From c972eebaac55d902a9afbf8f928ca631c9c46549 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Mon, 13 Oct 2025 17:25:09 +0200 Subject: [PATCH] doc: drop TODO.org file, replaced entirely with issues and project Signed-off-by: Joachim Wiberg --- doc/TODO.org | 72 ---------------------------------------------------- 1 file changed, 72 deletions(-) delete mode 100644 doc/TODO.org diff --git a/doc/TODO.org b/doc/TODO.org deleted file mode 100644 index 7e7840ce..00000000 --- a/doc/TODO.org +++ /dev/null @@ -1,72 +0,0 @@ -* TODO Add support for firewall -- [X] All "implicit" policies in zones are now policies: intra- and inter-zone policies -- [X] Add locked rules for implicit drop/reject policy as last rule in policy (ANY, ANY) -- [X] Firewall logs should show IN=iface (IIF) before SOURCE -- [X] Interfaces are not defaulting to the default zone, must handle bridge - ports and changes to enslavement, so regenerate every time is a must! -- [ ] firewalld helpers -- possibly for conntrack, e.g., ftp -- [ ] With =modprobe br_netfilter= firewalld would see *all* traffic, but there are - issues, , and limits to what - seem to be possible atm. You may also need to enable these callbacks: - =echo 1 | sudo tee /proc/sys/net/bridge/bridge-nf-call-iptables= - =echo 1 | sudo tee /proc/sys/net/bridge/bridge-nf-call-ip6tables= - =echo 1 | sudo tee /proc/sys/net/bridge/bridge-nf-call-arptables= -- [X] Add missing upper to port forward since port ranges are supported, see services! -- [X] =[do] show firewall= not available yet -- [X] Add RPC to pause firewall using =firewall-cmd --panic-on= and restart - firewall again with =firewall-cmd --panic-off=. The current state can - be queried using =firewall-cmd --query-panic=, which returns =yes= -- [X] Remove debug log messages! -- [X] Add "Log Messages" section to =show firewall= when =LogDenied ≠ off= -- [ ] Investigate filtering out firewall log messages from other log files -- [1/2] Rename policy->policy to policy->action, and replace allow->forward -- [X] Rename zone->sources to networks -- [X] A zone's action is for ingress, clarify this if missing! -- [X] Any services/ports listed in a zone with policy:accept are a NO-OP -- [X] =firwall-cmd --reload= takes fooooorever! :-( -- [X] If forwarding is disabled in a zone then the zone matrix should - show deny for the same zone-to-zone communication -- [X] We should show the implicit rules for communicating with the HOST -- [X] Investigate "padlock" on built-in policys (and zones?) and expose more? -- [X] Document established,related somewhere, fixed/padlocked policy? Also, - document why this is a good idea to always have enabled. See RH docs. -- [ ] Podman published ports, -- [ ] Software fastpath -- +[ ] Allow overriding/editing immutable policies and zones+ -- [X] Add tests: basic (end device), wan-lan, wan-lan-dmz, +hammer (stress)+ -- [X] Add documentation - - See - - Add some tool tips: nc, nmap, ping, and socat to stress the firewall -- [X] Fix inference so we can remove defaults from factory-config! -- [X] Add iperf service -- [X] Add nftables ownership=yes setting, introduced in later firewalld versions -- [ ] Investigate fail2ban integration with firewalld, for more info, see: - https://github.com/firewalld/firewalld/issues/1466#issuecomment-2773130569 -- [ ] Update screenshots for documentation -- [ ] Review both cli-pretty and yanger code -- [ ] Review default-zone handling (needed?) -- [ ] Clean up =INFER_POLICY= ifdefs -- [ ] Revisit built-in fallback zones (public, block, drop) - -* TODO doc: User Guide - -- Feature set and scope, e.g. - - Device discovery: LLDP, mDNS-SD how do they work, interfacing with Windows/macOS/Linux - - Network redundancy protocols: STP/RSTP, MRP -- Configuring the system; using ifupdown2, enabling/disabling services -- Diagnosing the system; using rmon, port mirroring, debugging services, searching logs -- Limitations, e.g., PRP/HSR or IEEE 802.1CB will not be possible to support -- Tips & Trix - -* TODO document how to set up passwordless SSH -* TODO add setup wizard, based on pdmenu - - - setup-port script to tweak ethtool settings - - setup-iface script to configure a layer-3 interface - - setup-bridge script that creates a new bridge with config from cmdline - - setup-firewall script that can do basic firewall rules and masquerading - -* TODO split out qemu Config.in to a "make run-menuconfing" -* TODO rename qemu/ to run/, perhaps? -* TODO ship qemu/* with output/images/ for stand-alone runs of older builds -