DEBIAN TODO 2010-03-01

* Linux-igd Shorewall integration: think about route/iptables fragments
  to run on shorewall reload/restart so that it keeps our changes.
  Should we do a store, or add a hook, or just forget about it and let
  the client repeat its forwardings ?

* Linux-igd Shorewall integration: we could perhaps add further chains:

  1. to setup outward NAT/forwarding as well as incoming, so that that
     doesn't have to be the default policy.

  2. to restrict a subscription connection to the host that actually
     subscribed, so that we don't have to have all of 49152 to 65535 open
     Note the current Shorewall assumes hosts will only subscribe on
     port 49152 which limits it to single-host, single-subscription.

* Re-work HAVE_LIBIPTC code to work with the xfilter public interface
  to netfilter, instead of using fields which don't exist any more from
  iptable's private headers - should make us kernel version independent.

