TODO List for netfilter / iptables. 
Currently maintained by Harald Welte <laforge@gnumonks.org>

Please inform me, if you want to work on any of the TODO items, so I
can update this list and thus prevent two people doing the same work.

CVS ID: $Id: TODO,v 1.45 2001/07/31 21:35:18 laforge Exp $

IMPORTANT issues:
- solution for nostate / notrack (we don't want to track specific conn's)
- iptables-save/restore problems with log-level
- multiple related connections [HW]
- ip_conntrack rmmod loop (sometimes, Yan's patch?)
- conntrack helper not called for first packet (udp!)
- add support for correct SACK handling [HW]
- erroneously too-fast dropped conntrack for half-open TCP connections [HW]
X why is nat_helper's expect() function called for all helpers? [HW]
X full tcp window tracking incompatibility with nat helpers [HW]
- mangle table should use all five netfilter hooks [BC]
X merge EPRT / EPSV ftp stuff [RR] (reimplemented in ftp-fixes, included 2.4.4)
X runme error with IPv6 stuff! [HW]
- wrong 'Out of window' error message from tcp-windowtracking [HW]
X SMP conntrack race [RR] (ftp-fixes, included in 2.4.4)
X static compiling/linking of iptables (for router-on-a-disk) [HW]
X IPv6 testing (MARK, LOG, REJECT) [HW]
x iptables-save doesn't work with eth+ style multiple IF stuff [HW]
X reject-with on REJECT target doesn't work [HW]
X IPv6 REJECT target doesn't have extension plugin ?!?
- colon inside prefix doesn't work
X pending minor ip_queue updates [JM]
- --mac-source not working in FORWARD (manpage bug?)
- netfilter hooks should give error if same function registers twice [HW]

NICE to have:
- make RPC conntrack work again
- interface names in ipv6 can contain _ and -
- multicast connection tracking
- sysctl support for ftp-multi, irc-conntrack/nat, ftp-fxp
- integrate HOPLIMIT for ipv6 in patch-o-matic [HW]
X static 1:1 NAT (only ip address NAT in both directions) (NETMAP target)
- u32 classifier (port from tc -> iptables) [YU]
X pktlen match (not needed, when u32 available) [FM]
- MARK match / target with boolean OR / AND (to use nfmark bitwise)
- documentation for libiptc
- port conntrack to IPv6 (code reuse?) [BB]
X port matches (owner, limit, multiport, owner) to IPv6 [RJ]
- make patch-o-matic more generic (any subdir), and reversible
- CONFIG_NF_IP_NAT_LOCAL
- fix and test the netfilter bridging stuff
X integrate the ipt_NETLINK target from gianni@ecsc.co.uk [HW]
X integrate PSD target / port it as match [HW]
- various NAT performance optimizations possible! (which? ask HW)
- ip_nat_ident module [FM]
- provide daily CVS snapshots via ftp [HW]
- 10.1.2.3.4 is accepted as a valid IP address by iptables -s / -d ?
- make iptables / ip6tables use the same codebase (as libiptc) [KA]
X string_to_number() does not work correctly for unsigned ints [JM]
- REJECT optionally generates port unreachable with faked SOURCE
- libipq reentrancy [JM]
- libipq asynchronousness [JM]
- compiling without O2 issue

FUTURE extensions:
- dealing with fragmented expectation-causes (i.e. DCC chat split
  over two packets, etc.)
- conntrack / nat failover [HW]
- brainstorming about 2.5 conntrack code
- netlink interface for conntrack manipulation from userspace [HW]
- unified nfnetlink for queue,ulog,conntrack (and more?) (2.5 issue)

======================================================================
[RR]	Paul 'Rusty' Russel <rusty@rustcorp.com.au>
[MB]	Marc Boucher <marc@mbsi.ca>
[JM]	James Morris <jmorris@intercode.com.au>
[HW]	Harald Welte <laforge@gnumonks.org>
[YU]	Yon Uriarte <ukl2@rz.uni-karlsruhe.de>
[RJ]	Jan Rekorajski <baggins@mimuw.edu.pl>
[BB]	Bastian Blank <bastianb@gmx.de>
[FM]	Fabrice Marie <fabrice@celestix.com>
[KA]	Kiz-Szabo Andras <kisza@sch.bme.hu>
[BC]	Brad Chapman <kakadu_croc@yahoo.com>