TODO List for netfilter / iptables. Currently maintained by Harald Welte Please inform me, if you want to work on any of the TODO items, so I can update this list and thus prevent two people doing the same work. CVS ID: $Id: TODO,v 1.49 2001/10/25 13:37:46 laforge Exp $ IMPORTANT issues: - token ring crashes ?? - solution for nostate / notrack (we don't want to track specific conn's) - iptables-save/restore problems with log-level - multiple related connections [HW] - ip_conntrack rmmod loop (sometimes, Yan's patch?) - conntrack helper not called for first packet (udp!) - add support for correct SACK handling [HW] - erroneously too-fast dropped conntrack for half-open TCP connections [HW] - mangle table should use all five netfilter hooks [BC] - wrong 'Out of window' error message from tcp-windowtracking [HW] - --mac-source not working in FORWARD (manpage bug?) - netfilter hooks should give error if same function registers twice [HW] - speed issues (mark_source_chains, Robert Olsson) NICE to have: - make RPC conntrack work again - interface names in ipv6 can contain _ and - - multicast connection tracking - sysctl support for ftp-multi, irc-conntrack/nat, ftp-fxp - integrate HOPLIMIT for ipv6 in patch-o-matic [HW] - u32 classifier (port from tc -> iptables) [YU] - MARK match / target with boolean OR / AND (to use nfmark bitwise) - documentation for libiptc - port conntrack to IPv6 (code reuse?) [BB] - make patch-o-matic reversible - CONFIG_NF_IP_NAT_LOCAL - fix and test the netfilter bridging stuff - various NAT performance optimizations possible! (which? ask HW) - ip_nat_ident module [FM] - provide daily CVS snapshots via ftp [HW] - make iptables / ip6tables use the same codebase (as libiptc) [KA] - REJECT optionally generates port unreachable with faked SOURCE - libipq reentrancy [JM] - compiling without O2 issue FUTURE extensions: - dealing with fragmented expectation-causes (i.e. DCC chat split over two packets, etc.) - conntrack / nat failover [HW] - brainstorming about 2.5 conntrack code - netlink interface for conntrack manipulation from userspace [HW] - unified nfnetlink for queue,ulog,conntrack (and more?) (2.5 issue) ====================================================================== [RR] Paul 'Rusty' Russel [MB] Marc Boucher [JM] James Morris [HW] Harald Welte [YU] Yon Uriarte [RJ] Jan Rekorajski [BB] Bastian Blank [FM] Fabrice Marie [KA] Kiz-Szabo Andras [BC] Brad Chapman