These changes are the raw update to linux-4.4.6-rt14. Kernel sources

[kvmfornfv.git] / kernel / net / netfilter / Kconfig

diff --git a/kernel/net/netfilter/Kconfig b/kernel/net/netfilter/Kconfig
index a0f3e6a..4692782 100644 (file)
--- a/kernel/net/netfilter/Kconfig
+++ b/kernel/net/netfilter/Kconfig
@@ -1,6 +1,14 @@
 menu "Core Netfilter Configuration"
        depends on NET && INET && NETFILTER
 
+config NETFILTER_INGRESS
+       bool "Netfilter ingress support"
+       default y
+       select NET_INGRESS
+       help
+         This allows you to classify packets from ingress using the Netfilter
+         infrastructure.
+
 config NETFILTER_NETLINK
        tristate
 
@@ -198,7 +206,7 @@ config NF_CONNTRACK_FTP
 
 config NF_CONNTRACK_H323
        tristate "H.323 protocol support"
-       depends on (IPV6 || IPV6=n)
+       depends on IPV6 || IPV6=n
        depends on NETFILTER_ADVANCED
        help
          H.323 is a VoIP signalling protocol from ITU-T. As one of the most
@@ -346,7 +354,7 @@ config NF_CT_NETLINK_HELPER
        select NETFILTER_NETLINK
        depends on NF_CT_NETLINK
        depends on NETFILTER_NETLINK_QUEUE
-       depends on NETFILTER_NETLINK_QUEUE_CT
+       depends on NETFILTER_NETLINK_GLUE_CT
        depends on NETFILTER_ADVANCED
        help
          This option enables the user-space connection tracking helpers
@@ -354,13 +362,14 @@ config NF_CT_NETLINK_HELPER
 
          If unsure, say `N'.
 
-config NETFILTER_NETLINK_QUEUE_CT
-        bool "NFQUEUE integration with Connection Tracking"
-        default n
-        depends on NETFILTER_NETLINK_QUEUE
+config NETFILTER_NETLINK_GLUE_CT
+       bool "NFQUEUE and NFLOG integration with Connection Tracking"
+       default n
+       depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
        help
-         If this option is enabled, NFQUEUE can include Connection Tracking
-         information together with the packet is the enqueued via NFNETLINK.
+         If this option is enabled, NFQUEUE and NFLOG can include
+         Connection Tracking information together with the packet is
+         the enqueued via NFNETLINK.
 
 config NF_NAT
        tristate
@@ -448,6 +457,11 @@ config NF_TABLES_INET
        help
          This option enables support for a mixed IPv4/IPv6 "inet" table.
 
+config NF_TABLES_NETDEV
+       tristate "Netfilter nf_tables netdev tables support"
+       help
+         This option enables support for the "netdev" table.
+
 config NFT_EXTHDR
        tristate "Netfilter nf_tables IPv6 exthdr module"
        help
@@ -710,7 +724,7 @@ config NETFILTER_XT_TARGET_HL
 
 config NETFILTER_XT_TARGET_HMARK
        tristate '"HMARK" target support'
-       depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
+       depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
        depends on NETFILTER_ADVANCED
        ---help---
        This option adds the "HMARK" target.
@@ -852,8 +866,10 @@ config NETFILTER_XT_TARGET_REDIRECT
 config NETFILTER_XT_TARGET_TEE
        tristate '"TEE" - packet cloning to alternate destination'
        depends on NETFILTER_ADVANCED
-       depends on (IPV6 || IPV6=n)
+       depends on IPV6 || IPV6=n
        depends on !NF_CONNTRACK || NF_CONNTRACK
+       select NF_DUP_IPV4
+       select NF_DUP_IPV6 if IP6_NF_IPTABLES != n
        ---help---
        This option adds a "TEE" target with which a packet can be cloned and
        this clone be rerouted to another nexthop.
@@ -862,11 +878,11 @@ config NETFILTER_XT_TARGET_TPROXY
        tristate '"TPROXY" target transparent proxying support'
        depends on NETFILTER_XTABLES
        depends on NETFILTER_ADVANCED
-       depends on (IPV6 || IPV6=n)
-       depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
+       depends on IPV6 || IPV6=n
+       depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
        depends on IP_NF_MANGLE
        select NF_DEFRAG_IPV4
-       select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
+       select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
        help
          This option adds a `TPROXY' target, which is somewhat similar to
          REDIRECT.  It can only be used in the mangle table and is useful
@@ -902,7 +918,7 @@ config NETFILTER_XT_TARGET_SECMARK
 
 config NETFILTER_XT_TARGET_TCPMSS
        tristate '"TCPMSS" target support'
-       depends on (IPV6 || IPV6=n)
+       depends on IPV6 || IPV6=n
        default m if NETFILTER_ADVANCED=n
        ---help---
          This option adds a `TCPMSS' target, which allows you to alter the
@@ -1114,7 +1130,7 @@ config NETFILTER_XT_MATCH_ESP
 
 config NETFILTER_XT_MATCH_HASHLIMIT
        tristate '"hashlimit" match support'
-       depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
+       depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
        depends on NETFILTER_ADVANCED
        help
          This option adds a `hashlimit' match.
@@ -1356,10 +1372,10 @@ config NETFILTER_XT_MATCH_SOCKET
        depends on NETFILTER_XTABLES
        depends on NETFILTER_ADVANCED
        depends on !NF_CONNTRACK || NF_CONNTRACK
-       depends on (IPV6 || IPV6=n)
-       depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
+       depends on IPV6 || IPV6=n
+       depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
        select NF_DEFRAG_IPV4
-       select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
+       select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
        help
          This option adds a `socket' match, which can be used to match
          packets for which a TCP or UDP socket lookup finds a valid socket.