any subdir), and reversible - CONFIG_NF_IP_NAT_LOCAL - fix and test the netfilter bridging stuff -- integrate the ipt_NETLINK target from gianni@ecsc.co.uk +X integrate the ipt_NETLINK target from gianni@ecsc.co.uk [HW] X integrate PSD target / port it as match [HW] - various NAT performance optimizations possible! (which? ask HW) - ip_nat_ident module @@ -44,6 +40,12 @@ X integrate PSD target / port it as match [HW] - 10.1.2.3.4 is accepted as a valid IP address by iptables -s / -d ? - make iptables / ip6tables use the same codebase (as libiptc) +FUTURE extensions: +- conntrack / nat failover [HW] +- brainstorming about 2.5 conntrack code +- netlink interface for conntrack manipulation from userspace [HW] +- unified nfnetlink for queue,ulog,conntrack (and more?) (2.5 issue) + ====================================================================== [RR] Paul 'Rusty' Russel [MB] Marc Boucher -- cgit v1.2.3