xref: /openbmc/linux/net/netfilter/Kconfig (revision 1802d0be)
1# SPDX-License-Identifier: GPL-2.0-only
2menu "Core Netfilter Configuration"
3	depends on NET && INET && NETFILTER
4
5config NETFILTER_INGRESS
6	bool "Netfilter ingress support"
7	default y
8	select NET_INGRESS
9	help
10	  This allows you to classify packets from ingress using the Netfilter
11	  infrastructure.
12
13config NETFILTER_NETLINK
14	tristate
15
16config NETFILTER_FAMILY_BRIDGE
17	bool
18
19config NETFILTER_FAMILY_ARP
20	bool
21
22config NETFILTER_NETLINK_ACCT
23tristate "Netfilter NFACCT over NFNETLINK interface"
24	depends on NETFILTER_ADVANCED
25	select NETFILTER_NETLINK
26	help
27	  If this option is enabled, the kernel will include support
28	  for extended accounting via NFNETLINK.
29
30config NETFILTER_NETLINK_QUEUE
31	tristate "Netfilter NFQUEUE over NFNETLINK interface"
32	depends on NETFILTER_ADVANCED
33	select NETFILTER_NETLINK
34	help
35	  If this option is enabled, the kernel will include support
36	  for queueing packets via NFNETLINK.
37
38config NETFILTER_NETLINK_LOG
39	tristate "Netfilter LOG over NFNETLINK interface"
40	default m if NETFILTER_ADVANCED=n
41	select NETFILTER_NETLINK
42	help
43	  If this option is enabled, the kernel will include support
44	  for logging packets via NFNETLINK.
45
46	  This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
47	  and is also scheduled to replace the old syslog-based ipt_LOG
48	  and ip6t_LOG modules.
49
50config NETFILTER_NETLINK_OSF
51	tristate "Netfilter OSF over NFNETLINK interface"
52	depends on NETFILTER_ADVANCED
53	select NETFILTER_NETLINK
54	help
55	  If this option is enabled, the kernel will include support
56	  for passive OS fingerprint via NFNETLINK.
57
58config NF_CONNTRACK
59	tristate "Netfilter connection tracking support"
60	default m if NETFILTER_ADVANCED=n
61	select NF_DEFRAG_IPV4
62	select NF_DEFRAG_IPV6 if IPV6 != n
63	help
64	  Connection tracking keeps a record of what packets have passed
65	  through your machine, in order to figure out how they are related
66	  into connections.
67
68	  This is required to do Masquerading or other kinds of Network
69	  Address Translation.  It can also be used to enhance packet
70	  filtering (see `Connection state match support' below).
71
72	  To compile it as a module, choose M here.  If unsure, say N.
73
74config NF_LOG_COMMON
75	tristate
76
77config NF_LOG_NETDEV
78	tristate "Netdev packet logging"
79	select NF_LOG_COMMON
80
81if NF_CONNTRACK
82config NETFILTER_CONNCOUNT
83	tristate
84
85config NF_CONNTRACK_MARK
86	bool  'Connection mark tracking support'
87	depends on NETFILTER_ADVANCED
88	help
89	  This option enables support for connection marks, used by the
90	  `CONNMARK' target and `connmark' match. Similar to the mark value
91	  of packets, but this mark value is kept in the conntrack session
92	  instead of the individual packets.
93
94config NF_CONNTRACK_SECMARK
95	bool  'Connection tracking security mark support'
96	depends on NETWORK_SECMARK
97	default m if NETFILTER_ADVANCED=n
98	help
99	  This option enables security markings to be applied to
100	  connections.  Typically they are copied to connections from
101	  packets using the CONNSECMARK target and copied back from
102	  connections to packets with the same target, with the packets
103	  being originally labeled via SECMARK.
104
105	  If unsure, say 'N'.
106
107config NF_CONNTRACK_ZONES
108	bool  'Connection tracking zones'
109	depends on NETFILTER_ADVANCED
110	help
111	  This option enables support for connection tracking zones.
112	  Normally, each connection needs to have a unique system wide
113	  identity. Connection tracking zones allow to have multiple
114	  connections using the same identity, as long as they are
115	  contained in different zones.
116
117	  If unsure, say `N'.
118
119config NF_CONNTRACK_PROCFS
120	bool "Supply CT list in procfs (OBSOLETE)"
121	default y
122	depends on PROC_FS
123	---help---
124	This option enables for the list of known conntrack entries
125	to be shown in procfs under net/netfilter/nf_conntrack. This
126	is considered obsolete in favor of using the conntrack(8)
127	tool which uses Netlink.
128
129config NF_CONNTRACK_EVENTS
130	bool "Connection tracking events"
131	depends on NETFILTER_ADVANCED
132	help
133	  If this option is enabled, the connection tracking code will
134	  provide a notifier chain that can be used by other kernel code
135	  to get notified about changes in the connection tracking state.
136
137	  If unsure, say `N'.
138
139config NF_CONNTRACK_TIMEOUT
140	bool  'Connection tracking timeout'
141	depends on NETFILTER_ADVANCED
142	help
143	  This option enables support for connection tracking timeout
144	  extension. This allows you to attach timeout policies to flow
145	  via the CT target.
146
147	  If unsure, say `N'.
148
149config NF_CONNTRACK_TIMESTAMP
150	bool  'Connection tracking timestamping'
151	depends on NETFILTER_ADVANCED
152	help
153	  This option enables support for connection tracking timestamping.
154	  This allows you to store the flow start-time and to obtain
155	  the flow-stop time (once it has been destroyed) via Connection
156	  tracking events.
157
158	  If unsure, say `N'.
159
160config NF_CONNTRACK_LABELS
161	bool "Connection tracking labels"
162	help
163	  This option enables support for assigning user-defined flag bits
164	  to connection tracking entries.  It can be used with xtables connlabel
165	  match and the nftables ct expression.
166
167config NF_CT_PROTO_DCCP
168	bool 'DCCP protocol connection tracking support'
169	depends on NETFILTER_ADVANCED
170	default y
171	help
172	  With this option enabled, the layer 3 independent connection
173	  tracking code will be able to do state tracking on DCCP connections.
174
175	  If unsure, say Y.
176
177config NF_CT_PROTO_GRE
178	bool
179
180config NF_CT_PROTO_SCTP
181	bool 'SCTP protocol connection tracking support'
182	depends on NETFILTER_ADVANCED
183	default y
184	select LIBCRC32C
185	help
186	  With this option enabled, the layer 3 independent connection
187	  tracking code will be able to do state tracking on SCTP connections.
188
189	  If unsure, say Y.
190
191config NF_CT_PROTO_UDPLITE
192	bool 'UDP-Lite protocol connection tracking support'
193	depends on NETFILTER_ADVANCED
194	default y
195	help
196	  With this option enabled, the layer 3 independent connection
197	  tracking code will be able to do state tracking on UDP-Lite
198	  connections.
199
200	  If unsure, say Y.
201
202config NF_CONNTRACK_AMANDA
203	tristate "Amanda backup protocol support"
204	depends on NETFILTER_ADVANCED
205	select TEXTSEARCH
206	select TEXTSEARCH_KMP
207	help
208	  If you are running the Amanda backup package <http://www.amanda.org/>
209	  on this machine or machines that will be MASQUERADED through this
210	  machine, then you may want to enable this feature.  This allows the
211	  connection tracking and natting code to allow the sub-channels that
212	  Amanda requires for communication of the backup data, messages and
213	  index.
214
215	  To compile it as a module, choose M here.  If unsure, say N.
216
217config NF_CONNTRACK_FTP
218	tristate "FTP protocol support"
219	default m if NETFILTER_ADVANCED=n
220	help
221	  Tracking FTP connections is problematic: special helpers are
222	  required for tracking them, and doing masquerading and other forms
223	  of Network Address Translation on them.
224
225	  This is FTP support on Layer 3 independent connection tracking.
226	  Layer 3 independent connection tracking is experimental scheme
227	  which generalize ip_conntrack to support other layer 3 protocols.
228
229	  To compile it as a module, choose M here.  If unsure, say N.
230
231config NF_CONNTRACK_H323
232	tristate "H.323 protocol support"
233	depends on IPV6 || IPV6=n
234	depends on NETFILTER_ADVANCED
235	help
236	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
237	  important VoIP protocols, it is widely used by voice hardware and
238	  software including voice gateways, IP phones, Netmeeting, OpenPhone,
239	  Gnomemeeting, etc.
240
241	  With this module you can support H.323 on a connection tracking/NAT
242	  firewall.
243
244	  This module supports RAS, Fast Start, H.245 Tunnelling, Call
245	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
246	  whiteboard, file transfer, etc. For more information, please
247	  visit http://nath323.sourceforge.net/.
248
249	  To compile it as a module, choose M here.  If unsure, say N.
250
251config NF_CONNTRACK_IRC
252	tristate "IRC protocol support"
253	default m if NETFILTER_ADVANCED=n
254	help
255	  There is a commonly-used extension to IRC called
256	  Direct Client-to-Client Protocol (DCC).  This enables users to send
257	  files to each other, and also chat to each other without the need
258	  of a server.  DCC Sending is used anywhere you send files over IRC,
259	  and DCC Chat is most commonly used by Eggdrop bots.  If you are
260	  using NAT, this extension will enable you to send files and initiate
261	  chats.  Note that you do NOT need this extension to get files or
262	  have others initiate chats, or everything else in IRC.
263
264	  To compile it as a module, choose M here.  If unsure, say N.
265
266config NF_CONNTRACK_BROADCAST
267	tristate
268
269config NF_CONNTRACK_NETBIOS_NS
270	tristate "NetBIOS name service protocol support"
271	select NF_CONNTRACK_BROADCAST
272	help
273	  NetBIOS name service requests are sent as broadcast messages from an
274	  unprivileged port and responded to with unicast messages to the
275	  same port. This make them hard to firewall properly because connection
276	  tracking doesn't deal with broadcasts. This helper tracks locally
277	  originating NetBIOS name service requests and the corresponding
278	  responses. It relies on correct IP address configuration, specifically
279	  netmask and broadcast address. When properly configured, the output
280	  of "ip address show" should look similar to this:
281
282	  $ ip -4 address show eth0
283	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
284	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
285
286	  To compile it as a module, choose M here.  If unsure, say N.
287
288config NF_CONNTRACK_SNMP
289	tristate "SNMP service protocol support"
290	depends on NETFILTER_ADVANCED
291	select NF_CONNTRACK_BROADCAST
292	help
293	  SNMP service requests are sent as broadcast messages from an
294	  unprivileged port and responded to with unicast messages to the
295	  same port. This make them hard to firewall properly because connection
296	  tracking doesn't deal with broadcasts. This helper tracks locally
297	  originating SNMP service requests and the corresponding
298	  responses. It relies on correct IP address configuration, specifically
299	  netmask and broadcast address.
300
301	  To compile it as a module, choose M here.  If unsure, say N.
302
303config NF_CONNTRACK_PPTP
304	tristate "PPtP protocol support"
305	depends on NETFILTER_ADVANCED
306	select NF_CT_PROTO_GRE
307	help
308	  This module adds support for PPTP (Point to Point Tunnelling
309	  Protocol, RFC2637) connection tracking and NAT.
310
311	  If you are running PPTP sessions over a stateful firewall or NAT
312	  box, you may want to enable this feature.
313
314	  Please note that not all PPTP modes of operation are supported yet.
315	  Specifically these limitations exist:
316	    - Blindly assumes that control connections are always established
317	      in PNS->PAC direction. This is a violation of RFC2637.
318	    - Only supports a single call within each session
319
320	  To compile it as a module, choose M here.  If unsure, say N.
321
322config NF_CONNTRACK_SANE
323	tristate "SANE protocol support"
324	depends on NETFILTER_ADVANCED
325	help
326	  SANE is a protocol for remote access to scanners as implemented
327	  by the 'saned' daemon. Like FTP, it uses separate control and
328	  data connections.
329
330	  With this module you can support SANE on a connection tracking
331	  firewall.
332
333	  To compile it as a module, choose M here.  If unsure, say N.
334
335config NF_CONNTRACK_SIP
336	tristate "SIP protocol support"
337	default m if NETFILTER_ADVANCED=n
338	help
339	  SIP is an application-layer control protocol that can establish,
340	  modify, and terminate multimedia sessions (conferences) such as
341	  Internet telephony calls. With the ip_conntrack_sip and
342	  the nf_nat_sip modules you can support the protocol on a connection
343	  tracking/NATing firewall.
344
345	  To compile it as a module, choose M here.  If unsure, say N.
346
347config NF_CONNTRACK_TFTP
348	tristate "TFTP protocol support"
349	depends on NETFILTER_ADVANCED
350	help
351	  TFTP connection tracking helper, this is required depending
352	  on how restrictive your ruleset is.
353	  If you are using a tftp client behind -j SNAT or -j MASQUERADING
354	  you will need this.
355
356	  To compile it as a module, choose M here.  If unsure, say N.
357
358config NF_CT_NETLINK
359	tristate 'Connection tracking netlink interface'
360	select NETFILTER_NETLINK
361	default m if NETFILTER_ADVANCED=n
362	help
363	  This option enables support for a netlink-based userspace interface
364
365config NF_CT_NETLINK_TIMEOUT
366	tristate  'Connection tracking timeout tuning via Netlink'
367	select NETFILTER_NETLINK
368	depends on NETFILTER_ADVANCED
369	depends on NF_CONNTRACK_TIMEOUT
370	help
371	  This option enables support for connection tracking timeout
372	  fine-grain tuning. This allows you to attach specific timeout
373	  policies to flows, instead of using the global timeout policy.
374
375	  If unsure, say `N'.
376
377config NF_CT_NETLINK_HELPER
378	tristate 'Connection tracking helpers in user-space via Netlink'
379	select NETFILTER_NETLINK
380	depends on NF_CT_NETLINK
381	depends on NETFILTER_NETLINK_QUEUE
382	depends on NETFILTER_NETLINK_GLUE_CT
383	depends on NETFILTER_ADVANCED
384	help
385	  This option enables the user-space connection tracking helpers
386	  infrastructure.
387
388	  If unsure, say `N'.
389
390config NETFILTER_NETLINK_GLUE_CT
391	bool "NFQUEUE and NFLOG integration with Connection Tracking"
392	default n
393	depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
394	help
395	  If this option is enabled, NFQUEUE and NFLOG can include
396	  Connection Tracking information together with the packet is
397	  the enqueued via NFNETLINK.
398
399config NF_NAT
400	tristate "Network Address Translation support"
401	depends on NF_CONNTRACK
402	default m if NETFILTER_ADVANCED=n
403	help
404	  The NAT option allows masquerading, port forwarding and other
405	  forms of full Network Address Port Translation. This can be
406	  controlled by iptables, ip6tables or nft.
407
408config NF_NAT_AMANDA
409	tristate
410	depends on NF_CONNTRACK && NF_NAT
411	default NF_NAT && NF_CONNTRACK_AMANDA
412
413config NF_NAT_FTP
414	tristate
415	depends on NF_CONNTRACK && NF_NAT
416	default NF_NAT && NF_CONNTRACK_FTP
417
418config NF_NAT_IRC
419	tristate
420	depends on NF_CONNTRACK && NF_NAT
421	default NF_NAT && NF_CONNTRACK_IRC
422
423config NF_NAT_SIP
424	tristate
425	depends on NF_CONNTRACK && NF_NAT
426	default NF_NAT && NF_CONNTRACK_SIP
427
428config NF_NAT_TFTP
429	tristate
430	depends on NF_CONNTRACK && NF_NAT
431	default NF_NAT && NF_CONNTRACK_TFTP
432
433config NF_NAT_REDIRECT
434	bool
435
436config NF_NAT_MASQUERADE
437	bool
438
439config NETFILTER_SYNPROXY
440	tristate
441
442endif # NF_CONNTRACK
443
444config NF_TABLES
445	select NETFILTER_NETLINK
446	tristate "Netfilter nf_tables support"
447	help
448	  nftables is the new packet classification framework that intends to
449	  replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
450	  provides a pseudo-state machine with an extensible instruction-set
451	  (also known as expressions) that the userspace 'nft' utility
452	  (http://www.netfilter.org/projects/nftables) uses to build the
453	  rule-set. It also comes with the generic set infrastructure that
454	  allows you to construct mappings between matchings and actions
455	  for performance lookups.
456
457	  To compile it as a module, choose M here.
458
459if NF_TABLES
460
461config NF_TABLES_SET
462	tristate "Netfilter nf_tables set infrastructure"
463	help
464	  This option enables the nf_tables set infrastructure that allows to
465	  look up for elements in a set and to build one-way mappings between
466	  matchings and actions.
467
468config NF_TABLES_INET
469	depends on IPV6
470	select NF_TABLES_IPV4
471	select NF_TABLES_IPV6
472	bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
473	help
474	  This option enables support for a mixed IPv4/IPv6 "inet" table.
475
476config NF_TABLES_NETDEV
477	bool "Netfilter nf_tables netdev tables support"
478	help
479	  This option enables support for the "netdev" table.
480
481config NFT_NUMGEN
482	tristate "Netfilter nf_tables number generator module"
483	help
484	  This option adds the number generator expression used to perform
485	  incremental counting and random numbers bound to a upper limit.
486
487config NFT_CT
488	depends on NF_CONNTRACK
489	tristate "Netfilter nf_tables conntrack module"
490	help
491	  This option adds the "ct" expression that you can use to match
492	  connection tracking information such as the flow state.
493
494config NFT_FLOW_OFFLOAD
495	depends on NF_CONNTRACK && NF_FLOW_TABLE
496	tristate "Netfilter nf_tables hardware flow offload module"
497	help
498	  This option adds the "flow_offload" expression that you can use to
499	  choose what flows are placed into the hardware.
500
501config NFT_COUNTER
502	tristate "Netfilter nf_tables counter module"
503	help
504	  This option adds the "counter" expression that you can use to
505	  include packet and byte counters in a rule.
506
507config NFT_CONNLIMIT
508	tristate "Netfilter nf_tables connlimit module"
509	depends on NF_CONNTRACK
510	depends on NETFILTER_ADVANCED
511	select NETFILTER_CONNCOUNT
512	help
513	  This option adds the "connlimit" expression that you can use to
514	  ratelimit rule matchings per connections.
515
516config NFT_LOG
517	tristate "Netfilter nf_tables log module"
518	help
519	  This option adds the "log" expression that you can use to log
520	  packets matching some criteria.
521
522config NFT_LIMIT
523	tristate "Netfilter nf_tables limit module"
524	help
525	  This option adds the "limit" expression that you can use to
526	  ratelimit rule matchings.
527
528config NFT_MASQ
529	depends on NF_CONNTRACK
530	depends on NF_NAT
531	select NF_NAT_MASQUERADE
532	tristate "Netfilter nf_tables masquerade support"
533	help
534	  This option adds the "masquerade" expression that you can use
535	  to perform NAT in the masquerade flavour.
536
537config NFT_REDIR
538	depends on NF_CONNTRACK
539	depends on NF_NAT
540	tristate "Netfilter nf_tables redirect support"
541	select NF_NAT_REDIRECT
542	help
543	  This options adds the "redirect" expression that you can use
544	  to perform NAT in the redirect flavour.
545
546config NFT_NAT
547	depends on NF_CONNTRACK
548	select NF_NAT
549	depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
550	tristate "Netfilter nf_tables nat module"
551	help
552	  This option adds the "nat" expression that you can use to perform
553	  typical Network Address Translation (NAT) packet transformations.
554
555config NFT_TUNNEL
556	tristate "Netfilter nf_tables tunnel module"
557	help
558	  This option adds the "tunnel" expression that you can use to set
559	  tunneling policies.
560
561config NFT_OBJREF
562	tristate "Netfilter nf_tables stateful object reference module"
563	help
564	  This option adds the "objref" expression that allows you to refer to
565	  stateful objects, such as counters and quotas.
566
567config NFT_QUEUE
568	depends on NETFILTER_NETLINK_QUEUE
569	tristate "Netfilter nf_tables queue module"
570	help
571	  This is required if you intend to use the userspace queueing
572	  infrastructure (also known as NFQUEUE) from nftables.
573
574config NFT_QUOTA
575	tristate "Netfilter nf_tables quota module"
576	help
577	  This option adds the "quota" expression that you can use to match
578	  enforce bytes quotas.
579
580config NFT_REJECT
581	default m if NETFILTER_ADVANCED=n
582	tristate "Netfilter nf_tables reject support"
583	depends on !NF_TABLES_INET || (IPV6!=m || m)
584	help
585	  This option adds the "reject" expression that you can use to
586	  explicitly deny and notify via TCP reset/ICMP informational errors
587	  unallowed traffic.
588
589config NFT_REJECT_INET
590	depends on NF_TABLES_INET
591	default NFT_REJECT
592	tristate
593
594config NFT_COMPAT
595	depends on NETFILTER_XTABLES
596	tristate "Netfilter x_tables over nf_tables module"
597	help
598	  This is required if you intend to use any of existing
599	  x_tables match/target extensions over the nf_tables
600	  framework.
601
602config NFT_HASH
603	tristate "Netfilter nf_tables hash module"
604	help
605	  This option adds the "hash" expression that you can use to perform
606	  a hash operation on registers.
607
608config NFT_FIB
609	tristate
610
611config NFT_FIB_INET
612	depends on NF_TABLES_INET
613	depends on NFT_FIB_IPV4
614	depends on NFT_FIB_IPV6
615	tristate "Netfilter nf_tables fib inet support"
616	help
617	  This option allows using the FIB expression from the inet table.
618	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
619	  on the protocol of the packet.
620
621config NFT_XFRM
622	tristate "Netfilter nf_tables xfrm/IPSec security association matching"
623	depends on XFRM
624	help
625	  This option adds an expression that you can use to extract properties
626	  of a packets security association.
627
628config NFT_SOCKET
629	tristate "Netfilter nf_tables socket match support"
630	depends on IPV6 || IPV6=n
631	select NF_SOCKET_IPV4
632	select NF_SOCKET_IPV6 if NF_TABLES_IPV6
633	help
634	  This option allows matching for the presence or absence of a
635	  corresponding socket and its attributes.
636
637config NFT_OSF
638	tristate "Netfilter nf_tables passive OS fingerprint support"
639	depends on NETFILTER_ADVANCED
640	select NETFILTER_NETLINK_OSF
641	help
642	  This option allows matching packets from an specific OS.
643
644config NFT_TPROXY
645	tristate "Netfilter nf_tables tproxy support"
646	depends on IPV6 || IPV6=n
647	select NF_DEFRAG_IPV4
648	select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
649	select NF_TPROXY_IPV4
650	select NF_TPROXY_IPV6 if NF_TABLES_IPV6
651	help
652	  This makes transparent proxy support available in nftables.
653
654if NF_TABLES_NETDEV
655
656config NF_DUP_NETDEV
657	tristate "Netfilter packet duplication support"
658	help
659	  This option enables the generic packet duplication infrastructure
660	  for Netfilter.
661
662config NFT_DUP_NETDEV
663	tristate "Netfilter nf_tables netdev packet duplication support"
664	select NF_DUP_NETDEV
665	help
666	  This option enables packet duplication for the "netdev" family.
667
668config NFT_FWD_NETDEV
669	tristate "Netfilter nf_tables netdev packet forwarding support"
670	select NF_DUP_NETDEV
671	help
672	  This option enables packet forwarding for the "netdev" family.
673
674config NFT_FIB_NETDEV
675	depends on NFT_FIB_IPV4
676	depends on NFT_FIB_IPV6
677	tristate "Netfilter nf_tables netdev fib lookups support"
678	help
679	  This option allows using the FIB expression from the netdev table.
680	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
681	  on the protocol of the packet.
682
683endif # NF_TABLES_NETDEV
684
685endif # NF_TABLES
686
687config NF_FLOW_TABLE_INET
688	tristate "Netfilter flow table mixed IPv4/IPv6 module"
689	depends on NF_FLOW_TABLE
690	help
691          This option adds the flow table mixed IPv4/IPv6 support.
692
693	  To compile it as a module, choose M here.
694
695config NF_FLOW_TABLE
696	tristate "Netfilter flow table module"
697	depends on NETFILTER_INGRESS
698	depends on NF_CONNTRACK
699	depends on NF_TABLES
700	help
701	  This option adds the flow table core infrastructure.
702
703	  To compile it as a module, choose M here.
704
705config NETFILTER_XTABLES
706	tristate "Netfilter Xtables support (required for ip_tables)"
707	default m if NETFILTER_ADVANCED=n
708	help
709	  This is required if you intend to use any of ip_tables,
710	  ip6_tables or arp_tables.
711
712if NETFILTER_XTABLES
713
714comment "Xtables combined modules"
715
716config NETFILTER_XT_MARK
717	tristate 'nfmark target and match support'
718	default m if NETFILTER_ADVANCED=n
719	---help---
720	This option adds the "MARK" target and "mark" match.
721
722	Netfilter mark matching allows you to match packets based on the
723	"nfmark" value in the packet.
724	The target allows you to create rules in the "mangle" table which alter
725	the netfilter mark (nfmark) field associated with the packet.
726
727	Prior to routing, the nfmark can influence the routing method and can
728	also be used by other subsystems to change their behavior.
729
730config NETFILTER_XT_CONNMARK
731	tristate 'ctmark target and match support'
732	depends on NF_CONNTRACK
733	depends on NETFILTER_ADVANCED
734	select NF_CONNTRACK_MARK
735	---help---
736	This option adds the "CONNMARK" target and "connmark" match.
737
738	Netfilter allows you to store a mark value per connection (a.k.a.
739	ctmark), similarly to the packet mark (nfmark). Using this
740	target and match, you can set and match on this mark.
741
742config NETFILTER_XT_SET
743	tristate 'set target and match support'
744	depends on IP_SET
745	depends on NETFILTER_ADVANCED
746	help
747	  This option adds the "SET" target and "set" match.
748
749	  Using this target and match, you can add/delete and match
750	  elements in the sets created by ipset(8).
751
752	  To compile it as a module, choose M here.  If unsure, say N.
753
754# alphabetically ordered list of targets
755
756comment "Xtables targets"
757
758config NETFILTER_XT_TARGET_AUDIT
759	tristate "AUDIT target support"
760	depends on AUDIT
761	depends on NETFILTER_ADVANCED
762	---help---
763	  This option adds a 'AUDIT' target, which can be used to create
764	  audit records for packets dropped/accepted.
765
766	  To compileit as a module, choose M here. If unsure, say N.
767
768config NETFILTER_XT_TARGET_CHECKSUM
769	tristate "CHECKSUM target support"
770	depends on IP_NF_MANGLE || IP6_NF_MANGLE
771	depends on NETFILTER_ADVANCED
772	---help---
773	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
774	  table to work around buggy DHCP clients in virtualized environments.
775
776	  Some old DHCP clients drop packets because they are not aware
777	  that the checksum would normally be offloaded to hardware and
778	  thus should be considered valid.
779	  This target can be used to fill in the checksum using iptables
780	  when such packets are sent via a virtual network device.
781
782	  To compile it as a module, choose M here.  If unsure, say N.
783
784config NETFILTER_XT_TARGET_CLASSIFY
785	tristate '"CLASSIFY" target support'
786	depends on NETFILTER_ADVANCED
787	help
788	  This option adds a `CLASSIFY' target, which enables the user to set
789	  the priority of a packet. Some qdiscs can use this value for
790	  classification, among these are:
791
792  	  atm, cbq, dsmark, pfifo_fast, htb, prio
793
794	  To compile it as a module, choose M here.  If unsure, say N.
795
796config NETFILTER_XT_TARGET_CONNMARK
797	tristate  '"CONNMARK" target support'
798	depends on NF_CONNTRACK
799	depends on NETFILTER_ADVANCED
800	select NETFILTER_XT_CONNMARK
801	---help---
802	This is a backwards-compat option for the user's convenience
803	(e.g. when running oldconfig). It selects
804	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
805
806config NETFILTER_XT_TARGET_CONNSECMARK
807	tristate '"CONNSECMARK" target support'
808	depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
809	default m if NETFILTER_ADVANCED=n
810	help
811	  The CONNSECMARK target copies security markings from packets
812	  to connections, and restores security markings from connections
813	  to packets (if the packets are not already marked).  This would
814	  normally be used in conjunction with the SECMARK target.
815
816	  To compile it as a module, choose M here.  If unsure, say N.
817
818config NETFILTER_XT_TARGET_CT
819	tristate '"CT" target support'
820	depends on NF_CONNTRACK
821	depends on IP_NF_RAW || IP6_NF_RAW
822	depends on NETFILTER_ADVANCED
823	help
824	  This options adds a `CT' target, which allows to specify initial
825	  connection tracking parameters like events to be delivered and
826	  the helper to be used.
827
828	  To compile it as a module, choose M here.  If unsure, say N.
829
830config NETFILTER_XT_TARGET_DSCP
831	tristate '"DSCP" and "TOS" target support'
832	depends on IP_NF_MANGLE || IP6_NF_MANGLE
833	depends on NETFILTER_ADVANCED
834	help
835	  This option adds a `DSCP' target, which allows you to manipulate
836	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
837
838	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
839
840	  It also adds the "TOS" target, which allows you to create rules in
841	  the "mangle" table which alter the Type Of Service field of an IPv4
842	  or the Priority field of an IPv6 packet, prior to routing.
843
844	  To compile it as a module, choose M here.  If unsure, say N.
845
846config NETFILTER_XT_TARGET_HL
847	tristate '"HL" hoplimit target support'
848	depends on IP_NF_MANGLE || IP6_NF_MANGLE
849	depends on NETFILTER_ADVANCED
850	---help---
851	This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
852	targets, which enable the user to change the
853	hoplimit/time-to-live value of the IP header.
854
855	While it is safe to decrement the hoplimit/TTL value, the
856	modules also allow to increment and set the hoplimit value of
857	the header to arbitrary values. This is EXTREMELY DANGEROUS
858	since you can easily create immortal packets that loop
859	forever on the network.
860
861config NETFILTER_XT_TARGET_HMARK
862	tristate '"HMARK" target support'
863	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
864	depends on NETFILTER_ADVANCED
865	---help---
866	This option adds the "HMARK" target.
867
868	The target allows you to create rules in the "raw" and "mangle" tables
869	which set the skbuff mark by means of hash calculation within a given
870	range. The nfmark can influence the routing method and can also be used
871	by other subsystems to change their behaviour.
872
873	To compile it as a module, choose M here. If unsure, say N.
874
875config NETFILTER_XT_TARGET_IDLETIMER
876	tristate  "IDLETIMER target support"
877	depends on NETFILTER_ADVANCED
878	help
879
880	  This option adds the `IDLETIMER' target.  Each matching packet
881	  resets the timer associated with label specified when the rule is
882	  added.  When the timer expires, it triggers a sysfs notification.
883	  The remaining time for expiration can be read via sysfs.
884
885	  To compile it as a module, choose M here.  If unsure, say N.
886
887config NETFILTER_XT_TARGET_LED
888	tristate '"LED" target support'
889	depends on LEDS_CLASS && LEDS_TRIGGERS
890	depends on NETFILTER_ADVANCED
891	help
892	  This option adds a `LED' target, which allows you to blink LEDs in
893	  response to particular packets passing through your machine.
894
895	  This can be used to turn a spare LED into a network activity LED,
896	  which only flashes in response to FTP transfers, for example.  Or
897	  you could have an LED which lights up for a minute or two every time
898	  somebody connects to your machine via SSH.
899
900	  You will need support for the "led" class to make this work.
901
902	  To create an LED trigger for incoming SSH traffic:
903	    iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
904
905	  Then attach the new trigger to an LED on your system:
906	    echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
907
908	  For more information on the LEDs available on your system, see
909	  Documentation/leds/leds-class.txt
910
911config NETFILTER_XT_TARGET_LOG
912	tristate "LOG target support"
913	select NF_LOG_COMMON
914	select NF_LOG_IPV4
915	select NF_LOG_IPV6 if IP6_NF_IPTABLES
916	default m if NETFILTER_ADVANCED=n
917	help
918	  This option adds a `LOG' target, which allows you to create rules in
919	  any iptables table which records the packet header to the syslog.
920
921	  To compile it as a module, choose M here.  If unsure, say N.
922
923config NETFILTER_XT_TARGET_MARK
924	tristate '"MARK" target support'
925	depends on NETFILTER_ADVANCED
926	select NETFILTER_XT_MARK
927	---help---
928	This is a backwards-compat option for the user's convenience
929	(e.g. when running oldconfig). It selects
930	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
931
932config NETFILTER_XT_NAT
933	tristate '"SNAT and DNAT" targets support'
934	depends on NF_NAT
935	---help---
936	This option enables the SNAT and DNAT targets.
937
938	To compile it as a module, choose M here. If unsure, say N.
939
940config NETFILTER_XT_TARGET_NETMAP
941	tristate '"NETMAP" target support'
942	depends on NF_NAT
943	---help---
944	NETMAP is an implementation of static 1:1 NAT mapping of network
945	addresses. It maps the network address part, while keeping the host
946	address part intact.
947
948	To compile it as a module, choose M here. If unsure, say N.
949
950config NETFILTER_XT_TARGET_NFLOG
951	tristate '"NFLOG" target support'
952	default m if NETFILTER_ADVANCED=n
953	select NETFILTER_NETLINK_LOG
954	help
955	  This option enables the NFLOG target, which allows to LOG
956	  messages through nfnetlink_log.
957
958	  To compile it as a module, choose M here.  If unsure, say N.
959
960config NETFILTER_XT_TARGET_NFQUEUE
961	tristate '"NFQUEUE" target Support'
962	depends on NETFILTER_ADVANCED
963	select NETFILTER_NETLINK_QUEUE
964	help
965	  This target replaced the old obsolete QUEUE target.
966
967	  As opposed to QUEUE, it supports 65535 different queues,
968	  not just one.
969
970	  To compile it as a module, choose M here.  If unsure, say N.
971
972config NETFILTER_XT_TARGET_NOTRACK
973	tristate  '"NOTRACK" target support (DEPRECATED)'
974	depends on NF_CONNTRACK
975	depends on IP_NF_RAW || IP6_NF_RAW
976	depends on NETFILTER_ADVANCED
977	select NETFILTER_XT_TARGET_CT
978
979config NETFILTER_XT_TARGET_RATEEST
980	tristate '"RATEEST" target support'
981	depends on NETFILTER_ADVANCED
982	help
983	  This option adds a `RATEEST' target, which allows to measure
984	  rates similar to TC estimators. The `rateest' match can be
985	  used to match on the measured rates.
986
987	  To compile it as a module, choose M here.  If unsure, say N.
988
989config NETFILTER_XT_TARGET_REDIRECT
990	tristate "REDIRECT target support"
991	depends on NF_NAT
992	select NF_NAT_REDIRECT
993	---help---
994	REDIRECT is a special case of NAT: all incoming connections are
995	mapped onto the incoming interface's address, causing the packets to
996	come to the local machine instead of passing through. This is
997	useful for transparent proxies.
998
999	To compile it as a module, choose M here. If unsure, say N.
1000
1001config NETFILTER_XT_TARGET_MASQUERADE
1002	tristate "MASQUERADE target support"
1003	depends on NF_NAT
1004	default m if NETFILTER_ADVANCED=n
1005	select NF_NAT_MASQUERADE
1006	help
1007	  Masquerading is a special case of NAT: all outgoing connections are
1008	  changed to seem to come from a particular interface's address, and
1009	  if the interface goes down, those connections are lost.  This is
1010	  only useful for dialup accounts with dynamic IP address (ie. your IP
1011	  address will be different on next dialup).
1012
1013	  To compile it as a module, choose M here.  If unsure, say N.
1014
1015config NETFILTER_XT_TARGET_TEE
1016	tristate '"TEE" - packet cloning to alternate destination'
1017	depends on NETFILTER_ADVANCED
1018	depends on IPV6 || IPV6=n
1019	depends on !NF_CONNTRACK || NF_CONNTRACK
1020	depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1021	select NF_DUP_IPV4
1022	select NF_DUP_IPV6 if IP6_NF_IPTABLES
1023	---help---
1024	This option adds a "TEE" target with which a packet can be cloned and
1025	this clone be rerouted to another nexthop.
1026
1027config NETFILTER_XT_TARGET_TPROXY
1028	tristate '"TPROXY" target transparent proxying support'
1029	depends on NETFILTER_XTABLES
1030	depends on NETFILTER_ADVANCED
1031	depends on IPV6 || IPV6=n
1032	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1033	depends on IP_NF_MANGLE
1034	select NF_DEFRAG_IPV4
1035	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1036	select NF_TPROXY_IPV4
1037	select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1038	help
1039	  This option adds a `TPROXY' target, which is somewhat similar to
1040	  REDIRECT.  It can only be used in the mangle table and is useful
1041	  to redirect traffic to a transparent proxy.  It does _not_ depend
1042	  on Netfilter connection tracking and NAT, unlike REDIRECT.
1043	  For it to work you will have to configure certain iptables rules
1044	  and use policy routing. For more information on how to set it up
1045	  see Documentation/networking/tproxy.txt.
1046
1047	  To compile it as a module, choose M here.  If unsure, say N.
1048
1049config NETFILTER_XT_TARGET_TRACE
1050	tristate  '"TRACE" target support'
1051	depends on IP_NF_RAW || IP6_NF_RAW
1052	depends on NETFILTER_ADVANCED
1053	help
1054	  The TRACE target allows you to mark packets so that the kernel
1055	  will log every rule which match the packets as those traverse
1056	  the tables, chains, rules.
1057
1058	  If you want to compile it as a module, say M here and read
1059	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1060
1061config NETFILTER_XT_TARGET_SECMARK
1062	tristate '"SECMARK" target support'
1063	depends on NETWORK_SECMARK
1064	default m if NETFILTER_ADVANCED=n
1065	help
1066	  The SECMARK target allows security marking of network
1067	  packets, for use with security subsystems.
1068
1069	  To compile it as a module, choose M here.  If unsure, say N.
1070
1071config NETFILTER_XT_TARGET_TCPMSS
1072	tristate '"TCPMSS" target support'
1073	depends on IPV6 || IPV6=n
1074	default m if NETFILTER_ADVANCED=n
1075	---help---
1076	  This option adds a `TCPMSS' target, which allows you to alter the
1077	  MSS value of TCP SYN packets, to control the maximum size for that
1078	  connection (usually limiting it to your outgoing interface's MTU
1079	  minus 40).
1080
1081	  This is used to overcome criminally braindead ISPs or servers which
1082	  block ICMP Fragmentation Needed packets.  The symptoms of this
1083	  problem are that everything works fine from your Linux
1084	  firewall/router, but machines behind it can never exchange large
1085	  packets:
1086	        1) Web browsers connect, then hang with no data received.
1087	        2) Small mail works fine, but large emails hang.
1088	        3) ssh works fine, but scp hangs after initial handshaking.
1089
1090	  Workaround: activate this option and add a rule to your firewall
1091	  configuration like:
1092
1093	  iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1094	                 -j TCPMSS --clamp-mss-to-pmtu
1095
1096	  To compile it as a module, choose M here.  If unsure, say N.
1097
1098config NETFILTER_XT_TARGET_TCPOPTSTRIP
1099	tristate '"TCPOPTSTRIP" target support'
1100	depends on IP_NF_MANGLE || IP6_NF_MANGLE
1101	depends on NETFILTER_ADVANCED
1102	help
1103	  This option adds a "TCPOPTSTRIP" target, which allows you to strip
1104	  TCP options from TCP packets.
1105
1106# alphabetically ordered list of matches
1107
1108comment "Xtables matches"
1109
1110config NETFILTER_XT_MATCH_ADDRTYPE
1111	tristate '"addrtype" address type match support'
1112	default m if NETFILTER_ADVANCED=n
1113	---help---
1114	  This option allows you to match what routing thinks of an address,
1115	  eg. UNICAST, LOCAL, BROADCAST, ...
1116
1117	  If you want to compile it as a module, say M here and read
1118	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1119
1120config NETFILTER_XT_MATCH_BPF
1121	tristate '"bpf" match support'
1122	depends on NETFILTER_ADVANCED
1123	help
1124	  BPF matching applies a linux socket filter to each packet and
1125	  accepts those for which the filter returns non-zero.
1126
1127	  To compile it as a module, choose M here.  If unsure, say N.
1128
1129config NETFILTER_XT_MATCH_CGROUP
1130	tristate '"control group" match support'
1131	depends on NETFILTER_ADVANCED
1132	depends on CGROUPS
1133	select CGROUP_NET_CLASSID
1134	---help---
1135	Socket/process control group matching allows you to match locally
1136	generated packets based on which net_cls control group processes
1137	belong to.
1138
1139config NETFILTER_XT_MATCH_CLUSTER
1140	tristate '"cluster" match support'
1141	depends on NF_CONNTRACK
1142	depends on NETFILTER_ADVANCED
1143	---help---
1144	  This option allows you to build work-load-sharing clusters of
1145	  network servers/stateful firewalls without having a dedicated
1146	  load-balancing router/server/switch. Basically, this match returns
1147	  true when the packet must be handled by this cluster node. Thus,
1148	  all nodes see all packets and this match decides which node handles
1149	  what packets. The work-load sharing algorithm is based on source
1150	  address hashing.
1151
1152	  If you say Y or M here, try `iptables -m cluster --help` for
1153	  more information.
1154
1155config NETFILTER_XT_MATCH_COMMENT
1156	tristate  '"comment" match support'
1157	depends on NETFILTER_ADVANCED
1158	help
1159	  This option adds a `comment' dummy-match, which allows you to put
1160	  comments in your iptables ruleset.
1161
1162	  If you want to compile it as a module, say M here and read
1163	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1164
1165config NETFILTER_XT_MATCH_CONNBYTES
1166	tristate  '"connbytes" per-connection counter match support'
1167	depends on NF_CONNTRACK
1168	depends on NETFILTER_ADVANCED
1169	help
1170	  This option adds a `connbytes' match, which allows you to match the
1171	  number of bytes and/or packets for each direction within a connection.
1172
1173	  If you want to compile it as a module, say M here and read
1174	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1175
1176config NETFILTER_XT_MATCH_CONNLABEL
1177	tristate '"connlabel" match support'
1178	select NF_CONNTRACK_LABELS
1179	depends on NF_CONNTRACK
1180	depends on NETFILTER_ADVANCED
1181	---help---
1182	  This match allows you to test and assign userspace-defined labels names
1183	  to a connection.  The kernel only stores bit values - mapping
1184	  names to bits is done by userspace.
1185
1186	  Unlike connmark, more than 32 flag bits may be assigned to a
1187	  connection simultaneously.
1188
1189config NETFILTER_XT_MATCH_CONNLIMIT
1190	tristate '"connlimit" match support'
1191	depends on NF_CONNTRACK
1192	depends on NETFILTER_ADVANCED
1193	select NETFILTER_CONNCOUNT
1194	---help---
1195	  This match allows you to match against the number of parallel
1196	  connections to a server per client IP address (or address block).
1197
1198config NETFILTER_XT_MATCH_CONNMARK
1199	tristate  '"connmark" connection mark match support'
1200	depends on NF_CONNTRACK
1201	depends on NETFILTER_ADVANCED
1202	select NETFILTER_XT_CONNMARK
1203	---help---
1204	This is a backwards-compat option for the user's convenience
1205	(e.g. when running oldconfig). It selects
1206	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1207
1208config NETFILTER_XT_MATCH_CONNTRACK
1209	tristate '"conntrack" connection tracking match support'
1210	depends on NF_CONNTRACK
1211	default m if NETFILTER_ADVANCED=n
1212	help
1213	  This is a general conntrack match module, a superset of the state match.
1214
1215	  It allows matching on additional conntrack information, which is
1216	  useful in complex configurations, such as NAT gateways with multiple
1217	  internet links or tunnels.
1218
1219	  To compile it as a module, choose M here.  If unsure, say N.
1220
1221config NETFILTER_XT_MATCH_CPU
1222	tristate '"cpu" match support'
1223	depends on NETFILTER_ADVANCED
1224	help
1225	  CPU matching allows you to match packets based on the CPU
1226	  currently handling the packet.
1227
1228	  To compile it as a module, choose M here.  If unsure, say N.
1229
1230config NETFILTER_XT_MATCH_DCCP
1231	tristate '"dccp" protocol match support'
1232	depends on NETFILTER_ADVANCED
1233	default IP_DCCP
1234	help
1235	  With this option enabled, you will be able to use the iptables
1236	  `dccp' match in order to match on DCCP source/destination ports
1237	  and DCCP flags.
1238
1239	  If you want to compile it as a module, say M here and read
1240	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1241
1242config NETFILTER_XT_MATCH_DEVGROUP
1243	tristate '"devgroup" match support'
1244	depends on NETFILTER_ADVANCED
1245	help
1246	  This options adds a `devgroup' match, which allows to match on the
1247	  device group a network device is assigned to.
1248
1249	  To compile it as a module, choose M here.  If unsure, say N.
1250
1251config NETFILTER_XT_MATCH_DSCP
1252	tristate '"dscp" and "tos" match support'
1253	depends on NETFILTER_ADVANCED
1254	help
1255	  This option adds a `DSCP' match, which allows you to match against
1256	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1257
1258	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
1259
1260	  It will also add a "tos" match, which allows you to match packets
1261	  based on the Type Of Service fields of the IPv4 packet (which share
1262	  the same bits as DSCP).
1263
1264	  To compile it as a module, choose M here.  If unsure, say N.
1265
1266config NETFILTER_XT_MATCH_ECN
1267	tristate '"ecn" match support'
1268	depends on NETFILTER_ADVANCED
1269	---help---
1270	This option adds an "ECN" match, which allows you to match against
1271	the IPv4 and TCP header ECN fields.
1272
1273	To compile it as a module, choose M here. If unsure, say N.
1274
1275config NETFILTER_XT_MATCH_ESP
1276	tristate '"esp" match support'
1277	depends on NETFILTER_ADVANCED
1278	help
1279	  This match extension allows you to match a range of SPIs
1280	  inside ESP header of IPSec packets.
1281
1282	  To compile it as a module, choose M here.  If unsure, say N.
1283
1284config NETFILTER_XT_MATCH_HASHLIMIT
1285	tristate '"hashlimit" match support'
1286	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1287	depends on NETFILTER_ADVANCED
1288	help
1289	  This option adds a `hashlimit' match.
1290
1291	  As opposed to `limit', this match dynamically creates a hash table
1292	  of limit buckets, based on your selection of source/destination
1293	  addresses and/or ports.
1294
1295	  It enables you to express policies like `10kpps for any given
1296	  destination address' or `500pps from any given source address'
1297	  with a single rule.
1298
1299config NETFILTER_XT_MATCH_HELPER
1300	tristate '"helper" match support'
1301	depends on NF_CONNTRACK
1302	depends on NETFILTER_ADVANCED
1303	help
1304	  Helper matching allows you to match packets in dynamic connections
1305	  tracked by a conntrack-helper, ie. ip_conntrack_ftp
1306
1307	  To compile it as a module, choose M here.  If unsure, say Y.
1308
1309config NETFILTER_XT_MATCH_HL
1310	tristate '"hl" hoplimit/TTL match support'
1311	depends on NETFILTER_ADVANCED
1312	---help---
1313	HL matching allows you to match packets based on the hoplimit
1314	in the IPv6 header, or the time-to-live field in the IPv4
1315	header of the packet.
1316
1317config NETFILTER_XT_MATCH_IPCOMP
1318	tristate '"ipcomp" match support'
1319	depends on NETFILTER_ADVANCED
1320	help
1321	  This match extension allows you to match a range of CPIs(16 bits)
1322	  inside IPComp header of IPSec packets.
1323
1324	  To compile it as a module, choose M here.  If unsure, say N.
1325
1326config NETFILTER_XT_MATCH_IPRANGE
1327	tristate '"iprange" address range match support'
1328	depends on NETFILTER_ADVANCED
1329	---help---
1330	This option adds a "iprange" match, which allows you to match based on
1331	an IP address range. (Normal iptables only matches on single addresses
1332	with an optional mask.)
1333
1334	If unsure, say M.
1335
1336config NETFILTER_XT_MATCH_IPVS
1337	tristate '"ipvs" match support'
1338	depends on IP_VS
1339	depends on NETFILTER_ADVANCED
1340	depends on NF_CONNTRACK
1341	help
1342	  This option allows you to match against IPVS properties of a packet.
1343
1344	  If unsure, say N.
1345
1346config NETFILTER_XT_MATCH_L2TP
1347	tristate '"l2tp" match support'
1348	depends on NETFILTER_ADVANCED
1349	default L2TP
1350	---help---
1351	This option adds an "L2TP" match, which allows you to match against
1352	L2TP protocol header fields.
1353
1354	To compile it as a module, choose M here. If unsure, say N.
1355
1356config NETFILTER_XT_MATCH_LENGTH
1357	tristate '"length" match support'
1358	depends on NETFILTER_ADVANCED
1359	help
1360	  This option allows you to match the length of a packet against a
1361	  specific value or range of values.
1362
1363	  To compile it as a module, choose M here.  If unsure, say N.
1364
1365config NETFILTER_XT_MATCH_LIMIT
1366	tristate '"limit" match support'
1367	depends on NETFILTER_ADVANCED
1368	help
1369	  limit matching allows you to control the rate at which a rule can be
1370	  matched: mainly useful in combination with the LOG target ("LOG
1371	  target support", below) and to avoid some Denial of Service attacks.
1372
1373	  To compile it as a module, choose M here.  If unsure, say N.
1374
1375config NETFILTER_XT_MATCH_MAC
1376	tristate '"mac" address match support'
1377	depends on NETFILTER_ADVANCED
1378	help
1379	  MAC matching allows you to match packets based on the source
1380	  Ethernet address of the packet.
1381
1382	  To compile it as a module, choose M here.  If unsure, say N.
1383
1384config NETFILTER_XT_MATCH_MARK
1385	tristate '"mark" match support'
1386	depends on NETFILTER_ADVANCED
1387	select NETFILTER_XT_MARK
1388	---help---
1389	This is a backwards-compat option for the user's convenience
1390	(e.g. when running oldconfig). It selects
1391	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1392
1393config NETFILTER_XT_MATCH_MULTIPORT
1394	tristate '"multiport" Multiple port match support'
1395	depends on NETFILTER_ADVANCED
1396	help
1397	  Multiport matching allows you to match TCP or UDP packets based on
1398	  a series of source or destination ports: normally a rule can only
1399	  match a single range of ports.
1400
1401	  To compile it as a module, choose M here.  If unsure, say N.
1402
1403config NETFILTER_XT_MATCH_NFACCT
1404	tristate '"nfacct" match support'
1405	depends on NETFILTER_ADVANCED
1406	select NETFILTER_NETLINK_ACCT
1407	help
1408	  This option allows you to use the extended accounting through
1409	  nfnetlink_acct.
1410
1411	  To compile it as a module, choose M here.  If unsure, say N.
1412
1413config NETFILTER_XT_MATCH_OSF
1414	tristate '"osf" Passive OS fingerprint match'
1415	depends on NETFILTER_ADVANCED
1416	select NETFILTER_NETLINK_OSF
1417	help
1418	  This option selects the Passive OS Fingerprinting match module
1419	  that allows to passively match the remote operating system by
1420	  analyzing incoming TCP SYN packets.
1421
1422	  Rules and loading software can be downloaded from
1423	  http://www.ioremap.net/projects/osf
1424
1425	  To compile it as a module, choose M here.  If unsure, say N.
1426
1427config NETFILTER_XT_MATCH_OWNER
1428	tristate '"owner" match support'
1429	depends on NETFILTER_ADVANCED
1430	---help---
1431	Socket owner matching allows you to match locally-generated packets
1432	based on who created the socket: the user or group. It is also
1433	possible to check whether a socket actually exists.
1434
1435config NETFILTER_XT_MATCH_POLICY
1436	tristate 'IPsec "policy" match support'
1437	depends on XFRM
1438	default m if NETFILTER_ADVANCED=n
1439	help
1440	  Policy matching allows you to match packets based on the
1441	  IPsec policy that was used during decapsulation/will
1442	  be used during encapsulation.
1443
1444	  To compile it as a module, choose M here.  If unsure, say N.
1445
1446config NETFILTER_XT_MATCH_PHYSDEV
1447	tristate '"physdev" match support'
1448	depends on BRIDGE && BRIDGE_NETFILTER
1449	depends on NETFILTER_ADVANCED
1450	help
1451	  Physdev packet matching matches against the physical bridge ports
1452	  the IP packet arrived on or will leave by.
1453
1454	  To compile it as a module, choose M here.  If unsure, say N.
1455
1456config NETFILTER_XT_MATCH_PKTTYPE
1457	tristate '"pkttype" packet type match support'
1458	depends on NETFILTER_ADVANCED
1459	help
1460	  Packet type matching allows you to match a packet by
1461	  its "class", eg. BROADCAST, MULTICAST, ...
1462
1463	  Typical usage:
1464	  iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1465
1466	  To compile it as a module, choose M here.  If unsure, say N.
1467
1468config NETFILTER_XT_MATCH_QUOTA
1469	tristate '"quota" match support'
1470	depends on NETFILTER_ADVANCED
1471	help
1472	  This option adds a `quota' match, which allows to match on a
1473	  byte counter.
1474
1475	  If you want to compile it as a module, say M here and read
1476	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1477
1478config NETFILTER_XT_MATCH_RATEEST
1479	tristate '"rateest" match support'
1480	depends on NETFILTER_ADVANCED
1481	select NETFILTER_XT_TARGET_RATEEST
1482	help
1483	  This option adds a `rateest' match, which allows to match on the
1484	  rate estimated by the RATEEST target.
1485
1486	  To compile it as a module, choose M here.  If unsure, say N.
1487
1488config NETFILTER_XT_MATCH_REALM
1489	tristate  '"realm" match support'
1490	depends on NETFILTER_ADVANCED
1491	select IP_ROUTE_CLASSID
1492	help
1493	  This option adds a `realm' match, which allows you to use the realm
1494	  key from the routing subsystem inside iptables.
1495
1496	  This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1497	  in tc world.
1498
1499	  If you want to compile it as a module, say M here and read
1500	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1501
1502config NETFILTER_XT_MATCH_RECENT
1503	tristate '"recent" match support'
1504	depends on NETFILTER_ADVANCED
1505	---help---
1506	This match is used for creating one or many lists of recently
1507	used addresses and then matching against that/those list(s).
1508
1509	Short options are available by using 'iptables -m recent -h'
1510	Official Website: <http://snowman.net/projects/ipt_recent/>
1511
1512config NETFILTER_XT_MATCH_SCTP
1513	tristate  '"sctp" protocol match support'
1514	depends on NETFILTER_ADVANCED
1515	default IP_SCTP
1516	help
1517	  With this option enabled, you will be able to use the
1518	  `sctp' match in order to match on SCTP source/destination ports
1519	  and SCTP chunk types.
1520
1521	  If you want to compile it as a module, say M here and read
1522	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1523
1524config NETFILTER_XT_MATCH_SOCKET
1525	tristate '"socket" match support'
1526	depends on NETFILTER_XTABLES
1527	depends on NETFILTER_ADVANCED
1528	depends on IPV6 || IPV6=n
1529	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1530	select NF_SOCKET_IPV4
1531	select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1532	select NF_DEFRAG_IPV4
1533	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1534	help
1535	  This option adds a `socket' match, which can be used to match
1536	  packets for which a TCP or UDP socket lookup finds a valid socket.
1537	  It can be used in combination with the MARK target and policy
1538	  routing to implement full featured non-locally bound sockets.
1539
1540	  To compile it as a module, choose M here.  If unsure, say N.
1541
1542config NETFILTER_XT_MATCH_STATE
1543	tristate '"state" match support'
1544	depends on NF_CONNTRACK
1545	default m if NETFILTER_ADVANCED=n
1546	help
1547	  Connection state matching allows you to match packets based on their
1548	  relationship to a tracked connection (ie. previous packets).  This
1549	  is a powerful tool for packet classification.
1550
1551	  To compile it as a module, choose M here.  If unsure, say N.
1552
1553config NETFILTER_XT_MATCH_STATISTIC
1554	tristate '"statistic" match support'
1555	depends on NETFILTER_ADVANCED
1556	help
1557	  This option adds a `statistic' match, which allows you to match
1558	  on packets periodically or randomly with a given percentage.
1559
1560	  To compile it as a module, choose M here.  If unsure, say N.
1561
1562config NETFILTER_XT_MATCH_STRING
1563	tristate  '"string" match support'
1564	depends on NETFILTER_ADVANCED
1565	select TEXTSEARCH
1566	select TEXTSEARCH_KMP
1567	select TEXTSEARCH_BM
1568	select TEXTSEARCH_FSM
1569	help
1570	  This option adds a `string' match, which allows you to look for
1571	  pattern matchings in packets.
1572
1573	  To compile it as a module, choose M here.  If unsure, say N.
1574
1575config NETFILTER_XT_MATCH_TCPMSS
1576	tristate '"tcpmss" match support'
1577	depends on NETFILTER_ADVANCED
1578	help
1579	  This option adds a `tcpmss' match, which allows you to examine the
1580	  MSS value of TCP SYN packets, which control the maximum packet size
1581	  for that connection.
1582
1583	  To compile it as a module, choose M here.  If unsure, say N.
1584
1585config NETFILTER_XT_MATCH_TIME
1586	tristate '"time" match support'
1587	depends on NETFILTER_ADVANCED
1588	---help---
1589	  This option adds a "time" match, which allows you to match based on
1590	  the packet arrival time (at the machine which netfilter is running)
1591	  on) or departure time/date (for locally generated packets).
1592
1593	  If you say Y here, try `iptables -m time --help` for
1594	  more information.
1595
1596	  If you want to compile it as a module, say M here.
1597	  If unsure, say N.
1598
1599config NETFILTER_XT_MATCH_U32
1600	tristate '"u32" match support'
1601	depends on NETFILTER_ADVANCED
1602	---help---
1603	  u32 allows you to extract quantities of up to 4 bytes from a packet,
1604	  AND them with specified masks, shift them by specified amounts and
1605	  test whether the results are in any of a set of specified ranges.
1606	  The specification of what to extract is general enough to skip over
1607	  headers with lengths stored in the packet, as in IP or TCP header
1608	  lengths.
1609
1610	  Details and examples are in the kernel module source.
1611
1612endif # NETFILTER_XTABLES
1613
1614endmenu
1615
1616source "net/netfilter/ipset/Kconfig"
1617
1618source "net/netfilter/ipvs/Kconfig"
1619