xref: /openbmc/linux/net/netfilter/Kconfig (revision e15a5365)
1# SPDX-License-Identifier: GPL-2.0-only
2menu "Core Netfilter Configuration"
3	depends on NET && INET && NETFILTER
4
5config NETFILTER_INGRESS
6	bool "Netfilter ingress support"
7	default y
8	select NET_INGRESS
9	help
10	  This allows you to classify packets from ingress using the Netfilter
11	  infrastructure.
12
13config NETFILTER_NETLINK
14	tristate
15
16config NETFILTER_FAMILY_BRIDGE
17	bool
18
19config NETFILTER_FAMILY_ARP
20	bool
21
22config NETFILTER_NETLINK_ACCT
23	tristate "Netfilter NFACCT over NFNETLINK interface"
24	depends on NETFILTER_ADVANCED
25	select NETFILTER_NETLINK
26	help
27	  If this option is enabled, the kernel will include support
28	  for extended accounting via NFNETLINK.
29
30config NETFILTER_NETLINK_QUEUE
31	tristate "Netfilter NFQUEUE over NFNETLINK interface"
32	depends on NETFILTER_ADVANCED
33	select NETFILTER_NETLINK
34	help
35	  If this option is enabled, the kernel will include support
36	  for queueing packets via NFNETLINK.
37
38config NETFILTER_NETLINK_LOG
39	tristate "Netfilter LOG over NFNETLINK interface"
40	default m if NETFILTER_ADVANCED=n
41	select NETFILTER_NETLINK
42	help
43	  If this option is enabled, the kernel will include support
44	  for logging packets via NFNETLINK.
45
46	  This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
47	  and is also scheduled to replace the old syslog-based ipt_LOG
48	  and ip6t_LOG modules.
49
50config NETFILTER_NETLINK_OSF
51	tristate "Netfilter OSF over NFNETLINK interface"
52	depends on NETFILTER_ADVANCED
53	select NETFILTER_NETLINK
54	help
55	  If this option is enabled, the kernel will include support
56	  for passive OS fingerprint via NFNETLINK.
57
58config NF_CONNTRACK
59	tristate "Netfilter connection tracking support"
60	default m if NETFILTER_ADVANCED=n
61	select NF_DEFRAG_IPV4
62	select NF_DEFRAG_IPV6 if IPV6 != n
63	help
64	  Connection tracking keeps a record of what packets have passed
65	  through your machine, in order to figure out how they are related
66	  into connections.
67
68	  This is required to do Masquerading or other kinds of Network
69	  Address Translation.  It can also be used to enhance packet
70	  filtering (see `Connection state match support' below).
71
72	  To compile it as a module, choose M here.  If unsure, say N.
73
74config NF_LOG_COMMON
75	tristate
76
77config NF_LOG_NETDEV
78	tristate "Netdev packet logging"
79	select NF_LOG_COMMON
80
81if NF_CONNTRACK
82config NETFILTER_CONNCOUNT
83	tristate
84
85config NF_CONNTRACK_MARK
86	bool  'Connection mark tracking support'
87	depends on NETFILTER_ADVANCED
88	help
89	  This option enables support for connection marks, used by the
90	  `CONNMARK' target and `connmark' match. Similar to the mark value
91	  of packets, but this mark value is kept in the conntrack session
92	  instead of the individual packets.
93
94config NF_CONNTRACK_SECMARK
95	bool  'Connection tracking security mark support'
96	depends on NETWORK_SECMARK
97	default m if NETFILTER_ADVANCED=n
98	help
99	  This option enables security markings to be applied to
100	  connections.  Typically they are copied to connections from
101	  packets using the CONNSECMARK target and copied back from
102	  connections to packets with the same target, with the packets
103	  being originally labeled via SECMARK.
104
105	  If unsure, say 'N'.
106
107config NF_CONNTRACK_ZONES
108	bool  'Connection tracking zones'
109	depends on NETFILTER_ADVANCED
110	help
111	  This option enables support for connection tracking zones.
112	  Normally, each connection needs to have a unique system wide
113	  identity. Connection tracking zones allow to have multiple
114	  connections using the same identity, as long as they are
115	  contained in different zones.
116
117	  If unsure, say `N'.
118
119config NF_CONNTRACK_PROCFS
120	bool "Supply CT list in procfs (OBSOLETE)"
121	default y
122	depends on PROC_FS
123	help
124	This option enables for the list of known conntrack entries
125	to be shown in procfs under net/netfilter/nf_conntrack. This
126	is considered obsolete in favor of using the conntrack(8)
127	tool which uses Netlink.
128
129config NF_CONNTRACK_EVENTS
130	bool "Connection tracking events"
131	depends on NETFILTER_ADVANCED
132	help
133	  If this option is enabled, the connection tracking code will
134	  provide a notifier chain that can be used by other kernel code
135	  to get notified about changes in the connection tracking state.
136
137	  If unsure, say `N'.
138
139config NF_CONNTRACK_TIMEOUT
140	bool  'Connection tracking timeout'
141	depends on NETFILTER_ADVANCED
142	help
143	  This option enables support for connection tracking timeout
144	  extension. This allows you to attach timeout policies to flow
145	  via the CT target.
146
147	  If unsure, say `N'.
148
149config NF_CONNTRACK_TIMESTAMP
150	bool  'Connection tracking timestamping'
151	depends on NETFILTER_ADVANCED
152	help
153	  This option enables support for connection tracking timestamping.
154	  This allows you to store the flow start-time and to obtain
155	  the flow-stop time (once it has been destroyed) via Connection
156	  tracking events.
157
158	  If unsure, say `N'.
159
160config NF_CONNTRACK_LABELS
161	bool "Connection tracking labels"
162	help
163	  This option enables support for assigning user-defined flag bits
164	  to connection tracking entries.  It can be used with xtables connlabel
165	  match and the nftables ct expression.
166
167config NF_CT_PROTO_DCCP
168	bool 'DCCP protocol connection tracking support'
169	depends on NETFILTER_ADVANCED
170	default y
171	help
172	  With this option enabled, the layer 3 independent connection
173	  tracking code will be able to do state tracking on DCCP connections.
174
175	  If unsure, say Y.
176
177config NF_CT_PROTO_GRE
178	bool
179
180config NF_CT_PROTO_SCTP
181	bool 'SCTP protocol connection tracking support'
182	depends on NETFILTER_ADVANCED
183	default y
184	select LIBCRC32C
185	help
186	  With this option enabled, the layer 3 independent connection
187	  tracking code will be able to do state tracking on SCTP connections.
188
189	  If unsure, say Y.
190
191config NF_CT_PROTO_UDPLITE
192	bool 'UDP-Lite protocol connection tracking support'
193	depends on NETFILTER_ADVANCED
194	default y
195	help
196	  With this option enabled, the layer 3 independent connection
197	  tracking code will be able to do state tracking on UDP-Lite
198	  connections.
199
200	  If unsure, say Y.
201
202config NF_CONNTRACK_AMANDA
203	tristate "Amanda backup protocol support"
204	depends on NETFILTER_ADVANCED
205	select TEXTSEARCH
206	select TEXTSEARCH_KMP
207	help
208	  If you are running the Amanda backup package <http://www.amanda.org/>
209	  on this machine or machines that will be MASQUERADED through this
210	  machine, then you may want to enable this feature.  This allows the
211	  connection tracking and natting code to allow the sub-channels that
212	  Amanda requires for communication of the backup data, messages and
213	  index.
214
215	  To compile it as a module, choose M here.  If unsure, say N.
216
217config NF_CONNTRACK_FTP
218	tristate "FTP protocol support"
219	default m if NETFILTER_ADVANCED=n
220	help
221	  Tracking FTP connections is problematic: special helpers are
222	  required for tracking them, and doing masquerading and other forms
223	  of Network Address Translation on them.
224
225	  This is FTP support on Layer 3 independent connection tracking.
226
227	  To compile it as a module, choose M here.  If unsure, say N.
228
229config NF_CONNTRACK_H323
230	tristate "H.323 protocol support"
231	depends on IPV6 || IPV6=n
232	depends on NETFILTER_ADVANCED
233	help
234	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
235	  important VoIP protocols, it is widely used by voice hardware and
236	  software including voice gateways, IP phones, Netmeeting, OpenPhone,
237	  Gnomemeeting, etc.
238
239	  With this module you can support H.323 on a connection tracking/NAT
240	  firewall.
241
242	  This module supports RAS, Fast Start, H.245 Tunnelling, Call
243	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
244	  whiteboard, file transfer, etc. For more information, please
245	  visit http://nath323.sourceforge.net/.
246
247	  To compile it as a module, choose M here.  If unsure, say N.
248
249config NF_CONNTRACK_IRC
250	tristate "IRC protocol support"
251	default m if NETFILTER_ADVANCED=n
252	help
253	  There is a commonly-used extension to IRC called
254	  Direct Client-to-Client Protocol (DCC).  This enables users to send
255	  files to each other, and also chat to each other without the need
256	  of a server.  DCC Sending is used anywhere you send files over IRC,
257	  and DCC Chat is most commonly used by Eggdrop bots.  If you are
258	  using NAT, this extension will enable you to send files and initiate
259	  chats.  Note that you do NOT need this extension to get files or
260	  have others initiate chats, or everything else in IRC.
261
262	  To compile it as a module, choose M here.  If unsure, say N.
263
264config NF_CONNTRACK_BROADCAST
265	tristate
266
267config NF_CONNTRACK_NETBIOS_NS
268	tristate "NetBIOS name service protocol support"
269	select NF_CONNTRACK_BROADCAST
270	help
271	  NetBIOS name service requests are sent as broadcast messages from an
272	  unprivileged port and responded to with unicast messages to the
273	  same port. This make them hard to firewall properly because connection
274	  tracking doesn't deal with broadcasts. This helper tracks locally
275	  originating NetBIOS name service requests and the corresponding
276	  responses. It relies on correct IP address configuration, specifically
277	  netmask and broadcast address. When properly configured, the output
278	  of "ip address show" should look similar to this:
279
280	  $ ip -4 address show eth0
281	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
282	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
283
284	  To compile it as a module, choose M here.  If unsure, say N.
285
286config NF_CONNTRACK_SNMP
287	tristate "SNMP service protocol support"
288	depends on NETFILTER_ADVANCED
289	select NF_CONNTRACK_BROADCAST
290	help
291	  SNMP service requests are sent as broadcast messages from an
292	  unprivileged port and responded to with unicast messages to the
293	  same port. This make them hard to firewall properly because connection
294	  tracking doesn't deal with broadcasts. This helper tracks locally
295	  originating SNMP service requests and the corresponding
296	  responses. It relies on correct IP address configuration, specifically
297	  netmask and broadcast address.
298
299	  To compile it as a module, choose M here.  If unsure, say N.
300
301config NF_CONNTRACK_PPTP
302	tristate "PPtP protocol support"
303	depends on NETFILTER_ADVANCED
304	select NF_CT_PROTO_GRE
305	help
306	  This module adds support for PPTP (Point to Point Tunnelling
307	  Protocol, RFC2637) connection tracking and NAT.
308
309	  If you are running PPTP sessions over a stateful firewall or NAT
310	  box, you may want to enable this feature.
311
312	  Please note that not all PPTP modes of operation are supported yet.
313	  Specifically these limitations exist:
314	    - Blindly assumes that control connections are always established
315	      in PNS->PAC direction. This is a violation of RFC2637.
316	    - Only supports a single call within each session
317
318	  To compile it as a module, choose M here.  If unsure, say N.
319
320config NF_CONNTRACK_SANE
321	tristate "SANE protocol support"
322	depends on NETFILTER_ADVANCED
323	help
324	  SANE is a protocol for remote access to scanners as implemented
325	  by the 'saned' daemon. Like FTP, it uses separate control and
326	  data connections.
327
328	  With this module you can support SANE on a connection tracking
329	  firewall.
330
331	  To compile it as a module, choose M here.  If unsure, say N.
332
333config NF_CONNTRACK_SIP
334	tristate "SIP protocol support"
335	default m if NETFILTER_ADVANCED=n
336	help
337	  SIP is an application-layer control protocol that can establish,
338	  modify, and terminate multimedia sessions (conferences) such as
339	  Internet telephony calls. With the nf_conntrack_sip and
340	  the nf_nat_sip modules you can support the protocol on a connection
341	  tracking/NATing firewall.
342
343	  To compile it as a module, choose M here.  If unsure, say N.
344
345config NF_CONNTRACK_TFTP
346	tristate "TFTP protocol support"
347	depends on NETFILTER_ADVANCED
348	help
349	  TFTP connection tracking helper, this is required depending
350	  on how restrictive your ruleset is.
351	  If you are using a tftp client behind -j SNAT or -j MASQUERADING
352	  you will need this.
353
354	  To compile it as a module, choose M here.  If unsure, say N.
355
356config NF_CT_NETLINK
357	tristate 'Connection tracking netlink interface'
358	select NETFILTER_NETLINK
359	default m if NETFILTER_ADVANCED=n
360	help
361	  This option enables support for a netlink-based userspace interface
362
363config NF_CT_NETLINK_TIMEOUT
364	tristate  'Connection tracking timeout tuning via Netlink'
365	select NETFILTER_NETLINK
366	depends on NETFILTER_ADVANCED
367	depends on NF_CONNTRACK_TIMEOUT
368	help
369	  This option enables support for connection tracking timeout
370	  fine-grain tuning. This allows you to attach specific timeout
371	  policies to flows, instead of using the global timeout policy.
372
373	  If unsure, say `N'.
374
375config NF_CT_NETLINK_HELPER
376	tristate 'Connection tracking helpers in user-space via Netlink'
377	select NETFILTER_NETLINK
378	depends on NF_CT_NETLINK
379	depends on NETFILTER_NETLINK_QUEUE
380	depends on NETFILTER_NETLINK_GLUE_CT
381	depends on NETFILTER_ADVANCED
382	help
383	  This option enables the user-space connection tracking helpers
384	  infrastructure.
385
386	  If unsure, say `N'.
387
388config NETFILTER_NETLINK_GLUE_CT
389	bool "NFQUEUE and NFLOG integration with Connection Tracking"
390	default n
391	depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
392	help
393	  If this option is enabled, NFQUEUE and NFLOG can include
394	  Connection Tracking information together with the packet is
395	  the enqueued via NFNETLINK.
396
397config NF_NAT
398	tristate "Network Address Translation support"
399	depends on NF_CONNTRACK
400	default m if NETFILTER_ADVANCED=n
401	help
402	  The NAT option allows masquerading, port forwarding and other
403	  forms of full Network Address Port Translation. This can be
404	  controlled by iptables, ip6tables or nft.
405
406config NF_NAT_AMANDA
407	tristate
408	depends on NF_CONNTRACK && NF_NAT
409	default NF_NAT && NF_CONNTRACK_AMANDA
410
411config NF_NAT_FTP
412	tristate
413	depends on NF_CONNTRACK && NF_NAT
414	default NF_NAT && NF_CONNTRACK_FTP
415
416config NF_NAT_IRC
417	tristate
418	depends on NF_CONNTRACK && NF_NAT
419	default NF_NAT && NF_CONNTRACK_IRC
420
421config NF_NAT_SIP
422	tristate
423	depends on NF_CONNTRACK && NF_NAT
424	default NF_NAT && NF_CONNTRACK_SIP
425
426config NF_NAT_TFTP
427	tristate
428	depends on NF_CONNTRACK && NF_NAT
429	default NF_NAT && NF_CONNTRACK_TFTP
430
431config NF_NAT_REDIRECT
432	bool
433
434config NF_NAT_MASQUERADE
435	bool
436
437config NETFILTER_SYNPROXY
438	tristate
439
440endif # NF_CONNTRACK
441
442config NF_TABLES
443	select NETFILTER_NETLINK
444	select LIBCRC32C
445	tristate "Netfilter nf_tables support"
446	help
447	  nftables is the new packet classification framework that intends to
448	  replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
449	  provides a pseudo-state machine with an extensible instruction-set
450	  (also known as expressions) that the userspace 'nft' utility
451	  (https://www.netfilter.org/projects/nftables) uses to build the
452	  rule-set. It also comes with the generic set infrastructure that
453	  allows you to construct mappings between matchings and actions
454	  for performance lookups.
455
456	  To compile it as a module, choose M here.
457
458if NF_TABLES
459config NF_TABLES_INET
460	depends on IPV6
461	select NF_TABLES_IPV4
462	select NF_TABLES_IPV6
463	bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
464	help
465	  This option enables support for a mixed IPv4/IPv6 "inet" table.
466
467config NF_TABLES_NETDEV
468	bool "Netfilter nf_tables netdev tables support"
469	help
470	  This option enables support for the "netdev" table.
471
472config NFT_NUMGEN
473	tristate "Netfilter nf_tables number generator module"
474	help
475	  This option adds the number generator expression used to perform
476	  incremental counting and random numbers bound to a upper limit.
477
478config NFT_CT
479	depends on NF_CONNTRACK
480	tristate "Netfilter nf_tables conntrack module"
481	help
482	  This option adds the "ct" expression that you can use to match
483	  connection tracking information such as the flow state.
484
485config NFT_FLOW_OFFLOAD
486	depends on NF_CONNTRACK && NF_FLOW_TABLE
487	tristate "Netfilter nf_tables hardware flow offload module"
488	help
489	  This option adds the "flow_offload" expression that you can use to
490	  choose what flows are placed into the hardware.
491
492config NFT_COUNTER
493	tristate "Netfilter nf_tables counter module"
494	help
495	  This option adds the "counter" expression that you can use to
496	  include packet and byte counters in a rule.
497
498config NFT_CONNLIMIT
499	tristate "Netfilter nf_tables connlimit module"
500	depends on NF_CONNTRACK
501	depends on NETFILTER_ADVANCED
502	select NETFILTER_CONNCOUNT
503	help
504	  This option adds the "connlimit" expression that you can use to
505	  ratelimit rule matchings per connections.
506
507config NFT_LOG
508	tristate "Netfilter nf_tables log module"
509	help
510	  This option adds the "log" expression that you can use to log
511	  packets matching some criteria.
512
513config NFT_LIMIT
514	tristate "Netfilter nf_tables limit module"
515	help
516	  This option adds the "limit" expression that you can use to
517	  ratelimit rule matchings.
518
519config NFT_MASQ
520	depends on NF_CONNTRACK
521	depends on NF_NAT
522	select NF_NAT_MASQUERADE
523	tristate "Netfilter nf_tables masquerade support"
524	help
525	  This option adds the "masquerade" expression that you can use
526	  to perform NAT in the masquerade flavour.
527
528config NFT_REDIR
529	depends on NF_CONNTRACK
530	depends on NF_NAT
531	tristate "Netfilter nf_tables redirect support"
532	select NF_NAT_REDIRECT
533	help
534	  This options adds the "redirect" expression that you can use
535	  to perform NAT in the redirect flavour.
536
537config NFT_NAT
538	depends on NF_CONNTRACK
539	select NF_NAT
540	depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
541	tristate "Netfilter nf_tables nat module"
542	help
543	  This option adds the "nat" expression that you can use to perform
544	  typical Network Address Translation (NAT) packet transformations.
545
546config NFT_TUNNEL
547	tristate "Netfilter nf_tables tunnel module"
548	help
549	  This option adds the "tunnel" expression that you can use to set
550	  tunneling policies.
551
552config NFT_OBJREF
553	tristate "Netfilter nf_tables stateful object reference module"
554	help
555	  This option adds the "objref" expression that allows you to refer to
556	  stateful objects, such as counters and quotas.
557
558config NFT_QUEUE
559	depends on NETFILTER_NETLINK_QUEUE
560	tristate "Netfilter nf_tables queue module"
561	help
562	  This is required if you intend to use the userspace queueing
563	  infrastructure (also known as NFQUEUE) from nftables.
564
565config NFT_QUOTA
566	tristate "Netfilter nf_tables quota module"
567	help
568	  This option adds the "quota" expression that you can use to match
569	  enforce bytes quotas.
570
571config NFT_REJECT
572	default m if NETFILTER_ADVANCED=n
573	tristate "Netfilter nf_tables reject support"
574	depends on !NF_TABLES_INET || (IPV6!=m || m)
575	help
576	  This option adds the "reject" expression that you can use to
577	  explicitly deny and notify via TCP reset/ICMP informational errors
578	  unallowed traffic.
579
580config NFT_REJECT_INET
581	depends on NF_TABLES_INET
582	default NFT_REJECT
583	tristate
584
585config NFT_COMPAT
586	depends on NETFILTER_XTABLES
587	tristate "Netfilter x_tables over nf_tables module"
588	help
589	  This is required if you intend to use any of existing
590	  x_tables match/target extensions over the nf_tables
591	  framework.
592
593config NFT_HASH
594	tristate "Netfilter nf_tables hash module"
595	help
596	  This option adds the "hash" expression that you can use to perform
597	  a hash operation on registers.
598
599config NFT_FIB
600	tristate
601
602config NFT_FIB_INET
603	depends on NF_TABLES_INET
604	depends on NFT_FIB_IPV4
605	depends on NFT_FIB_IPV6
606	tristate "Netfilter nf_tables fib inet support"
607	help
608	  This option allows using the FIB expression from the inet table.
609	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
610	  on the protocol of the packet.
611
612config NFT_XFRM
613	tristate "Netfilter nf_tables xfrm/IPSec security association matching"
614	depends on XFRM
615	help
616	  This option adds an expression that you can use to extract properties
617	  of a packets security association.
618
619config NFT_SOCKET
620	tristate "Netfilter nf_tables socket match support"
621	depends on IPV6 || IPV6=n
622	select NF_SOCKET_IPV4
623	select NF_SOCKET_IPV6 if NF_TABLES_IPV6
624	help
625	  This option allows matching for the presence or absence of a
626	  corresponding socket and its attributes.
627
628config NFT_OSF
629	tristate "Netfilter nf_tables passive OS fingerprint support"
630	depends on NETFILTER_ADVANCED
631	select NETFILTER_NETLINK_OSF
632	help
633	  This option allows matching packets from an specific OS.
634
635config NFT_TPROXY
636	tristate "Netfilter nf_tables tproxy support"
637	depends on IPV6 || IPV6=n
638	select NF_DEFRAG_IPV4
639	select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
640	select NF_TPROXY_IPV4
641	select NF_TPROXY_IPV6 if NF_TABLES_IPV6
642	help
643	  This makes transparent proxy support available in nftables.
644
645config NFT_SYNPROXY
646	tristate "Netfilter nf_tables SYNPROXY expression support"
647	depends on NF_CONNTRACK && NETFILTER_ADVANCED
648	select NETFILTER_SYNPROXY
649	select SYN_COOKIES
650	help
651	  The SYNPROXY expression allows you to intercept TCP connections and
652	  establish them using syncookies before they are passed on to the
653	  server. This allows to avoid conntrack and server resource usage
654	  during SYN-flood attacks.
655
656if NF_TABLES_NETDEV
657
658config NF_DUP_NETDEV
659	tristate "Netfilter packet duplication support"
660	help
661	  This option enables the generic packet duplication infrastructure
662	  for Netfilter.
663
664config NFT_DUP_NETDEV
665	tristate "Netfilter nf_tables netdev packet duplication support"
666	select NF_DUP_NETDEV
667	help
668	  This option enables packet duplication for the "netdev" family.
669
670config NFT_FWD_NETDEV
671	tristate "Netfilter nf_tables netdev packet forwarding support"
672	select NF_DUP_NETDEV
673	help
674	  This option enables packet forwarding for the "netdev" family.
675
676config NFT_FIB_NETDEV
677	depends on NFT_FIB_IPV4
678	depends on NFT_FIB_IPV6
679	tristate "Netfilter nf_tables netdev fib lookups support"
680	help
681	  This option allows using the FIB expression from the netdev table.
682	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
683	  on the protocol of the packet.
684
685endif # NF_TABLES_NETDEV
686
687endif # NF_TABLES
688
689config NF_FLOW_TABLE_INET
690	tristate "Netfilter flow table mixed IPv4/IPv6 module"
691	depends on NF_FLOW_TABLE
692	help
693	  This option adds the flow table mixed IPv4/IPv6 support.
694
695	  To compile it as a module, choose M here.
696
697config NF_FLOW_TABLE
698	tristate "Netfilter flow table module"
699	depends on NETFILTER_INGRESS
700	depends on NF_CONNTRACK
701	depends on NF_TABLES
702	help
703	  This option adds the flow table core infrastructure.
704
705	  To compile it as a module, choose M here.
706
707config NETFILTER_XTABLES
708	tristate "Netfilter Xtables support (required for ip_tables)"
709	default m if NETFILTER_ADVANCED=n
710	help
711	  This is required if you intend to use any of ip_tables,
712	  ip6_tables or arp_tables.
713
714if NETFILTER_XTABLES
715
716comment "Xtables combined modules"
717
718config NETFILTER_XT_MARK
719	tristate 'nfmark target and match support'
720	default m if NETFILTER_ADVANCED=n
721	help
722	This option adds the "MARK" target and "mark" match.
723
724	Netfilter mark matching allows you to match packets based on the
725	"nfmark" value in the packet.
726	The target allows you to create rules in the "mangle" table which alter
727	the netfilter mark (nfmark) field associated with the packet.
728
729	Prior to routing, the nfmark can influence the routing method and can
730	also be used by other subsystems to change their behavior.
731
732config NETFILTER_XT_CONNMARK
733	tristate 'ctmark target and match support'
734	depends on NF_CONNTRACK
735	depends on NETFILTER_ADVANCED
736	select NF_CONNTRACK_MARK
737	help
738	This option adds the "CONNMARK" target and "connmark" match.
739
740	Netfilter allows you to store a mark value per connection (a.k.a.
741	ctmark), similarly to the packet mark (nfmark). Using this
742	target and match, you can set and match on this mark.
743
744config NETFILTER_XT_SET
745	tristate 'set target and match support'
746	depends on IP_SET
747	depends on NETFILTER_ADVANCED
748	help
749	  This option adds the "SET" target and "set" match.
750
751	  Using this target and match, you can add/delete and match
752	  elements in the sets created by ipset(8).
753
754	  To compile it as a module, choose M here.  If unsure, say N.
755
756# alphabetically ordered list of targets
757
758comment "Xtables targets"
759
760config NETFILTER_XT_TARGET_AUDIT
761	tristate "AUDIT target support"
762	depends on AUDIT
763	depends on NETFILTER_ADVANCED
764	help
765	  This option adds a 'AUDIT' target, which can be used to create
766	  audit records for packets dropped/accepted.
767
768	  To compileit as a module, choose M here. If unsure, say N.
769
770config NETFILTER_XT_TARGET_CHECKSUM
771	tristate "CHECKSUM target support"
772	depends on IP_NF_MANGLE || IP6_NF_MANGLE
773	depends on NETFILTER_ADVANCED
774	help
775	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
776	  table to work around buggy DHCP clients in virtualized environments.
777
778	  Some old DHCP clients drop packets because they are not aware
779	  that the checksum would normally be offloaded to hardware and
780	  thus should be considered valid.
781	  This target can be used to fill in the checksum using iptables
782	  when such packets are sent via a virtual network device.
783
784	  To compile it as a module, choose M here.  If unsure, say N.
785
786config NETFILTER_XT_TARGET_CLASSIFY
787	tristate '"CLASSIFY" target support'
788	depends on NETFILTER_ADVANCED
789	help
790	  This option adds a `CLASSIFY' target, which enables the user to set
791	  the priority of a packet. Some qdiscs can use this value for
792	  classification, among these are:
793
794  	  atm, cbq, dsmark, pfifo_fast, htb, prio
795
796	  To compile it as a module, choose M here.  If unsure, say N.
797
798config NETFILTER_XT_TARGET_CONNMARK
799	tristate  '"CONNMARK" target support'
800	depends on NF_CONNTRACK
801	depends on NETFILTER_ADVANCED
802	select NETFILTER_XT_CONNMARK
803	help
804	This is a backwards-compat option for the user's convenience
805	(e.g. when running oldconfig). It selects
806	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
807
808config NETFILTER_XT_TARGET_CONNSECMARK
809	tristate '"CONNSECMARK" target support'
810	depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
811	default m if NETFILTER_ADVANCED=n
812	help
813	  The CONNSECMARK target copies security markings from packets
814	  to connections, and restores security markings from connections
815	  to packets (if the packets are not already marked).  This would
816	  normally be used in conjunction with the SECMARK target.
817
818	  To compile it as a module, choose M here.  If unsure, say N.
819
820config NETFILTER_XT_TARGET_CT
821	tristate '"CT" target support'
822	depends on NF_CONNTRACK
823	depends on IP_NF_RAW || IP6_NF_RAW
824	depends on NETFILTER_ADVANCED
825	help
826	  This options adds a `CT' target, which allows to specify initial
827	  connection tracking parameters like events to be delivered and
828	  the helper to be used.
829
830	  To compile it as a module, choose M here.  If unsure, say N.
831
832config NETFILTER_XT_TARGET_DSCP
833	tristate '"DSCP" and "TOS" target support'
834	depends on IP_NF_MANGLE || IP6_NF_MANGLE
835	depends on NETFILTER_ADVANCED
836	help
837	  This option adds a `DSCP' target, which allows you to manipulate
838	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
839
840	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
841
842	  It also adds the "TOS" target, which allows you to create rules in
843	  the "mangle" table which alter the Type Of Service field of an IPv4
844	  or the Priority field of an IPv6 packet, prior to routing.
845
846	  To compile it as a module, choose M here.  If unsure, say N.
847
848config NETFILTER_XT_TARGET_HL
849	tristate '"HL" hoplimit target support'
850	depends on IP_NF_MANGLE || IP6_NF_MANGLE
851	depends on NETFILTER_ADVANCED
852	help
853	This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
854	targets, which enable the user to change the
855	hoplimit/time-to-live value of the IP header.
856
857	While it is safe to decrement the hoplimit/TTL value, the
858	modules also allow to increment and set the hoplimit value of
859	the header to arbitrary values. This is EXTREMELY DANGEROUS
860	since you can easily create immortal packets that loop
861	forever on the network.
862
863config NETFILTER_XT_TARGET_HMARK
864	tristate '"HMARK" target support'
865	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
866	depends on NETFILTER_ADVANCED
867	help
868	This option adds the "HMARK" target.
869
870	The target allows you to create rules in the "raw" and "mangle" tables
871	which set the skbuff mark by means of hash calculation within a given
872	range. The nfmark can influence the routing method and can also be used
873	by other subsystems to change their behaviour.
874
875	To compile it as a module, choose M here. If unsure, say N.
876
877config NETFILTER_XT_TARGET_IDLETIMER
878	tristate  "IDLETIMER target support"
879	depends on NETFILTER_ADVANCED
880	help
881
882	  This option adds the `IDLETIMER' target.  Each matching packet
883	  resets the timer associated with label specified when the rule is
884	  added.  When the timer expires, it triggers a sysfs notification.
885	  The remaining time for expiration can be read via sysfs.
886
887	  To compile it as a module, choose M here.  If unsure, say N.
888
889config NETFILTER_XT_TARGET_LED
890	tristate '"LED" target support'
891	depends on LEDS_CLASS && LEDS_TRIGGERS
892	depends on NETFILTER_ADVANCED
893	help
894	  This option adds a `LED' target, which allows you to blink LEDs in
895	  response to particular packets passing through your machine.
896
897	  This can be used to turn a spare LED into a network activity LED,
898	  which only flashes in response to FTP transfers, for example.  Or
899	  you could have an LED which lights up for a minute or two every time
900	  somebody connects to your machine via SSH.
901
902	  You will need support for the "led" class to make this work.
903
904	  To create an LED trigger for incoming SSH traffic:
905	    iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
906
907	  Then attach the new trigger to an LED on your system:
908	    echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
909
910	  For more information on the LEDs available on your system, see
911	  Documentation/leds/leds-class.rst
912
913config NETFILTER_XT_TARGET_LOG
914	tristate "LOG target support"
915	select NF_LOG_COMMON
916	select NF_LOG_IPV4
917	select NF_LOG_IPV6 if IP6_NF_IPTABLES
918	default m if NETFILTER_ADVANCED=n
919	help
920	  This option adds a `LOG' target, which allows you to create rules in
921	  any iptables table which records the packet header to the syslog.
922
923	  To compile it as a module, choose M here.  If unsure, say N.
924
925config NETFILTER_XT_TARGET_MARK
926	tristate '"MARK" target support'
927	depends on NETFILTER_ADVANCED
928	select NETFILTER_XT_MARK
929	help
930	This is a backwards-compat option for the user's convenience
931	(e.g. when running oldconfig). It selects
932	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
933
934config NETFILTER_XT_NAT
935	tristate '"SNAT and DNAT" targets support'
936	depends on NF_NAT
937	help
938	This option enables the SNAT and DNAT targets.
939
940	To compile it as a module, choose M here. If unsure, say N.
941
942config NETFILTER_XT_TARGET_NETMAP
943	tristate '"NETMAP" target support'
944	depends on NF_NAT
945	help
946	NETMAP is an implementation of static 1:1 NAT mapping of network
947	addresses. It maps the network address part, while keeping the host
948	address part intact.
949
950	To compile it as a module, choose M here. If unsure, say N.
951
952config NETFILTER_XT_TARGET_NFLOG
953	tristate '"NFLOG" target support'
954	default m if NETFILTER_ADVANCED=n
955	select NETFILTER_NETLINK_LOG
956	help
957	  This option enables the NFLOG target, which allows to LOG
958	  messages through nfnetlink_log.
959
960	  To compile it as a module, choose M here.  If unsure, say N.
961
962config NETFILTER_XT_TARGET_NFQUEUE
963	tristate '"NFQUEUE" target Support'
964	depends on NETFILTER_ADVANCED
965	select NETFILTER_NETLINK_QUEUE
966	help
967	  This target replaced the old obsolete QUEUE target.
968
969	  As opposed to QUEUE, it supports 65535 different queues,
970	  not just one.
971
972	  To compile it as a module, choose M here.  If unsure, say N.
973
974config NETFILTER_XT_TARGET_NOTRACK
975	tristate  '"NOTRACK" target support (DEPRECATED)'
976	depends on NF_CONNTRACK
977	depends on IP_NF_RAW || IP6_NF_RAW
978	depends on NETFILTER_ADVANCED
979	select NETFILTER_XT_TARGET_CT
980
981config NETFILTER_XT_TARGET_RATEEST
982	tristate '"RATEEST" target support'
983	depends on NETFILTER_ADVANCED
984	help
985	  This option adds a `RATEEST' target, which allows to measure
986	  rates similar to TC estimators. The `rateest' match can be
987	  used to match on the measured rates.
988
989	  To compile it as a module, choose M here.  If unsure, say N.
990
991config NETFILTER_XT_TARGET_REDIRECT
992	tristate "REDIRECT target support"
993	depends on NF_NAT
994	select NF_NAT_REDIRECT
995	help
996	REDIRECT is a special case of NAT: all incoming connections are
997	mapped onto the incoming interface's address, causing the packets to
998	come to the local machine instead of passing through. This is
999	useful for transparent proxies.
1000
1001	To compile it as a module, choose M here. If unsure, say N.
1002
1003config NETFILTER_XT_TARGET_MASQUERADE
1004	tristate "MASQUERADE target support"
1005	depends on NF_NAT
1006	default m if NETFILTER_ADVANCED=n
1007	select NF_NAT_MASQUERADE
1008	help
1009	  Masquerading is a special case of NAT: all outgoing connections are
1010	  changed to seem to come from a particular interface's address, and
1011	  if the interface goes down, those connections are lost.  This is
1012	  only useful for dialup accounts with dynamic IP address (ie. your IP
1013	  address will be different on next dialup).
1014
1015	  To compile it as a module, choose M here.  If unsure, say N.
1016
1017config NETFILTER_XT_TARGET_TEE
1018	tristate '"TEE" - packet cloning to alternate destination'
1019	depends on NETFILTER_ADVANCED
1020	depends on IPV6 || IPV6=n
1021	depends on !NF_CONNTRACK || NF_CONNTRACK
1022	depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1023	select NF_DUP_IPV4
1024	select NF_DUP_IPV6 if IP6_NF_IPTABLES
1025	help
1026	This option adds a "TEE" target with which a packet can be cloned and
1027	this clone be rerouted to another nexthop.
1028
1029config NETFILTER_XT_TARGET_TPROXY
1030	tristate '"TPROXY" target transparent proxying support'
1031	depends on NETFILTER_XTABLES
1032	depends on NETFILTER_ADVANCED
1033	depends on IPV6 || IPV6=n
1034	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1035	depends on IP_NF_MANGLE
1036	select NF_DEFRAG_IPV4
1037	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1038	select NF_TPROXY_IPV4
1039	select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1040	help
1041	  This option adds a `TPROXY' target, which is somewhat similar to
1042	  REDIRECT.  It can only be used in the mangle table and is useful
1043	  to redirect traffic to a transparent proxy.  It does _not_ depend
1044	  on Netfilter connection tracking and NAT, unlike REDIRECT.
1045	  For it to work you will have to configure certain iptables rules
1046	  and use policy routing. For more information on how to set it up
1047	  see Documentation/networking/tproxy.rst.
1048
1049	  To compile it as a module, choose M here.  If unsure, say N.
1050
1051config NETFILTER_XT_TARGET_TRACE
1052	tristate  '"TRACE" target support'
1053	depends on IP_NF_RAW || IP6_NF_RAW
1054	depends on NETFILTER_ADVANCED
1055	help
1056	  The TRACE target allows you to mark packets so that the kernel
1057	  will log every rule which match the packets as those traverse
1058	  the tables, chains, rules.
1059
1060	  If you want to compile it as a module, say M here and read
1061	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1062
1063config NETFILTER_XT_TARGET_SECMARK
1064	tristate '"SECMARK" target support'
1065	depends on NETWORK_SECMARK
1066	default m if NETFILTER_ADVANCED=n
1067	help
1068	  The SECMARK target allows security marking of network
1069	  packets, for use with security subsystems.
1070
1071	  To compile it as a module, choose M here.  If unsure, say N.
1072
1073config NETFILTER_XT_TARGET_TCPMSS
1074	tristate '"TCPMSS" target support'
1075	depends on IPV6 || IPV6=n
1076	default m if NETFILTER_ADVANCED=n
1077	help
1078	  This option adds a `TCPMSS' target, which allows you to alter the
1079	  MSS value of TCP SYN packets, to control the maximum size for that
1080	  connection (usually limiting it to your outgoing interface's MTU
1081	  minus 40).
1082
1083	  This is used to overcome criminally braindead ISPs or servers which
1084	  block ICMP Fragmentation Needed packets.  The symptoms of this
1085	  problem are that everything works fine from your Linux
1086	  firewall/router, but machines behind it can never exchange large
1087	  packets:
1088	        1) Web browsers connect, then hang with no data received.
1089	        2) Small mail works fine, but large emails hang.
1090	        3) ssh works fine, but scp hangs after initial handshaking.
1091
1092	  Workaround: activate this option and add a rule to your firewall
1093	  configuration like:
1094
1095	  iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1096	                 -j TCPMSS --clamp-mss-to-pmtu
1097
1098	  To compile it as a module, choose M here.  If unsure, say N.
1099
1100config NETFILTER_XT_TARGET_TCPOPTSTRIP
1101	tristate '"TCPOPTSTRIP" target support'
1102	depends on IP_NF_MANGLE || IP6_NF_MANGLE
1103	depends on NETFILTER_ADVANCED
1104	help
1105	  This option adds a "TCPOPTSTRIP" target, which allows you to strip
1106	  TCP options from TCP packets.
1107
1108# alphabetically ordered list of matches
1109
1110comment "Xtables matches"
1111
1112config NETFILTER_XT_MATCH_ADDRTYPE
1113	tristate '"addrtype" address type match support'
1114	default m if NETFILTER_ADVANCED=n
1115	help
1116	  This option allows you to match what routing thinks of an address,
1117	  eg. UNICAST, LOCAL, BROADCAST, ...
1118
1119	  If you want to compile it as a module, say M here and read
1120	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1121
1122config NETFILTER_XT_MATCH_BPF
1123	tristate '"bpf" match support'
1124	depends on NETFILTER_ADVANCED
1125	help
1126	  BPF matching applies a linux socket filter to each packet and
1127	  accepts those for which the filter returns non-zero.
1128
1129	  To compile it as a module, choose M here.  If unsure, say N.
1130
1131config NETFILTER_XT_MATCH_CGROUP
1132	tristate '"control group" match support'
1133	depends on NETFILTER_ADVANCED
1134	depends on CGROUPS
1135	select CGROUP_NET_CLASSID
1136	help
1137	Socket/process control group matching allows you to match locally
1138	generated packets based on which net_cls control group processes
1139	belong to.
1140
1141config NETFILTER_XT_MATCH_CLUSTER
1142	tristate '"cluster" match support'
1143	depends on NF_CONNTRACK
1144	depends on NETFILTER_ADVANCED
1145	help
1146	  This option allows you to build work-load-sharing clusters of
1147	  network servers/stateful firewalls without having a dedicated
1148	  load-balancing router/server/switch. Basically, this match returns
1149	  true when the packet must be handled by this cluster node. Thus,
1150	  all nodes see all packets and this match decides which node handles
1151	  what packets. The work-load sharing algorithm is based on source
1152	  address hashing.
1153
1154	  If you say Y or M here, try `iptables -m cluster --help` for
1155	  more information.
1156
1157config NETFILTER_XT_MATCH_COMMENT
1158	tristate  '"comment" match support'
1159	depends on NETFILTER_ADVANCED
1160	help
1161	  This option adds a `comment' dummy-match, which allows you to put
1162	  comments in your iptables ruleset.
1163
1164	  If you want to compile it as a module, say M here and read
1165	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1166
1167config NETFILTER_XT_MATCH_CONNBYTES
1168	tristate  '"connbytes" per-connection counter match support'
1169	depends on NF_CONNTRACK
1170	depends on NETFILTER_ADVANCED
1171	help
1172	  This option adds a `connbytes' match, which allows you to match the
1173	  number of bytes and/or packets for each direction within a connection.
1174
1175	  If you want to compile it as a module, say M here and read
1176	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1177
1178config NETFILTER_XT_MATCH_CONNLABEL
1179	tristate '"connlabel" match support'
1180	select NF_CONNTRACK_LABELS
1181	depends on NF_CONNTRACK
1182	depends on NETFILTER_ADVANCED
1183	help
1184	  This match allows you to test and assign userspace-defined labels names
1185	  to a connection.  The kernel only stores bit values - mapping
1186	  names to bits is done by userspace.
1187
1188	  Unlike connmark, more than 32 flag bits may be assigned to a
1189	  connection simultaneously.
1190
1191config NETFILTER_XT_MATCH_CONNLIMIT
1192	tristate '"connlimit" match support'
1193	depends on NF_CONNTRACK
1194	depends on NETFILTER_ADVANCED
1195	select NETFILTER_CONNCOUNT
1196	help
1197	  This match allows you to match against the number of parallel
1198	  connections to a server per client IP address (or address block).
1199
1200config NETFILTER_XT_MATCH_CONNMARK
1201	tristate  '"connmark" connection mark match support'
1202	depends on NF_CONNTRACK
1203	depends on NETFILTER_ADVANCED
1204	select NETFILTER_XT_CONNMARK
1205	help
1206	This is a backwards-compat option for the user's convenience
1207	(e.g. when running oldconfig). It selects
1208	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1209
1210config NETFILTER_XT_MATCH_CONNTRACK
1211	tristate '"conntrack" connection tracking match support'
1212	depends on NF_CONNTRACK
1213	default m if NETFILTER_ADVANCED=n
1214	help
1215	  This is a general conntrack match module, a superset of the state match.
1216
1217	  It allows matching on additional conntrack information, which is
1218	  useful in complex configurations, such as NAT gateways with multiple
1219	  internet links or tunnels.
1220
1221	  To compile it as a module, choose M here.  If unsure, say N.
1222
1223config NETFILTER_XT_MATCH_CPU
1224	tristate '"cpu" match support'
1225	depends on NETFILTER_ADVANCED
1226	help
1227	  CPU matching allows you to match packets based on the CPU
1228	  currently handling the packet.
1229
1230	  To compile it as a module, choose M here.  If unsure, say N.
1231
1232config NETFILTER_XT_MATCH_DCCP
1233	tristate '"dccp" protocol match support'
1234	depends on NETFILTER_ADVANCED
1235	default IP_DCCP
1236	help
1237	  With this option enabled, you will be able to use the iptables
1238	  `dccp' match in order to match on DCCP source/destination ports
1239	  and DCCP flags.
1240
1241	  If you want to compile it as a module, say M here and read
1242	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1243
1244config NETFILTER_XT_MATCH_DEVGROUP
1245	tristate '"devgroup" match support'
1246	depends on NETFILTER_ADVANCED
1247	help
1248	  This options adds a `devgroup' match, which allows to match on the
1249	  device group a network device is assigned to.
1250
1251	  To compile it as a module, choose M here.  If unsure, say N.
1252
1253config NETFILTER_XT_MATCH_DSCP
1254	tristate '"dscp" and "tos" match support'
1255	depends on NETFILTER_ADVANCED
1256	help
1257	  This option adds a `DSCP' match, which allows you to match against
1258	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1259
1260	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
1261
1262	  It will also add a "tos" match, which allows you to match packets
1263	  based on the Type Of Service fields of the IPv4 packet (which share
1264	  the same bits as DSCP).
1265
1266	  To compile it as a module, choose M here.  If unsure, say N.
1267
1268config NETFILTER_XT_MATCH_ECN
1269	tristate '"ecn" match support'
1270	depends on NETFILTER_ADVANCED
1271	help
1272	This option adds an "ECN" match, which allows you to match against
1273	the IPv4 and TCP header ECN fields.
1274
1275	To compile it as a module, choose M here. If unsure, say N.
1276
1277config NETFILTER_XT_MATCH_ESP
1278	tristate '"esp" match support'
1279	depends on NETFILTER_ADVANCED
1280	help
1281	  This match extension allows you to match a range of SPIs
1282	  inside ESP header of IPSec packets.
1283
1284	  To compile it as a module, choose M here.  If unsure, say N.
1285
1286config NETFILTER_XT_MATCH_HASHLIMIT
1287	tristate '"hashlimit" match support'
1288	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1289	depends on NETFILTER_ADVANCED
1290	help
1291	  This option adds a `hashlimit' match.
1292
1293	  As opposed to `limit', this match dynamically creates a hash table
1294	  of limit buckets, based on your selection of source/destination
1295	  addresses and/or ports.
1296
1297	  It enables you to express policies like `10kpps for any given
1298	  destination address' or `500pps from any given source address'
1299	  with a single rule.
1300
1301config NETFILTER_XT_MATCH_HELPER
1302	tristate '"helper" match support'
1303	depends on NF_CONNTRACK
1304	depends on NETFILTER_ADVANCED
1305	help
1306	  Helper matching allows you to match packets in dynamic connections
1307	  tracked by a conntrack-helper, ie. nf_conntrack_ftp
1308
1309	  To compile it as a module, choose M here.  If unsure, say Y.
1310
1311config NETFILTER_XT_MATCH_HL
1312	tristate '"hl" hoplimit/TTL match support'
1313	depends on NETFILTER_ADVANCED
1314	help
1315	HL matching allows you to match packets based on the hoplimit
1316	in the IPv6 header, or the time-to-live field in the IPv4
1317	header of the packet.
1318
1319config NETFILTER_XT_MATCH_IPCOMP
1320	tristate '"ipcomp" match support'
1321	depends on NETFILTER_ADVANCED
1322	help
1323	  This match extension allows you to match a range of CPIs(16 bits)
1324	  inside IPComp header of IPSec packets.
1325
1326	  To compile it as a module, choose M here.  If unsure, say N.
1327
1328config NETFILTER_XT_MATCH_IPRANGE
1329	tristate '"iprange" address range match support'
1330	depends on NETFILTER_ADVANCED
1331	help
1332	This option adds a "iprange" match, which allows you to match based on
1333	an IP address range. (Normal iptables only matches on single addresses
1334	with an optional mask.)
1335
1336	If unsure, say M.
1337
1338config NETFILTER_XT_MATCH_IPVS
1339	tristate '"ipvs" match support'
1340	depends on IP_VS
1341	depends on NETFILTER_ADVANCED
1342	depends on NF_CONNTRACK
1343	help
1344	  This option allows you to match against IPVS properties of a packet.
1345
1346	  If unsure, say N.
1347
1348config NETFILTER_XT_MATCH_L2TP
1349	tristate '"l2tp" match support'
1350	depends on NETFILTER_ADVANCED
1351	default L2TP
1352	help
1353	This option adds an "L2TP" match, which allows you to match against
1354	L2TP protocol header fields.
1355
1356	To compile it as a module, choose M here. If unsure, say N.
1357
1358config NETFILTER_XT_MATCH_LENGTH
1359	tristate '"length" match support'
1360	depends on NETFILTER_ADVANCED
1361	help
1362	  This option allows you to match the length of a packet against a
1363	  specific value or range of values.
1364
1365	  To compile it as a module, choose M here.  If unsure, say N.
1366
1367config NETFILTER_XT_MATCH_LIMIT
1368	tristate '"limit" match support'
1369	depends on NETFILTER_ADVANCED
1370	help
1371	  limit matching allows you to control the rate at which a rule can be
1372	  matched: mainly useful in combination with the LOG target ("LOG
1373	  target support", below) and to avoid some Denial of Service attacks.
1374
1375	  To compile it as a module, choose M here.  If unsure, say N.
1376
1377config NETFILTER_XT_MATCH_MAC
1378	tristate '"mac" address match support'
1379	depends on NETFILTER_ADVANCED
1380	help
1381	  MAC matching allows you to match packets based on the source
1382	  Ethernet address of the packet.
1383
1384	  To compile it as a module, choose M here.  If unsure, say N.
1385
1386config NETFILTER_XT_MATCH_MARK
1387	tristate '"mark" match support'
1388	depends on NETFILTER_ADVANCED
1389	select NETFILTER_XT_MARK
1390	help
1391	This is a backwards-compat option for the user's convenience
1392	(e.g. when running oldconfig). It selects
1393	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1394
1395config NETFILTER_XT_MATCH_MULTIPORT
1396	tristate '"multiport" Multiple port match support'
1397	depends on NETFILTER_ADVANCED
1398	help
1399	  Multiport matching allows you to match TCP or UDP packets based on
1400	  a series of source or destination ports: normally a rule can only
1401	  match a single range of ports.
1402
1403	  To compile it as a module, choose M here.  If unsure, say N.
1404
1405config NETFILTER_XT_MATCH_NFACCT
1406	tristate '"nfacct" match support'
1407	depends on NETFILTER_ADVANCED
1408	select NETFILTER_NETLINK_ACCT
1409	help
1410	  This option allows you to use the extended accounting through
1411	  nfnetlink_acct.
1412
1413	  To compile it as a module, choose M here.  If unsure, say N.
1414
1415config NETFILTER_XT_MATCH_OSF
1416	tristate '"osf" Passive OS fingerprint match'
1417	depends on NETFILTER_ADVANCED
1418	select NETFILTER_NETLINK_OSF
1419	help
1420	  This option selects the Passive OS Fingerprinting match module
1421	  that allows to passively match the remote operating system by
1422	  analyzing incoming TCP SYN packets.
1423
1424	  Rules and loading software can be downloaded from
1425	  http://www.ioremap.net/projects/osf
1426
1427	  To compile it as a module, choose M here.  If unsure, say N.
1428
1429config NETFILTER_XT_MATCH_OWNER
1430	tristate '"owner" match support'
1431	depends on NETFILTER_ADVANCED
1432	help
1433	Socket owner matching allows you to match locally-generated packets
1434	based on who created the socket: the user or group. It is also
1435	possible to check whether a socket actually exists.
1436
1437config NETFILTER_XT_MATCH_POLICY
1438	tristate 'IPsec "policy" match support'
1439	depends on XFRM
1440	default m if NETFILTER_ADVANCED=n
1441	help
1442	  Policy matching allows you to match packets based on the
1443	  IPsec policy that was used during decapsulation/will
1444	  be used during encapsulation.
1445
1446	  To compile it as a module, choose M here.  If unsure, say N.
1447
1448config NETFILTER_XT_MATCH_PHYSDEV
1449	tristate '"physdev" match support'
1450	depends on BRIDGE && BRIDGE_NETFILTER
1451	depends on NETFILTER_ADVANCED
1452	help
1453	  Physdev packet matching matches against the physical bridge ports
1454	  the IP packet arrived on or will leave by.
1455
1456	  To compile it as a module, choose M here.  If unsure, say N.
1457
1458config NETFILTER_XT_MATCH_PKTTYPE
1459	tristate '"pkttype" packet type match support'
1460	depends on NETFILTER_ADVANCED
1461	help
1462	  Packet type matching allows you to match a packet by
1463	  its "class", eg. BROADCAST, MULTICAST, ...
1464
1465	  Typical usage:
1466	  iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1467
1468	  To compile it as a module, choose M here.  If unsure, say N.
1469
1470config NETFILTER_XT_MATCH_QUOTA
1471	tristate '"quota" match support'
1472	depends on NETFILTER_ADVANCED
1473	help
1474	  This option adds a `quota' match, which allows to match on a
1475	  byte counter.
1476
1477	  If you want to compile it as a module, say M here and read
1478	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1479
1480config NETFILTER_XT_MATCH_RATEEST
1481	tristate '"rateest" match support'
1482	depends on NETFILTER_ADVANCED
1483	select NETFILTER_XT_TARGET_RATEEST
1484	help
1485	  This option adds a `rateest' match, which allows to match on the
1486	  rate estimated by the RATEEST target.
1487
1488	  To compile it as a module, choose M here.  If unsure, say N.
1489
1490config NETFILTER_XT_MATCH_REALM
1491	tristate  '"realm" match support'
1492	depends on NETFILTER_ADVANCED
1493	select IP_ROUTE_CLASSID
1494	help
1495	  This option adds a `realm' match, which allows you to use the realm
1496	  key from the routing subsystem inside iptables.
1497
1498	  This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1499	  in tc world.
1500
1501	  If you want to compile it as a module, say M here and read
1502	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1503
1504config NETFILTER_XT_MATCH_RECENT
1505	tristate '"recent" match support'
1506	depends on NETFILTER_ADVANCED
1507	help
1508	This match is used for creating one or many lists of recently
1509	used addresses and then matching against that/those list(s).
1510
1511	Short options are available by using 'iptables -m recent -h'
1512	Official Website: <http://snowman.net/projects/ipt_recent/>
1513
1514config NETFILTER_XT_MATCH_SCTP
1515	tristate  '"sctp" protocol match support'
1516	depends on NETFILTER_ADVANCED
1517	default IP_SCTP
1518	help
1519	  With this option enabled, you will be able to use the
1520	  `sctp' match in order to match on SCTP source/destination ports
1521	  and SCTP chunk types.
1522
1523	  If you want to compile it as a module, say M here and read
1524	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1525
1526config NETFILTER_XT_MATCH_SOCKET
1527	tristate '"socket" match support'
1528	depends on NETFILTER_XTABLES
1529	depends on NETFILTER_ADVANCED
1530	depends on IPV6 || IPV6=n
1531	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1532	select NF_SOCKET_IPV4
1533	select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1534	select NF_DEFRAG_IPV4
1535	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1536	help
1537	  This option adds a `socket' match, which can be used to match
1538	  packets for which a TCP or UDP socket lookup finds a valid socket.
1539	  It can be used in combination with the MARK target and policy
1540	  routing to implement full featured non-locally bound sockets.
1541
1542	  To compile it as a module, choose M here.  If unsure, say N.
1543
1544config NETFILTER_XT_MATCH_STATE
1545	tristate '"state" match support'
1546	depends on NF_CONNTRACK
1547	default m if NETFILTER_ADVANCED=n
1548	help
1549	  Connection state matching allows you to match packets based on their
1550	  relationship to a tracked connection (ie. previous packets).  This
1551	  is a powerful tool for packet classification.
1552
1553	  To compile it as a module, choose M here.  If unsure, say N.
1554
1555config NETFILTER_XT_MATCH_STATISTIC
1556	tristate '"statistic" match support'
1557	depends on NETFILTER_ADVANCED
1558	help
1559	  This option adds a `statistic' match, which allows you to match
1560	  on packets periodically or randomly with a given percentage.
1561
1562	  To compile it as a module, choose M here.  If unsure, say N.
1563
1564config NETFILTER_XT_MATCH_STRING
1565	tristate  '"string" match support'
1566	depends on NETFILTER_ADVANCED
1567	select TEXTSEARCH
1568	select TEXTSEARCH_KMP
1569	select TEXTSEARCH_BM
1570	select TEXTSEARCH_FSM
1571	help
1572	  This option adds a `string' match, which allows you to look for
1573	  pattern matchings in packets.
1574
1575	  To compile it as a module, choose M here.  If unsure, say N.
1576
1577config NETFILTER_XT_MATCH_TCPMSS
1578	tristate '"tcpmss" match support'
1579	depends on NETFILTER_ADVANCED
1580	help
1581	  This option adds a `tcpmss' match, which allows you to examine the
1582	  MSS value of TCP SYN packets, which control the maximum packet size
1583	  for that connection.
1584
1585	  To compile it as a module, choose M here.  If unsure, say N.
1586
1587config NETFILTER_XT_MATCH_TIME
1588	tristate '"time" match support'
1589	depends on NETFILTER_ADVANCED
1590	help
1591	  This option adds a "time" match, which allows you to match based on
1592	  the packet arrival time (at the machine which netfilter is running)
1593	  on) or departure time/date (for locally generated packets).
1594
1595	  If you say Y here, try `iptables -m time --help` for
1596	  more information.
1597
1598	  If you want to compile it as a module, say M here.
1599	  If unsure, say N.
1600
1601config NETFILTER_XT_MATCH_U32
1602	tristate '"u32" match support'
1603	depends on NETFILTER_ADVANCED
1604	help
1605	  u32 allows you to extract quantities of up to 4 bytes from a packet,
1606	  AND them with specified masks, shift them by specified amounts and
1607	  test whether the results are in any of a set of specified ranges.
1608	  The specification of what to extract is general enough to skip over
1609	  headers with lengths stored in the packet, as in IP or TCP header
1610	  lengths.
1611
1612	  Details and examples are in the kernel module source.
1613
1614endif # NETFILTER_XTABLES
1615
1616endmenu
1617
1618source "net/netfilter/ipset/Kconfig"
1619
1620source "net/netfilter/ipvs/Kconfig"
1621