Gitiles
Code Review Sign In
gerrit-public.fairphone.software / fp2-dev / platform / external / iptables / bfc3369c025a8dab814c4f290c50aace52daa126 / . / TODO
blob: 3e5e1c90a34a7281b0a9dce337d59ded43a188d1 [file] [log] [blame]
Harald Welteaf4ec452001-01-24 01:15:16 +0000[diff] [blame]1TODO List for netfilter / iptables.
2Currently maintained by Harald Welte <laforge@gnumonks.org>
3
4Please inform me, if you want to work on any of the TODO items, so I
5can update this list and thus prevent two people doing the same work.
6
Harald Welteefa41332002-07-24 07:25:20 +0000[diff] [blame]7CVS ID: $Id: TODO,v 1.63 2002/07/08 06:17:33 laforge Exp $
Harald Welteaf4ec452001-01-24 01:15:16 +0000[diff] [blame]8
Harald Welte3666e0e2001-04-12 22:24:29 +0000[diff] [blame]9IMPORTANT issues:
Harald Welteefa41332002-07-24 07:25:20 +0000[diff] [blame]10x solution for nostate / notrack (we don't want to track specific conn's)
Harald Welte15a9a692002-02-19 09:14:27 +0000[diff] [blame]11x multiple related connections (solved: newnat)[HW]
Harald Welte15a9a692002-02-19 09:14:27 +0000[diff] [blame]12x add support for correct SACK handling [HW]
13- erroneously too-fast dropped conntrack for half-open TCP connections [JK]
14- wrong 'Out of window' error message from tcp-windowtracking [JK]
15x mangle table should use all five netfilter hooks [BC]
Harald Welte87d4be42001-07-05 06:26:37 +0000[diff] [blame]16- --mac-source not working in FORWARD (manpage bug?)
Harald Weltec22f64e2002-02-19 20:36:19 +0000[diff] [blame]17x netfilter hooks should give error if same function registers twice [HW]
18x speed issues (mark_source_chains, Robert Olsson)
Harald Weltec22f64e2002-02-19 20:36:19 +0000[diff] [blame]19x fix apparent output nat + slip oops bug; see thread at
James Morris0d13eb22001-12-18 23:44:23 +0000[diff] [blame]20 http://lists.samba.org/pipermail/netfilter/2001-December/017747.html
Harald Weltec22f64e2002-02-19 20:36:19 +0000[diff] [blame]21x TFTP helper: works only on second packet?
Harald Welte452d29b2002-03-25 13:54:17 +0000[diff] [blame]22x necessary structures for helper match in newnat [HW]
Harald Welteb8f85c72002-05-27 07:52:33 +0000[diff] [blame]23x port old conntrack/nat helpers to newnat [HW]
Harald Welteefa41332002-07-24 07:25:20 +0000[diff] [blame]24x update NAT part of netfilter-hacking-HOWTO to newnat [HW]
25x update packet traversal schematics to represent 5hook-mangle
Harald Welte452d29b2002-03-25 13:54:17 +0000[diff] [blame]26- update manpages to include recently submitted extensions
Harald Welteefa41332002-07-24 07:25:20 +0000[diff] [blame]27x remove manually-specified source IP for reject-fakesource patch
Harald Welte706e53c2002-07-08 06:17:33 +0000[diff] [blame]28- locally bound udp port can still be used for MASQ/SNAT
29- fix for ICMP DNAT info leak
Harald Welteefa41332002-07-24 07:25:20 +0000[diff] [blame]30- unaligned access of nulldevname during string match
Harald Welteaf4ec452001-01-24 01:15:16 +0000[diff] [blame]31
Harald Welte4799c732002-02-25 09:27:31 +0000[diff] [blame]32TO BE INVESTIGATED:
Harald Welteb8f85c72002-05-27 07:52:33 +0000[diff] [blame]33- packet counters on ultrasparc platform (32bit userspace/64bit kernel issue)
Harald Welte4799c732002-02-25 09:27:31 +0000[diff] [blame]34- token ring crashes ??
35- iptables-save/restore problems with log-level
36- ip_conntrack rmmod loop (sometimes, Yan's patch?)
37- conntrack helper not called for first packet (udp!)
38- different behaviour for first packet towards an l2-unresolved ip?
39
Harald Welte3666e0e2001-04-12 22:24:29 +0000[diff] [blame]40NICE to have:
Harald Welte706e53c2002-07-08 06:17:33 +0000[diff] [blame]41- endianness wrt. unnamed initializers in conntrack helpers after
42 pptp-patch applied
Harald Welte489b6032001-07-14 19:21:47 +0000[diff] [blame]43- make RPC conntrack work again
Harald Welte15a9a692002-02-19 09:14:27 +0000[diff] [blame]44x interface names in ipv6 can contain _ and -
Harald Welte3666e0e2001-04-12 22:24:29 +0000[diff] [blame]45- multicast connection tracking
Harald Welteaf4ec452001-01-24 01:15:16 +0000[diff] [blame]46- sysctl support for ftp-multi, irc-conntrack/nat, ftp-fxp
47- integrate HOPLIMIT for ipv6 in patch-o-matic [HW]
Harald Welte302ca3e2001-02-07 16:27:20 +0000[diff] [blame]48- u32 classifier (port from tc -> iptables) [YU]
Harald Welte87802662002-03-26 12:54:35 +0000[diff] [blame]49x MARK match with boolean OR / AND (to use nfmark bitwise)
Harald Welteaf4ec452001-01-24 01:15:16 +0000[diff] [blame]50- documentation for libiptc
Harald Welte15a9a692002-02-19 09:14:27 +0000[diff] [blame]51- port conntrack to IPv6 (code reuse?) [BC]
Harald Weltec22f64e2002-02-19 20:36:19 +0000[diff] [blame]52x make patch-o-matic reversible
53x CONFIG_NF_IP_NAT_LOCAL
54x fix and test the netfilter bridging stuff
Harald Welte452d29b2002-03-25 13:54:17 +0000[diff] [blame]55- ip_nat_ident module
Harald Weltec22f64e2002-02-19 20:36:19 +0000[diff] [blame]56x provide daily CVS snapshots via ftp [HW]
Harald Welte90ba5ec2001-05-03 21:10:24 +0000[diff] [blame]57- make iptables / ip6tables use the same codebase (as libiptc) [KA]
Harald Welte0a8335c2002-03-19 07:56:59 +0000[diff] [blame]58x REJECT optionally generates port unreachable with faked SOURCE
James Morris1cb4c052001-05-25 12:24:20 +0000[diff] [blame]59- libipq reentrancy [JM]
Harald Welte489b6032001-07-14 19:21:47 +0000[diff] [blame]60- compiling without O2 issue
Harald Weltec22f64e2002-02-19 20:36:19 +0000[diff] [blame]61x add more information like original addresses to the state match
James Morrisb25f99e2001-11-24 22:59:16 +0000[diff] [blame]62- libipq runtime version, do before 1.2.5 [JM]
Harald Welte15a9a692002-02-19 09:14:27 +0000[diff] [blame]63- add ICMP type-3-code-13 option to REJECT
Harald Welteb8f85c72002-05-27 07:52:33 +0000[diff] [blame]64- export list of matches/targets via proc-fs
Harald Welteaf4ec452001-01-24 01:15:16 +0000[diff] [blame]65
Harald Welte3666e0e2001-04-12 22:24:29 +0000[diff] [blame]66FUTURE extensions:
Harald Welteb961e6b2001-05-05 00:01:55 +0000[diff] [blame]67- dealing with fragmented expectation-causes (i.e. DCC chat split
68 over two packets, etc.)
Harald Welte3666e0e2001-04-12 22:24:29 +0000[diff] [blame]69- conntrack / nat failover [HW]
70- brainstorming about 2.5 conntrack code
71- netlink interface for conntrack manipulation from userspace [HW]
72- unified nfnetlink for queue,ulog,conntrack (and more?) (2.5 issue)
73
James Morris47a026d2001-11-30 10:55:10 +0000[diff] [blame]74Userspace queuing for 2.5:
75- Integration with nfnetlink.
76- Multiple queues per protocol.
77- Netlink broadcast support.
78- Allow multiple reader/writers in userspace.
79- How to handle multiple protocols (e.g. use separate queue handlers
80 or a multiplexer like ipqmpd).
81- Peformance improvements: multipart messages, mmaped socket (possibly).
82- Simplify queuing logic, which is quite ugly at the moment. (BC suggested
83 removing logic from kernel).
84- Allow userspace to set nfmark.
85- Allow userspace to set queue length etc.
86- Possibly pass conntrack/NAT info to userspace with packet.
87
Harald Welteaf4ec452001-01-24 01:15:16 +0000[diff] [blame]88======================================================================
Harald Welteb4c648b2001-09-02 14:03:02 +0000[diff] [blame]89[BC] Brad Chapman <kakadu_croc@yahoo.com>
Harald Welte15a9a692002-02-19 09:14:27 +0000[diff] [blame]90[HW] Harald Welte <laforge@gnumonks.org>
91[JK] Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
92[JM] James Morris <jmorris@intercode.com.au>
93[KA] Kiz-Szabo Andras <kisza@sch.bme.hu>
94[MB] Marc Boucher <marc@mbsi.ca>
95[RR] Paul 'Rusty' Russel <rusty@rustcorp.com.au>
96[YU] Yon Uriarte <ukl2@rz.uni-karlsruhe.de>