fedora core 6 1.2949 + vserver 2.2.0

[linux-2.6.git] / net / ipv4 / netfilter / Kconfig

diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 46d4cb1..47bd3ad 100644 (file)
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -5,21 +5,32 @@
 menu "IP: Netfilter Configuration"
        depends on INET && NETFILTER
 
 menu "IP: Netfilter Configuration"
        depends on INET && NETFILTER
 

-# connection tracking, helpers and protocols
-config IP_NF_CONNTRACK
-       tristate "Connection tracking (required for masq/NAT)"
+config NF_CONNTRACK_IPV4
+       tristate "IPv4 connection tracking support (required for NAT)"
+       depends on NF_CONNTRACK

        ---help---
          Connection tracking keeps a record of what packets have passed
          through your machine, in order to figure out how they are related
          into connections.
 
        ---help---
          Connection tracking keeps a record of what packets have passed
          through your machine, in order to figure out how they are related
          into connections.
 

-         This is required to do Masquerading or other kinds of Network
-         Address Translation (except for Fast NAT).  It can also be used to
-         enhance packet filtering (see `Connection state match support'
-         below).
+         This is IPv4 support on Layer 3 independent connection tracking.
+         Layer 3 independent connection tracking is experimental scheme
+         which generalize ip_conntrack to support other layer 3 protocols.

 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

+config NF_CONNTRACK_PROC_COMPAT
+       bool "proc/sysctl compatibility with old connection tracking"
+       depends on NF_CONNTRACK_IPV4
+       default y
+       help
+         This option enables /proc and sysctl compatibility with the old
+         layer 3 dependant connection tracking. This is needed to keep
+         old programs that have not been adapted to the new names working.
+
+         If unsure, say Y.
+
+# connection tracking, helpers and protocols

 config IP_NF_CT_ACCT
        bool "Connection tracking flow accounting"
        depends on IP_NF_CONNTRACK
 config IP_NF_CT_ACCT
        bool "Connection tracking flow accounting"
        depends on IP_NF_CONNTRACK


@@ -34,12 +45,44 @@ config IP_NF_CT_ACCT
 
 config IP_NF_CONNTRACK_MARK
        bool  'Connection mark tracking support'
 
 config IP_NF_CONNTRACK_MARK
        bool  'Connection mark tracking support'

+       depends on IP_NF_CONNTRACK

        help
          This option enables support for connection marks, used by the
          `CONNMARK' target and `connmark' match. Similar to the mark value
          of packets, but this mark value is kept in the conntrack session
          instead of the individual packets.
        
        help
          This option enables support for connection marks, used by the
          `CONNMARK' target and `connmark' match. Similar to the mark value
          of packets, but this mark value is kept in the conntrack session
          instead of the individual packets.
        

+config IP_NF_CONNTRACK_SECMARK
+       bool  'Connection tracking security mark support'
+       depends on IP_NF_CONNTRACK && NETWORK_SECMARK
+       help
+         This option enables security markings to be applied to
+         connections.  Typically they are copied to connections from
+         packets using the CONNSECMARK target and copied back from
+         connections to packets with the same target, with the packets
+         being originally labeled via SECMARK.
+
+         If unsure, say 'N'.
+
+config IP_NF_CONNTRACK_EVENTS
+       bool "Connection tracking events (EXPERIMENTAL)"
+       depends on EXPERIMENTAL && IP_NF_CONNTRACK
+       help
+         If this option is enabled, the connection tracking code will
+         provide a notifier chain that can be used by other kernel code
+         to get notified about changes in the connection tracking state.
+         
+         IF unsure, say `N'.
+
+config IP_NF_CONNTRACK_NETLINK
+       tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
+       depends on EXPERIMENTAL && IP_NF_CONNTRACK && NETFILTER_NETLINK
+       depends on IP_NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
+       depends on IP_NF_NAT=n || IP_NF_NAT
+       help
+         This option enables support for a netlink-based userspace interface
+
+

 config IP_NF_CT_PROTO_SCTP
        tristate  'SCTP protocol connection tracking support (EXPERIMENTAL)'
        depends on IP_NF_CONNTRACK && EXPERIMENTAL
 config IP_NF_CT_PROTO_SCTP
        tristate  'SCTP protocol connection tracking support (EXPERIMENTAL)'
        depends on IP_NF_CONNTRACK && EXPERIMENTAL


@@ -75,6 +118,25 @@ config IP_NF_IRC
 
          To compile it as a module, choose M here.  If unsure, say Y.
 
 
          To compile it as a module, choose M here.  If unsure, say Y.
 

+config IP_NF_NETBIOS_NS
+       tristate "NetBIOS name service protocol support (EXPERIMENTAL)"
+       depends on IP_NF_CONNTRACK && EXPERIMENTAL
+       help
+         NetBIOS name service requests are sent as broadcast messages from an
+         unprivileged port and responded to with unicast messages to the
+         same port. This make them hard to firewall properly because connection
+         tracking doesn't deal with broadcasts. This helper tracks locally
+         originating NetBIOS name service requests and the corresponding
+         responses. It relies on correct IP address configuration, specifically
+         netmask and broadcast address. When properly configured, the output
+         of "ip address show" should look similar to this:
+
+         $ ip -4 address show eth0
+         4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
+             inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
+         
+         To compile it as a module, choose M here.  If unsure, say N.
+

 config IP_NF_TFTP
        tristate "TFTP protocol support"
        depends on IP_NF_CONNTRACK
 config IP_NF_TFTP
        tristate "TFTP protocol support"
        depends on IP_NF_CONNTRACK


@@ -89,6 +151,8 @@ config IP_NF_TFTP
 config IP_NF_AMANDA
        tristate "Amanda backup protocol support"
        depends on IP_NF_CONNTRACK
 config IP_NF_AMANDA
        tristate "Amanda backup protocol support"
        depends on IP_NF_CONNTRACK

+       select TEXTSEARCH
+       select TEXTSEARCH_KMP

        help
          If you are running the Amanda backup package <http://www.amanda.org/>
          on this machine or machines that will be MASQUERADED through this
        help
          If you are running the Amanda backup package <http://www.amanda.org/>
          on this machine or machines that will be MASQUERADED through this


@@ -99,16 +163,70 @@ config IP_NF_AMANDA
 
          To compile it as a module, choose M here.  If unsure, say Y.
 
 
          To compile it as a module, choose M here.  If unsure, say Y.
 

+config IP_NF_PPTP
+       tristate  'PPTP protocol support'
+       depends on IP_NF_CONNTRACK
+       help
+         This module adds support for PPTP (Point to Point Tunnelling
+         Protocol, RFC2637) connection tracking and NAT. 
+       
+         If you are running PPTP sessions over a stateful firewall or NAT
+         box, you may want to enable this feature.  
+       
+         Please note that not all PPTP modes of operation are supported yet.
+         For more info, read top of the file
+         net/ipv4/netfilter/ip_conntrack_pptp.c
+       
+         If you want to compile it as a module, say M here and read
+         Documentation/modules.txt.  If unsure, say `N'.
+
+config IP_NF_H323
+       tristate  'H.323 protocol support (EXPERIMENTAL)'
+       depends on IP_NF_CONNTRACK && EXPERIMENTAL
+       help
+         H.323 is a VoIP signalling protocol from ITU-T. As one of the most
+         important VoIP protocols, it is widely used by voice hardware and
+         software including voice gateways, IP phones, Netmeeting, OpenPhone,
+         Gnomemeeting, etc.
+
+         With this module you can support H.323 on a connection tracking/NAT
+         firewall.
+
+         This module supports RAS, Fast Start, H.245 Tunnelling, Call
+         Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
+         whiteboard, file transfer, etc. For more information, please
+         visit http://nath323.sourceforge.net/.
+
+         If you want to compile it as a module, say 'M' here and read
+         Documentation/modules.txt.  If unsure, say 'N'.
+
+config IP_NF_SIP
+       tristate "SIP protocol support (EXPERIMENTAL)"
+       depends on IP_NF_CONNTRACK && EXPERIMENTAL
+       help
+         SIP is an application-layer control protocol that can establish,
+         modify, and terminate multimedia sessions (conferences) such as
+         Internet telephony calls. With the ip_conntrack_sip and
+         the ip_nat_sip modules you can support the protocol on a connection
+         tracking/NATing firewall.
+
+         To compile it as a module, choose M here.  If unsure, say Y.
+

 config IP_NF_QUEUE
 config IP_NF_QUEUE

-       tristate "Userspace queueing via NETLINK"
+       tristate "IP Userspace queueing via NETLINK (OBSOLETE)"

        help
          Netfilter has the ability to queue packets to user space: the
          netlink device can be used to access them using this driver.
 
        help
          Netfilter has the ability to queue packets to user space: the
          netlink device can be used to access them using this driver.
 

+         This option enables the old IPv4-only "ip_queue" implementation
+         which has been obsoleted by the new "nfnetlink_queue" code (see
+         CONFIG_NETFILTER_NETLINK_QUEUE).
+

          To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_IPTABLES
        tristate "IP tables support (required for filtering/masq/NAT)"
          To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_IPTABLES
        tristate "IP tables support (required for filtering/masq/NAT)"

+       depends on NETFILTER_XTABLES

        help
          iptables is a general, extensible packet identification framework.
          The packet filtering and full NAT (masquerading, port forwarding,
        help
          iptables is a general, extensible packet identification framework.
          The packet filtering and full NAT (masquerading, port forwarding,


@@ -118,16 +236,6 @@ config IP_NF_IPTABLES
          To compile it as a module, choose M here.  If unsure, say N.
 
 # The matches.
          To compile it as a module, choose M here.  If unsure, say N.
 
 # The matches.

-config IP_NF_MATCH_LIMIT
-       tristate "limit match support"
-       depends on IP_NF_IPTABLES
-       help
-         limit matching allows you to control the rate at which a rule can be
-         matched: mainly useful in combination with the LOG target ("LOG
-         target support", below) and to avoid some Denial of Service attacks.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-

 config IP_NF_MATCH_IPRANGE
        tristate "IP range match support"
        depends on IP_NF_IPTABLES
 config IP_NF_MATCH_IPRANGE
        tristate "IP range match support"
        depends on IP_NF_IPTABLES


@@ -137,47 +245,6 @@ config IP_NF_MATCH_IPRANGE
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-config IP_NF_MATCH_MAC
-       tristate "MAC address match support"
-       depends on IP_NF_IPTABLES
-       help
-         MAC matching allows you to match packets based on the source
-         Ethernet address of the packet.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_MATCH_PKTTYPE
-       tristate "Packet type match support"
-       depends on IP_NF_IPTABLES
-       help
-         Packet type matching allows you to match a packet by
-         its "class", eg. BROADCAST, MULTICAST, ...
-
-         Typical usage:
-         iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_MATCH_MARK
-       tristate "netfilter MARK match support"
-       depends on IP_NF_IPTABLES
-       help
-         Netfilter mark matching allows you to match packets based on the
-         `nfmark' value in the packet.  This can be set by the MARK target
-         (see below).
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_MATCH_MULTIPORT
-       tristate "Multiple port match support"
-       depends on IP_NF_IPTABLES
-       help
-         Multiport matching allows you to match TCP or UDP packets based on
-         a series of source or destination ports: normally a rule can only
-         match a single range of ports.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-

 config IP_NF_MATCH_TOS
        tristate "TOS match support"
        depends on IP_NF_IPTABLES
 config IP_NF_MATCH_TOS
        tristate "TOS match support"
        depends on IP_NF_IPTABLES


@@ -208,32 +275,12 @@ config IP_NF_MATCH_ECN
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-config IP_NF_MATCH_DSCP
-       tristate "DSCP match support"
+config IP_NF_MATCH_AH
+       tristate "AH match support"

        depends on IP_NF_IPTABLES
        help
        depends on IP_NF_IPTABLES
        help

-         This option adds a `DSCP' match, which allows you to match against
-         the IPv4 header DSCP field (DSCP codepoint).
-
-         The DSCP codepoint can have any value between 0x0 and 0x4f.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_MATCH_AH_ESP
-       tristate "AH/ESP match support"
-       depends on IP_NF_IPTABLES
-       help
-         These two match extensions (`ah' and `esp') allow you to match a
-         range of SPIs inside AH or ESP headers of IPSec packets.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_MATCH_LENGTH
-       tristate "LENGTH match support"
-       depends on IP_NF_IPTABLES
-       help
-         This option allows you to match the length of a packet against a
-         specific value or range of values.
+         This match extension allows you to match a range of SPIs
+         inside AH header of IPSec packets.

 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 


@@ -246,47 +293,6 @@ config IP_NF_MATCH_TTL
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-config IP_NF_MATCH_TCPMSS
-       tristate "tcpmss match support"
-       depends on IP_NF_IPTABLES
-       help
-         This option adds a `tcpmss' match, which allows you to examine the
-         MSS value of TCP SYN packets, which control the maximum packet size
-         for that connection.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_MATCH_HELPER
-       tristate "Helper match support"
-       depends on IP_NF_CONNTRACK && IP_NF_IPTABLES
-       help
-         Helper matching allows you to match packets in dynamic connections
-         tracked by a conntrack-helper, ie. ip_conntrack_ftp
-
-         To compile it as a module, choose M here.  If unsure, say Y.
-
-config IP_NF_MATCH_STATE
-       tristate "Connection state match support"
-       depends on IP_NF_CONNTRACK && IP_NF_IPTABLES
-       help
-         Connection state matching allows you to match packets based on their
-         relationship to a tracked connection (ie. previous packets).  This
-         is a powerful tool for packet classification.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_MATCH_CONNTRACK
-       tristate "Connection tracking match support"
-       depends on IP_NF_CONNTRACK && IP_NF_IPTABLES
-       help
-         This is a general conntrack match module, a superset of the state match.
-
-         It allows matching on additional conntrack information, which is
-         useful in complex configurations, such as NAT gateways with multiple
-         internet links or tunnels.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-

 config IP_NF_MATCH_OWNER
        tristate "Owner match support"
        depends on IP_NF_IPTABLES
 config IP_NF_MATCH_OWNER
        tristate "Owner match support"
        depends on IP_NF_IPTABLES


@@ -296,15 +302,6 @@ config IP_NF_MATCH_OWNER
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-config IP_NF_MATCH_PHYSDEV
-       tristate "Physdev match support"
-       depends on IP_NF_IPTABLES && BRIDGE_NETFILTER
-       help
-         Physdev packet matching matches against the physical bridge ports
-         the IP packet arrived on or will leave by.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-

 config IP_NF_MATCH_ADDRTYPE
        tristate  'address type match support'
        depends on IP_NF_IPTABLES
 config IP_NF_MATCH_ADDRTYPE
        tristate  'address type match support'
        depends on IP_NF_IPTABLES


@@ -315,66 +312,6 @@ config IP_NF_MATCH_ADDRTYPE
          If you want to compile it as a module, say M here and read
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 
          If you want to compile it as a module, say M here and read
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 

-config IP_NF_MATCH_REALM
-       tristate  'realm match support'
-       depends on IP_NF_IPTABLES
-       select NET_CLS_ROUTE
-       help
-         This option adds a `realm' match, which allows you to use the realm
-         key from the routing subsystem inside iptables.
-       
-         This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 
-         in tc world.
-       
-         If you want to compile it as a module, say M here and read
-         <file:Documentation/modules.txt>.  If unsure, say `N'.
-
-config IP_NF_MATCH_SCTP
-       tristate  'SCTP protocol match support'
-       depends on IP_NF_IPTABLES
-       help
-         With this option enabled, you will be able to use the iptables
-         `sctp' match in order to match on SCTP source/destination ports
-         and SCTP chunk types.
-
-         If you want to compile it as a module, say M here and read
-         <file:Documentation/modules.txt>.  If unsure, say `N'.
-
-config IP_NF_MATCH_COMMENT
-       tristate  'comment match support'
-       depends on IP_NF_IPTABLES
-       help
-         This option adds a `comment' dummy-match, which allows you to put
-         comments in your iptables ruleset.
-
-         If you want to compile it as a module, say M here and read
-         <file:Documentation/modules.txt>.  If unsure, say `N'.
-
-config IP_NF_MATCH_CONNMARK
-       tristate  'Connection mark match support'
-       depends on IP_NF_CONNTRACK_MARK && IP_NF_IPTABLES
-       help
-         This option adds a `connmark' match, which allows you to match the
-         connection mark value previously set for the session by `CONNMARK'. 
-       
-         If you want to compile it as a module, say M here and read
-         <file:Documentation/modules.txt>.  The module will be called
-         ipt_connmark.o.  If unsure, say `N'.
-
-config IP_NF_MATCH_HASHLIMIT
-       tristate  'hashlimit match support'
-       depends on IP_NF_IPTABLES
-       help
-         This option adds a new iptables `hashlimit' match.  
-
-         As opposed to `limit', this match dynamically crates a hash table
-         of limit buckets, based on your selection of source/destination
-         ip addresses and/or ports.
-
-         It enables you to express policies like `10kpps for any given
-         destination IP' or `500pps from any given source IP'  with a single
-         IPtables rule.
-

 # `filter', generic and specific targets
 config IP_NF_FILTER
        tristate "Packet filtering"
 # `filter', generic and specific targets
 config IP_NF_FILTER
        tristate "Packet filtering"


@@ -409,12 +346,17 @@ config IP_NF_TARGET_ULOG
        tristate "ULOG target support"
        depends on IP_NF_IPTABLES
        ---help---
        tristate "ULOG target support"
        depends on IP_NF_IPTABLES
        ---help---

+
+         This option enables the old IPv4-only "ipt_ULOG" implementation
+         which has been obsoleted by the new "nfnetlink_log" code (see
+         CONFIG_NETFILTER_NETLINK_LOG).
+

          This option adds a `ULOG' target, which allows you to create rules in
          any iptables table. The packet is passed to a userspace logging
          daemon using netlink multicast sockets; unlike the LOG target
          which can only be viewed through syslog.
 
          This option adds a `ULOG' target, which allows you to create rules in
          any iptables table. The packet is passed to a userspace logging
          daemon using netlink multicast sockets; unlike the LOG target
          which can only be viewed through syslog.
 

-         The apropriate userspace logging daemon (ulogd) may be obtained from
+         The appropriate userspace logging daemon (ulogd) may be obtained from

          <http://www.gnumonks.org/projects/ulogd/>
 
          To compile it as a module, choose M here.  If unsure, say N.
          <http://www.gnumonks.org/projects/ulogd/>
 
          To compile it as a module, choose M here.  If unsure, say N.


@@ -445,7 +387,7 @@ config IP_NF_TARGET_TCPMSS
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-# NAT + specific targets
+# NAT + specific targets: ip_conntrack

 config IP_NF_NAT
        tristate "Full NAT"
        depends on IP_NF_IPTABLES && IP_NF_CONNTRACK
 config IP_NF_NAT
        tristate "Full NAT"
        depends on IP_NF_IPTABLES && IP_NF_CONNTRACK


@@ -456,14 +398,30 @@ config IP_NF_NAT
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

+# NAT + specific targets: nf_conntrack
+config NF_NAT
+       tristate "Full NAT"
+       depends on IP_NF_IPTABLES && NF_CONNTRACK_IPV4
+       help
+         The Full NAT option allows masquerading, port forwarding and other
+         forms of full Network Address Port Translation.  It is controlled by
+         the `nat' table in iptables: see the man page for iptables(8).
+
+         To compile it as a module, choose M here.  If unsure, say N.
+

 config IP_NF_NAT_NEEDED
        bool
 config IP_NF_NAT_NEEDED
        bool

-       depends on IP_NF_NAT != n
+       depends on IP_NF_NAT
+       default y
+
+config NF_NAT_NEEDED
+       bool
+       depends on NF_NAT

        default y
 
 config IP_NF_TARGET_MASQUERADE
        tristate "MASQUERADE target support"
        default y
 
 config IP_NF_TARGET_MASQUERADE
        tristate "MASQUERADE target support"

-       depends on IP_NF_NAT
+       depends on (NF_NAT || IP_NF_NAT)

        help
          Masquerading is a special case of NAT: all outgoing connections are
          changed to seem to come from a particular interface's address, and
        help
          Masquerading is a special case of NAT: all outgoing connections are
          changed to seem to come from a particular interface's address, and


@@ -475,7 +433,7 @@ config IP_NF_TARGET_MASQUERADE
 
 config IP_NF_TARGET_REDIRECT
        tristate "REDIRECT target support"
 
 config IP_NF_TARGET_REDIRECT
        tristate "REDIRECT target support"

-       depends on IP_NF_NAT
+       depends on (NF_NAT || IP_NF_NAT)

        help
          REDIRECT is a special case of NAT: all incoming connections are
          mapped onto the incoming interface's address, causing the packets to
        help
          REDIRECT is a special case of NAT: all incoming connections are
          mapped onto the incoming interface's address, causing the packets to


@@ -486,7 +444,7 @@ config IP_NF_TARGET_REDIRECT
 
 config IP_NF_TARGET_NETMAP
        tristate "NETMAP target support"
 
 config IP_NF_TARGET_NETMAP
        tristate "NETMAP target support"

-       depends on IP_NF_NAT
+       depends on (NF_NAT || IP_NF_NAT)

        help
          NETMAP is an implementation of static 1:1 NAT mapping of network
          addresses. It maps the network address part, while keeping the host
        help
          NETMAP is an implementation of static 1:1 NAT mapping of network
          addresses. It maps the network address part, while keeping the host


@@ -497,7 +455,7 @@ config IP_NF_TARGET_NETMAP
 
 config IP_NF_TARGET_SAME
        tristate "SAME target support"
 
 config IP_NF_TARGET_SAME
        tristate "SAME target support"

-       depends on IP_NF_NAT
+       depends on (NF_NAT || IP_NF_NAT)

        help
          This option adds a `SAME' target, which works like the standard SNAT
          target, but attempts to give clients the same IP for all connections.
        help
          This option adds a `SAME' target, which works like the standard SNAT
          target, but attempts to give clients the same IP for all connections.


@@ -519,19 +477,52 @@ config IP_NF_NAT_SNMP_BASIC
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

+config NF_NAT_SNMP_BASIC
+       tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
+       depends on EXPERIMENTAL && NF_NAT
+       ---help---
+
+         This module implements an Application Layer Gateway (ALG) for
+         SNMP payloads.  In conjunction with NAT, it allows a network
+         management system to access multiple private networks with
+         conflicting addresses.  It works by modifying IP addresses
+         inside SNMP payloads to match IP-layer NAT mapping.
+
+         This is the "basic" form of SNMP-ALG, as described in RFC 2962
+
+         To compile it as a module, choose M here.  If unsure, say N.
+
+# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
+# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
+# From kconfig-language.txt:
+#
+#           <expr> '&&' <expr>                   (6)
+#
+# (6) Returns the result of min(/expr/, /expr/).
+config NF_NAT_PROTO_GRE
+       tristate
+       depends on NF_NAT && NF_CT_PROTO_GRE
+
+config IP_NF_NAT_FTP
+       tristate
+       depends on IP_NF_IPTABLES && IP_NF_CONNTRACK && IP_NF_NAT
+       default IP_NF_NAT && IP_NF_FTP
+
+config NF_NAT_FTP
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_FTP
+

 config IP_NF_NAT_IRC
        tristate
        depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
        default IP_NF_NAT if IP_NF_IRC=y
        default m if IP_NF_IRC=m
 
 config IP_NF_NAT_IRC
        tristate
        depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
        default IP_NF_NAT if IP_NF_IRC=y
        default m if IP_NF_IRC=m
 

-# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y), 
-# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.  Argh.
-config IP_NF_NAT_FTP
+config NF_NAT_IRC

        tristate
        tristate

-       depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
-       default IP_NF_NAT if IP_NF_FTP=y
-       default m if IP_NF_FTP=m
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_IRC

 
 config IP_NF_NAT_TFTP
        tristate
 
 config IP_NF_NAT_TFTP
        tristate


@@ -539,12 +530,56 @@ config IP_NF_NAT_TFTP
        default IP_NF_NAT if IP_NF_TFTP=y
        default m if IP_NF_TFTP=m
 
        default IP_NF_NAT if IP_NF_TFTP=y
        default m if IP_NF_TFTP=m
 

+config NF_NAT_TFTP
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_TFTP
+

 config IP_NF_NAT_AMANDA
        tristate
        depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
        default IP_NF_NAT if IP_NF_AMANDA=y
        default m if IP_NF_AMANDA=m
 
 config IP_NF_NAT_AMANDA
        tristate
        depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
        default IP_NF_NAT if IP_NF_AMANDA=y
        default m if IP_NF_AMANDA=m
 

+config NF_NAT_AMANDA
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_AMANDA
+
+config IP_NF_NAT_PPTP
+       tristate
+       depends on IP_NF_NAT!=n && IP_NF_PPTP!=n
+       default IP_NF_NAT if IP_NF_PPTP=y
+       default m if IP_NF_PPTP=m
+
+config NF_NAT_PPTP
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_PPTP
+       select NF_NAT_PROTO_GRE
+
+config IP_NF_NAT_H323
+       tristate
+       depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
+       default IP_NF_NAT if IP_NF_H323=y
+       default m if IP_NF_H323=m
+
+config NF_NAT_H323
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_H323
+
+config IP_NF_NAT_SIP
+       tristate
+       depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
+       default IP_NF_NAT if IP_NF_SIP=y
+       default m if IP_NF_SIP=m
+
+config NF_NAT_SIP
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_SIP
+

 # mangle + specific targets
 config IP_NF_MANGLE
        tristate "Packet mangling"
 # mangle + specific targets
 config IP_NF_MANGLE
        tristate "Packet mangling"


@@ -580,57 +615,24 @@ config IP_NF_TARGET_ECN
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-config IP_NF_TARGET_DSCP
-       tristate "DSCP target support"
-       depends on IP_NF_MANGLE
-       help
-         This option adds a `DSCP' match, which allows you to match against
-         the IPv4 header DSCP field (DSCP codepoint).
-
-         The DSCP codepoint can have any value between 0x0 and 0x4f.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_TARGET_MARK
-       tristate "MARK target support"
-       depends on IP_NF_MANGLE
-       help
-         This option adds a `MARK' target, which allows you to create rules
-         in the `mangle' table which alter the netfilter mark (nfmark) field
-         associated with the packet prior to routing. This can change
-         the routing method (see `Use netfilter MARK value as routing
-         key') and can also be used by other subsystems to change their
-         behavior.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_TARGET_CLASSIFY
-       tristate "CLASSIFY target support"
+config IP_NF_TARGET_TTL
+       tristate  'TTL target support'

        depends on IP_NF_MANGLE
        help
        depends on IP_NF_MANGLE
        help

-         This option adds a `CLASSIFY' target, which enables the user to set
-         the priority of a packet. Some qdiscs can use this value for
-         classification, among these are:
+         This option adds a `TTL' target, which enables the user to modify
+         the TTL value of the IP header.

 
 

-         atm, cbq, dsmark, pfifo_fast, htb, prio
+         While it is safe to decrement/lower the TTL, this target also enables
+         functionality to increment and set the TTL value of the IP header to
+         arbitrary values.  This is EXTREMELY DANGEROUS since you can easily
+         create immortal packets that loop forever on the network.

 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-config IP_NF_TARGET_CONNMARK
-       tristate  'CONNMARK target support'
-       depends on IP_NF_CONNTRACK_MARK && IP_NF_MANGLE
-       help
-         This option adds a `CONNMARK' target, which allows one to manipulate
-         the connection mark value.  Similar to the MARK target, but
-         affects the connection mark value rather than the packet mark value.
-       
-         If you want to compile it as a module, say M here and read
-         <file:Documentation/modules.txt>.  The module will be called
-         ipt_CONNMARK.o.  If unsure, say `N'.
-

 config IP_NF_TARGET_CLUSTERIP
        tristate "CLUSTERIP target support (EXPERIMENTAL)"
 config IP_NF_TARGET_CLUSTERIP
        tristate "CLUSTERIP target support (EXPERIMENTAL)"

-       depends on IP_NF_CONNTRACK_MARK && IP_NF_IPTABLES && EXPERIMENTAL
+       depends on IP_NF_MANGLE && EXPERIMENTAL
+       depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK_IPV4)

        help
          The CLUSTERIP target allows you to build load-balancing clusters of
          network servers without having a dedicated load-balancing
        help
          The CLUSTERIP target allows you to build load-balancing clusters of
          network servers without having a dedicated load-balancing


@@ -650,23 +652,10 @@ config IP_NF_RAW
          If you want to compile it as a module, say M here and read
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 
          If you want to compile it as a module, say M here and read
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 

-config IP_NF_TARGET_NOTRACK
-       tristate  'NOTRACK target support'
-       depends on IP_NF_RAW
-       depends on IP_NF_CONNTRACK
-       help
-         The NOTRACK target allows a select rule to specify
-         which packets *not* to enter the conntrack/NAT
-         subsystem with all the consequences (no ICMP error tracking,
-         no protocol helpers for the selected packets).
-       
-         If you want to compile it as a module, say M here and read
-         <file:Documentation/modules.txt>.  If unsure, say `N'.
-
-

 # ARP tables
 config IP_NF_ARPTABLES
        tristate "ARP tables support"
 # ARP tables
 config IP_NF_ARPTABLES
        tristate "ARP tables support"

+       depends on NETFILTER_XTABLES

        help
          arptables is a general, extensible packet identification framework.
          The ARP packet filtering and mangling (manipulation)subsystems
        help
          arptables is a general, extensible packet identification framework.
          The ARP packet filtering and mangling (manipulation)subsystems