net/netfilter/Kconfig

   1 menu "Core Netfilter Configuration"
   2         depends on NET && INET && NETFILTER
   3
   4 config NETFILTER_NETLINK
   5         tristate
   6
   7 config NETFILTER_NETLINK_ACCT
   8 tristate "Netfilter NFACCT over NFNETLINK interface"
   9         depends on NETFILTER_ADVANCED
  10         select NETFILTER_NETLINK
  11         help
  12           If this option is enabled, the kernel will include support
  13           for extended accounting via NFNETLINK.
  14
  15 config NETFILTER_NETLINK_QUEUE
  16         tristate "Netfilter NFQUEUE over NFNETLINK interface"
  17         depends on NETFILTER_ADVANCED
  18         select NETFILTER_NETLINK
  19         help
  20           If this option is enabled, the kernel will include support
  21           for queueing packets via NFNETLINK.
  22
  23 config NETFILTER_NETLINK_LOG
  24         tristate "Netfilter LOG over NFNETLINK interface"
  25         default m if NETFILTER_ADVANCED=n
  26         select NETFILTER_NETLINK
  27         help
  28           If this option is enabled, the kernel will include support
  29           for logging packets via NFNETLINK.
  30
  31           This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
  32           and is also scheduled to replace the old syslog-based ipt_LOG
  33           and ip6t_LOG modules.
  34
  35 config NF_CONNTRACK
  36         tristate "Netfilter connection tracking support"
  37         default m if NETFILTER_ADVANCED=n
  38         help
  39           Connection tracking keeps a record of what packets have passed
  40           through your machine, in order to figure out how they are related
  41           into connections.
  42
  43           This is required to do Masquerading or other kinds of Network
  44           Address Translation.  It can also be used to enhance packet
  45           filtering (see `Connection state match support' below).
  46
  47           To compile it as a module, choose M here.  If unsure, say N.
  48
  49 if NF_CONNTRACK
  50
  51 config NF_CONNTRACK_MARK
  52         bool  'Connection mark tracking support'
  53         depends on NETFILTER_ADVANCED
  54         help
  55           This option enables support for connection marks, used by the
  56           `CONNMARK' target and `connmark' match. Similar to the mark value
  57           of packets, but this mark value is kept in the conntrack session
  58           instead of the individual packets.
  59
  60 config NF_CONNTRACK_SECMARK
  61         bool  'Connection tracking security mark support'
  62         depends on NETWORK_SECMARK
  63         default m if NETFILTER_ADVANCED=n
  64         help
  65           This option enables security markings to be applied to
  66           connections.  Typically they are copied to connections from
  67           packets using the CONNSECMARK target and copied back from
  68           connections to packets with the same target, with the packets
  69           being originally labeled via SECMARK.
  70
  71           If unsure, say 'N'.
  72
  73 config NF_CONNTRACK_ZONES
  74         bool  'Connection tracking zones'
  75         depends on NETFILTER_ADVANCED
  76         depends on NETFILTER_XT_TARGET_CT
  77         help
  78           This option enables support for connection tracking zones.
  79           Normally, each connection needs to have a unique system wide
  80           identity. Connection tracking zones allow to have multiple
  81           connections using the same identity, as long as they are
  82           contained in different zones.
  83
  84           If unsure, say `N'.
  85
  86 config NF_CONNTRACK_PROCFS
  87         bool "Supply CT list in procfs (OBSOLETE)"
  88         default y
  89         depends on PROC_FS
  90         ---help---
  91         This option enables for the list of known conntrack entries
  92         to be shown in procfs under net/netfilter/nf_conntrack. This
  93         is considered obsolete in favor of using the conntrack(8)
  94         tool which uses Netlink.
  95
  96 config NF_CONNTRACK_EVENTS
  97         bool "Connection tracking events"
  98         depends on NETFILTER_ADVANCED
  99         help
 100           If this option is enabled, the connection tracking code will
 101           provide a notifier chain that can be used by other kernel code
 102           to get notified about changes in the connection tracking state.
 103
 104           If unsure, say `N'.
 105
 106 config NF_CONNTRACK_TIMEOUT
 107         bool  'Connection tracking timeout'
 108         depends on NETFILTER_ADVANCED
 109         help
 110           This option enables support for connection tracking timeout
 111           extension. This allows you to attach timeout policies to flow
 112           via the CT target.
 113
 114           If unsure, say `N'.
 115
 116 config NF_CONNTRACK_TIMESTAMP
 117         bool  'Connection tracking timestamping'
 118         depends on NETFILTER_ADVANCED
 119         help
 120           This option enables support for connection tracking timestamping.
 121           This allows you to store the flow start-time and to obtain
 122           the flow-stop time (once it has been destroyed) via Connection
 123           tracking events.
 124
 125           If unsure, say `N'.
 126
 127 config NF_CT_PROTO_DCCP
 128         tristate 'DCCP protocol connection tracking support (EXPERIMENTAL)'
 129         depends on EXPERIMENTAL
 130         depends on NETFILTER_ADVANCED
 131         default IP_DCCP
 132         help
 133           With this option enabled, the layer 3 independent connection
 134           tracking code will be able to do state tracking on DCCP connections.
 135
 136           If unsure, say 'N'.
 137
 138 config NF_CT_PROTO_GRE
 139         tristate
 140
 141 config NF_CT_PROTO_SCTP
 142         tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
 143         depends on EXPERIMENTAL
 144         depends on NETFILTER_ADVANCED
 145         default IP_SCTP
 146         help
 147           With this option enabled, the layer 3 independent connection
 148           tracking code will be able to do state tracking on SCTP connections.
 149
 150           If you want to compile it as a module, say M here and read
 151           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 152
 153 config NF_CT_PROTO_UDPLITE
 154         tristate 'UDP-Lite protocol connection tracking support'
 155         depends on NETFILTER_ADVANCED
 156         help
 157           With this option enabled, the layer 3 independent connection
 158           tracking code will be able to do state tracking on UDP-Lite
 159           connections.
 160
 161           To compile it as a module, choose M here.  If unsure, say N.
 162
 163 config NF_CONNTRACK_AMANDA
 164         tristate "Amanda backup protocol support"
 165         depends on NETFILTER_ADVANCED
 166         select TEXTSEARCH
 167         select TEXTSEARCH_KMP
 168         help
 169           If you are running the Amanda backup package <http://www.amanda.org/>
 170           on this machine or machines that will be MASQUERADED through this
 171           machine, then you may want to enable this feature.  This allows the
 172           connection tracking and natting code to allow the sub-channels that
 173           Amanda requires for communication of the backup data, messages and
 174           index.
 175
 176           To compile it as a module, choose M here.  If unsure, say N.
 177
 178 config NF_CONNTRACK_FTP
 179         tristate "FTP protocol support"
 180         default m if NETFILTER_ADVANCED=n
 181         help
 182           Tracking FTP connections is problematic: special helpers are
 183           required for tracking them, and doing masquerading and other forms
 184           of Network Address Translation on them.
 185
 186           This is FTP support on Layer 3 independent connection tracking.
 187           Layer 3 independent connection tracking is experimental scheme
 188           which generalize ip_conntrack to support other layer 3 protocols.
 189
 190           To compile it as a module, choose M here.  If unsure, say N.
 191
 192 config NF_CONNTRACK_H323
 193         tristate "H.323 protocol support"
 194         depends on (IPV6 || IPV6=n)
 195         depends on NETFILTER_ADVANCED
 196         help
 197           H.323 is a VoIP signalling protocol from ITU-T. As one of the most
 198           important VoIP protocols, it is widely used by voice hardware and
 199           software including voice gateways, IP phones, Netmeeting, OpenPhone,
 200           Gnomemeeting, etc.
 201
 202           With this module you can support H.323 on a connection tracking/NAT
 203           firewall.
 204
 205           This module supports RAS, Fast Start, H.245 Tunnelling, Call
 206           Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
 207           whiteboard, file transfer, etc. For more information, please
 208           visit http://nath323.sourceforge.net/.
 209
 210           To compile it as a module, choose M here.  If unsure, say N.
 211
 212 config NF_CONNTRACK_IRC
 213         tristate "IRC protocol support"
 214         default m if NETFILTER_ADVANCED=n
 215         help
 216           There is a commonly-used extension to IRC called
 217           Direct Client-to-Client Protocol (DCC).  This enables users to send
 218           files to each other, and also chat to each other without the need
 219           of a server.  DCC Sending is used anywhere you send files over IRC,
 220           and DCC Chat is most commonly used by Eggdrop bots.  If you are
 221           using NAT, this extension will enable you to send files and initiate
 222           chats.  Note that you do NOT need this extension to get files or
 223           have others initiate chats, or everything else in IRC.
 224
 225           To compile it as a module, choose M here.  If unsure, say N.
 226
 227 config NF_CONNTRACK_BROADCAST
 228         tristate
 229
 230 config NF_CONNTRACK_NETBIOS_NS
 231         tristate "NetBIOS name service protocol support"
 232         select NF_CONNTRACK_BROADCAST
 233         help
 234           NetBIOS name service requests are sent as broadcast messages from an
 235           unprivileged port and responded to with unicast messages to the
 236           same port. This make them hard to firewall properly because connection
 237           tracking doesn't deal with broadcasts. This helper tracks locally
 238           originating NetBIOS name service requests and the corresponding
 239           responses. It relies on correct IP address configuration, specifically
 240           netmask and broadcast address. When properly configured, the output
 241           of "ip address show" should look similar to this:
 242
 243           $ ip -4 address show eth0
 244           4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
 245               inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
 246
 247           To compile it as a module, choose M here.  If unsure, say N.
 248
 249 config NF_CONNTRACK_SNMP
 250         tristate "SNMP service protocol support"
 251         depends on NETFILTER_ADVANCED
 252         select NF_CONNTRACK_BROADCAST
 253         help
 254           SNMP service requests are sent as broadcast messages from an
 255           unprivileged port and responded to with unicast messages to the
 256           same port. This make them hard to firewall properly because connection
 257           tracking doesn't deal with broadcasts. This helper tracks locally
 258           originating SNMP service requests and the corresponding
 259           responses. It relies on correct IP address configuration, specifically
 260           netmask and broadcast address.
 261
 262           To compile it as a module, choose M here.  If unsure, say N.
 263
 264 config NF_CONNTRACK_PPTP
 265         tristate "PPtP protocol support"
 266         depends on NETFILTER_ADVANCED
 267         select NF_CT_PROTO_GRE
 268         help
 269           This module adds support for PPTP (Point to Point Tunnelling
 270           Protocol, RFC2637) connection tracking and NAT.
 271
 272           If you are running PPTP sessions over a stateful firewall or NAT
 273           box, you may want to enable this feature.
 274
 275           Please note that not all PPTP modes of operation are supported yet.
 276           Specifically these limitations exist:
 277             - Blindly assumes that control connections are always established
 278               in PNS->PAC direction. This is a violation of RFC2637.
 279             - Only supports a single call within each session
 280
 281           To compile it as a module, choose M here.  If unsure, say N.
 282
 283 config NF_CONNTRACK_SANE
 284         tristate "SANE protocol support (EXPERIMENTAL)"
 285         depends on EXPERIMENTAL
 286         depends on NETFILTER_ADVANCED
 287         help
 288           SANE is a protocol for remote access to scanners as implemented
 289           by the 'saned' daemon. Like FTP, it uses separate control and
 290           data connections.
 291
 292           With this module you can support SANE on a connection tracking
 293           firewall.
 294
 295           To compile it as a module, choose M here.  If unsure, say N.
 296
 297 config NF_CONNTRACK_SIP
 298         tristate "SIP protocol support"
 299         default m if NETFILTER_ADVANCED=n
 300         help
 301           SIP is an application-layer control protocol that can establish,
 302           modify, and terminate multimedia sessions (conferences) such as
 303           Internet telephony calls. With the ip_conntrack_sip and
 304           the nf_nat_sip modules you can support the protocol on a connection
 305           tracking/NATing firewall.
 306
 307           To compile it as a module, choose M here.  If unsure, say N.
 308
 309 config NF_CONNTRACK_TFTP
 310         tristate "TFTP protocol support"
 311         depends on NETFILTER_ADVANCED
 312         help
 313           TFTP connection tracking helper, this is required depending
 314           on how restrictive your ruleset is.
 315           If you are using a tftp client behind -j SNAT or -j MASQUERADING
 316           you will need this.
 317
 318           To compile it as a module, choose M here.  If unsure, say N.
 319
 320 config NF_CT_NETLINK
 321         tristate 'Connection tracking netlink interface'
 322         select NETFILTER_NETLINK
 323         default m if NETFILTER_ADVANCED=n
 324         help
 325           This option enables support for a netlink-based userspace interface
 326
 327 config NF_CT_NETLINK_TIMEOUT
 328         tristate  'Connection tracking timeout tuning via Netlink'
 329         select NETFILTER_NETLINK
 330         depends on NETFILTER_ADVANCED
 331         help
 332           This option enables support for connection tracking timeout
 333           fine-grain tuning. This allows you to attach specific timeout
 334           policies to flows, instead of using the global timeout policy.
 335
 336           If unsure, say `N'.
 337
 338 config NF_CT_NETLINK_HELPER
 339         tristate 'Connection tracking helpers in user-space via Netlink'
 340         select NETFILTER_NETLINK
 341         depends on NF_CT_NETLINK
 342         depends on NETFILTER_NETLINK_QUEUE
 343         depends on NETFILTER_NETLINK_QUEUE_CT
 344         depends on NETFILTER_ADVANCED
 345         help
 346           This option enables the user-space connection tracking helpers
 347           infrastructure.
 348
 349           If unsure, say `N'.
 350
 351 config NETFILTER_NETLINK_QUEUE_CT
 352         bool "NFQUEUE integration with Connection Tracking"
 353         default n
 354         depends on NETFILTER_NETLINK_QUEUE
 355         help
 356           If this option is enabled, NFQUEUE can include Connection Tracking
 357           information together with the packet is the enqueued via NFNETLINK.
 358
 359 config NF_NAT
 360         tristate
 361
 362 config NF_NAT_NEEDED
 363         bool
 364         depends on NF_NAT
 365         default y
 366
 367 config NF_NAT_PROTO_DCCP
 368         tristate
 369         depends on NF_NAT && NF_CT_PROTO_DCCP
 370         default NF_NAT && NF_CT_PROTO_DCCP
 371
 372 config NF_NAT_PROTO_UDPLITE
 373         tristate
 374         depends on NF_NAT && NF_CT_PROTO_UDPLITE
 375         default NF_NAT && NF_CT_PROTO_UDPLITE
 376
 377 config NF_NAT_PROTO_SCTP
 378         tristate
 379         default NF_NAT && NF_CT_PROTO_SCTP
 380         depends on NF_NAT && NF_CT_PROTO_SCTP
 381         select LIBCRC32C
 382
 383 endif # NF_CONNTRACK
 384
 385 # transparent proxy support
 386 config NETFILTER_TPROXY
 387         tristate "Transparent proxying support (EXPERIMENTAL)"
 388         depends on EXPERIMENTAL
 389         depends on IP_NF_MANGLE
 390         depends on NETFILTER_ADVANCED
 391         help
 392           This option enables transparent proxying support, that is,
 393           support for handling non-locally bound IPv4 TCP and UDP sockets.
 394           For it to work you will have to configure certain iptables rules
 395           and use policy routing. For more information on how to set it up
 396           see Documentation/networking/tproxy.txt.
 397
 398           To compile it as a module, choose M here.  If unsure, say N.
 399
 400 config NETFILTER_XTABLES
 401         tristate "Netfilter Xtables support (required for ip_tables)"
 402         default m if NETFILTER_ADVANCED=n
 403         help
 404           This is required if you intend to use any of ip_tables,
 405           ip6_tables or arp_tables.
 406
 407 if NETFILTER_XTABLES
 408
 409 comment "Xtables combined modules"
 410
 411 config NETFILTER_XT_MARK
 412         tristate 'nfmark target and match support'
 413         default m if NETFILTER_ADVANCED=n
 414         ---help---
 415         This option adds the "MARK" target and "mark" match.
 416
 417         Netfilter mark matching allows you to match packets based on the
 418         "nfmark" value in the packet.
 419         The target allows you to create rules in the "mangle" table which alter
 420         the netfilter mark (nfmark) field associated with the packet.
 421
 422         Prior to routing, the nfmark can influence the routing method (see
 423         "Use netfilter MARK value as routing key") and can also be used by
 424         other subsystems to change their behavior.
 425
 426 config NETFILTER_XT_CONNMARK
 427         tristate 'ctmark target and match support'
 428         depends on NF_CONNTRACK
 429         depends on NETFILTER_ADVANCED
 430         select NF_CONNTRACK_MARK
 431         ---help---
 432         This option adds the "CONNMARK" target and "connmark" match.
 433
 434         Netfilter allows you to store a mark value per connection (a.k.a.
 435         ctmark), similarly to the packet mark (nfmark). Using this
 436         target and match, you can set and match on this mark.
 437
 438 config NETFILTER_XT_SET
 439         tristate 'set target and match support'
 440         depends on IP_SET
 441         depends on NETFILTER_ADVANCED
 442         help
 443           This option adds the "SET" target and "set" match.
 444
 445           Using this target and match, you can add/delete and match
 446           elements in the sets created by ipset(8).
 447
 448           To compile it as a module, choose M here.  If unsure, say N.
 449
 450 # alphabetically ordered list of targets
 451
 452 comment "Xtables targets"
 453
 454 config NETFILTER_XT_TARGET_AUDIT
 455         tristate "AUDIT target support"
 456         depends on AUDIT
 457         depends on NETFILTER_ADVANCED
 458         ---help---
 459           This option adds a 'AUDIT' target, which can be used to create
 460           audit records for packets dropped/accepted.
 461
 462           To compileit as a module, choose M here. If unsure, say N.
 463
 464 config NETFILTER_XT_TARGET_CHECKSUM
 465         tristate "CHECKSUM target support"
 466         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 467         depends on NETFILTER_ADVANCED
 468         ---help---
 469           This option adds a `CHECKSUM' target, which can be used in the iptables mangle
 470           table.
 471
 472           You can use this target to compute and fill in the checksum in
 473           a packet that lacks a checksum.  This is particularly useful,
 474           if you need to work around old applications such as dhcp clients,
 475           that do not work well with checksum offloads, but don't want to disable
 476           checksum offload in your device.
 477
 478           To compile it as a module, choose M here.  If unsure, say N.
 479
 480 config NETFILTER_XT_TARGET_CLASSIFY
 481         tristate '"CLASSIFY" target support'
 482         depends on NETFILTER_ADVANCED
 483         help
 484           This option adds a `CLASSIFY' target, which enables the user to set
 485           the priority of a packet. Some qdiscs can use this value for
 486           classification, among these are:
 487
 488           atm, cbq, dsmark, pfifo_fast, htb, prio
 489
 490           To compile it as a module, choose M here.  If unsure, say N.
 491
 492 config NETFILTER_XT_TARGET_CONNMARK
 493         tristate  '"CONNMARK" target support'
 494         depends on NF_CONNTRACK
 495         depends on NETFILTER_ADVANCED
 496         select NETFILTER_XT_CONNMARK
 497         ---help---
 498         This is a backwards-compat option for the user's convenience
 499         (e.g. when running oldconfig). It selects
 500         CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
 501
 502 config NETFILTER_XT_TARGET_CONNSECMARK
 503         tristate '"CONNSECMARK" target support'
 504         depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
 505         default m if NETFILTER_ADVANCED=n
 506         help
 507           The CONNSECMARK target copies security markings from packets
 508           to connections, and restores security markings from connections
 509           to packets (if the packets are not already marked).  This would
 510           normally be used in conjunction with the SECMARK target.
 511
 512           To compile it as a module, choose M here.  If unsure, say N.
 513
 514 config NETFILTER_XT_TARGET_CT
 515         tristate '"CT" target support'
 516         depends on NF_CONNTRACK
 517         depends on IP_NF_RAW || IP6_NF_RAW
 518         depends on NETFILTER_ADVANCED
 519         help
 520           This options adds a `CT' target, which allows to specify initial
 521           connection tracking parameters like events to be delivered and
 522           the helper to be used.
 523
 524           To compile it as a module, choose M here.  If unsure, say N.
 525
 526 config NETFILTER_XT_TARGET_DSCP
 527         tristate '"DSCP" and "TOS" target support'
 528         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 529         depends on NETFILTER_ADVANCED
 530         help
 531           This option adds a `DSCP' target, which allows you to manipulate
 532           the IPv4/IPv6 header DSCP field (differentiated services codepoint).
 533
 534           The DSCP field can have any value between 0x0 and 0x3f inclusive.
 535
 536           It also adds the "TOS" target, which allows you to create rules in
 537           the "mangle" table which alter the Type Of Service field of an IPv4
 538           or the Priority field of an IPv6 packet, prior to routing.
 539
 540           To compile it as a module, choose M here.  If unsure, say N.
 541
 542 config NETFILTER_XT_TARGET_HL
 543         tristate '"HL" hoplimit target support'
 544         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 545         depends on NETFILTER_ADVANCED
 546         ---help---
 547         This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
 548         targets, which enable the user to change the
 549         hoplimit/time-to-live value of the IP header.
 550
 551         While it is safe to decrement the hoplimit/TTL value, the
 552         modules also allow to increment and set the hoplimit value of
 553         the header to arbitrary values. This is EXTREMELY DANGEROUS
 554         since you can easily create immortal packets that loop
 555         forever on the network.
 556
 557 config NETFILTER_XT_TARGET_HMARK
 558         tristate '"HMARK" target support'
 559         depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
 560         depends on NETFILTER_ADVANCED
 561         ---help---
 562         This option adds the "HMARK" target.
 563
 564         The target allows you to create rules in the "raw" and "mangle" tables
 565         which set the skbuff mark by means of hash calculation within a given
 566         range. The nfmark can influence the routing method (see "Use netfilter
 567         MARK value as routing key") and can also be used by other subsystems to
 568         change their behaviour.
 569
 570         To compile it as a module, choose M here. If unsure, say N.
 571
 572 config NETFILTER_XT_TARGET_IDLETIMER
 573         tristate  "IDLETIMER target support"
 574         depends on NETFILTER_ADVANCED
 575         help
 576
 577           This option adds the `IDLETIMER' target.  Each matching packet
 578           resets the timer associated with label specified when the rule is
 579           added.  When the timer expires, it triggers a sysfs notification.
 580           The remaining time for expiration can be read via sysfs.
 581
 582           To compile it as a module, choose M here.  If unsure, say N.
 583
 584 config NETFILTER_XT_TARGET_LED
 585         tristate '"LED" target support'
 586         depends on LEDS_CLASS && LEDS_TRIGGERS
 587         depends on NETFILTER_ADVANCED
 588         help
 589           This option adds a `LED' target, which allows you to blink LEDs in
 590           response to particular packets passing through your machine.
 591
 592           This can be used to turn a spare LED into a network activity LED,
 593           which only flashes in response to FTP transfers, for example.  Or
 594           you could have an LED which lights up for a minute or two every time
 595           somebody connects to your machine via SSH.
 596
 597           You will need support for the "led" class to make this work.
 598
 599           To create an LED trigger for incoming SSH traffic:
 600             iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
 601
 602           Then attach the new trigger to an LED on your system:
 603             echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
 604
 605           For more information on the LEDs available on your system, see
 606           Documentation/leds/leds-class.txt
 607
 608 config NETFILTER_XT_TARGET_LOG
 609         tristate "LOG target support"
 610         default m if NETFILTER_ADVANCED=n
 611         help
 612           This option adds a `LOG' target, which allows you to create rules in
 613           any iptables table which records the packet header to the syslog.
 614
 615           To compile it as a module, choose M here.  If unsure, say N.
 616
 617 config NETFILTER_XT_TARGET_MARK
 618         tristate '"MARK" target support'
 619         depends on NETFILTER_ADVANCED
 620         select NETFILTER_XT_MARK
 621         ---help---
 622         This is a backwards-compat option for the user's convenience
 623         (e.g. when running oldconfig). It selects
 624         CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
 625
 626 config NETFILTER_XT_TARGET_NFLOG
 627         tristate '"NFLOG" target support'
 628         default m if NETFILTER_ADVANCED=n
 629         select NETFILTER_NETLINK_LOG
 630         help
 631           This option enables the NFLOG target, which allows to LOG
 632           messages through nfnetlink_log.
 633
 634           To compile it as a module, choose M here.  If unsure, say N.
 635
 636 config NETFILTER_XT_TARGET_NFQUEUE
 637         tristate '"NFQUEUE" target Support'
 638         depends on NETFILTER_ADVANCED
 639         select NETFILTER_NETLINK_QUEUE
 640         help
 641           This target replaced the old obsolete QUEUE target.
 642
 643           As opposed to QUEUE, it supports 65535 different queues,
 644           not just one.
 645
 646           To compile it as a module, choose M here.  If unsure, say N.
 647
 648 config NETFILTER_XT_TARGET_NOTRACK
 649         tristate  '"NOTRACK" target support'
 650         depends on IP_NF_RAW || IP6_NF_RAW
 651         depends on NF_CONNTRACK
 652         help
 653           The NOTRACK target allows a select rule to specify
 654           which packets *not* to enter the conntrack/NAT
 655           subsystem with all the consequences (no ICMP error tracking,
 656           no protocol helpers for the selected packets).
 657
 658           If you want to compile it as a module, say M here and read
 659           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 660
 661 config NETFILTER_XT_TARGET_RATEEST
 662         tristate '"RATEEST" target support'
 663         depends on NETFILTER_ADVANCED
 664         help
 665           This option adds a `RATEEST' target, which allows to measure
 666           rates similar to TC estimators. The `rateest' match can be
 667           used to match on the measured rates.
 668
 669           To compile it as a module, choose M here.  If unsure, say N.
 670
 671 config NETFILTER_XT_TARGET_TEE
 672         tristate '"TEE" - packet cloning to alternate destination'
 673         depends on NETFILTER_ADVANCED
 674         depends on (IPV6 || IPV6=n)
 675         depends on !NF_CONNTRACK || NF_CONNTRACK
 676         ---help---
 677         This option adds a "TEE" target with which a packet can be cloned and
 678         this clone be rerouted to another nexthop.
 679
 680 config NETFILTER_XT_TARGET_TPROXY
 681         tristate '"TPROXY" target support (EXPERIMENTAL)'
 682         depends on EXPERIMENTAL
 683         depends on NETFILTER_TPROXY
 684         depends on NETFILTER_XTABLES
 685         depends on NETFILTER_ADVANCED
 686         select NF_DEFRAG_IPV4
 687         select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
 688         help
 689           This option adds a `TPROXY' target, which is somewhat similar to
 690           REDIRECT.  It can only be used in the mangle table and is useful
 691           to redirect traffic to a transparent proxy.  It does _not_ depend
 692           on Netfilter connection tracking and NAT, unlike REDIRECT.
 693
 694           To compile it as a module, choose M here.  If unsure, say N.
 695
 696 config NETFILTER_XT_TARGET_TRACE
 697         tristate  '"TRACE" target support'
 698         depends on IP_NF_RAW || IP6_NF_RAW
 699         depends on NETFILTER_ADVANCED
 700         help
 701           The TRACE target allows you to mark packets so that the kernel
 702           will log every rule which match the packets as those traverse
 703           the tables, chains, rules.
 704
 705           If you want to compile it as a module, say M here and read
 706           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 707
 708 config NETFILTER_XT_TARGET_SECMARK
 709         tristate '"SECMARK" target support'
 710         depends on NETWORK_SECMARK
 711         default m if NETFILTER_ADVANCED=n
 712         help
 713           The SECMARK target allows security marking of network
 714           packets, for use with security subsystems.
 715
 716           To compile it as a module, choose M here.  If unsure, say N.
 717
 718 config NETFILTER_XT_TARGET_TCPMSS
 719         tristate '"TCPMSS" target support'
 720         depends on (IPV6 || IPV6=n)
 721         default m if NETFILTER_ADVANCED=n
 722         ---help---
 723           This option adds a `TCPMSS' target, which allows you to alter the
 724           MSS value of TCP SYN packets, to control the maximum size for that
 725           connection (usually limiting it to your outgoing interface's MTU
 726           minus 40).
 727
 728           This is used to overcome criminally braindead ISPs or servers which
 729           block ICMP Fragmentation Needed packets.  The symptoms of this
 730           problem are that everything works fine from your Linux
 731           firewall/router, but machines behind it can never exchange large
 732           packets:
 733                 1) Web browsers connect, then hang with no data received.
 734                 2) Small mail works fine, but large emails hang.
 735                 3) ssh works fine, but scp hangs after initial handshaking.
 736
 737           Workaround: activate this option and add a rule to your firewall
 738           configuration like:
 739
 740           iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
 741                          -j TCPMSS --clamp-mss-to-pmtu
 742
 743           To compile it as a module, choose M here.  If unsure, say N.
 744
 745 config NETFILTER_XT_TARGET_TCPOPTSTRIP
 746         tristate '"TCPOPTSTRIP" target support (EXPERIMENTAL)'
 747         depends on EXPERIMENTAL
 748         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 749         depends on NETFILTER_ADVANCED
 750         help
 751           This option adds a "TCPOPTSTRIP" target, which allows you to strip
 752           TCP options from TCP packets.
 753
 754 # alphabetically ordered list of matches
 755
 756 comment "Xtables matches"
 757
 758 config NETFILTER_XT_MATCH_ADDRTYPE
 759         tristate '"addrtype" address type match support'
 760         depends on NETFILTER_ADVANCED
 761         ---help---
 762           This option allows you to match what routing thinks of an address,
 763           eg. UNICAST, LOCAL, BROADCAST, ...
 764
 765           If you want to compile it as a module, say M here and read
 766           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 767
 768 config NETFILTER_XT_MATCH_CLUSTER
 769         tristate '"cluster" match support'
 770         depends on NF_CONNTRACK
 771         depends on NETFILTER_ADVANCED
 772         ---help---
 773           This option allows you to build work-load-sharing clusters of
 774           network servers/stateful firewalls without having a dedicated
 775           load-balancing router/server/switch. Basically, this match returns
 776           true when the packet must be handled by this cluster node. Thus,
 777           all nodes see all packets and this match decides which node handles
 778           what packets. The work-load sharing algorithm is based on source
 779           address hashing.
 780
 781           If you say Y or M here, try `iptables -m cluster --help` for
 782           more information.
 783
 784 config NETFILTER_XT_MATCH_COMMENT
 785         tristate  '"comment" match support'
 786         depends on NETFILTER_ADVANCED
 787         help
 788           This option adds a `comment' dummy-match, which allows you to put
 789           comments in your iptables ruleset.
 790
 791           If you want to compile it as a module, say M here and read
 792           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 793
 794 config NETFILTER_XT_MATCH_CONNBYTES
 795         tristate  '"connbytes" per-connection counter match support'
 796         depends on NF_CONNTRACK
 797         depends on NETFILTER_ADVANCED
 798         help
 799           This option adds a `connbytes' match, which allows you to match the
 800           number of bytes and/or packets for each direction within a connection.
 801
 802           If you want to compile it as a module, say M here and read
 803           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 804
 805 config NETFILTER_XT_MATCH_CONNLIMIT
 806         tristate '"connlimit" match support"'
 807         depends on NF_CONNTRACK
 808         depends on NETFILTER_ADVANCED
 809         ---help---
 810           This match allows you to match against the number of parallel
 811           connections to a server per client IP address (or address block).
 812
 813 config NETFILTER_XT_MATCH_CONNMARK
 814         tristate  '"connmark" connection mark match support'
 815         depends on NF_CONNTRACK
 816         depends on NETFILTER_ADVANCED
 817         select NETFILTER_XT_CONNMARK
 818         ---help---
 819         This is a backwards-compat option for the user's convenience
 820         (e.g. when running oldconfig). It selects
 821         CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
 822
 823 config NETFILTER_XT_MATCH_CONNTRACK
 824         tristate '"conntrack" connection tracking match support'
 825         depends on NF_CONNTRACK
 826         default m if NETFILTER_ADVANCED=n
 827         help
 828           This is a general conntrack match module, a superset of the state match.
 829
 830           It allows matching on additional conntrack information, which is
 831           useful in complex configurations, such as NAT gateways with multiple
 832           internet links or tunnels.
 833
 834           To compile it as a module, choose M here.  If unsure, say N.
 835
 836 config NETFILTER_XT_MATCH_CPU
 837         tristate '"cpu" match support'
 838         depends on NETFILTER_ADVANCED
 839         help
 840           CPU matching allows you to match packets based on the CPU
 841           currently handling the packet.
 842
 843           To compile it as a module, choose M here.  If unsure, say N.
 844
 845 config NETFILTER_XT_MATCH_DCCP
 846         tristate '"dccp" protocol match support'
 847         depends on NETFILTER_ADVANCED
 848         default IP_DCCP
 849         help
 850           With this option enabled, you will be able to use the iptables
 851           `dccp' match in order to match on DCCP source/destination ports
 852           and DCCP flags.
 853
 854           If you want to compile it as a module, say M here and read
 855           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 856
 857 config NETFILTER_XT_MATCH_DEVGROUP
 858         tristate '"devgroup" match support'
 859         depends on NETFILTER_ADVANCED
 860         help
 861           This options adds a `devgroup' match, which allows to match on the
 862           device group a network device is assigned to.
 863
 864           To compile it as a module, choose M here.  If unsure, say N.
 865
 866 config NETFILTER_XT_MATCH_DSCP
 867         tristate '"dscp" and "tos" match support'
 868         depends on NETFILTER_ADVANCED
 869         help
 870           This option adds a `DSCP' match, which allows you to match against
 871           the IPv4/IPv6 header DSCP field (differentiated services codepoint).
 872
 873           The DSCP field can have any value between 0x0 and 0x3f inclusive.
 874
 875           It will also add a "tos" match, which allows you to match packets
 876           based on the Type Of Service fields of the IPv4 packet (which share
 877           the same bits as DSCP).
 878
 879           To compile it as a module, choose M here.  If unsure, say N.
 880
 881 config NETFILTER_XT_MATCH_ECN
 882         tristate '"ecn" match support'
 883         depends on NETFILTER_ADVANCED
 884         ---help---
 885         This option adds an "ECN" match, which allows you to match against
 886         the IPv4 and TCP header ECN fields.
 887
 888         To compile it as a module, choose M here. If unsure, say N.
 889
 890 config NETFILTER_XT_MATCH_ESP
 891         tristate '"esp" match support'
 892         depends on NETFILTER_ADVANCED
 893         help
 894           This match extension allows you to match a range of SPIs
 895           inside ESP header of IPSec packets.
 896
 897           To compile it as a module, choose M here.  If unsure, say N.
 898
 899 config NETFILTER_XT_MATCH_HASHLIMIT
 900         tristate '"hashlimit" match support'
 901         depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
 902         depends on NETFILTER_ADVANCED
 903         help
 904           This option adds a `hashlimit' match.
 905
 906           As opposed to `limit', this match dynamically creates a hash table
 907           of limit buckets, based on your selection of source/destination
 908           addresses and/or ports.
 909
 910           It enables you to express policies like `10kpps for any given
 911           destination address' or `500pps from any given source address'
 912           with a single rule.
 913
 914 config NETFILTER_XT_MATCH_HELPER
 915         tristate '"helper" match support'
 916         depends on NF_CONNTRACK
 917         depends on NETFILTER_ADVANCED
 918         help
 919           Helper matching allows you to match packets in dynamic connections
 920           tracked by a conntrack-helper, ie. ip_conntrack_ftp
 921
 922           To compile it as a module, choose M here.  If unsure, say Y.
 923
 924 config NETFILTER_XT_MATCH_HL
 925         tristate '"hl" hoplimit/TTL match support'
 926         depends on NETFILTER_ADVANCED
 927         ---help---
 928         HL matching allows you to match packets based on the hoplimit
 929         in the IPv6 header, or the time-to-live field in the IPv4
 930         header of the packet.
 931
 932 config NETFILTER_XT_MATCH_IPRANGE
 933         tristate '"iprange" address range match support'
 934         depends on NETFILTER_ADVANCED
 935         ---help---
 936         This option adds a "iprange" match, which allows you to match based on
 937         an IP address range. (Normal iptables only matches on single addresses
 938         with an optional mask.)
 939
 940         If unsure, say M.
 941
 942 config NETFILTER_XT_MATCH_IPVS
 943         tristate '"ipvs" match support'
 944         depends on IP_VS
 945         depends on NETFILTER_ADVANCED
 946         depends on NF_CONNTRACK
 947         help
 948           This option allows you to match against IPVS properties of a packet.
 949
 950           If unsure, say N.
 951
 952 config NETFILTER_XT_MATCH_LENGTH
 953         tristate '"length" match support'
 954         depends on NETFILTER_ADVANCED
 955         help
 956           This option allows you to match the length of a packet against a
 957           specific value or range of values.
 958
 959           To compile it as a module, choose M here.  If unsure, say N.
 960
 961 config NETFILTER_XT_MATCH_LIMIT
 962         tristate '"limit" match support'
 963         depends on NETFILTER_ADVANCED
 964         help
 965           limit matching allows you to control the rate at which a rule can be
 966           matched: mainly useful in combination with the LOG target ("LOG
 967           target support", below) and to avoid some Denial of Service attacks.
 968
 969           To compile it as a module, choose M here.  If unsure, say N.
 970
 971 config NETFILTER_XT_MATCH_MAC
 972         tristate '"mac" address match support'
 973         depends on NETFILTER_ADVANCED
 974         help
 975           MAC matching allows you to match packets based on the source
 976           Ethernet address of the packet.
 977
 978           To compile it as a module, choose M here.  If unsure, say N.
 979
 980 config NETFILTER_XT_MATCH_MARK
 981         tristate '"mark" match support'
 982         depends on NETFILTER_ADVANCED
 983         select NETFILTER_XT_MARK
 984         ---help---
 985         This is a backwards-compat option for the user's convenience
 986         (e.g. when running oldconfig). It selects
 987         CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
 988
 989 config NETFILTER_XT_MATCH_MULTIPORT
 990         tristate '"multiport" Multiple port match support'
 991         depends on NETFILTER_ADVANCED
 992         help
 993           Multiport matching allows you to match TCP or UDP packets based on
 994           a series of source or destination ports: normally a rule can only
 995           match a single range of ports.
 996
 997           To compile it as a module, choose M here.  If unsure, say N.
 998
 999 config NETFILTER_XT_MATCH_NFACCT
1000         tristate '"nfacct" match support'
1001         depends on NETFILTER_ADVANCED
1002         select NETFILTER_NETLINK_ACCT
1003         help
1004           This option allows you to use the extended accounting through
1005           nfnetlink_acct.
1006
1007           To compile it as a module, choose M here.  If unsure, say N.
1008
1009 config NETFILTER_XT_MATCH_OSF
1010         tristate '"osf" Passive OS fingerprint match'
1011         depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
1012         help
1013           This option selects the Passive OS Fingerprinting match module
1014           that allows to passively match the remote operating system by
1015           analyzing incoming TCP SYN packets.
1016
1017           Rules and loading software can be downloaded from
1018           http://www.ioremap.net/projects/osf
1019
1020           To compile it as a module, choose M here.  If unsure, say N.
1021
1022 config NETFILTER_XT_MATCH_OWNER
1023         tristate '"owner" match support'
1024         depends on NETFILTER_ADVANCED
1025         ---help---
1026         Socket owner matching allows you to match locally-generated packets
1027         based on who created the socket: the user or group. It is also
1028         possible to check whether a socket actually exists.
1029
1030 config NETFILTER_XT_MATCH_POLICY
1031         tristate 'IPsec "policy" match support'
1032         depends on XFRM
1033         default m if NETFILTER_ADVANCED=n
1034         help
1035           Policy matching allows you to match packets based on the
1036           IPsec policy that was used during decapsulation/will
1037           be used during encapsulation.
1038
1039           To compile it as a module, choose M here.  If unsure, say N.
1040
1041 config NETFILTER_XT_MATCH_PHYSDEV
1042         tristate '"physdev" match support'
1043         depends on BRIDGE && BRIDGE_NETFILTER
1044         depends on NETFILTER_ADVANCED
1045         help
1046           Physdev packet matching matches against the physical bridge ports
1047           the IP packet arrived on or will leave by.
1048
1049           To compile it as a module, choose M here.  If unsure, say N.
1050
1051 config NETFILTER_XT_MATCH_PKTTYPE
1052         tristate '"pkttype" packet type match support'
1053         depends on NETFILTER_ADVANCED
1054         help
1055           Packet type matching allows you to match a packet by
1056           its "class", eg. BROADCAST, MULTICAST, ...
1057
1058           Typical usage:
1059           iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1060
1061           To compile it as a module, choose M here.  If unsure, say N.
1062
1063 config NETFILTER_XT_MATCH_QUOTA
1064         tristate '"quota" match support'
1065         depends on NETFILTER_ADVANCED
1066         help
1067           This option adds a `quota' match, which allows to match on a
1068           byte counter.
1069
1070           If you want to compile it as a module, say M here and read
1071           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1072
1073 config NETFILTER_XT_MATCH_RATEEST
1074         tristate '"rateest" match support'
1075         depends on NETFILTER_ADVANCED
1076         select NETFILTER_XT_TARGET_RATEEST
1077         help
1078           This option adds a `rateest' match, which allows to match on the
1079           rate estimated by the RATEEST target.
1080
1081           To compile it as a module, choose M here.  If unsure, say N.
1082
1083 config NETFILTER_XT_MATCH_REALM
1084         tristate  '"realm" match support'
1085         depends on NETFILTER_ADVANCED
1086         select IP_ROUTE_CLASSID
1087         help
1088           This option adds a `realm' match, which allows you to use the realm
1089           key from the routing subsystem inside iptables.
1090
1091           This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1092           in tc world.
1093
1094           If you want to compile it as a module, say M here and read
1095           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1096
1097 config NETFILTER_XT_MATCH_RECENT
1098         tristate '"recent" match support'
1099         depends on NETFILTER_ADVANCED
1100         ---help---
1101         This match is used for creating one or many lists of recently
1102         used addresses and then matching against that/those list(s).
1103
1104         Short options are available by using 'iptables -m recent -h'
1105         Official Website: <http://snowman.net/projects/ipt_recent/>
1106
1107 config NETFILTER_XT_MATCH_SCTP
1108         tristate  '"sctp" protocol match support (EXPERIMENTAL)'
1109         depends on EXPERIMENTAL
1110         depends on NETFILTER_ADVANCED
1111         default IP_SCTP
1112         help
1113           With this option enabled, you will be able to use the
1114           `sctp' match in order to match on SCTP source/destination ports
1115           and SCTP chunk types.
1116
1117           If you want to compile it as a module, say M here and read
1118           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1119
1120 config NETFILTER_XT_MATCH_SOCKET
1121         tristate '"socket" match support (EXPERIMENTAL)'
1122         depends on EXPERIMENTAL
1123         depends on NETFILTER_TPROXY
1124         depends on NETFILTER_XTABLES
1125         depends on NETFILTER_ADVANCED
1126         depends on !NF_CONNTRACK || NF_CONNTRACK
1127         select NF_DEFRAG_IPV4
1128         select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
1129         help
1130           This option adds a `socket' match, which can be used to match
1131           packets for which a TCP or UDP socket lookup finds a valid socket.
1132           It can be used in combination with the MARK target and policy
1133           routing to implement full featured non-locally bound sockets.
1134
1135           To compile it as a module, choose M here.  If unsure, say N.
1136
1137 config NETFILTER_XT_MATCH_STATE
1138         tristate '"state" match support'
1139         depends on NF_CONNTRACK
1140         default m if NETFILTER_ADVANCED=n
1141         help
1142           Connection state matching allows you to match packets based on their
1143           relationship to a tracked connection (ie. previous packets).  This
1144           is a powerful tool for packet classification.
1145
1146           To compile it as a module, choose M here.  If unsure, say N.
1147
1148 config NETFILTER_XT_MATCH_STATISTIC
1149         tristate '"statistic" match support'
1150         depends on NETFILTER_ADVANCED
1151         help
1152           This option adds a `statistic' match, which allows you to match
1153           on packets periodically or randomly with a given percentage.
1154
1155           To compile it as a module, choose M here.  If unsure, say N.
1156
1157 config NETFILTER_XT_MATCH_STRING
1158         tristate  '"string" match support'
1159         depends on NETFILTER_ADVANCED
1160         select TEXTSEARCH
1161         select TEXTSEARCH_KMP
1162         select TEXTSEARCH_BM
1163         select TEXTSEARCH_FSM
1164         help
1165           This option adds a `string' match, which allows you to look for
1166           pattern matchings in packets.
1167
1168           To compile it as a module, choose M here.  If unsure, say N.
1169
1170 config NETFILTER_XT_MATCH_TCPMSS
1171         tristate '"tcpmss" match support'
1172         depends on NETFILTER_ADVANCED
1173         help
1174           This option adds a `tcpmss' match, which allows you to examine the
1175           MSS value of TCP SYN packets, which control the maximum packet size
1176           for that connection.
1177
1178           To compile it as a module, choose M here.  If unsure, say N.
1179
1180 config NETFILTER_XT_MATCH_TIME
1181         tristate '"time" match support'
1182         depends on NETFILTER_ADVANCED
1183         ---help---
1184           This option adds a "time" match, which allows you to match based on
1185           the packet arrival time (at the machine which netfilter is running)
1186           on) or departure time/date (for locally generated packets).
1187
1188           If you say Y here, try `iptables -m time --help` for
1189           more information.
1190
1191           If you want to compile it as a module, say M here.
1192           If unsure, say N.
1193
1194 config NETFILTER_XT_MATCH_U32
1195         tristate '"u32" match support'
1196         depends on NETFILTER_ADVANCED
1197         ---help---
1198           u32 allows you to extract quantities of up to 4 bytes from a packet,
1199           AND them with specified masks, shift them by specified amounts and
1200           test whether the results are in any of a set of specified ranges.
1201           The specification of what to extract is general enough to skip over
1202           headers with lengths stored in the packet, as in IP or TCP header
1203           lengths.
1204
1205           Details and examples are in the kernel module source.
1206
1207 endif # NETFILTER_XTABLES
1208
1209 endmenu
1210
1211 source "net/netfilter/ipset/Kconfig"
1212
1213 source "net/netfilter/ipvs/Kconfig"