Harald Welte | af4ec45 | 2001-01-24 01:15:16 +0000 | [diff] [blame] | 1 | TODO List for netfilter / iptables. |
| 2 | Currently maintained by Harald Welte <laforge@gnumonks.org> |
| 3 | |
| 4 | Please inform me, if you want to work on any of the TODO items, so I |
| 5 | can update this list and thus prevent two people doing the same work. |
| 6 | |
Harald Welte | efa4133 | 2002-07-24 07:25:20 +0000 | [diff] [blame] | 7 | CVS ID: $Id: TODO,v 1.63 2002/07/08 06:17:33 laforge Exp $ |
Harald Welte | af4ec45 | 2001-01-24 01:15:16 +0000 | [diff] [blame] | 8 | |
Harald Welte | 3666e0e | 2001-04-12 22:24:29 +0000 | [diff] [blame] | 9 | IMPORTANT issues: |
Harald Welte | efa4133 | 2002-07-24 07:25:20 +0000 | [diff] [blame] | 10 | x solution for nostate / notrack (we don't want to track specific conn's) |
Harald Welte | 15a9a69 | 2002-02-19 09:14:27 +0000 | [diff] [blame] | 11 | x multiple related connections (solved: newnat)[HW] |
Harald Welte | 15a9a69 | 2002-02-19 09:14:27 +0000 | [diff] [blame] | 12 | x add support for correct SACK handling [HW] |
| 13 | - erroneously too-fast dropped conntrack for half-open TCP connections [JK] |
| 14 | - wrong 'Out of window' error message from tcp-windowtracking [JK] |
| 15 | x mangle table should use all five netfilter hooks [BC] |
Harald Welte | 87d4be4 | 2001-07-05 06:26:37 +0000 | [diff] [blame] | 16 | - --mac-source not working in FORWARD (manpage bug?) |
Harald Welte | c22f64e | 2002-02-19 20:36:19 +0000 | [diff] [blame] | 17 | x netfilter hooks should give error if same function registers twice [HW] |
| 18 | x speed issues (mark_source_chains, Robert Olsson) |
Harald Welte | c22f64e | 2002-02-19 20:36:19 +0000 | [diff] [blame] | 19 | x fix apparent output nat + slip oops bug; see thread at |
James Morris | 0d13eb2 | 2001-12-18 23:44:23 +0000 | [diff] [blame] | 20 | http://lists.samba.org/pipermail/netfilter/2001-December/017747.html |
Harald Welte | c22f64e | 2002-02-19 20:36:19 +0000 | [diff] [blame] | 21 | x TFTP helper: works only on second packet? |
Harald Welte | 452d29b | 2002-03-25 13:54:17 +0000 | [diff] [blame] | 22 | x necessary structures for helper match in newnat [HW] |
Harald Welte | b8f85c7 | 2002-05-27 07:52:33 +0000 | [diff] [blame] | 23 | x port old conntrack/nat helpers to newnat [HW] |
Harald Welte | efa4133 | 2002-07-24 07:25:20 +0000 | [diff] [blame] | 24 | x update NAT part of netfilter-hacking-HOWTO to newnat [HW] |
| 25 | x update packet traversal schematics to represent 5hook-mangle |
Harald Welte | 452d29b | 2002-03-25 13:54:17 +0000 | [diff] [blame] | 26 | - update manpages to include recently submitted extensions |
Harald Welte | efa4133 | 2002-07-24 07:25:20 +0000 | [diff] [blame] | 27 | x remove manually-specified source IP for reject-fakesource patch |
Harald Welte | 706e53c | 2002-07-08 06:17:33 +0000 | [diff] [blame] | 28 | - locally bound udp port can still be used for MASQ/SNAT |
| 29 | - fix for ICMP DNAT info leak |
Harald Welte | efa4133 | 2002-07-24 07:25:20 +0000 | [diff] [blame] | 30 | - unaligned access of nulldevname during string match |
Harald Welte | af4ec45 | 2001-01-24 01:15:16 +0000 | [diff] [blame] | 31 | |
Harald Welte | 4799c73 | 2002-02-25 09:27:31 +0000 | [diff] [blame] | 32 | TO BE INVESTIGATED: |
Harald Welte | b8f85c7 | 2002-05-27 07:52:33 +0000 | [diff] [blame] | 33 | - packet counters on ultrasparc platform (32bit userspace/64bit kernel issue) |
Harald Welte | 4799c73 | 2002-02-25 09:27:31 +0000 | [diff] [blame] | 34 | - token ring crashes ?? |
| 35 | - iptables-save/restore problems with log-level |
| 36 | - ip_conntrack rmmod loop (sometimes, Yan's patch?) |
| 37 | - conntrack helper not called for first packet (udp!) |
| 38 | - different behaviour for first packet towards an l2-unresolved ip? |
| 39 | |
Harald Welte | 3666e0e | 2001-04-12 22:24:29 +0000 | [diff] [blame] | 40 | NICE to have: |
Harald Welte | 706e53c | 2002-07-08 06:17:33 +0000 | [diff] [blame] | 41 | - endianness wrt. unnamed initializers in conntrack helpers after |
| 42 | pptp-patch applied |
Harald Welte | 489b603 | 2001-07-14 19:21:47 +0000 | [diff] [blame] | 43 | - make RPC conntrack work again |
Harald Welte | 15a9a69 | 2002-02-19 09:14:27 +0000 | [diff] [blame] | 44 | x interface names in ipv6 can contain _ and - |
Harald Welte | 3666e0e | 2001-04-12 22:24:29 +0000 | [diff] [blame] | 45 | - multicast connection tracking |
Harald Welte | af4ec45 | 2001-01-24 01:15:16 +0000 | [diff] [blame] | 46 | - sysctl support for ftp-multi, irc-conntrack/nat, ftp-fxp |
| 47 | - integrate HOPLIMIT for ipv6 in patch-o-matic [HW] |
Harald Welte | 302ca3e | 2001-02-07 16:27:20 +0000 | [diff] [blame] | 48 | - u32 classifier (port from tc -> iptables) [YU] |
Harald Welte | 8780266 | 2002-03-26 12:54:35 +0000 | [diff] [blame] | 49 | x MARK match with boolean OR / AND (to use nfmark bitwise) |
Harald Welte | af4ec45 | 2001-01-24 01:15:16 +0000 | [diff] [blame] | 50 | - documentation for libiptc |
Harald Welte | 15a9a69 | 2002-02-19 09:14:27 +0000 | [diff] [blame] | 51 | - port conntrack to IPv6 (code reuse?) [BC] |
Harald Welte | c22f64e | 2002-02-19 20:36:19 +0000 | [diff] [blame] | 52 | x make patch-o-matic reversible |
| 53 | x CONFIG_NF_IP_NAT_LOCAL |
| 54 | x fix and test the netfilter bridging stuff |
Harald Welte | 452d29b | 2002-03-25 13:54:17 +0000 | [diff] [blame] | 55 | - ip_nat_ident module |
Harald Welte | c22f64e | 2002-02-19 20:36:19 +0000 | [diff] [blame] | 56 | x provide daily CVS snapshots via ftp [HW] |
Harald Welte | 90ba5ec | 2001-05-03 21:10:24 +0000 | [diff] [blame] | 57 | - make iptables / ip6tables use the same codebase (as libiptc) [KA] |
Harald Welte | 0a8335c | 2002-03-19 07:56:59 +0000 | [diff] [blame] | 58 | x REJECT optionally generates port unreachable with faked SOURCE |
James Morris | 1cb4c05 | 2001-05-25 12:24:20 +0000 | [diff] [blame] | 59 | - libipq reentrancy [JM] |
Harald Welte | 489b603 | 2001-07-14 19:21:47 +0000 | [diff] [blame] | 60 | - compiling without O2 issue |
Harald Welte | c22f64e | 2002-02-19 20:36:19 +0000 | [diff] [blame] | 61 | x add more information like original addresses to the state match |
James Morris | b25f99e | 2001-11-24 22:59:16 +0000 | [diff] [blame] | 62 | - libipq runtime version, do before 1.2.5 [JM] |
Harald Welte | 15a9a69 | 2002-02-19 09:14:27 +0000 | [diff] [blame] | 63 | - add ICMP type-3-code-13 option to REJECT |
Harald Welte | b8f85c7 | 2002-05-27 07:52:33 +0000 | [diff] [blame] | 64 | - export list of matches/targets via proc-fs |
Harald Welte | af4ec45 | 2001-01-24 01:15:16 +0000 | [diff] [blame] | 65 | |
Harald Welte | 3666e0e | 2001-04-12 22:24:29 +0000 | [diff] [blame] | 66 | FUTURE extensions: |
Harald Welte | b961e6b | 2001-05-05 00:01:55 +0000 | [diff] [blame] | 67 | - dealing with fragmented expectation-causes (i.e. DCC chat split |
| 68 | over two packets, etc.) |
Harald Welte | 3666e0e | 2001-04-12 22:24:29 +0000 | [diff] [blame] | 69 | - conntrack / nat failover [HW] |
| 70 | - brainstorming about 2.5 conntrack code |
| 71 | - netlink interface for conntrack manipulation from userspace [HW] |
| 72 | - unified nfnetlink for queue,ulog,conntrack (and more?) (2.5 issue) |
| 73 | |
James Morris | 47a026d | 2001-11-30 10:55:10 +0000 | [diff] [blame] | 74 | Userspace queuing for 2.5: |
| 75 | - Integration with nfnetlink. |
| 76 | - Multiple queues per protocol. |
| 77 | - Netlink broadcast support. |
| 78 | - Allow multiple reader/writers in userspace. |
| 79 | - How to handle multiple protocols (e.g. use separate queue handlers |
| 80 | or a multiplexer like ipqmpd). |
| 81 | - Peformance improvements: multipart messages, mmaped socket (possibly). |
| 82 | - Simplify queuing logic, which is quite ugly at the moment. (BC suggested |
| 83 | removing logic from kernel). |
| 84 | - Allow userspace to set nfmark. |
| 85 | - Allow userspace to set queue length etc. |
| 86 | - Possibly pass conntrack/NAT info to userspace with packet. |
| 87 | |
Harald Welte | af4ec45 | 2001-01-24 01:15:16 +0000 | [diff] [blame] | 88 | ====================================================================== |
Harald Welte | b4c648b | 2001-09-02 14:03:02 +0000 | [diff] [blame] | 89 | [BC] Brad Chapman <kakadu_croc@yahoo.com> |
Harald Welte | 15a9a69 | 2002-02-19 09:14:27 +0000 | [diff] [blame] | 90 | [HW] Harald Welte <laforge@gnumonks.org> |
| 91 | [JK] Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> |
| 92 | [JM] James Morris <jmorris@intercode.com.au> |
| 93 | [KA] Kiz-Szabo Andras <kisza@sch.bme.hu> |
| 94 | [MB] Marc Boucher <marc@mbsi.ca> |
| 95 | [RR] Paul 'Rusty' Russel <rusty@rustcorp.com.au> |
| 96 | [YU] Yon Uriarte <ukl2@rz.uni-karlsruhe.de> |