fedora core 6 1.2949 + vserver 2.2.0

[linux-2.6.git] / net / ipv4 / netfilter / Kconfig

diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index db78303..47bd3ad 100644 (file)
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -6,8 +6,8 @@ menu "IP: Netfilter Configuration"
        depends on INET && NETFILTER
 
 config NF_CONNTRACK_IPV4
        depends on INET && NETFILTER
 
 config NF_CONNTRACK_IPV4

-       tristate "IPv4 support for new connection tracking (EXPERIMENTAL)"
-       depends on EXPERIMENTAL && NF_CONNTRACK
+       tristate "IPv4 connection tracking support (required for NAT)"
+       depends on NF_CONNTRACK

        ---help---
          Connection tracking keeps a record of what packets have passed
          through your machine, in order to figure out how they are related
        ---help---
          Connection tracking keeps a record of what packets have passed
          through your machine, in order to figure out how they are related


@@ -19,21 +19,18 @@ config NF_CONNTRACK_IPV4
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-# connection tracking, helpers and protocols
-config IP_NF_CONNTRACK
-       tristate "Connection tracking (required for masq/NAT)"
-       ---help---
-         Connection tracking keeps a record of what packets have passed
-         through your machine, in order to figure out how they are related
-         into connections.
-
-         This is required to do Masquerading or other kinds of Network
-         Address Translation (except for Fast NAT).  It can also be used to
-         enhance packet filtering (see `Connection state match support'
-         below).
+config NF_CONNTRACK_PROC_COMPAT
+       bool "proc/sysctl compatibility with old connection tracking"
+       depends on NF_CONNTRACK_IPV4
+       default y
+       help
+         This option enables /proc and sysctl compatibility with the old
+         layer 3 dependant connection tracking. This is needed to keep
+         old programs that have not been adapted to the new names working.

 
 

-         To compile it as a module, choose M here.  If unsure, say N.
+         If unsure, say Y.

 
 

+# connection tracking, helpers and protocols

 config IP_NF_CT_ACCT
        bool "Connection tracking flow accounting"
        depends on IP_NF_CONNTRACK
 config IP_NF_CT_ACCT
        bool "Connection tracking flow accounting"
        depends on IP_NF_CONNTRACK


@@ -55,6 +52,18 @@ config IP_NF_CONNTRACK_MARK
          of packets, but this mark value is kept in the conntrack session
          instead of the individual packets.
        
          of packets, but this mark value is kept in the conntrack session
          instead of the individual packets.
        

+config IP_NF_CONNTRACK_SECMARK
+       bool  'Connection tracking security mark support'
+       depends on IP_NF_CONNTRACK && NETWORK_SECMARK
+       help
+         This option enables security markings to be applied to
+         connections.  Typically they are copied to connections from
+         packets using the CONNSECMARK target and copied back from
+         connections to packets with the same target, with the packets
+         being originally labeled via SECMARK.
+
+         If unsure, say 'N'.
+

 config IP_NF_CONNTRACK_EVENTS
        bool "Connection tracking events (EXPERIMENTAL)"
        depends on EXPERIMENTAL && IP_NF_CONNTRACK
 config IP_NF_CONNTRACK_EVENTS
        bool "Connection tracking events (EXPERIMENTAL)"
        depends on EXPERIMENTAL && IP_NF_CONNTRACK


@@ -69,6 +78,7 @@ config IP_NF_CONNTRACK_NETLINK
        tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
        depends on EXPERIMENTAL && IP_NF_CONNTRACK && NETFILTER_NETLINK
        depends on IP_NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
        tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
        depends on EXPERIMENTAL && IP_NF_CONNTRACK && NETFILTER_NETLINK
        depends on IP_NF_CONNTRACK!=y || NETFILTER_NETLINK!=m

+       depends on IP_NF_NAT=n || IP_NF_NAT

        help
          This option enables support for a netlink-based userspace interface
 
        help
          This option enables support for a netlink-based userspace interface
 


@@ -141,6 +151,8 @@ config IP_NF_TFTP
 config IP_NF_AMANDA
        tristate "Amanda backup protocol support"
        depends on IP_NF_CONNTRACK
 config IP_NF_AMANDA
        tristate "Amanda backup protocol support"
        depends on IP_NF_CONNTRACK

+       select TEXTSEARCH
+       select TEXTSEARCH_KMP

        help
          If you are running the Amanda backup package <http://www.amanda.org/>
          on this machine or machines that will be MASQUERADED through this
        help
          If you are running the Amanda backup package <http://www.amanda.org/>
          on this machine or machines that will be MASQUERADED through this


@@ -168,6 +180,38 @@ config IP_NF_PPTP
          If you want to compile it as a module, say M here and read
          Documentation/modules.txt.  If unsure, say `N'.
 
          If you want to compile it as a module, say M here and read
          Documentation/modules.txt.  If unsure, say `N'.
 

+config IP_NF_H323
+       tristate  'H.323 protocol support (EXPERIMENTAL)'
+       depends on IP_NF_CONNTRACK && EXPERIMENTAL
+       help
+         H.323 is a VoIP signalling protocol from ITU-T. As one of the most
+         important VoIP protocols, it is widely used by voice hardware and
+         software including voice gateways, IP phones, Netmeeting, OpenPhone,
+         Gnomemeeting, etc.
+
+         With this module you can support H.323 on a connection tracking/NAT
+         firewall.
+
+         This module supports RAS, Fast Start, H.245 Tunnelling, Call
+         Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
+         whiteboard, file transfer, etc. For more information, please
+         visit http://nath323.sourceforge.net/.
+
+         If you want to compile it as a module, say 'M' here and read
+         Documentation/modules.txt.  If unsure, say 'N'.
+
+config IP_NF_SIP
+       tristate "SIP protocol support (EXPERIMENTAL)"
+       depends on IP_NF_CONNTRACK && EXPERIMENTAL
+       help
+         SIP is an application-layer control protocol that can establish,
+         modify, and terminate multimedia sessions (conferences) such as
+         Internet telephony calls. With the ip_conntrack_sip and
+         the ip_nat_sip modules you can support the protocol on a connection
+         tracking/NATing firewall.
+
+         To compile it as a module, choose M here.  If unsure, say Y.
+

 config IP_NF_QUEUE
        tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
        help
 config IP_NF_QUEUE
        tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
        help


@@ -201,16 +245,6 @@ config IP_NF_MATCH_IPRANGE
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-config IP_NF_MATCH_MULTIPORT
-       tristate "Multiple port match support"
-       depends on IP_NF_IPTABLES
-       help
-         Multiport matching allows you to match TCP or UDP packets based on
-         a series of source or destination ports: normally a rule can only
-         match a single range of ports.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-

 config IP_NF_MATCH_TOS
        tristate "TOS match support"
        depends on IP_NF_IPTABLES
 config IP_NF_MATCH_TOS
        tristate "TOS match support"
        depends on IP_NF_IPTABLES


@@ -241,23 +275,12 @@ config IP_NF_MATCH_ECN
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-config IP_NF_MATCH_DSCP
-       tristate "DSCP match support"
+config IP_NF_MATCH_AH
+       tristate "AH match support"

        depends on IP_NF_IPTABLES
        help
        depends on IP_NF_IPTABLES
        help

-         This option adds a `DSCP' match, which allows you to match against
-         the IPv4 header DSCP field (DSCP codepoint).
-
-         The DSCP codepoint can have any value between 0x0 and 0x4f.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-
-config IP_NF_MATCH_AH_ESP
-       tristate "AH/ESP match support"
-       depends on IP_NF_IPTABLES
-       help
-         These two match extensions (`ah' and `esp') allow you to match a
-         range of SPIs inside AH or ESP headers of IPSec packets.
+         This match extension allows you to match a range of SPIs
+         inside AH header of IPSec packets.

 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 


@@ -289,30 +312,6 @@ config IP_NF_MATCH_ADDRTYPE
          If you want to compile it as a module, say M here and read
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 
          If you want to compile it as a module, say M here and read
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 

-config IP_NF_MATCH_HASHLIMIT
-       tristate  'hashlimit match support'
-       depends on IP_NF_IPTABLES
-       help
-         This option adds a new iptables `hashlimit' match.  
-
-         As opposed to `limit', this match dynamically crates a hash table
-         of limit buckets, based on your selection of source/destination
-         ip addresses and/or ports.
-
-         It enables you to express policies like `10kpps for any given
-         destination IP' or `500pps from any given source IP'  with a single
-         IPtables rule.
-
-config IP_NF_MATCH_POLICY
-       tristate "IPsec policy match support"
-       depends on IP_NF_IPTABLES && XFRM
-       help
-         Policy matching allows you to match packets based on the
-         IPsec policy that was used during decapsulation/will
-         be used during encapsulation.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-

 # `filter', generic and specific targets
 config IP_NF_FILTER
        tristate "Packet filtering"
 # `filter', generic and specific targets
 config IP_NF_FILTER
        tristate "Packet filtering"


@@ -344,7 +343,7 @@ config IP_NF_TARGET_LOG
          To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_TARGET_ULOG
          To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_TARGET_ULOG

-       tristate "ULOG target support (OBSOLETE)"
+       tristate "ULOG target support"

        depends on IP_NF_IPTABLES
        ---help---
 
        depends on IP_NF_IPTABLES
        ---help---
 


@@ -357,7 +356,7 @@ config IP_NF_TARGET_ULOG
          daemon using netlink multicast sockets; unlike the LOG target
          which can only be viewed through syslog.
 
          daemon using netlink multicast sockets; unlike the LOG target
          which can only be viewed through syslog.
 

-         The apropriate userspace logging daemon (ulogd) may be obtained from
+         The appropriate userspace logging daemon (ulogd) may be obtained from

          <http://www.gnumonks.org/projects/ulogd/>
 
          To compile it as a module, choose M here.  If unsure, say N.
          <http://www.gnumonks.org/projects/ulogd/>
 
          To compile it as a module, choose M here.  If unsure, say N.


@@ -388,7 +387,7 @@ config IP_NF_TARGET_TCPMSS
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-# NAT + specific targets
+# NAT + specific targets: ip_conntrack

 config IP_NF_NAT
        tristate "Full NAT"
        depends on IP_NF_IPTABLES && IP_NF_CONNTRACK
 config IP_NF_NAT
        tristate "Full NAT"
        depends on IP_NF_IPTABLES && IP_NF_CONNTRACK


@@ -399,14 +398,30 @@ config IP_NF_NAT
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

+# NAT + specific targets: nf_conntrack
+config NF_NAT
+       tristate "Full NAT"
+       depends on IP_NF_IPTABLES && NF_CONNTRACK_IPV4
+       help
+         The Full NAT option allows masquerading, port forwarding and other
+         forms of full Network Address Port Translation.  It is controlled by
+         the `nat' table in iptables: see the man page for iptables(8).
+
+         To compile it as a module, choose M here.  If unsure, say N.
+

 config IP_NF_NAT_NEEDED
        bool
 config IP_NF_NAT_NEEDED
        bool

-       depends on IP_NF_NAT != n
+       depends on IP_NF_NAT
+       default y
+
+config NF_NAT_NEEDED
+       bool
+       depends on NF_NAT

        default y
 
 config IP_NF_TARGET_MASQUERADE
        tristate "MASQUERADE target support"
        default y
 
 config IP_NF_TARGET_MASQUERADE
        tristate "MASQUERADE target support"

-       depends on IP_NF_NAT
+       depends on (NF_NAT || IP_NF_NAT)

        help
          Masquerading is a special case of NAT: all outgoing connections are
          changed to seem to come from a particular interface's address, and
        help
          Masquerading is a special case of NAT: all outgoing connections are
          changed to seem to come from a particular interface's address, and


@@ -418,7 +433,7 @@ config IP_NF_TARGET_MASQUERADE
 
 config IP_NF_TARGET_REDIRECT
        tristate "REDIRECT target support"
 
 config IP_NF_TARGET_REDIRECT
        tristate "REDIRECT target support"

-       depends on IP_NF_NAT
+       depends on (NF_NAT || IP_NF_NAT)

        help
          REDIRECT is a special case of NAT: all incoming connections are
          mapped onto the incoming interface's address, causing the packets to
        help
          REDIRECT is a special case of NAT: all incoming connections are
          mapped onto the incoming interface's address, causing the packets to


@@ -429,7 +444,7 @@ config IP_NF_TARGET_REDIRECT
 
 config IP_NF_TARGET_NETMAP
        tristate "NETMAP target support"
 
 config IP_NF_TARGET_NETMAP
        tristate "NETMAP target support"

-       depends on IP_NF_NAT
+       depends on (NF_NAT || IP_NF_NAT)

        help
          NETMAP is an implementation of static 1:1 NAT mapping of network
          addresses. It maps the network address part, while keeping the host
        help
          NETMAP is an implementation of static 1:1 NAT mapping of network
          addresses. It maps the network address part, while keeping the host


@@ -440,7 +455,7 @@ config IP_NF_TARGET_NETMAP
 
 config IP_NF_TARGET_SAME
        tristate "SAME target support"
 
 config IP_NF_TARGET_SAME
        tristate "SAME target support"

-       depends on IP_NF_NAT
+       depends on (NF_NAT || IP_NF_NAT)

        help
          This option adds a `SAME' target, which works like the standard SNAT
          target, but attempts to give clients the same IP for all connections.
        help
          This option adds a `SAME' target, which works like the standard SNAT
          target, but attempts to give clients the same IP for all connections.


@@ -462,19 +477,52 @@ config IP_NF_NAT_SNMP_BASIC
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

+config NF_NAT_SNMP_BASIC
+       tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
+       depends on EXPERIMENTAL && NF_NAT
+       ---help---
+
+         This module implements an Application Layer Gateway (ALG) for
+         SNMP payloads.  In conjunction with NAT, it allows a network
+         management system to access multiple private networks with
+         conflicting addresses.  It works by modifying IP addresses
+         inside SNMP payloads to match IP-layer NAT mapping.
+
+         This is the "basic" form of SNMP-ALG, as described in RFC 2962
+
+         To compile it as a module, choose M here.  If unsure, say N.
+
+# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y),
+# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.
+# From kconfig-language.txt:
+#
+#           <expr> '&&' <expr>                   (6)
+#
+# (6) Returns the result of min(/expr/, /expr/).
+config NF_NAT_PROTO_GRE
+       tristate
+       depends on NF_NAT && NF_CT_PROTO_GRE
+
+config IP_NF_NAT_FTP
+       tristate
+       depends on IP_NF_IPTABLES && IP_NF_CONNTRACK && IP_NF_NAT
+       default IP_NF_NAT && IP_NF_FTP
+
+config NF_NAT_FTP
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_FTP
+

 config IP_NF_NAT_IRC
        tristate
        depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
        default IP_NF_NAT if IP_NF_IRC=y
        default m if IP_NF_IRC=m
 
 config IP_NF_NAT_IRC
        tristate
        depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
        default IP_NF_NAT if IP_NF_IRC=y
        default m if IP_NF_IRC=m
 

-# If they want FTP, set to $CONFIG_IP_NF_NAT (m or y), 
-# or $CONFIG_IP_NF_FTP (m or y), whichever is weaker.  Argh.
-config IP_NF_NAT_FTP
+config NF_NAT_IRC

        tristate
        tristate

-       depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
-       default IP_NF_NAT if IP_NF_FTP=y
-       default m if IP_NF_FTP=m
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_IRC

 
 config IP_NF_NAT_TFTP
        tristate
 
 config IP_NF_NAT_TFTP
        tristate


@@ -482,18 +530,56 @@ config IP_NF_NAT_TFTP
        default IP_NF_NAT if IP_NF_TFTP=y
        default m if IP_NF_TFTP=m
 
        default IP_NF_NAT if IP_NF_TFTP=y
        default m if IP_NF_TFTP=m
 

+config NF_NAT_TFTP
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_TFTP
+

 config IP_NF_NAT_AMANDA
        tristate
        depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
        default IP_NF_NAT if IP_NF_AMANDA=y
        default m if IP_NF_AMANDA=m
 
 config IP_NF_NAT_AMANDA
        tristate
        depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
        default IP_NF_NAT if IP_NF_AMANDA=y
        default m if IP_NF_AMANDA=m
 

+config NF_NAT_AMANDA
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_AMANDA
+

 config IP_NF_NAT_PPTP
        tristate
        depends on IP_NF_NAT!=n && IP_NF_PPTP!=n
        default IP_NF_NAT if IP_NF_PPTP=y
        default m if IP_NF_PPTP=m
 
 config IP_NF_NAT_PPTP
        tristate
        depends on IP_NF_NAT!=n && IP_NF_PPTP!=n
        default IP_NF_NAT if IP_NF_PPTP=y
        default m if IP_NF_PPTP=m
 

+config NF_NAT_PPTP
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_PPTP
+       select NF_NAT_PROTO_GRE
+
+config IP_NF_NAT_H323
+       tristate
+       depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
+       default IP_NF_NAT if IP_NF_H323=y
+       default m if IP_NF_H323=m
+
+config NF_NAT_H323
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_H323
+
+config IP_NF_NAT_SIP
+       tristate
+       depends on IP_NF_IPTABLES!=n && IP_NF_CONNTRACK!=n && IP_NF_NAT!=n
+       default IP_NF_NAT if IP_NF_SIP=y
+       default m if IP_NF_SIP=m
+
+config NF_NAT_SIP
+       tristate
+       depends on IP_NF_IPTABLES && NF_CONNTRACK && NF_NAT
+       default NF_NAT && NF_CONNTRACK_SIP
+

 # mangle + specific targets
 config IP_NF_MANGLE
        tristate "Packet mangling"
 # mangle + specific targets
 config IP_NF_MANGLE
        tristate "Packet mangling"


@@ -529,17 +615,6 @@ config IP_NF_TARGET_ECN
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-config IP_NF_TARGET_DSCP
-       tristate "DSCP target support"
-       depends on IP_NF_MANGLE
-       help
-         This option adds a `DSCP' match, which allows you to match against
-         the IPv4 header DSCP field (DSCP codepoint).
-
-         The DSCP codepoint can have any value between 0x0 and 0x4f.
-
-         To compile it as a module, choose M here.  If unsure, say N.
-

 config IP_NF_TARGET_TTL
        tristate  'TTL target support'
        depends on IP_NF_MANGLE
 config IP_NF_TARGET_TTL
        tristate  'TTL target support'
        depends on IP_NF_MANGLE