Merge remote-tracking branch 'lsk/linux-linaro-lsk-v4.4-android' into linux-linaro...

[firefly-linux-kernel-4.4.55.git] / net / netfilter / Kconfig

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 4692782b528053a408b15f0daccaf6f6cb3fc10e..273f26b67653e6561c475288cccbb5491aca0410 100644 (file)
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -1278,6 +1278,8 @@ config NETFILTER_XT_MATCH_OWNER
        based on who created the socket: the user or group. It is also
        possible to check whether a socket actually exists.
 
+       Conflicts with '"quota, tag, uid" match'
+
 config NETFILTER_XT_MATCH_POLICY
        tristate 'IPsec "policy" match support'
        depends on XFRM
@@ -1311,6 +1313,22 @@ config NETFILTER_XT_MATCH_PKTTYPE
 
          To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_MATCH_QTAGUID
+       bool '"quota, tag, owner" match and stats support'
+        depends on NETFILTER_XT_MATCH_SOCKET
+       depends on NETFILTER_XT_MATCH_OWNER=n
+       help
+         This option replaces the `owner' match. In addition to matching
+         on uid, it keeps stats based on a tag assigned to a socket.
+         The full tag is comprised of a UID and an accounting tag.
+         The tags are assignable to sockets from user space (e.g. a download
+         manager can assign the socket to another UID for accounting).
+         Stats and control are done via /proc/net/xt_qtaguid/.
+         It replaces owner as it takes the same arguments, but should
+         really be recognized by the iptables tool.
+
+         If unsure, say `N'.
+
 config NETFILTER_XT_MATCH_QUOTA
        tristate '"quota" match support'
        depends on NETFILTER_ADVANCED
@@ -1321,6 +1339,30 @@ config NETFILTER_XT_MATCH_QUOTA
          If you want to compile it as a module, say M here and read
          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
+config NETFILTER_XT_MATCH_QUOTA2
+       tristate '"quota2" match support'
+       depends on NETFILTER_ADVANCED
+       help
+         This option adds a `quota2' match, which allows to match on a
+         byte counter correctly and not per CPU.
+         It allows naming the quotas.
+         This is based on http://xtables-addons.git.sourceforge.net
+
+         If you want to compile it as a module, say M here and read
+         <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
+
+config NETFILTER_XT_MATCH_QUOTA2_LOG
+       bool '"quota2" Netfilter LOG support'
+       depends on NETFILTER_XT_MATCH_QUOTA2
+       depends on IP_NF_TARGET_ULOG=n    # not yes, not module, just no
+       default n
+       help
+         This option allows `quota2' to log ONCE when a quota limit
+         is passed. It logs via NETLINK using the NETLINK_NFLOG family.
+         It logs similarly to how ipt_ULOG would without data.
+
+         If unsure, say `N'.
+
 config NETFILTER_XT_MATCH_RATEEST
        tristate '"rateest" match support'
        depends on NETFILTER_ADVANCED