[PATCH] ieee80211: add missing global needed by IEEE80211_DEBUG_XXXX

[powerpc.git] / net / netfilter / Kconfig

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 80107d4..c558f32 100644 (file)
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -25,6 +25,7 @@ config NETFILTER_NETLINK_LOG
          and is also scheduled to replace the old syslog-based ipt_LOG
          and ip6t_LOG modules.
 
          and is also scheduled to replace the old syslog-based ipt_LOG
          and ip6t_LOG modules.
 

+# Rename this to NF_CONNTRACK in a 2.6.25

 config NF_CONNTRACK_ENABLED
        tristate "Netfilter connection tracking support"
        help
 config NF_CONNTRACK_ENABLED
        tristate "Netfilter connection tracking support"
        help


@@ -39,42 +40,9 @@ config NF_CONNTRACK_ENABLED
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

-choice
-       prompt "Netfilter connection tracking support"
-       depends on NF_CONNTRACK_ENABLED
-
-config NF_CONNTRACK_SUPPORT
-       bool "Layer 3 Independent Connection tracking"
-       help
-         Layer 3 independent connection tracking is experimental scheme
-         which generalize ip_conntrack to support other layer 3 protocols.
-
-         This is required to do Masquerading or other kinds of Network
-         Address Translation (except for Fast NAT).  It can also be used to
-         enhance packet filtering (see `Connection state match support'
-         below).
-
-config IP_NF_CONNTRACK_SUPPORT
-       bool "Layer 3 Dependent Connection tracking (OBSOLETE)"
-       help
-         The old, Layer 3 dependent ip_conntrack subsystem of netfilter.
-
-         This is required to do Masquerading or other kinds of Network
-         Address Translation (except for Fast NAT).  It can also be used to
-         enhance packet filtering (see `Connection state match support'
-         below).
-
-endchoice
-

 config NF_CONNTRACK
        tristate
 config NF_CONNTRACK
        tristate

-       default m if NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=m
-       default y if NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=y
-
-config IP_NF_CONNTRACK
-       tristate
-       default m if IP_NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=m
-       default y if IP_NF_CONNTRACK_SUPPORT && NF_CONNTRACK_ENABLED=y
+       default NF_CONNTRACK_ENABLED

 
 config NF_CT_ACCT
        bool "Connection tracking flow accounting"
 
 config NF_CT_ACCT
        bool "Connection tracking flow accounting"


@@ -235,6 +203,19 @@ config NF_CONNTRACK_PPTP
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

+config NF_CONNTRACK_SANE
+       tristate "SANE protocol support (EXPERIMENTAL)"
+       depends on EXPERIMENTAL && NF_CONNTRACK
+       help
+         SANE is a protocol for remote access to scanners as implemented
+         by the 'saned' daemon. Like FTP, it uses separate control and
+         data connections.
+
+         With this module you can support SANE on a connection tracking
+         firewall.
+
+         To compile it as a module, choose M here.  If unsure, say N.
+

 config NF_CONNTRACK_SIP
        tristate "SIP protocol support (EXPERIMENTAL)"
        depends on EXPERIMENTAL && NF_CONNTRACK
 config NF_CONNTRACK_SIP
        tristate "SIP protocol support (EXPERIMENTAL)"
        depends on EXPERIMENTAL && NF_CONNTRACK


@@ -262,6 +243,7 @@ config NF_CT_NETLINK
        tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
        depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
        depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
        tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
        depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
        depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m

+       depends on NF_NAT=n || NF_NAT

        help
          This option enables support for a netlink-based userspace interface
 
        help
          This option enables support for a netlink-based userspace interface
 


@@ -289,7 +271,8 @@ config NETFILTER_XT_TARGET_CONNMARK
        tristate  '"CONNMARK" target support'
        depends on NETFILTER_XTABLES
        depends on IP_NF_MANGLE || IP6_NF_MANGLE
        tristate  '"CONNMARK" target support'
        depends on NETFILTER_XTABLES
        depends on IP_NF_MANGLE || IP6_NF_MANGLE

-       depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
+       depends on NF_CONNTRACK
+       select NF_CONNTRACK_MARK

        help
          This option adds a `CONNMARK' target, which allows one to manipulate
          the connection mark value.  Similar to the MARK target, but
        help
          This option adds a `CONNMARK' target, which allows one to manipulate
          the connection mark value.  Similar to the MARK target, but


@@ -350,7 +333,7 @@ config NETFILTER_XT_TARGET_NOTRACK
        tristate  '"NOTRACK" target support'
        depends on NETFILTER_XTABLES
        depends on IP_NF_RAW || IP6_NF_RAW
        tristate  '"NOTRACK" target support'
        depends on NETFILTER_XTABLES
        depends on IP_NF_RAW || IP6_NF_RAW

-       depends on IP_NF_CONNTRACK || NF_CONNTRACK
+       depends on NF_CONNTRACK

        help
          The NOTRACK target allows a select rule to specify
          which packets *not* to enter the conntrack/NAT
        help
          The NOTRACK target allows a select rule to specify
          which packets *not* to enter the conntrack/NAT


@@ -371,9 +354,7 @@ config NETFILTER_XT_TARGET_SECMARK
 
 config NETFILTER_XT_TARGET_CONNSECMARK
        tristate '"CONNSECMARK" target support'
 
 config NETFILTER_XT_TARGET_CONNSECMARK
        tristate '"CONNSECMARK" target support'

-       depends on NETFILTER_XTABLES && \
-                  ((NF_CONNTRACK && NF_CONNTRACK_SECMARK) || \
-                   (IP_NF_CONNTRACK && IP_NF_CONNTRACK_SECMARK))
+       depends on NETFILTER_XTABLES && NF_CONNTRACK && NF_CONNTRACK_SECMARK

        help
          The CONNSECMARK target copies security markings from packets
          to connections, and restores security markings from connections
        help
          The CONNSECMARK target copies security markings from packets
          to connections, and restores security markings from connections


@@ -382,6 +363,32 @@ config NETFILTER_XT_TARGET_CONNSECMARK
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 
          To compile it as a module, choose M here.  If unsure, say N.
 

+config NETFILTER_XT_TARGET_TCPMSS
+       tristate '"TCPMSS" target support'
+       depends on NETFILTER_XTABLES && (IPV6 || IPV6=n)
+       ---help---
+         This option adds a `TCPMSS' target, which allows you to alter the
+         MSS value of TCP SYN packets, to control the maximum size for that
+         connection (usually limiting it to your outgoing interface's MTU
+         minus 40).
+
+         This is used to overcome criminally braindead ISPs or servers which
+         block ICMP Fragmentation Needed packets.  The symptoms of this
+         problem are that everything works fine from your Linux
+         firewall/router, but machines behind it can never exchange large
+         packets:
+               1) Web browsers connect, then hang with no data received.
+               2) Small mail works fine, but large emails hang.
+               3) ssh works fine, but scp hangs after initial handshaking.
+
+         Workaround: activate this option and add a rule to your firewall
+         configuration like:
+
+         iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
+                        -j TCPMSS --clamp-mss-to-pmtu
+
+         To compile it as a module, choose M here.  If unsure, say N.
+

 config NETFILTER_XT_MATCH_COMMENT
        tristate  '"comment" match support'
        depends on NETFILTER_XTABLES
 config NETFILTER_XT_MATCH_COMMENT
        tristate  '"comment" match support'
        depends on NETFILTER_XTABLES


@@ -395,7 +402,8 @@ config NETFILTER_XT_MATCH_COMMENT
 config NETFILTER_XT_MATCH_CONNBYTES
        tristate  '"connbytes" per-connection counter match support'
        depends on NETFILTER_XTABLES
 config NETFILTER_XT_MATCH_CONNBYTES
        tristate  '"connbytes" per-connection counter match support'
        depends on NETFILTER_XTABLES

-       depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || (NF_CT_ACCT && NF_CONNTRACK)
+       depends on NF_CONNTRACK
+       select NF_CT_ACCT

        help
          This option adds a `connbytes' match, which allows you to match the
          number of bytes and/or packets for each direction within a connection.
        help
          This option adds a `connbytes' match, which allows you to match the
          number of bytes and/or packets for each direction within a connection.


@@ -406,7 +414,8 @@ config NETFILTER_XT_MATCH_CONNBYTES
 config NETFILTER_XT_MATCH_CONNMARK
        tristate  '"connmark" connection mark match support'
        depends on NETFILTER_XTABLES
 config NETFILTER_XT_MATCH_CONNMARK
        tristate  '"connmark" connection mark match support'
        depends on NETFILTER_XTABLES

-       depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
+       depends on NF_CONNTRACK
+       select NF_CONNTRACK_MARK

        help
          This option adds a `connmark' match, which allows you to match the
          connection mark value previously set for the session by `CONNMARK'. 
        help
          This option adds a `connmark' match, which allows you to match the
          connection mark value previously set for the session by `CONNMARK'. 


@@ -418,7 +427,7 @@ config NETFILTER_XT_MATCH_CONNMARK
 config NETFILTER_XT_MATCH_CONNTRACK
        tristate '"conntrack" connection tracking match support'
        depends on NETFILTER_XTABLES
 config NETFILTER_XT_MATCH_CONNTRACK
        tristate '"conntrack" connection tracking match support'
        depends on NETFILTER_XTABLES

-       depends on IP_NF_CONNTRACK || NF_CONNTRACK
+       depends on NF_CONNTRACK

        help
          This is a general conntrack match module, a superset of the state match.
 
        help
          This is a general conntrack match module, a superset of the state match.
 


@@ -462,7 +471,7 @@ config NETFILTER_XT_MATCH_ESP
 config NETFILTER_XT_MATCH_HELPER
        tristate '"helper" match support'
        depends on NETFILTER_XTABLES
 config NETFILTER_XT_MATCH_HELPER
        tristate '"helper" match support'
        depends on NETFILTER_XTABLES

-       depends on IP_NF_CONNTRACK || NF_CONNTRACK
+       depends on NF_CONNTRACK

        help
          Helper matching allows you to match packets in dynamic connections
          tracked by a conntrack-helper, ie. ip_conntrack_ftp
        help
          Helper matching allows you to match packets in dynamic connections
          tracked by a conntrack-helper, ie. ip_conntrack_ftp


@@ -586,7 +595,7 @@ config NETFILTER_XT_MATCH_SCTP
 config NETFILTER_XT_MATCH_STATE
        tristate '"state" match support'
        depends on NETFILTER_XTABLES
 config NETFILTER_XT_MATCH_STATE
        tristate '"state" match support'
        depends on NETFILTER_XTABLES

-       depends on IP_NF_CONNTRACK || NF_CONNTRACK
+       depends on NF_CONNTRACK

        help
          Connection state matching allows you to match packets based on their
          relationship to a tracked connection (ie. previous packets).  This
        help
          Connection state matching allows you to match packets based on their
          relationship to a tracked connection (ie. previous packets).  This