ia64/linux-2.6.18-xen.hg

view net/netfilter/Kconfig @ 871:9cbcc9008446

xen/x86: don't initialize cpu_data[]'s apicid field on generic code

Afaict, this is not only redundant with the intialization done in
drivers/xen/core/smpboot.c, but actually results - at least for
secondary CPUs - in the Xen-specific value written to be later
overwritten with whatever the generic code determines (with no
guarantee that the two values are identical).

Signed-off-by: Jan Beulich <jbeulich@novell.com>
author Keir Fraser <keir.fraser@citrix.com>
date Thu May 14 10:09:15 2009 +0100 (2009-05-14)
parents 3e8752eb6d9c
children
line source
1 menu "Core Netfilter Configuration"
2 depends on NET && NETFILTER
4 config NETFILTER_NETLINK
5 tristate "Netfilter netlink interface"
6 help
7 If this option is enabled, the kernel will include support
8 for the new netfilter netlink interface.
10 config NETFILTER_NETLINK_QUEUE
11 tristate "Netfilter NFQUEUE over NFNETLINK interface"
12 depends on NETFILTER_NETLINK
13 help
14 If this option is enabled, the kernel will include support
15 for queueing packets via NFNETLINK.
17 config NETFILTER_NETLINK_LOG
18 tristate "Netfilter LOG over NFNETLINK interface"
19 depends on NETFILTER_NETLINK
20 help
21 If this option is enabled, the kernel will include support
22 for logging packets via NFNETLINK.
24 This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
25 and is also scheduled to replace the old syslog-based ipt_LOG
26 and ip6t_LOG modules.
28 config NF_CONNTRACK
29 tristate "Layer 3 Independent Connection tracking (EXPERIMENTAL)"
30 depends on EXPERIMENTAL && IP_NF_CONNTRACK=n
31 default n
32 ---help---
33 Connection tracking keeps a record of what packets have passed
34 through your machine, in order to figure out how they are related
35 into connections.
37 Layer 3 independent connection tracking is experimental scheme
38 which generalize ip_conntrack to support other layer 3 protocols.
40 To compile it as a module, choose M here. If unsure, say N.
42 config NF_CT_ACCT
43 bool "Connection tracking flow accounting"
44 depends on NF_CONNTRACK
45 help
46 If this option is enabled, the connection tracking code will
47 keep per-flow packet and byte counters.
49 Those counters can be used for flow-based accounting or the
50 `connbytes' match.
52 If unsure, say `N'.
54 config NF_CONNTRACK_MARK
55 bool 'Connection mark tracking support'
56 depends on NF_CONNTRACK
57 help
58 This option enables support for connection marks, used by the
59 `CONNMARK' target and `connmark' match. Similar to the mark value
60 of packets, but this mark value is kept in the conntrack session
61 instead of the individual packets.
63 config NF_CONNTRACK_SECMARK
64 bool 'Connection tracking security mark support'
65 depends on NF_CONNTRACK && NETWORK_SECMARK
66 help
67 This option enables security markings to be applied to
68 connections. Typically they are copied to connections from
69 packets using the CONNSECMARK target and copied back from
70 connections to packets with the same target, with the packets
71 being originally labeled via SECMARK.
73 If unsure, say 'N'.
75 config NF_CONNTRACK_EVENTS
76 bool "Connection tracking events (EXPERIMENTAL)"
77 depends on EXPERIMENTAL && NF_CONNTRACK
78 help
79 If this option is enabled, the connection tracking code will
80 provide a notifier chain that can be used by other kernel code
81 to get notified about changes in the connection tracking state.
83 If unsure, say `N'.
85 config NF_CT_PROTO_SCTP
86 tristate 'SCTP protocol on new connection tracking support (EXPERIMENTAL)'
87 depends on EXPERIMENTAL && NF_CONNTRACK
88 default n
89 help
90 With this option enabled, the layer 3 independent connection
91 tracking code will be able to do state tracking on SCTP connections.
93 If you want to compile it as a module, say M here and read
94 Documentation/modules.txt. If unsure, say `N'.
96 config NF_CONNTRACK_FTP
97 tristate "FTP support on new connection tracking (EXPERIMENTAL)"
98 depends on EXPERIMENTAL && NF_CONNTRACK
99 help
100 Tracking FTP connections is problematic: special helpers are
101 required for tracking them, and doing masquerading and other forms
102 of Network Address Translation on them.
104 This is FTP support on Layer 3 independent connection tracking.
105 Layer 3 independent connection tracking is experimental scheme
106 which generalize ip_conntrack to support other layer 3 protocols.
108 To compile it as a module, choose M here. If unsure, say N.
110 config NF_CT_NETLINK
111 tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
112 depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
113 depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
114 help
115 This option enables support for a netlink-based userspace interface
117 config NETFILTER_XTABLES
118 tristate "Netfilter Xtables support (required for ip_tables)"
119 help
120 This is required if you intend to use any of ip_tables,
121 ip6_tables or arp_tables.
123 # alphabetically ordered list of targets
125 config NETFILTER_XT_TARGET_CLASSIFY
126 tristate '"CLASSIFY" target support'
127 depends on NETFILTER_XTABLES
128 help
129 This option adds a `CLASSIFY' target, which enables the user to set
130 the priority of a packet. Some qdiscs can use this value for
131 classification, among these are:
133 atm, cbq, dsmark, pfifo_fast, htb, prio
135 To compile it as a module, choose M here. If unsure, say N.
137 config NETFILTER_XT_TARGET_CONNMARK
138 tristate '"CONNMARK" target support'
139 depends on NETFILTER_XTABLES
140 depends on IP_NF_MANGLE || IP6_NF_MANGLE
141 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
142 help
143 This option adds a `CONNMARK' target, which allows one to manipulate
144 the connection mark value. Similar to the MARK target, but
145 affects the connection mark value rather than the packet mark value.
147 If you want to compile it as a module, say M here and read
148 <file:Documentation/modules.txt>. The module will be called
149 ipt_CONNMARK.o. If unsure, say `N'.
151 config NETFILTER_XT_TARGET_MARK
152 tristate '"MARK" target support'
153 depends on NETFILTER_XTABLES
154 help
155 This option adds a `MARK' target, which allows you to create rules
156 in the `mangle' table which alter the netfilter mark (nfmark) field
157 associated with the packet prior to routing. This can change
158 the routing method (see `Use netfilter MARK value as routing
159 key') and can also be used by other subsystems to change their
160 behavior.
162 To compile it as a module, choose M here. If unsure, say N.
164 config NETFILTER_XT_TARGET_NFQUEUE
165 tristate '"NFQUEUE" target Support'
166 depends on NETFILTER_XTABLES
167 help
168 This target replaced the old obsolete QUEUE target.
170 As opposed to QUEUE, it supports 65535 different queues,
171 not just one.
173 To compile it as a module, choose M here. If unsure, say N.
175 config NETFILTER_XT_TARGET_NOTRACK
176 tristate '"NOTRACK" target support'
177 depends on NETFILTER_XTABLES
178 depends on IP_NF_RAW || IP6_NF_RAW
179 depends on IP_NF_CONNTRACK || NF_CONNTRACK
180 help
181 The NOTRACK target allows a select rule to specify
182 which packets *not* to enter the conntrack/NAT
183 subsystem with all the consequences (no ICMP error tracking,
184 no protocol helpers for the selected packets).
186 If you want to compile it as a module, say M here and read
187 <file:Documentation/modules.txt>. If unsure, say `N'.
189 config NETFILTER_XT_TARGET_SECMARK
190 tristate '"SECMARK" target support'
191 depends on NETFILTER_XTABLES && NETWORK_SECMARK
192 help
193 The SECMARK target allows security marking of network
194 packets, for use with security subsystems.
196 To compile it as a module, choose M here. If unsure, say N.
198 config NETFILTER_XT_TARGET_CONNSECMARK
199 tristate '"CONNSECMARK" target support'
200 depends on NETFILTER_XTABLES && \
201 ((NF_CONNTRACK && NF_CONNTRACK_SECMARK) || \
202 (IP_NF_CONNTRACK && IP_NF_CONNTRACK_SECMARK))
203 help
204 The CONNSECMARK target copies security markings from packets
205 to connections, and restores security markings from connections
206 to packets (if the packets are not already marked). This would
207 normally be used in conjunction with the SECMARK target.
209 To compile it as a module, choose M here. If unsure, say N.
211 config NETFILTER_XT_MATCH_COMMENT
212 tristate '"comment" match support'
213 depends on NETFILTER_XTABLES
214 help
215 This option adds a `comment' dummy-match, which allows you to put
216 comments in your iptables ruleset.
218 If you want to compile it as a module, say M here and read
219 <file:Documentation/modules.txt>. If unsure, say `N'.
221 config NETFILTER_XT_MATCH_CONNBYTES
222 tristate '"connbytes" per-connection counter match support'
223 depends on NETFILTER_XTABLES
224 depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || (NF_CT_ACCT && NF_CONNTRACK)
225 help
226 This option adds a `connbytes' match, which allows you to match the
227 number of bytes and/or packets for each direction within a connection.
229 If you want to compile it as a module, say M here and read
230 <file:Documentation/modules.txt>. If unsure, say `N'.
232 config NETFILTER_XT_MATCH_CONNMARK
233 tristate '"connmark" connection mark match support'
234 depends on NETFILTER_XTABLES
235 depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
236 help
237 This option adds a `connmark' match, which allows you to match the
238 connection mark value previously set for the session by `CONNMARK'.
240 If you want to compile it as a module, say M here and read
241 <file:Documentation/modules.txt>. The module will be called
242 ipt_connmark.o. If unsure, say `N'.
244 config NETFILTER_XT_MATCH_CONNTRACK
245 tristate '"conntrack" connection tracking match support'
246 depends on NETFILTER_XTABLES
247 depends on IP_NF_CONNTRACK || NF_CONNTRACK
248 help
249 This is a general conntrack match module, a superset of the state match.
251 It allows matching on additional conntrack information, which is
252 useful in complex configurations, such as NAT gateways with multiple
253 internet links or tunnels.
255 To compile it as a module, choose M here. If unsure, say N.
257 config NETFILTER_XT_MATCH_DCCP
258 tristate '"DCCP" protocol match support'
259 depends on NETFILTER_XTABLES
260 help
261 With this option enabled, you will be able to use the iptables
262 `dccp' match in order to match on DCCP source/destination ports
263 and DCCP flags.
265 If you want to compile it as a module, say M here and read
266 <file:Documentation/modules.txt>. If unsure, say `N'.
268 config NETFILTER_XT_MATCH_ESP
269 tristate '"ESP" match support'
270 depends on NETFILTER_XTABLES
271 help
272 This match extension allows you to match a range of SPIs
273 inside ESP header of IPSec packets.
275 To compile it as a module, choose M here. If unsure, say N.
277 config NETFILTER_XT_MATCH_HELPER
278 tristate '"helper" match support'
279 depends on NETFILTER_XTABLES
280 depends on IP_NF_CONNTRACK || NF_CONNTRACK
281 help
282 Helper matching allows you to match packets in dynamic connections
283 tracked by a conntrack-helper, ie. ip_conntrack_ftp
285 To compile it as a module, choose M here. If unsure, say Y.
287 config NETFILTER_XT_MATCH_LENGTH
288 tristate '"length" match support'
289 depends on NETFILTER_XTABLES
290 help
291 This option allows you to match the length of a packet against a
292 specific value or range of values.
294 To compile it as a module, choose M here. If unsure, say N.
296 config NETFILTER_XT_MATCH_LIMIT
297 tristate '"limit" match support'
298 depends on NETFILTER_XTABLES
299 help
300 limit matching allows you to control the rate at which a rule can be
301 matched: mainly useful in combination with the LOG target ("LOG
302 target support", below) and to avoid some Denial of Service attacks.
304 To compile it as a module, choose M here. If unsure, say N.
306 config NETFILTER_XT_MATCH_MAC
307 tristate '"mac" address match support'
308 depends on NETFILTER_XTABLES
309 help
310 MAC matching allows you to match packets based on the source
311 Ethernet address of the packet.
313 To compile it as a module, choose M here. If unsure, say N.
315 config NETFILTER_XT_MATCH_MARK
316 tristate '"mark" match support'
317 depends on NETFILTER_XTABLES
318 help
319 Netfilter mark matching allows you to match packets based on the
320 `nfmark' value in the packet. This can be set by the MARK target
321 (see below).
323 To compile it as a module, choose M here. If unsure, say N.
325 config NETFILTER_XT_MATCH_POLICY
326 tristate 'IPsec "policy" match support'
327 depends on NETFILTER_XTABLES && XFRM
328 help
329 Policy matching allows you to match packets based on the
330 IPsec policy that was used during decapsulation/will
331 be used during encapsulation.
333 To compile it as a module, choose M here. If unsure, say N.
335 config NETFILTER_XT_MATCH_MULTIPORT
336 tristate "Multiple port match support"
337 depends on NETFILTER_XTABLES
338 help
339 Multiport matching allows you to match TCP or UDP packets based on
340 a series of source or destination ports: normally a rule can only
341 match a single range of ports.
343 To compile it as a module, choose M here. If unsure, say N.
345 config NETFILTER_XT_MATCH_PHYSDEV
346 tristate '"physdev" match support'
347 depends on NETFILTER_XTABLES && BRIDGE && BRIDGE_NETFILTER
348 help
349 Physdev packet matching matches against the physical bridge ports
350 the IP packet arrived on or will leave by.
352 To compile it as a module, choose M here. If unsure, say N.
354 config NETFILTER_XT_MATCH_PKTTYPE
355 tristate '"pkttype" packet type match support'
356 depends on NETFILTER_XTABLES
357 help
358 Packet type matching allows you to match a packet by
359 its "class", eg. BROADCAST, MULTICAST, ...
361 Typical usage:
362 iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
364 To compile it as a module, choose M here. If unsure, say N.
366 config NETFILTER_XT_MATCH_QUOTA
367 tristate '"quota" match support'
368 depends on NETFILTER_XTABLES
369 help
370 This option adds a `quota' match, which allows to match on a
371 byte counter.
373 If you want to compile it as a module, say M here and read
374 <file:Documentation/modules.txt>. If unsure, say `N'.
376 config NETFILTER_XT_MATCH_REALM
377 tristate '"realm" match support'
378 depends on NETFILTER_XTABLES
379 select NET_CLS_ROUTE
380 help
381 This option adds a `realm' match, which allows you to use the realm
382 key from the routing subsystem inside iptables.
384 This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
385 in tc world.
387 If you want to compile it as a module, say M here and read
388 <file:Documentation/modules.txt>. If unsure, say `N'.
390 config NETFILTER_XT_MATCH_SCTP
391 tristate '"sctp" protocol match support (EXPERIMENTAL)'
392 depends on NETFILTER_XTABLES && EXPERIMENTAL
393 help
394 With this option enabled, you will be able to use the
395 `sctp' match in order to match on SCTP source/destination ports
396 and SCTP chunk types.
398 If you want to compile it as a module, say M here and read
399 <file:Documentation/modules.txt>. If unsure, say `N'.
401 config NETFILTER_XT_MATCH_STATE
402 tristate '"state" match support'
403 depends on NETFILTER_XTABLES
404 depends on IP_NF_CONNTRACK || NF_CONNTRACK
405 help
406 Connection state matching allows you to match packets based on their
407 relationship to a tracked connection (ie. previous packets). This
408 is a powerful tool for packet classification.
410 To compile it as a module, choose M here. If unsure, say N.
412 config NETFILTER_XT_MATCH_STATISTIC
413 tristate '"statistic" match support'
414 depends on NETFILTER_XTABLES
415 help
416 This option adds a `statistic' match, which allows you to match
417 on packets periodically or randomly with a given percentage.
419 To compile it as a module, choose M here. If unsure, say N.
421 config NETFILTER_XT_MATCH_STRING
422 tristate '"string" match support'
423 depends on NETFILTER_XTABLES
424 select TEXTSEARCH
425 select TEXTSEARCH_KMP
426 select TEXTSEARCH_BM
427 select TEXTSEARCH_FSM
428 help
429 This option adds a `string' match, which allows you to look for
430 pattern matchings in packets.
432 To compile it as a module, choose M here. If unsure, say N.
434 config NETFILTER_XT_MATCH_TCPMSS
435 tristate '"tcpmss" match support'
436 depends on NETFILTER_XTABLES
437 help
438 This option adds a `tcpmss' match, which allows you to examine the
439 MSS value of TCP SYN packets, which control the maximum packet size
440 for that connection.
442 To compile it as a module, choose M here. If unsure, say N.
444 endmenu