xref: /openbmc/linux/net/netfilter/Kconfig (revision bbb774d9)
1# SPDX-License-Identifier: GPL-2.0-only
2menu "Core Netfilter Configuration"
3	depends on INET && NETFILTER
4
5config NETFILTER_INGRESS
6	bool "Netfilter ingress support"
7	default y
8	select NET_INGRESS
9	help
10	  This allows you to classify packets from ingress using the Netfilter
11	  infrastructure.
12
13config NETFILTER_EGRESS
14	bool "Netfilter egress support"
15	default y
16	select NET_EGRESS
17	help
18	  This allows you to classify packets before transmission using the
19	  Netfilter infrastructure.
20
21config NETFILTER_SKIP_EGRESS
22	def_bool NETFILTER_EGRESS && (NET_CLS_ACT || IFB)
23
24config NETFILTER_NETLINK
25	tristate
26
27config NETFILTER_FAMILY_BRIDGE
28	bool
29
30config NETFILTER_FAMILY_ARP
31	bool
32
33config NETFILTER_NETLINK_HOOK
34	tristate "Netfilter base hook dump support"
35	depends on NETFILTER_ADVANCED
36	depends on NF_TABLES
37	select NETFILTER_NETLINK
38	help
39	  If this option is enabled, the kernel will include support
40	  to list the base netfilter hooks via NFNETLINK.
41	  This is helpful for debugging.
42
43config NETFILTER_NETLINK_ACCT
44	tristate "Netfilter NFACCT over NFNETLINK interface"
45	depends on NETFILTER_ADVANCED
46	select NETFILTER_NETLINK
47	help
48	  If this option is enabled, the kernel will include support
49	  for extended accounting via NFNETLINK.
50
51config NETFILTER_NETLINK_QUEUE
52	tristate "Netfilter NFQUEUE over NFNETLINK interface"
53	depends on NETFILTER_ADVANCED
54	select NETFILTER_NETLINK
55	help
56	  If this option is enabled, the kernel will include support
57	  for queueing packets via NFNETLINK.
58
59config NETFILTER_NETLINK_LOG
60	tristate "Netfilter LOG over NFNETLINK interface"
61	default m if NETFILTER_ADVANCED=n
62	select NETFILTER_NETLINK
63	help
64	  If this option is enabled, the kernel will include support
65	  for logging packets via NFNETLINK.
66
67	  This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
68	  and is also scheduled to replace the old syslog-based ipt_LOG
69	  and ip6t_LOG modules.
70
71config NETFILTER_NETLINK_OSF
72	tristate "Netfilter OSF over NFNETLINK interface"
73	depends on NETFILTER_ADVANCED
74	select NETFILTER_NETLINK
75	help
76	  If this option is enabled, the kernel will include support
77	  for passive OS fingerprint via NFNETLINK.
78
79config NF_CONNTRACK
80	tristate "Netfilter connection tracking support"
81	default m if NETFILTER_ADVANCED=n
82	select NF_DEFRAG_IPV4
83	select NF_DEFRAG_IPV6 if IPV6 != n
84	help
85	  Connection tracking keeps a record of what packets have passed
86	  through your machine, in order to figure out how they are related
87	  into connections.
88
89	  This is required to do Masquerading or other kinds of Network
90	  Address Translation.  It can also be used to enhance packet
91	  filtering (see `Connection state match support' below).
92
93	  To compile it as a module, choose M here.  If unsure, say N.
94
95config NF_LOG_SYSLOG
96	tristate "Syslog packet logging"
97	default m if NETFILTER_ADVANCED=n
98	help
99	  This option enable support for packet logging via syslog.
100	  It supports IPv4, IPV6, ARP and common transport protocols such
101	  as TCP and UDP.
102	  This is a simpler but less flexible logging method compared to
103	  CONFIG_NETFILTER_NETLINK_LOG.
104	  If both are enabled the backend to use can be configured at run-time
105	  by means of per-address-family sysctl tunables.
106
107if NF_CONNTRACK
108config NETFILTER_CONNCOUNT
109	tristate
110
111config NF_CONNTRACK_MARK
112	bool  'Connection mark tracking support'
113	depends on NETFILTER_ADVANCED
114	help
115	  This option enables support for connection marks, used by the
116	  `CONNMARK' target and `connmark' match. Similar to the mark value
117	  of packets, but this mark value is kept in the conntrack session
118	  instead of the individual packets.
119
120config NF_CONNTRACK_SECMARK
121	bool  'Connection tracking security mark support'
122	depends on NETWORK_SECMARK
123	default y if NETFILTER_ADVANCED=n
124	help
125	  This option enables security markings to be applied to
126	  connections.  Typically they are copied to connections from
127	  packets using the CONNSECMARK target and copied back from
128	  connections to packets with the same target, with the packets
129	  being originally labeled via SECMARK.
130
131	  If unsure, say 'N'.
132
133config NF_CONNTRACK_ZONES
134	bool  'Connection tracking zones'
135	depends on NETFILTER_ADVANCED
136	help
137	  This option enables support for connection tracking zones.
138	  Normally, each connection needs to have a unique system wide
139	  identity. Connection tracking zones allow to have multiple
140	  connections using the same identity, as long as they are
141	  contained in different zones.
142
143	  If unsure, say `N'.
144
145config NF_CONNTRACK_PROCFS
146	bool "Supply CT list in procfs (OBSOLETE)"
147	depends on PROC_FS
148	help
149	This option enables for the list of known conntrack entries
150	to be shown in procfs under net/netfilter/nf_conntrack. This
151	is considered obsolete in favor of using the conntrack(8)
152	tool which uses Netlink.
153
154config NF_CONNTRACK_EVENTS
155	bool "Connection tracking events"
156	depends on NETFILTER_ADVANCED
157	help
158	  If this option is enabled, the connection tracking code will
159	  provide a notifier chain that can be used by other kernel code
160	  to get notified about changes in the connection tracking state.
161
162	  If unsure, say `N'.
163
164config NF_CONNTRACK_TIMEOUT
165	bool  'Connection tracking timeout'
166	depends on NETFILTER_ADVANCED
167	help
168	  This option enables support for connection tracking timeout
169	  extension. This allows you to attach timeout policies to flow
170	  via the CT target.
171
172	  If unsure, say `N'.
173
174config NF_CONNTRACK_TIMESTAMP
175	bool  'Connection tracking timestamping'
176	depends on NETFILTER_ADVANCED
177	help
178	  This option enables support for connection tracking timestamping.
179	  This allows you to store the flow start-time and to obtain
180	  the flow-stop time (once it has been destroyed) via Connection
181	  tracking events.
182
183	  If unsure, say `N'.
184
185config NF_CONNTRACK_LABELS
186	bool "Connection tracking labels"
187	help
188	  This option enables support for assigning user-defined flag bits
189	  to connection tracking entries.  It can be used with xtables connlabel
190	  match and the nftables ct expression.
191
192config NF_CT_PROTO_DCCP
193	bool 'DCCP protocol connection tracking support'
194	depends on NETFILTER_ADVANCED
195	default y
196	help
197	  With this option enabled, the layer 3 independent connection
198	  tracking code will be able to do state tracking on DCCP connections.
199
200	  If unsure, say Y.
201
202config NF_CT_PROTO_GRE
203	bool
204
205config NF_CT_PROTO_SCTP
206	bool 'SCTP protocol connection tracking support'
207	depends on NETFILTER_ADVANCED
208	default y
209	select LIBCRC32C
210	help
211	  With this option enabled, the layer 3 independent connection
212	  tracking code will be able to do state tracking on SCTP connections.
213
214	  If unsure, say Y.
215
216config NF_CT_PROTO_UDPLITE
217	bool 'UDP-Lite protocol connection tracking support'
218	depends on NETFILTER_ADVANCED
219	default y
220	help
221	  With this option enabled, the layer 3 independent connection
222	  tracking code will be able to do state tracking on UDP-Lite
223	  connections.
224
225	  If unsure, say Y.
226
227config NF_CONNTRACK_AMANDA
228	tristate "Amanda backup protocol support"
229	depends on NETFILTER_ADVANCED
230	select TEXTSEARCH
231	select TEXTSEARCH_KMP
232	help
233	  If you are running the Amanda backup package <http://www.amanda.org/>
234	  on this machine or machines that will be MASQUERADED through this
235	  machine, then you may want to enable this feature.  This allows the
236	  connection tracking and natting code to allow the sub-channels that
237	  Amanda requires for communication of the backup data, messages and
238	  index.
239
240	  To compile it as a module, choose M here.  If unsure, say N.
241
242config NF_CONNTRACK_FTP
243	tristate "FTP protocol support"
244	default m if NETFILTER_ADVANCED=n
245	help
246	  Tracking FTP connections is problematic: special helpers are
247	  required for tracking them, and doing masquerading and other forms
248	  of Network Address Translation on them.
249
250	  This is FTP support on Layer 3 independent connection tracking.
251
252	  To compile it as a module, choose M here.  If unsure, say N.
253
254config NF_CONNTRACK_H323
255	tristate "H.323 protocol support"
256	depends on IPV6 || IPV6=n
257	depends on NETFILTER_ADVANCED
258	help
259	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
260	  important VoIP protocols, it is widely used by voice hardware and
261	  software including voice gateways, IP phones, Netmeeting, OpenPhone,
262	  Gnomemeeting, etc.
263
264	  With this module you can support H.323 on a connection tracking/NAT
265	  firewall.
266
267	  This module supports RAS, Fast Start, H.245 Tunnelling, Call
268	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
269	  whiteboard, file transfer, etc. For more information, please
270	  visit http://nath323.sourceforge.net/.
271
272	  To compile it as a module, choose M here.  If unsure, say N.
273
274config NF_CONNTRACK_IRC
275	tristate "IRC protocol support"
276	default m if NETFILTER_ADVANCED=n
277	help
278	  There is a commonly-used extension to IRC called
279	  Direct Client-to-Client Protocol (DCC).  This enables users to send
280	  files to each other, and also chat to each other without the need
281	  of a server.  DCC Sending is used anywhere you send files over IRC,
282	  and DCC Chat is most commonly used by Eggdrop bots.  If you are
283	  using NAT, this extension will enable you to send files and initiate
284	  chats.  Note that you do NOT need this extension to get files or
285	  have others initiate chats, or everything else in IRC.
286
287	  To compile it as a module, choose M here.  If unsure, say N.
288
289config NF_CONNTRACK_BROADCAST
290	tristate
291
292config NF_CONNTRACK_NETBIOS_NS
293	tristate "NetBIOS name service protocol support"
294	select NF_CONNTRACK_BROADCAST
295	help
296	  NetBIOS name service requests are sent as broadcast messages from an
297	  unprivileged port and responded to with unicast messages to the
298	  same port. This make them hard to firewall properly because connection
299	  tracking doesn't deal with broadcasts. This helper tracks locally
300	  originating NetBIOS name service requests and the corresponding
301	  responses. It relies on correct IP address configuration, specifically
302	  netmask and broadcast address. When properly configured, the output
303	  of "ip address show" should look similar to this:
304
305	  $ ip -4 address show eth0
306	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
307	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
308
309	  To compile it as a module, choose M here.  If unsure, say N.
310
311config NF_CONNTRACK_SNMP
312	tristate "SNMP service protocol support"
313	depends on NETFILTER_ADVANCED
314	select NF_CONNTRACK_BROADCAST
315	help
316	  SNMP service requests are sent as broadcast messages from an
317	  unprivileged port and responded to with unicast messages to the
318	  same port. This make them hard to firewall properly because connection
319	  tracking doesn't deal with broadcasts. This helper tracks locally
320	  originating SNMP service requests and the corresponding
321	  responses. It relies on correct IP address configuration, specifically
322	  netmask and broadcast address.
323
324	  To compile it as a module, choose M here.  If unsure, say N.
325
326config NF_CONNTRACK_PPTP
327	tristate "PPtP protocol support"
328	depends on NETFILTER_ADVANCED
329	select NF_CT_PROTO_GRE
330	help
331	  This module adds support for PPTP (Point to Point Tunnelling
332	  Protocol, RFC2637) connection tracking and NAT.
333
334	  If you are running PPTP sessions over a stateful firewall or NAT
335	  box, you may want to enable this feature.
336
337	  Please note that not all PPTP modes of operation are supported yet.
338	  Specifically these limitations exist:
339	    - Blindly assumes that control connections are always established
340	      in PNS->PAC direction. This is a violation of RFC2637.
341	    - Only supports a single call within each session
342
343	  To compile it as a module, choose M here.  If unsure, say N.
344
345config NF_CONNTRACK_SANE
346	tristate "SANE protocol support"
347	depends on NETFILTER_ADVANCED
348	help
349	  SANE is a protocol for remote access to scanners as implemented
350	  by the 'saned' daemon. Like FTP, it uses separate control and
351	  data connections.
352
353	  With this module you can support SANE on a connection tracking
354	  firewall.
355
356	  To compile it as a module, choose M here.  If unsure, say N.
357
358config NF_CONNTRACK_SIP
359	tristate "SIP protocol support"
360	default m if NETFILTER_ADVANCED=n
361	help
362	  SIP is an application-layer control protocol that can establish,
363	  modify, and terminate multimedia sessions (conferences) such as
364	  Internet telephony calls. With the nf_conntrack_sip and
365	  the nf_nat_sip modules you can support the protocol on a connection
366	  tracking/NATing firewall.
367
368	  To compile it as a module, choose M here.  If unsure, say N.
369
370config NF_CONNTRACK_TFTP
371	tristate "TFTP protocol support"
372	depends on NETFILTER_ADVANCED
373	help
374	  TFTP connection tracking helper, this is required depending
375	  on how restrictive your ruleset is.
376	  If you are using a tftp client behind -j SNAT or -j MASQUERADING
377	  you will need this.
378
379	  To compile it as a module, choose M here.  If unsure, say N.
380
381config NF_CT_NETLINK
382	tristate 'Connection tracking netlink interface'
383	select NETFILTER_NETLINK
384	default m if NETFILTER_ADVANCED=n
385	help
386	  This option enables support for a netlink-based userspace interface
387
388config NF_CT_NETLINK_TIMEOUT
389	tristate  'Connection tracking timeout tuning via Netlink'
390	select NETFILTER_NETLINK
391	depends on NETFILTER_ADVANCED
392	depends on NF_CONNTRACK_TIMEOUT
393	help
394	  This option enables support for connection tracking timeout
395	  fine-grain tuning. This allows you to attach specific timeout
396	  policies to flows, instead of using the global timeout policy.
397
398	  If unsure, say `N'.
399
400config NF_CT_NETLINK_HELPER
401	tristate 'Connection tracking helpers in user-space via Netlink'
402	select NETFILTER_NETLINK
403	depends on NF_CT_NETLINK
404	depends on NETFILTER_NETLINK_QUEUE
405	depends on NETFILTER_NETLINK_GLUE_CT
406	depends on NETFILTER_ADVANCED
407	help
408	  This option enables the user-space connection tracking helpers
409	  infrastructure.
410
411	  If unsure, say `N'.
412
413config NETFILTER_NETLINK_GLUE_CT
414	bool "NFQUEUE and NFLOG integration with Connection Tracking"
415	default n
416	depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
417	help
418	  If this option is enabled, NFQUEUE and NFLOG can include
419	  Connection Tracking information together with the packet is
420	  the enqueued via NFNETLINK.
421
422config NF_NAT
423	tristate "Network Address Translation support"
424	depends on NF_CONNTRACK
425	default m if NETFILTER_ADVANCED=n
426	help
427	  The NAT option allows masquerading, port forwarding and other
428	  forms of full Network Address Port Translation. This can be
429	  controlled by iptables, ip6tables or nft.
430
431config NF_NAT_AMANDA
432	tristate
433	depends on NF_CONNTRACK && NF_NAT
434	default NF_NAT && NF_CONNTRACK_AMANDA
435
436config NF_NAT_FTP
437	tristate
438	depends on NF_CONNTRACK && NF_NAT
439	default NF_NAT && NF_CONNTRACK_FTP
440
441config NF_NAT_IRC
442	tristate
443	depends on NF_CONNTRACK && NF_NAT
444	default NF_NAT && NF_CONNTRACK_IRC
445
446config NF_NAT_SIP
447	tristate
448	depends on NF_CONNTRACK && NF_NAT
449	default NF_NAT && NF_CONNTRACK_SIP
450
451config NF_NAT_TFTP
452	tristate
453	depends on NF_CONNTRACK && NF_NAT
454	default NF_NAT && NF_CONNTRACK_TFTP
455
456config NF_NAT_REDIRECT
457	bool
458
459config NF_NAT_MASQUERADE
460	bool
461
462config NETFILTER_SYNPROXY
463	tristate
464
465endif # NF_CONNTRACK
466
467config NF_TABLES
468	select NETFILTER_NETLINK
469	select LIBCRC32C
470	tristate "Netfilter nf_tables support"
471	help
472	  nftables is the new packet classification framework that intends to
473	  replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
474	  provides a pseudo-state machine with an extensible instruction-set
475	  (also known as expressions) that the userspace 'nft' utility
476	  (https://www.netfilter.org/projects/nftables) uses to build the
477	  rule-set. It also comes with the generic set infrastructure that
478	  allows you to construct mappings between matchings and actions
479	  for performance lookups.
480
481	  To compile it as a module, choose M here.
482
483if NF_TABLES
484config NF_TABLES_INET
485	depends on IPV6
486	select NF_TABLES_IPV4
487	select NF_TABLES_IPV6
488	bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
489	help
490	  This option enables support for a mixed IPv4/IPv6 "inet" table.
491
492config NF_TABLES_NETDEV
493	bool "Netfilter nf_tables netdev tables support"
494	help
495	  This option enables support for the "netdev" table.
496
497config NFT_NUMGEN
498	tristate "Netfilter nf_tables number generator module"
499	help
500	  This option adds the number generator expression used to perform
501	  incremental counting and random numbers bound to a upper limit.
502
503config NFT_CT
504	depends on NF_CONNTRACK
505	tristate "Netfilter nf_tables conntrack module"
506	help
507	  This option adds the "ct" expression that you can use to match
508	  connection tracking information such as the flow state.
509
510config NFT_FLOW_OFFLOAD
511	depends on NF_CONNTRACK && NF_FLOW_TABLE
512	tristate "Netfilter nf_tables hardware flow offload module"
513	help
514	  This option adds the "flow_offload" expression that you can use to
515	  choose what flows are placed into the hardware.
516
517config NFT_CONNLIMIT
518	tristate "Netfilter nf_tables connlimit module"
519	depends on NF_CONNTRACK
520	depends on NETFILTER_ADVANCED
521	select NETFILTER_CONNCOUNT
522	help
523	  This option adds the "connlimit" expression that you can use to
524	  ratelimit rule matchings per connections.
525
526config NFT_LOG
527	tristate "Netfilter nf_tables log module"
528	help
529	  This option adds the "log" expression that you can use to log
530	  packets matching some criteria.
531
532config NFT_LIMIT
533	tristate "Netfilter nf_tables limit module"
534	help
535	  This option adds the "limit" expression that you can use to
536	  ratelimit rule matchings.
537
538config NFT_MASQ
539	depends on NF_CONNTRACK
540	depends on NF_NAT
541	select NF_NAT_MASQUERADE
542	tristate "Netfilter nf_tables masquerade support"
543	help
544	  This option adds the "masquerade" expression that you can use
545	  to perform NAT in the masquerade flavour.
546
547config NFT_REDIR
548	depends on NF_CONNTRACK
549	depends on NF_NAT
550	tristate "Netfilter nf_tables redirect support"
551	select NF_NAT_REDIRECT
552	help
553	  This options adds the "redirect" expression that you can use
554	  to perform NAT in the redirect flavour.
555
556config NFT_NAT
557	depends on NF_CONNTRACK
558	select NF_NAT
559	depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
560	tristate "Netfilter nf_tables nat module"
561	help
562	  This option adds the "nat" expression that you can use to perform
563	  typical Network Address Translation (NAT) packet transformations.
564
565config NFT_TUNNEL
566	tristate "Netfilter nf_tables tunnel module"
567	help
568	  This option adds the "tunnel" expression that you can use to set
569	  tunneling policies.
570
571config NFT_OBJREF
572	tristate "Netfilter nf_tables stateful object reference module"
573	help
574	  This option adds the "objref" expression that allows you to refer to
575	  stateful objects, such as counters and quotas.
576
577config NFT_QUEUE
578	depends on NETFILTER_NETLINK_QUEUE
579	tristate "Netfilter nf_tables queue module"
580	help
581	  This is required if you intend to use the userspace queueing
582	  infrastructure (also known as NFQUEUE) from nftables.
583
584config NFT_QUOTA
585	tristate "Netfilter nf_tables quota module"
586	help
587	  This option adds the "quota" expression that you can use to match
588	  enforce bytes quotas.
589
590config NFT_REJECT
591	default m if NETFILTER_ADVANCED=n
592	tristate "Netfilter nf_tables reject support"
593	depends on !NF_TABLES_INET || (IPV6!=m || m)
594	help
595	  This option adds the "reject" expression that you can use to
596	  explicitly deny and notify via TCP reset/ICMP informational errors
597	  unallowed traffic.
598
599config NFT_REJECT_INET
600	depends on NF_TABLES_INET
601	default NFT_REJECT
602	tristate
603
604config NFT_COMPAT
605	depends on NETFILTER_XTABLES
606	tristate "Netfilter x_tables over nf_tables module"
607	help
608	  This is required if you intend to use any of existing
609	  x_tables match/target extensions over the nf_tables
610	  framework.
611
612config NFT_HASH
613	tristate "Netfilter nf_tables hash module"
614	help
615	  This option adds the "hash" expression that you can use to perform
616	  a hash operation on registers.
617
618config NFT_FIB
619	tristate
620
621config NFT_FIB_INET
622	depends on NF_TABLES_INET
623	depends on NFT_FIB_IPV4
624	depends on NFT_FIB_IPV6
625	tristate "Netfilter nf_tables fib inet support"
626	help
627	  This option allows using the FIB expression from the inet table.
628	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
629	  on the protocol of the packet.
630
631config NFT_XFRM
632	tristate "Netfilter nf_tables xfrm/IPSec security association matching"
633	depends on XFRM
634	help
635	  This option adds an expression that you can use to extract properties
636	  of a packets security association.
637
638config NFT_SOCKET
639	tristate "Netfilter nf_tables socket match support"
640	depends on IPV6 || IPV6=n
641	select NF_SOCKET_IPV4
642	select NF_SOCKET_IPV6 if NF_TABLES_IPV6
643	help
644	  This option allows matching for the presence or absence of a
645	  corresponding socket and its attributes.
646
647config NFT_OSF
648	tristate "Netfilter nf_tables passive OS fingerprint support"
649	depends on NETFILTER_ADVANCED
650	select NETFILTER_NETLINK_OSF
651	help
652	  This option allows matching packets from an specific OS.
653
654config NFT_TPROXY
655	tristate "Netfilter nf_tables tproxy support"
656	depends on IPV6 || IPV6=n
657	select NF_DEFRAG_IPV4
658	select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
659	select NF_TPROXY_IPV4
660	select NF_TPROXY_IPV6 if NF_TABLES_IPV6
661	help
662	  This makes transparent proxy support available in nftables.
663
664config NFT_SYNPROXY
665	tristate "Netfilter nf_tables SYNPROXY expression support"
666	depends on NF_CONNTRACK && NETFILTER_ADVANCED
667	select NETFILTER_SYNPROXY
668	select SYN_COOKIES
669	help
670	  The SYNPROXY expression allows you to intercept TCP connections and
671	  establish them using syncookies before they are passed on to the
672	  server. This allows to avoid conntrack and server resource usage
673	  during SYN-flood attacks.
674
675if NF_TABLES_NETDEV
676
677config NF_DUP_NETDEV
678	tristate "Netfilter packet duplication support"
679	help
680	  This option enables the generic packet duplication infrastructure
681	  for Netfilter.
682
683config NFT_DUP_NETDEV
684	tristate "Netfilter nf_tables netdev packet duplication support"
685	select NF_DUP_NETDEV
686	help
687	  This option enables packet duplication for the "netdev" family.
688
689config NFT_FWD_NETDEV
690	tristate "Netfilter nf_tables netdev packet forwarding support"
691	select NF_DUP_NETDEV
692	help
693	  This option enables packet forwarding for the "netdev" family.
694
695config NFT_FIB_NETDEV
696	depends on NFT_FIB_IPV4
697	depends on NFT_FIB_IPV6
698	tristate "Netfilter nf_tables netdev fib lookups support"
699	help
700	  This option allows using the FIB expression from the netdev table.
701	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
702	  on the protocol of the packet.
703
704config NFT_REJECT_NETDEV
705	depends on NFT_REJECT_IPV4
706	depends on NFT_REJECT_IPV6
707	tristate "Netfilter nf_tables netdev REJECT support"
708	help
709	  This option enables the REJECT support from the netdev table.
710	  The return packet generation will be delegated to the IPv4
711	  or IPv6 ICMP or TCP RST implementation depending on the
712	  protocol of the packet.
713
714endif # NF_TABLES_NETDEV
715
716endif # NF_TABLES
717
718config NF_FLOW_TABLE_INET
719	tristate "Netfilter flow table mixed IPv4/IPv6 module"
720	depends on NF_FLOW_TABLE
721	help
722	  This option adds the flow table mixed IPv4/IPv6 support.
723
724	  To compile it as a module, choose M here.
725
726config NF_FLOW_TABLE
727	tristate "Netfilter flow table module"
728	depends on NETFILTER_INGRESS
729	depends on NF_CONNTRACK
730	depends on NF_TABLES
731	help
732	  This option adds the flow table core infrastructure.
733
734	  To compile it as a module, choose M here.
735
736config NF_FLOW_TABLE_PROCFS
737	bool "Supply flow table statistics in procfs"
738	depends on NF_FLOW_TABLE
739	depends on PROC_FS
740	help
741	  This option enables for the flow table offload statistics
742	  to be shown in procfs under net/netfilter/nf_flowtable.
743
744config NETFILTER_XTABLES
745	tristate "Netfilter Xtables support (required for ip_tables)"
746	default m if NETFILTER_ADVANCED=n
747	help
748	  This is required if you intend to use any of ip_tables,
749	  ip6_tables or arp_tables.
750
751if NETFILTER_XTABLES
752
753config NETFILTER_XTABLES_COMPAT
754	bool "Netfilter Xtables 32bit support"
755	depends on COMPAT
756	default y
757	help
758	   This option provides a translation layer to run 32bit arp,ip(6),ebtables
759	   binaries on 64bit kernels.
760
761	   If unsure, say N.
762
763comment "Xtables combined modules"
764
765config NETFILTER_XT_MARK
766	tristate 'nfmark target and match support'
767	default m if NETFILTER_ADVANCED=n
768	help
769	This option adds the "MARK" target and "mark" match.
770
771	Netfilter mark matching allows you to match packets based on the
772	"nfmark" value in the packet.
773	The target allows you to create rules in the "mangle" table which alter
774	the netfilter mark (nfmark) field associated with the packet.
775
776	Prior to routing, the nfmark can influence the routing method and can
777	also be used by other subsystems to change their behavior.
778
779config NETFILTER_XT_CONNMARK
780	tristate 'ctmark target and match support'
781	depends on NF_CONNTRACK
782	depends on NETFILTER_ADVANCED
783	select NF_CONNTRACK_MARK
784	help
785	This option adds the "CONNMARK" target and "connmark" match.
786
787	Netfilter allows you to store a mark value per connection (a.k.a.
788	ctmark), similarly to the packet mark (nfmark). Using this
789	target and match, you can set and match on this mark.
790
791config NETFILTER_XT_SET
792	tristate 'set target and match support'
793	depends on IP_SET
794	depends on NETFILTER_ADVANCED
795	help
796	  This option adds the "SET" target and "set" match.
797
798	  Using this target and match, you can add/delete and match
799	  elements in the sets created by ipset(8).
800
801	  To compile it as a module, choose M here.  If unsure, say N.
802
803# alphabetically ordered list of targets
804
805comment "Xtables targets"
806
807config NETFILTER_XT_TARGET_AUDIT
808	tristate "AUDIT target support"
809	depends on AUDIT
810	depends on NETFILTER_ADVANCED
811	help
812	  This option adds a 'AUDIT' target, which can be used to create
813	  audit records for packets dropped/accepted.
814
815	  To compileit as a module, choose M here. If unsure, say N.
816
817config NETFILTER_XT_TARGET_CHECKSUM
818	tristate "CHECKSUM target support"
819	depends on IP_NF_MANGLE || IP6_NF_MANGLE
820	depends on NETFILTER_ADVANCED
821	help
822	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
823	  table to work around buggy DHCP clients in virtualized environments.
824
825	  Some old DHCP clients drop packets because they are not aware
826	  that the checksum would normally be offloaded to hardware and
827	  thus should be considered valid.
828	  This target can be used to fill in the checksum using iptables
829	  when such packets are sent via a virtual network device.
830
831	  To compile it as a module, choose M here.  If unsure, say N.
832
833config NETFILTER_XT_TARGET_CLASSIFY
834	tristate '"CLASSIFY" target support'
835	depends on NETFILTER_ADVANCED
836	help
837	  This option adds a `CLASSIFY' target, which enables the user to set
838	  the priority of a packet. Some qdiscs can use this value for
839	  classification, among these are:
840
841	  atm, cbq, dsmark, pfifo_fast, htb, prio
842
843	  To compile it as a module, choose M here.  If unsure, say N.
844
845config NETFILTER_XT_TARGET_CONNMARK
846	tristate  '"CONNMARK" target support'
847	depends on NF_CONNTRACK
848	depends on NETFILTER_ADVANCED
849	select NETFILTER_XT_CONNMARK
850	help
851	This is a backwards-compat option for the user's convenience
852	(e.g. when running oldconfig). It selects
853	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
854
855config NETFILTER_XT_TARGET_CONNSECMARK
856	tristate '"CONNSECMARK" target support'
857	depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
858	default m if NETFILTER_ADVANCED=n
859	help
860	  The CONNSECMARK target copies security markings from packets
861	  to connections, and restores security markings from connections
862	  to packets (if the packets are not already marked).  This would
863	  normally be used in conjunction with the SECMARK target.
864
865	  To compile it as a module, choose M here.  If unsure, say N.
866
867config NETFILTER_XT_TARGET_CT
868	tristate '"CT" target support'
869	depends on NF_CONNTRACK
870	depends on IP_NF_RAW || IP6_NF_RAW
871	depends on NETFILTER_ADVANCED
872	help
873	  This options adds a `CT' target, which allows to specify initial
874	  connection tracking parameters like events to be delivered and
875	  the helper to be used.
876
877	  To compile it as a module, choose M here.  If unsure, say N.
878
879config NETFILTER_XT_TARGET_DSCP
880	tristate '"DSCP" and "TOS" target support'
881	depends on IP_NF_MANGLE || IP6_NF_MANGLE
882	depends on NETFILTER_ADVANCED
883	help
884	  This option adds a `DSCP' target, which allows you to manipulate
885	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
886
887	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
888
889	  It also adds the "TOS" target, which allows you to create rules in
890	  the "mangle" table which alter the Type Of Service field of an IPv4
891	  or the Priority field of an IPv6 packet, prior to routing.
892
893	  To compile it as a module, choose M here.  If unsure, say N.
894
895config NETFILTER_XT_TARGET_HL
896	tristate '"HL" hoplimit target support'
897	depends on IP_NF_MANGLE || IP6_NF_MANGLE
898	depends on NETFILTER_ADVANCED
899	help
900	This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
901	targets, which enable the user to change the
902	hoplimit/time-to-live value of the IP header.
903
904	While it is safe to decrement the hoplimit/TTL value, the
905	modules also allow to increment and set the hoplimit value of
906	the header to arbitrary values. This is EXTREMELY DANGEROUS
907	since you can easily create immortal packets that loop
908	forever on the network.
909
910config NETFILTER_XT_TARGET_HMARK
911	tristate '"HMARK" target support'
912	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
913	depends on NETFILTER_ADVANCED
914	help
915	This option adds the "HMARK" target.
916
917	The target allows you to create rules in the "raw" and "mangle" tables
918	which set the skbuff mark by means of hash calculation within a given
919	range. The nfmark can influence the routing method and can also be used
920	by other subsystems to change their behaviour.
921
922	To compile it as a module, choose M here. If unsure, say N.
923
924config NETFILTER_XT_TARGET_IDLETIMER
925	tristate  "IDLETIMER target support"
926	depends on NETFILTER_ADVANCED
927	help
928
929	  This option adds the `IDLETIMER' target.  Each matching packet
930	  resets the timer associated with label specified when the rule is
931	  added.  When the timer expires, it triggers a sysfs notification.
932	  The remaining time for expiration can be read via sysfs.
933
934	  To compile it as a module, choose M here.  If unsure, say N.
935
936config NETFILTER_XT_TARGET_LED
937	tristate '"LED" target support'
938	depends on LEDS_CLASS && LEDS_TRIGGERS
939	depends on NETFILTER_ADVANCED
940	help
941	  This option adds a `LED' target, which allows you to blink LEDs in
942	  response to particular packets passing through your machine.
943
944	  This can be used to turn a spare LED into a network activity LED,
945	  which only flashes in response to FTP transfers, for example.  Or
946	  you could have an LED which lights up for a minute or two every time
947	  somebody connects to your machine via SSH.
948
949	  You will need support for the "led" class to make this work.
950
951	  To create an LED trigger for incoming SSH traffic:
952	    iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
953
954	  Then attach the new trigger to an LED on your system:
955	    echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
956
957	  For more information on the LEDs available on your system, see
958	  Documentation/leds/leds-class.rst
959
960config NETFILTER_XT_TARGET_LOG
961	tristate "LOG target support"
962	select NF_LOG_SYSLOG
963	select NF_LOG_IPV6 if IP6_NF_IPTABLES
964	default m if NETFILTER_ADVANCED=n
965	help
966	  This option adds a `LOG' target, which allows you to create rules in
967	  any iptables table which records the packet header to the syslog.
968
969	  To compile it as a module, choose M here.  If unsure, say N.
970
971config NETFILTER_XT_TARGET_MARK
972	tristate '"MARK" target support'
973	depends on NETFILTER_ADVANCED
974	select NETFILTER_XT_MARK
975	help
976	This is a backwards-compat option for the user's convenience
977	(e.g. when running oldconfig). It selects
978	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
979
980config NETFILTER_XT_NAT
981	tristate '"SNAT and DNAT" targets support'
982	depends on NF_NAT
983	help
984	This option enables the SNAT and DNAT targets.
985
986	To compile it as a module, choose M here. If unsure, say N.
987
988config NETFILTER_XT_TARGET_NETMAP
989	tristate '"NETMAP" target support'
990	depends on NF_NAT
991	help
992	NETMAP is an implementation of static 1:1 NAT mapping of network
993	addresses. It maps the network address part, while keeping the host
994	address part intact.
995
996	To compile it as a module, choose M here. If unsure, say N.
997
998config NETFILTER_XT_TARGET_NFLOG
999	tristate '"NFLOG" target support'
1000	default m if NETFILTER_ADVANCED=n
1001	select NETFILTER_NETLINK_LOG
1002	help
1003	  This option enables the NFLOG target, which allows to LOG
1004	  messages through nfnetlink_log.
1005
1006	  To compile it as a module, choose M here.  If unsure, say N.
1007
1008config NETFILTER_XT_TARGET_NFQUEUE
1009	tristate '"NFQUEUE" target Support'
1010	depends on NETFILTER_ADVANCED
1011	select NETFILTER_NETLINK_QUEUE
1012	help
1013	  This target replaced the old obsolete QUEUE target.
1014
1015	  As opposed to QUEUE, it supports 65535 different queues,
1016	  not just one.
1017
1018	  To compile it as a module, choose M here.  If unsure, say N.
1019
1020config NETFILTER_XT_TARGET_NOTRACK
1021	tristate  '"NOTRACK" target support (DEPRECATED)'
1022	depends on NF_CONNTRACK
1023	depends on IP_NF_RAW || IP6_NF_RAW
1024	depends on NETFILTER_ADVANCED
1025	select NETFILTER_XT_TARGET_CT
1026
1027config NETFILTER_XT_TARGET_RATEEST
1028	tristate '"RATEEST" target support'
1029	depends on NETFILTER_ADVANCED
1030	help
1031	  This option adds a `RATEEST' target, which allows to measure
1032	  rates similar to TC estimators. The `rateest' match can be
1033	  used to match on the measured rates.
1034
1035	  To compile it as a module, choose M here.  If unsure, say N.
1036
1037config NETFILTER_XT_TARGET_REDIRECT
1038	tristate "REDIRECT target support"
1039	depends on NF_NAT
1040	select NF_NAT_REDIRECT
1041	help
1042	REDIRECT is a special case of NAT: all incoming connections are
1043	mapped onto the incoming interface's address, causing the packets to
1044	come to the local machine instead of passing through. This is
1045	useful for transparent proxies.
1046
1047	To compile it as a module, choose M here. If unsure, say N.
1048
1049config NETFILTER_XT_TARGET_MASQUERADE
1050	tristate "MASQUERADE target support"
1051	depends on NF_NAT
1052	default m if NETFILTER_ADVANCED=n
1053	select NF_NAT_MASQUERADE
1054	help
1055	  Masquerading is a special case of NAT: all outgoing connections are
1056	  changed to seem to come from a particular interface's address, and
1057	  if the interface goes down, those connections are lost.  This is
1058	  only useful for dialup accounts with dynamic IP address (ie. your IP
1059	  address will be different on next dialup).
1060
1061	  To compile it as a module, choose M here.  If unsure, say N.
1062
1063config NETFILTER_XT_TARGET_TEE
1064	tristate '"TEE" - packet cloning to alternate destination'
1065	depends on NETFILTER_ADVANCED
1066	depends on IPV6 || IPV6=n
1067	depends on !NF_CONNTRACK || NF_CONNTRACK
1068	depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1069	select NF_DUP_IPV4
1070	select NF_DUP_IPV6 if IP6_NF_IPTABLES
1071	help
1072	This option adds a "TEE" target with which a packet can be cloned and
1073	this clone be rerouted to another nexthop.
1074
1075config NETFILTER_XT_TARGET_TPROXY
1076	tristate '"TPROXY" target transparent proxying support'
1077	depends on NETFILTER_XTABLES
1078	depends on NETFILTER_ADVANCED
1079	depends on IPV6 || IPV6=n
1080	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1081	depends on IP_NF_MANGLE
1082	select NF_DEFRAG_IPV4
1083	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1084	select NF_TPROXY_IPV4
1085	select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1086	help
1087	  This option adds a `TPROXY' target, which is somewhat similar to
1088	  REDIRECT.  It can only be used in the mangle table and is useful
1089	  to redirect traffic to a transparent proxy.  It does _not_ depend
1090	  on Netfilter connection tracking and NAT, unlike REDIRECT.
1091	  For it to work you will have to configure certain iptables rules
1092	  and use policy routing. For more information on how to set it up
1093	  see Documentation/networking/tproxy.rst.
1094
1095	  To compile it as a module, choose M here.  If unsure, say N.
1096
1097config NETFILTER_XT_TARGET_TRACE
1098	tristate  '"TRACE" target support'
1099	depends on IP_NF_RAW || IP6_NF_RAW
1100	depends on NETFILTER_ADVANCED
1101	help
1102	  The TRACE target allows you to mark packets so that the kernel
1103	  will log every rule which match the packets as those traverse
1104	  the tables, chains, rules.
1105
1106	  If you want to compile it as a module, say M here and read
1107	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1108
1109config NETFILTER_XT_TARGET_SECMARK
1110	tristate '"SECMARK" target support'
1111	depends on NETWORK_SECMARK
1112	default m if NETFILTER_ADVANCED=n
1113	help
1114	  The SECMARK target allows security marking of network
1115	  packets, for use with security subsystems.
1116
1117	  To compile it as a module, choose M here.  If unsure, say N.
1118
1119config NETFILTER_XT_TARGET_TCPMSS
1120	tristate '"TCPMSS" target support'
1121	depends on IPV6 || IPV6=n
1122	default m if NETFILTER_ADVANCED=n
1123	help
1124	  This option adds a `TCPMSS' target, which allows you to alter the
1125	  MSS value of TCP SYN packets, to control the maximum size for that
1126	  connection (usually limiting it to your outgoing interface's MTU
1127	  minus 40).
1128
1129	  This is used to overcome criminally braindead ISPs or servers which
1130	  block ICMP Fragmentation Needed packets.  The symptoms of this
1131	  problem are that everything works fine from your Linux
1132	  firewall/router, but machines behind it can never exchange large
1133	  packets:
1134	        1) Web browsers connect, then hang with no data received.
1135	        2) Small mail works fine, but large emails hang.
1136	        3) ssh works fine, but scp hangs after initial handshaking.
1137
1138	  Workaround: activate this option and add a rule to your firewall
1139	  configuration like:
1140
1141	  iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1142	                 -j TCPMSS --clamp-mss-to-pmtu
1143
1144	  To compile it as a module, choose M here.  If unsure, say N.
1145
1146config NETFILTER_XT_TARGET_TCPOPTSTRIP
1147	tristate '"TCPOPTSTRIP" target support'
1148	depends on IP_NF_MANGLE || IP6_NF_MANGLE
1149	depends on NETFILTER_ADVANCED
1150	help
1151	  This option adds a "TCPOPTSTRIP" target, which allows you to strip
1152	  TCP options from TCP packets.
1153
1154# alphabetically ordered list of matches
1155
1156comment "Xtables matches"
1157
1158config NETFILTER_XT_MATCH_ADDRTYPE
1159	tristate '"addrtype" address type match support'
1160	default m if NETFILTER_ADVANCED=n
1161	help
1162	  This option allows you to match what routing thinks of an address,
1163	  eg. UNICAST, LOCAL, BROADCAST, ...
1164
1165	  If you want to compile it as a module, say M here and read
1166	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1167
1168config NETFILTER_XT_MATCH_BPF
1169	tristate '"bpf" match support'
1170	depends on NETFILTER_ADVANCED
1171	help
1172	  BPF matching applies a linux socket filter to each packet and
1173	  accepts those for which the filter returns non-zero.
1174
1175	  To compile it as a module, choose M here.  If unsure, say N.
1176
1177config NETFILTER_XT_MATCH_CGROUP
1178	tristate '"control group" match support'
1179	depends on NETFILTER_ADVANCED
1180	depends on CGROUPS
1181	select CGROUP_NET_CLASSID
1182	help
1183	Socket/process control group matching allows you to match locally
1184	generated packets based on which net_cls control group processes
1185	belong to.
1186
1187config NETFILTER_XT_MATCH_CLUSTER
1188	tristate '"cluster" match support'
1189	depends on NF_CONNTRACK
1190	depends on NETFILTER_ADVANCED
1191	help
1192	  This option allows you to build work-load-sharing clusters of
1193	  network servers/stateful firewalls without having a dedicated
1194	  load-balancing router/server/switch. Basically, this match returns
1195	  true when the packet must be handled by this cluster node. Thus,
1196	  all nodes see all packets and this match decides which node handles
1197	  what packets. The work-load sharing algorithm is based on source
1198	  address hashing.
1199
1200	  If you say Y or M here, try `iptables -m cluster --help` for
1201	  more information.
1202
1203config NETFILTER_XT_MATCH_COMMENT
1204	tristate  '"comment" match support'
1205	depends on NETFILTER_ADVANCED
1206	help
1207	  This option adds a `comment' dummy-match, which allows you to put
1208	  comments in your iptables ruleset.
1209
1210	  If you want to compile it as a module, say M here and read
1211	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1212
1213config NETFILTER_XT_MATCH_CONNBYTES
1214	tristate  '"connbytes" per-connection counter match support'
1215	depends on NF_CONNTRACK
1216	depends on NETFILTER_ADVANCED
1217	help
1218	  This option adds a `connbytes' match, which allows you to match the
1219	  number of bytes and/or packets for each direction within a connection.
1220
1221	  If you want to compile it as a module, say M here and read
1222	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1223
1224config NETFILTER_XT_MATCH_CONNLABEL
1225	tristate '"connlabel" match support'
1226	select NF_CONNTRACK_LABELS
1227	depends on NF_CONNTRACK
1228	depends on NETFILTER_ADVANCED
1229	help
1230	  This match allows you to test and assign userspace-defined labels names
1231	  to a connection.  The kernel only stores bit values - mapping
1232	  names to bits is done by userspace.
1233
1234	  Unlike connmark, more than 32 flag bits may be assigned to a
1235	  connection simultaneously.
1236
1237config NETFILTER_XT_MATCH_CONNLIMIT
1238	tristate '"connlimit" match support'
1239	depends on NF_CONNTRACK
1240	depends on NETFILTER_ADVANCED
1241	select NETFILTER_CONNCOUNT
1242	help
1243	  This match allows you to match against the number of parallel
1244	  connections to a server per client IP address (or address block).
1245
1246config NETFILTER_XT_MATCH_CONNMARK
1247	tristate  '"connmark" connection mark match support'
1248	depends on NF_CONNTRACK
1249	depends on NETFILTER_ADVANCED
1250	select NETFILTER_XT_CONNMARK
1251	help
1252	This is a backwards-compat option for the user's convenience
1253	(e.g. when running oldconfig). It selects
1254	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1255
1256config NETFILTER_XT_MATCH_CONNTRACK
1257	tristate '"conntrack" connection tracking match support'
1258	depends on NF_CONNTRACK
1259	default m if NETFILTER_ADVANCED=n
1260	help
1261	  This is a general conntrack match module, a superset of the state match.
1262
1263	  It allows matching on additional conntrack information, which is
1264	  useful in complex configurations, such as NAT gateways with multiple
1265	  internet links or tunnels.
1266
1267	  To compile it as a module, choose M here.  If unsure, say N.
1268
1269config NETFILTER_XT_MATCH_CPU
1270	tristate '"cpu" match support'
1271	depends on NETFILTER_ADVANCED
1272	help
1273	  CPU matching allows you to match packets based on the CPU
1274	  currently handling the packet.
1275
1276	  To compile it as a module, choose M here.  If unsure, say N.
1277
1278config NETFILTER_XT_MATCH_DCCP
1279	tristate '"dccp" protocol match support'
1280	depends on NETFILTER_ADVANCED
1281	default IP_DCCP
1282	help
1283	  With this option enabled, you will be able to use the iptables
1284	  `dccp' match in order to match on DCCP source/destination ports
1285	  and DCCP flags.
1286
1287	  If you want to compile it as a module, say M here and read
1288	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1289
1290config NETFILTER_XT_MATCH_DEVGROUP
1291	tristate '"devgroup" match support'
1292	depends on NETFILTER_ADVANCED
1293	help
1294	  This options adds a `devgroup' match, which allows to match on the
1295	  device group a network device is assigned to.
1296
1297	  To compile it as a module, choose M here.  If unsure, say N.
1298
1299config NETFILTER_XT_MATCH_DSCP
1300	tristate '"dscp" and "tos" match support'
1301	depends on NETFILTER_ADVANCED
1302	help
1303	  This option adds a `DSCP' match, which allows you to match against
1304	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1305
1306	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
1307
1308	  It will also add a "tos" match, which allows you to match packets
1309	  based on the Type Of Service fields of the IPv4 packet (which share
1310	  the same bits as DSCP).
1311
1312	  To compile it as a module, choose M here.  If unsure, say N.
1313
1314config NETFILTER_XT_MATCH_ECN
1315	tristate '"ecn" match support'
1316	depends on NETFILTER_ADVANCED
1317	help
1318	This option adds an "ECN" match, which allows you to match against
1319	the IPv4 and TCP header ECN fields.
1320
1321	To compile it as a module, choose M here. If unsure, say N.
1322
1323config NETFILTER_XT_MATCH_ESP
1324	tristate '"esp" match support'
1325	depends on NETFILTER_ADVANCED
1326	help
1327	  This match extension allows you to match a range of SPIs
1328	  inside ESP header of IPSec packets.
1329
1330	  To compile it as a module, choose M here.  If unsure, say N.
1331
1332config NETFILTER_XT_MATCH_HASHLIMIT
1333	tristate '"hashlimit" match support'
1334	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1335	depends on NETFILTER_ADVANCED
1336	help
1337	  This option adds a `hashlimit' match.
1338
1339	  As opposed to `limit', this match dynamically creates a hash table
1340	  of limit buckets, based on your selection of source/destination
1341	  addresses and/or ports.
1342
1343	  It enables you to express policies like `10kpps for any given
1344	  destination address' or `500pps from any given source address'
1345	  with a single rule.
1346
1347config NETFILTER_XT_MATCH_HELPER
1348	tristate '"helper" match support'
1349	depends on NF_CONNTRACK
1350	depends on NETFILTER_ADVANCED
1351	help
1352	  Helper matching allows you to match packets in dynamic connections
1353	  tracked by a conntrack-helper, ie. nf_conntrack_ftp
1354
1355	  To compile it as a module, choose M here.  If unsure, say Y.
1356
1357config NETFILTER_XT_MATCH_HL
1358	tristate '"hl" hoplimit/TTL match support'
1359	depends on NETFILTER_ADVANCED
1360	help
1361	HL matching allows you to match packets based on the hoplimit
1362	in the IPv6 header, or the time-to-live field in the IPv4
1363	header of the packet.
1364
1365config NETFILTER_XT_MATCH_IPCOMP
1366	tristate '"ipcomp" match support'
1367	depends on NETFILTER_ADVANCED
1368	help
1369	  This match extension allows you to match a range of CPIs(16 bits)
1370	  inside IPComp header of IPSec packets.
1371
1372	  To compile it as a module, choose M here.  If unsure, say N.
1373
1374config NETFILTER_XT_MATCH_IPRANGE
1375	tristate '"iprange" address range match support'
1376	depends on NETFILTER_ADVANCED
1377	help
1378	This option adds a "iprange" match, which allows you to match based on
1379	an IP address range. (Normal iptables only matches on single addresses
1380	with an optional mask.)
1381
1382	If unsure, say M.
1383
1384config NETFILTER_XT_MATCH_IPVS
1385	tristate '"ipvs" match support'
1386	depends on IP_VS
1387	depends on NETFILTER_ADVANCED
1388	depends on NF_CONNTRACK
1389	help
1390	  This option allows you to match against IPVS properties of a packet.
1391
1392	  If unsure, say N.
1393
1394config NETFILTER_XT_MATCH_L2TP
1395	tristate '"l2tp" match support'
1396	depends on NETFILTER_ADVANCED
1397	default L2TP
1398	help
1399	This option adds an "L2TP" match, which allows you to match against
1400	L2TP protocol header fields.
1401
1402	To compile it as a module, choose M here. If unsure, say N.
1403
1404config NETFILTER_XT_MATCH_LENGTH
1405	tristate '"length" match support'
1406	depends on NETFILTER_ADVANCED
1407	help
1408	  This option allows you to match the length of a packet against a
1409	  specific value or range of values.
1410
1411	  To compile it as a module, choose M here.  If unsure, say N.
1412
1413config NETFILTER_XT_MATCH_LIMIT
1414	tristate '"limit" match support'
1415	depends on NETFILTER_ADVANCED
1416	help
1417	  limit matching allows you to control the rate at which a rule can be
1418	  matched: mainly useful in combination with the LOG target ("LOG
1419	  target support", below) and to avoid some Denial of Service attacks.
1420
1421	  To compile it as a module, choose M here.  If unsure, say N.
1422
1423config NETFILTER_XT_MATCH_MAC
1424	tristate '"mac" address match support'
1425	depends on NETFILTER_ADVANCED
1426	help
1427	  MAC matching allows you to match packets based on the source
1428	  Ethernet address of the packet.
1429
1430	  To compile it as a module, choose M here.  If unsure, say N.
1431
1432config NETFILTER_XT_MATCH_MARK
1433	tristate '"mark" match support'
1434	depends on NETFILTER_ADVANCED
1435	select NETFILTER_XT_MARK
1436	help
1437	This is a backwards-compat option for the user's convenience
1438	(e.g. when running oldconfig). It selects
1439	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1440
1441config NETFILTER_XT_MATCH_MULTIPORT
1442	tristate '"multiport" Multiple port match support'
1443	depends on NETFILTER_ADVANCED
1444	help
1445	  Multiport matching allows you to match TCP or UDP packets based on
1446	  a series of source or destination ports: normally a rule can only
1447	  match a single range of ports.
1448
1449	  To compile it as a module, choose M here.  If unsure, say N.
1450
1451config NETFILTER_XT_MATCH_NFACCT
1452	tristate '"nfacct" match support'
1453	depends on NETFILTER_ADVANCED
1454	select NETFILTER_NETLINK_ACCT
1455	help
1456	  This option allows you to use the extended accounting through
1457	  nfnetlink_acct.
1458
1459	  To compile it as a module, choose M here.  If unsure, say N.
1460
1461config NETFILTER_XT_MATCH_OSF
1462	tristate '"osf" Passive OS fingerprint match'
1463	depends on NETFILTER_ADVANCED
1464	select NETFILTER_NETLINK_OSF
1465	help
1466	  This option selects the Passive OS Fingerprinting match module
1467	  that allows to passively match the remote operating system by
1468	  analyzing incoming TCP SYN packets.
1469
1470	  Rules and loading software can be downloaded from
1471	  http://www.ioremap.net/projects/osf
1472
1473	  To compile it as a module, choose M here.  If unsure, say N.
1474
1475config NETFILTER_XT_MATCH_OWNER
1476	tristate '"owner" match support'
1477	depends on NETFILTER_ADVANCED
1478	help
1479	Socket owner matching allows you to match locally-generated packets
1480	based on who created the socket: the user or group. It is also
1481	possible to check whether a socket actually exists.
1482
1483config NETFILTER_XT_MATCH_POLICY
1484	tristate 'IPsec "policy" match support'
1485	depends on XFRM
1486	default m if NETFILTER_ADVANCED=n
1487	help
1488	  Policy matching allows you to match packets based on the
1489	  IPsec policy that was used during decapsulation/will
1490	  be used during encapsulation.
1491
1492	  To compile it as a module, choose M here.  If unsure, say N.
1493
1494config NETFILTER_XT_MATCH_PHYSDEV
1495	tristate '"physdev" match support'
1496	depends on BRIDGE && BRIDGE_NETFILTER
1497	depends on NETFILTER_ADVANCED
1498	help
1499	  Physdev packet matching matches against the physical bridge ports
1500	  the IP packet arrived on or will leave by.
1501
1502	  To compile it as a module, choose M here.  If unsure, say N.
1503
1504config NETFILTER_XT_MATCH_PKTTYPE
1505	tristate '"pkttype" packet type match support'
1506	depends on NETFILTER_ADVANCED
1507	help
1508	  Packet type matching allows you to match a packet by
1509	  its "class", eg. BROADCAST, MULTICAST, ...
1510
1511	  Typical usage:
1512	  iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1513
1514	  To compile it as a module, choose M here.  If unsure, say N.
1515
1516config NETFILTER_XT_MATCH_QUOTA
1517	tristate '"quota" match support'
1518	depends on NETFILTER_ADVANCED
1519	help
1520	  This option adds a `quota' match, which allows to match on a
1521	  byte counter.
1522
1523	  If you want to compile it as a module, say M here and read
1524	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1525
1526config NETFILTER_XT_MATCH_RATEEST
1527	tristate '"rateest" match support'
1528	depends on NETFILTER_ADVANCED
1529	select NETFILTER_XT_TARGET_RATEEST
1530	help
1531	  This option adds a `rateest' match, which allows to match on the
1532	  rate estimated by the RATEEST target.
1533
1534	  To compile it as a module, choose M here.  If unsure, say N.
1535
1536config NETFILTER_XT_MATCH_REALM
1537	tristate  '"realm" match support'
1538	depends on NETFILTER_ADVANCED
1539	select IP_ROUTE_CLASSID
1540	help
1541	  This option adds a `realm' match, which allows you to use the realm
1542	  key from the routing subsystem inside iptables.
1543
1544	  This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1545	  in tc world.
1546
1547	  If you want to compile it as a module, say M here and read
1548	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1549
1550config NETFILTER_XT_MATCH_RECENT
1551	tristate '"recent" match support'
1552	depends on NETFILTER_ADVANCED
1553	help
1554	This match is used for creating one or many lists of recently
1555	used addresses and then matching against that/those list(s).
1556
1557	Short options are available by using 'iptables -m recent -h'
1558	Official Website: <http://snowman.net/projects/ipt_recent/>
1559
1560config NETFILTER_XT_MATCH_SCTP
1561	tristate  '"sctp" protocol match support'
1562	depends on NETFILTER_ADVANCED
1563	default IP_SCTP
1564	help
1565	  With this option enabled, you will be able to use the
1566	  `sctp' match in order to match on SCTP source/destination ports
1567	  and SCTP chunk types.
1568
1569	  If you want to compile it as a module, say M here and read
1570	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1571
1572config NETFILTER_XT_MATCH_SOCKET
1573	tristate '"socket" match support'
1574	depends on NETFILTER_XTABLES
1575	depends on NETFILTER_ADVANCED
1576	depends on IPV6 || IPV6=n
1577	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1578	select NF_SOCKET_IPV4
1579	select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1580	select NF_DEFRAG_IPV4
1581	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1582	help
1583	  This option adds a `socket' match, which can be used to match
1584	  packets for which a TCP or UDP socket lookup finds a valid socket.
1585	  It can be used in combination with the MARK target and policy
1586	  routing to implement full featured non-locally bound sockets.
1587
1588	  To compile it as a module, choose M here.  If unsure, say N.
1589
1590config NETFILTER_XT_MATCH_STATE
1591	tristate '"state" match support'
1592	depends on NF_CONNTRACK
1593	default m if NETFILTER_ADVANCED=n
1594	help
1595	  Connection state matching allows you to match packets based on their
1596	  relationship to a tracked connection (ie. previous packets).  This
1597	  is a powerful tool for packet classification.
1598
1599	  To compile it as a module, choose M here.  If unsure, say N.
1600
1601config NETFILTER_XT_MATCH_STATISTIC
1602	tristate '"statistic" match support'
1603	depends on NETFILTER_ADVANCED
1604	help
1605	  This option adds a `statistic' match, which allows you to match
1606	  on packets periodically or randomly with a given percentage.
1607
1608	  To compile it as a module, choose M here.  If unsure, say N.
1609
1610config NETFILTER_XT_MATCH_STRING
1611	tristate  '"string" match support'
1612	depends on NETFILTER_ADVANCED
1613	select TEXTSEARCH
1614	select TEXTSEARCH_KMP
1615	select TEXTSEARCH_BM
1616	select TEXTSEARCH_FSM
1617	help
1618	  This option adds a `string' match, which allows you to look for
1619	  pattern matchings in packets.
1620
1621	  To compile it as a module, choose M here.  If unsure, say N.
1622
1623config NETFILTER_XT_MATCH_TCPMSS
1624	tristate '"tcpmss" match support'
1625	depends on NETFILTER_ADVANCED
1626	help
1627	  This option adds a `tcpmss' match, which allows you to examine the
1628	  MSS value of TCP SYN packets, which control the maximum packet size
1629	  for that connection.
1630
1631	  To compile it as a module, choose M here.  If unsure, say N.
1632
1633config NETFILTER_XT_MATCH_TIME
1634	tristate '"time" match support'
1635	depends on NETFILTER_ADVANCED
1636	help
1637	  This option adds a "time" match, which allows you to match based on
1638	  the packet arrival time (at the machine which netfilter is running)
1639	  on) or departure time/date (for locally generated packets).
1640
1641	  If you say Y here, try `iptables -m time --help` for
1642	  more information.
1643
1644	  If you want to compile it as a module, say M here.
1645	  If unsure, say N.
1646
1647config NETFILTER_XT_MATCH_U32
1648	tristate '"u32" match support'
1649	depends on NETFILTER_ADVANCED
1650	help
1651	  u32 allows you to extract quantities of up to 4 bytes from a packet,
1652	  AND them with specified masks, shift them by specified amounts and
1653	  test whether the results are in any of a set of specified ranges.
1654	  The specification of what to extract is general enough to skip over
1655	  headers with lengths stored in the packet, as in IP or TCP header
1656	  lengths.
1657
1658	  Details and examples are in the kernel module source.
1659
1660endif # NETFILTER_XTABLES
1661
1662endmenu
1663
1664source "net/netfilter/ipset/Kconfig"
1665
1666source "net/netfilter/ipvs/Kconfig"
1667