Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6

[karo-tx-linux.git] / net / netfilter / Kconfig

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 8593a77cfea906ac0257405fb8aa9ae0e0bef597..1534f2b44cafbf8d465d55229f3ee807cf5f6fb2 100644 (file)
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -40,27 +40,6 @@ config NF_CONNTRACK
 
 if NF_CONNTRACK
 
-config NF_CT_ACCT
-       bool "Connection tracking flow accounting"
-       depends on NETFILTER_ADVANCED
-       help
-         If this option is enabled, the connection tracking code will
-         keep per-flow packet and byte counters.
-
-         Those counters can be used for flow-based accounting or the
-         `connbytes' match.
-
-         Please note that currently this option only sets a default state.
-         You may change it at boot time with nf_conntrack.acct=0/1 kernel
-         parameter or by loading the nf_conntrack module with acct=0/1.
-
-         You may also disable/enable it on a running system with:
-          sysctl net.netfilter.nf_conntrack_acct=0/1
-
-         This option will be removed in 2.6.29.
-
-         If unsure, say `N'.
-
 config NF_CONNTRACK_MARK
        bool  'Connection mark tracking support'
        depends on NETFILTER_ADVANCED
@@ -347,6 +326,22 @@ config NETFILTER_XT_CONNMARK
 
 comment "Xtables targets"
 
+config NETFILTER_XT_TARGET_CHECKSUM
+       tristate "CHECKSUM target support"
+       depends on IP_NF_MANGLE || IP6_NF_MANGLE
+       depends on NETFILTER_ADVANCED
+       ---help---
+         This option adds a `CHECKSUM' target, which can be used in the iptables mangle
+         table.
+
+         You can use this target to compute and fill in the checksum in
+         a packet that lacks a checksum.  This is particularly useful,
+         if you need to work around old applications such as dhcp clients,
+         that do not work well with checksum offloads, but don't want to disable
+         checksum offload in your device.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_TARGET_CLASSIFY
        tristate '"CLASSIFY" target support'
        depends on NETFILTER_ADVANCED
@@ -424,6 +419,18 @@ config NETFILTER_XT_TARGET_HL
        since you can easily create immortal packets that loop
        forever on the network.
 
+config NETFILTER_XT_TARGET_IDLETIMER
+       tristate  "IDLETIMER target support"
+       depends on NETFILTER_ADVANCED
+       help
+
+         This option adds the `IDLETIMER' target.  Each matching packet
+         resets the timer associated with label specified when the rule is
+         added.  When the timer expires, it triggers a sysfs notification.
+         The remaining time for expiration can be read via sysfs.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_TARGET_LED
        tristate '"LED" target support'
        depends on LEDS_CLASS && LEDS_TRIGGERS
@@ -503,7 +510,7 @@ config NETFILTER_XT_TARGET_RATEEST
          To compile it as a module, choose M here.  If unsure, say N.
 
 config NETFILTER_XT_TARGET_TEE
-       tristate '"TEE" - packet cloning to alternate destiantion'
+       tristate '"TEE" - packet cloning to alternate destination'
        depends on NETFILTER_ADVANCED
        depends on (IPV6 || IPV6=n)
        depends on !NF_CONNTRACK || NF_CONNTRACK
@@ -518,6 +525,7 @@ config NETFILTER_XT_TARGET_TPROXY
        depends on NETFILTER_XTABLES
        depends on NETFILTER_ADVANCED
        select NF_DEFRAG_IPV4
+       select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
        help
          This option adds a `TPROXY' target, which is somewhat similar to
          REDIRECT.  It can only be used in the mangle table and is useful
@@ -618,7 +626,6 @@ config NETFILTER_XT_MATCH_CONNBYTES
        tristate  '"connbytes" per-connection counter match support'
        depends on NF_CONNTRACK
        depends on NETFILTER_ADVANCED
-       select NF_CT_ACCT
        help
          This option adds a `connbytes' match, which allows you to match the
          number of bytes and/or packets for each direction within a connection.
@@ -657,6 +664,15 @@ config NETFILTER_XT_MATCH_CONNTRACK
 
          To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_MATCH_CPU
+       tristate '"cpu" match support'
+       depends on NETFILTER_ADVANCED
+       help
+         CPU matching allows you to match packets based on the CPU
+         currently handling the packet.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_MATCH_DCCP
        tristate '"dccp" protocol match support'
        depends on NETFILTER_ADVANCED
@@ -736,6 +752,16 @@ config NETFILTER_XT_MATCH_IPRANGE
 
        If unsure, say M.
 
+config NETFILTER_XT_MATCH_IPVS
+       tristate '"ipvs" match support'
+       depends on IP_VS
+       depends on NETFILTER_ADVANCED
+       depends on NF_CONNTRACK
+       help
+         This option allows you to match against IPVS properties of a packet.
+
+         If unsure, say N.
+
 config NETFILTER_XT_MATCH_LENGTH
        tristate '"length" match support'
        depends on NETFILTER_ADVANCED
@@ -902,6 +928,7 @@ config NETFILTER_XT_MATCH_SOCKET
        depends on NETFILTER_ADVANCED
        depends on !NF_CONNTRACK || NF_CONNTRACK
        select NF_DEFRAG_IPV4
+       select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
        help
          This option adds a `socket' match, which can be used to match
          packets for which a TCP or UDP socket lookup finds a valid socket.