Home | History | Annotate | Line # | Download | only in doc
TODO.npf revision 1.5 
      1 Another TODO list is available here:
      2 
      3 	https://www.netbsd.org/~rmind/npf/__tasklist.html
      4 
      5 ====== DOCUMENTATION ======
      6 
      7 -- how to convert other packet filters to npf
      8 
      9 -- add more examples
     10 
     11 -- modify the doc of IPF and PF to indicate they are deprecated, and that
     12    NPF should be used instead
     13 
     14 ====== NPFCTL ======
     15 
     16 -- npfctl start does not load the configuration if not loaded.
     17    It is not clear you need to reload first. Or if it loads it should
     18    print the error messages. Or it should be called enable/disable since
     19    this is what it does. It does not "start" because like an engine with
     20    no fuel, an npf with no configuration does not do much.
     21 
     22 -- npf starts up too late (after traffic can go through)
     23 
     24 -- although the framework checks the file for consistency, returning EINVAL
     25    for system failures is probably not good enough. For example if a module
     26    failed to autoload, it is probably an error and it should be reported
     27    differently?
     28 
     29 -- startup/stop script does not load and save session state
     30 
     31 -- add algo for "with short"
     32 
     33 -- implement "port-unr"
     34 
     35 -- implement block return-icmp in log final all with ipopts
     36 
     37 -- handle array variables in more places
     38 
     39 ====== GENERAL ======
     40 
     41 -- disable IPv4 options by default, and add a "allow-ip4opts" feature to
     42    enable them
     43 
     44 -- disable IPv6 options (IPPROTO_ROUTING, IPPROTO_HOPOPTS and IPPROTO_DSTOPTS)
     45    by default, and add a "allow-ip6opts" feature to enable them
     46 
     47 -- add an ioctl, similar to PF's DIOCNATLOOK and IPF's SIOCGNATL, and document
     48    it so that it can be added in third-party software, like:
     49        https://github.com/squid-cache/squid/blob/5b74111aff8948e869959113241adada0cd488c2/src/ip/Intercept.cc#L263
     50 
     51 -- support IPv6 jumbograms
     52 
     53 -- support large IPv6 options, as explained here:
     54        http://mail-index.netbsd.org/tech-net/2018/04/08/msg006786.html
     55    But it's not a big problem - perhaps we don't care at all.
     56 
     57 -- add command line variables.  See -D option in pf.
     58 
     59 -- improve mss clamping, as explained here:
     60        http://mail-index.netbsd.org/tech-net/2017/01/15/msg006224.html
     61