Merge to Fedora kernel-2.6.18-1.2224_FC5 patched with stable patch-2.6.18.1-vs2.0...

[linux-2.6.git] / net / netfilter / Kconfig

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index e2893ef..a9894dd 100644 (file)
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -60,6 +60,18 @@ config NF_CONNTRACK_MARK
          of packets, but this mark value is kept in the conntrack session
          instead of the individual packets.
 
          of packets, but this mark value is kept in the conntrack session
          instead of the individual packets.
 

+config NF_CONNTRACK_SECMARK
+       bool  'Connection tracking security mark support'
+       depends on NF_CONNTRACK && NETWORK_SECMARK
+       help
+         This option enables security markings to be applied to
+         connections.  Typically they are copied to connections from
+         packets using the CONNSECMARK target and copied back from
+         connections to packets with the same target, with the packets
+         being originally labeled via SECMARK.
+
+         If unsure, say 'N'.
+

 config NF_CONNTRACK_EVENTS
        bool "Connection tracking events (EXPERIMENTAL)"
        depends on EXPERIMENTAL && NF_CONNTRACK
 config NF_CONNTRACK_EVENTS
        bool "Connection tracking events (EXPERIMENTAL)"
        depends on EXPERIMENTAL && NF_CONNTRACK


@@ -174,6 +186,26 @@ config NETFILTER_XT_TARGET_NOTRACK
          If you want to compile it as a module, say M here and read
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 
          If you want to compile it as a module, say M here and read
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 

+config NETFILTER_XT_TARGET_SECMARK
+       tristate '"SECMARK" target support'
+       depends on NETFILTER_XTABLES && NETWORK_SECMARK
+       help
+         The SECMARK target allows security marking of network
+         packets, for use with security subsystems.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+
+config NETFILTER_XT_TARGET_CONNSECMARK
+       tristate '"CONNSECMARK" target support'
+       depends on NETFILTER_XTABLES && (NF_CONNTRACK_SECMARK || IP_NF_CONNTRACK_SECMARK)
+       help
+         The CONNSECMARK target copies security markings from packets
+         to connections, and restores security markings from connections
+         to packets (if the packets are not already marked).  This would
+         normally be used in conjunction with the SECMARK target.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+

 config NETFILTER_XT_MATCH_COMMENT
        tristate  '"comment" match support'
        depends on NETFILTER_XTABLES
 config NETFILTER_XT_MATCH_COMMENT
        tristate  '"comment" match support'
        depends on NETFILTER_XTABLES


@@ -329,6 +361,16 @@ config NETFILTER_XT_MATCH_PKTTYPE
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

+config NETFILTER_XT_MATCH_QUOTA
+       tristate '"quota" match support'
+       depends on NETFILTER_XTABLES
+       help
+         This option adds a `quota' match, which allows to match on a
+         byte counter.
+
+         If you want to compile it as a module, say M here and read
+         <file:Documentation/modules.txt>.  If unsure, say `N'.
+

 config NETFILTER_XT_MATCH_REALM
        tristate  '"realm" match support'
        depends on NETFILTER_XTABLES
 config NETFILTER_XT_MATCH_REALM
        tristate  '"realm" match support'
        depends on NETFILTER_XTABLES


@@ -344,8 +386,8 @@ config NETFILTER_XT_MATCH_REALM
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 
 config NETFILTER_XT_MATCH_SCTP
          <file:Documentation/modules.txt>.  If unsure, say `N'.
 
 config NETFILTER_XT_MATCH_SCTP

-       tristate  '"sctp" protocol match support'
-       depends on NETFILTER_XTABLES
+       tristate  '"sctp" protocol match support (EXPERIMENTAL)'
+       depends on NETFILTER_XTABLES && EXPERIMENTAL

        help
          With this option enabled, you will be able to use the 
          `sctp' match in order to match on SCTP source/destination ports
        help
          With this option enabled, you will be able to use the 
          `sctp' match in order to match on SCTP source/destination ports


@@ -365,6 +407,15 @@ config NETFILTER_XT_MATCH_STATE
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

+config NETFILTER_XT_MATCH_STATISTIC
+       tristate '"statistic" match support'
+       depends on NETFILTER_XTABLES
+       help
+         This option adds a `statistic' match, which allows you to match
+         on packets periodically or randomly with a given percentage.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+

 config NETFILTER_XT_MATCH_STRING
        tristate  '"string" match support'
        depends on NETFILTER_XTABLES
 config NETFILTER_XT_MATCH_STRING
        tristate  '"string" match support'
        depends on NETFILTER_XTABLES