
--------------- first first prio -----------------------------------

- gebruik voor net_foo strings als

privnet-10
privnet-0
privnet-172

fix de FIXME's in uruk.in and doc/rc.


-

za 29 15:16 < fvos> joostvb: misschien kan het al, maar op de eee wil ik dat 
                    het ook kan werken als er per verbinding een ander ip-adres 
                    is
za 29 15:18 < fvos> checking van de rc-file is er niet, zoals je zelf aangeeft, 
                    maar met de xml+xsl-aanvulling van mij kun je de 
                    instelling-documenten valideren tegen een xsd en het 
                    bestand opdelen in logische bestanden die je met xinclude 
                    samenvoegt
za 29 19:29 < joostvb> fvos: valideren tegen een xsd: patches welkom :)
za 29 19:29 < joostvb> fvos: maar ik denk niet dat ik dat de default ga maken, 
                       dat ie dat doet


- add a full IPv6 example to uruk-rc manpage (we now only have the example
  rc-file).
localhost is 0000:0000:0000:0000:0000:0000:0000:0001 aka
Fri 18 10:36 < Fruit> ::1
000:0000:0000:0000:0000:0000:0000:0000/0 is ::/0
s/(^|:)(0+($|:))+/::/
rijen van woorden kun je afkorten tot ::
Tnx Wessel
http://www.faqs.org/rfcs/rfc3330.html

- enable IPv6 by default in init-script: adjust comment "enable_ipv6=true" in
  /etc/default/uruk and hack init-script.

- Suggested by Casper Gielen: enable broadcast/multicast filtering for IPv6
 Carefull, this part is very different from IPv4. IPv6 does not support
 broadcast (at all) while support for multicast is mandatory. Do not block
 without a proper understanding of what you are blocking.
 Very likely needs to get implemented in script/uruk.in near "# Don't answer
 broadcast and multicast packets"


----------------- first prio ------------------------------------

RSN: write urukconfig : generate uruk rc file based upon currently
offered network services.  all services will be available for _all_ IPs
(or perhaps just local network?)
Packages could run this to generate a first rc file.

----------------- local stuff / testing procedure -----------------

- testhosts

nagy
stegun (ipv6)
rolle (ipv6)
bruhat (ipv6)
dijkstra
lebesgue
kovalevskaya
freitag

- test with enable-uruk-save

- test remove & purge

- test an install on a fresh non-uruk system

( - upload .deb to non-gnu: etch; fix homepage about non-gnu)

- build and upload another .deb to unstable

----------------- candidates for upcoming release ------------------

- get rid of duplicated code in init-script:
      if test "$found_active" -a "$found_inactive"; then
      eval found_$rule=1

- dpkg --remove uruk does not remove symlinks in /etc/rcS.d/; init-script fails hard
  if binary gone.

- dpkg --purge uruk does not remove /var/lib/uruk/iptables/active.

- "status" is borken in case IPv6 is enabled (found on yosida):

root@yosida:~# invoke-rc.d uruk start
Saving IPv4 uruk rules as active ruleset.
Loading iptables ruleset: load "active".
Starting uruk (iptables)
Saving IPv6 uruk rules as active ruleset.
Loading ip6tables ruleset: load "active".
Starting uruk (ip6tables)

root@yosida:~# /etc/init.d/uruk status      
* Checking uruk (iptables): both active and inactive rulesets present, but active ruleset not loaded
* Checking uruk (ip6tables): both active and inactive rulesets present, but active ruleset not loaded

- "start" when uruk is running flushes and reloads current active ruleset.
  Should it do this?  Or should it rather be a no-op? check lsb.

- add a "dump-status" option to init-script: dump details about status, keep
  tmpfiles. usefull for debugging.

- /etc/init.d/uruk flush does not flush nat nor mangle table.  This means
force-reload breaks when these tables are in use.  See comment near initd_flush.
Fix this, and accept the introduced cruft.   Tnx Wessel.

- Phase out support for services_eth0_udp, but enforce ipS_eth0; warn for
obsolete syntax

- Be less anal on borken rc file:
za 29 09:12 < Fruit> warnings als een variabele ongedefinieerd is
za 29 09:13 < Fruit> services_tcp_eth0="foo"
za 29 09:13 < Fruit> warning: ports_foo_eth0 is undefined
za 29 09:16 < Fruit> case ${ports_foo_eth0-UNDEF} in UNDEF) warn; esac


----------------- end of candidates for upcoming release ------------------
----------------- stuff which just might happen one day -------------------

- improve documentation on usage with non-fixed IPs.
 ma 13 09:01 < joostvb> fvos: uruk werkt trouwens ook een beetje met dynamische ip, 
                       zie de docs.  met ifup/ifdown ipv met init-script. er staan 
                       wat tips in de documentatie
 ma 13 09:07 < Fruit> fvos: echo 'invoke-rc.d uruk restart' >/etc/network/if-up.d/uruk
 ma 13 09:08 < Fruit> ik zit me alleen af te vragen of networkmanager dat spul ook 
                     gebruikt
 ma 13 09:10 < Fruit> okee, networkmanager voert die scripts dus wél uit.
 ma 13 09:11 < Fruit> fvos: wellicht een hashbang erbij en een execbitje.

- using names of interfaces in names of variables is dumb.  the characters
  @ : . occur in interface names, but are not allowed in variable names.
  E.g. eth0.54@eth0 and vif6.0 and eth0:3 

- use functions
   log_daemon_msg
   log_end_msg
   log_action_msg
in init-script, see e.g. firehol init script

- Thu 20 23:13 < fvos> joostvb: ik zou de huidige rc graag gesplitst zien in 
                     meerdere losse bestanden, bijvoorbeeld 'networks', 
                     'sources' en zo. Daardoor kunnen de entries in die 
                     bestanden ook eenvoudiger namen hebben en is misschien 
                     kwaliteitscontrole op missende verwijzingen ook 
                     eenvoudiger.
Fri 21 05:37 < joostvb> fvos: een syntax-checker zou inderdaad wel handig zijn 
                        ja

- Phase out support for rc_e

- Debian package: S40uruk could better be S41uruk: explicitly start after
networking (which is S40networking).

- We setup firewall rules only _after_ the network interfaces are configured.
This is dumb: we are vulnerable for bugs in the kernel's IP stack.  One
solution for this: Create an /etc/init.d/uruk-pre script, which is run as early
as possible, and _before_ network interfaces are configured.  It should disable
all networktraffic (except for traffic on loopbackinterface).  Only later,
networkinterfaces are configured, /etc/init.d/uruk is run and networkservices
are started.  (N.B.: so even with the current setup we _do_ protect our
services).

- In uruk-rc manpage, include example rc-file verbatim.  Include license text.

- Create "upload" target in /Makefile.am

- Improve examples in documentation:
<Fruit> joostvb: ik geloof dat ":" een leuke shorthand is voor "alle poorten"

- Fix bugs in uruk script: (force-)reload should do something sane when
uruk not running.

- Check documentation: uruk-rc manpage needs more stuff.

- Perhaps we need an uruk-init manpage, for the init script.

- Write a wrapper for OpenBSD's pf and FreeBSD's ipfilter, so that these tools
can use the same rc file format.  We'd also have to make sure init-script
works on non-LSB-systems, then.

- Reimplement uruk-save: make it more robust.  See
http://www.faqs.org/docs/iptables/iptables-save.html for example of file
format.  Use logic from iptables-save.c.

- Think about alternative for uruk-save: create a chain, and enable it once it's
fully build by doing just one iptables call.  This would allow truly atomical
loading of new rulesets.

- Is it sane to allow all traffic in default inactive rule?

- Check save_counters support in init script.  It's likely broken.

- Date: Wed, 9 Feb 2005 15:09:16 +0100
Message-ID: <20050209140916.GZ1487@trogdor.uvt.nl>
Herken broadcasts (misschien aan destination MAC-adres?) en log ze niet.
.
alternative implementation: near code-snippet:
 # supporting this for multiple-ips would need multiple chains
 # or, perhaps, some iptables extension.
This log-spamming happens only in multiple-ip-per-nic mode.
Do DROP stuff just before log, would that work?  (No, we really can't do
something like "--dest !(ip1 or ip2 or ip3)".)
.
yet to implement: loglevel "high".  Document multiple ip per nic logspamming bug.

- Finish IPv6 support.  Change to enabled-by-default.  Document it.

# this file maintained at http://git.mdcc.cx/uruk.git
