net/netfilter/Kconfig

   1 menu "Core Netfilter Configuration"
   2         depends on NET && INET && NETFILTER
   3
   4 config NETFILTER_NETLINK
   5         tristate
   6
   7 config NETFILTER_NETLINK_ACCT
   8 tristate "Netfilter NFACCT over NFNETLINK interface"
   9         depends on NETFILTER_ADVANCED
  10         select NETFILTER_NETLINK
  11         help
  12           If this option is enabled, the kernel will include support
  13           for extended accounting via NFNETLINK.
  14
  15 config NETFILTER_NETLINK_QUEUE
  16         tristate "Netfilter NFQUEUE over NFNETLINK interface"
  17         depends on NETFILTER_ADVANCED
  18         select NETFILTER_NETLINK
  19         help
  20           If this option is enabled, the kernel will include support
  21           for queueing packets via NFNETLINK.
  22
  23 config NETFILTER_NETLINK_LOG
  24         tristate "Netfilter LOG over NFNETLINK interface"
  25         default m if NETFILTER_ADVANCED=n
  26         select NETFILTER_NETLINK
  27         help
  28           If this option is enabled, the kernel will include support
  29           for logging packets via NFNETLINK.
  30
  31           This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
  32           and is also scheduled to replace the old syslog-based ipt_LOG
  33           and ip6t_LOG modules.
  34
  35 config NF_CONNTRACK
  36         tristate "Netfilter connection tracking support"
  37         default m if NETFILTER_ADVANCED=n
  38         help
  39           Connection tracking keeps a record of what packets have passed
  40           through your machine, in order to figure out how they are related
  41           into connections.
  42
  43           This is required to do Masquerading or other kinds of Network
  44           Address Translation.  It can also be used to enhance packet
  45           filtering (see `Connection state match support' below).
  46
  47           To compile it as a module, choose M here.  If unsure, say N.
  48
  49 if NF_CONNTRACK
  50
  51 config NF_CONNTRACK_MARK
  52         bool  'Connection mark tracking support'
  53         depends on NETFILTER_ADVANCED
  54         help
  55           This option enables support for connection marks, used by the
  56           `CONNMARK' target and `connmark' match. Similar to the mark value
  57           of packets, but this mark value is kept in the conntrack session
  58           instead of the individual packets.
  59
  60 config NF_CONNTRACK_SECMARK
  61         bool  'Connection tracking security mark support'
  62         depends on NETWORK_SECMARK
  63         default m if NETFILTER_ADVANCED=n
  64         help
  65           This option enables security markings to be applied to
  66           connections.  Typically they are copied to connections from
  67           packets using the CONNSECMARK target and copied back from
  68           connections to packets with the same target, with the packets
  69           being originally labeled via SECMARK.
  70
  71           If unsure, say 'N'.
  72
  73 config NF_CONNTRACK_ZONES
  74         bool  'Connection tracking zones'
  75         depends on NETFILTER_ADVANCED
  76         depends on NETFILTER_XT_TARGET_CT
  77         help
  78           This option enables support for connection tracking zones.
  79           Normally, each connection needs to have a unique system wide
  80           identity. Connection tracking zones allow to have multiple
  81           connections using the same identity, as long as they are
  82           contained in different zones.
  83
  84           If unsure, say `N'.
  85
  86 config NF_CONNTRACK_PROCFS
  87         bool "Supply CT list in procfs (OBSOLETE)"
  88         default y
  89         depends on PROC_FS
  90         ---help---
  91         This option enables for the list of known conntrack entries
  92         to be shown in procfs under net/netfilter/nf_conntrack. This
  93         is considered obsolete in favor of using the conntrack(8)
  94         tool which uses Netlink.
  95
  96 config NF_CONNTRACK_EVENTS
  97         bool "Connection tracking events"
  98         depends on NETFILTER_ADVANCED
  99         help
 100           If this option is enabled, the connection tracking code will
 101           provide a notifier chain that can be used by other kernel code
 102           to get notified about changes in the connection tracking state.
 103
 104           If unsure, say `N'.
 105
 106 config NF_CONNTRACK_TIMEOUT
 107         bool  'Connection tracking timeout'
 108         depends on NETFILTER_ADVANCED
 109         help
 110           This option enables support for connection tracking timeout
 111           extension. This allows you to attach timeout policies to flow
 112           via the CT target.
 113
 114           If unsure, say `N'.
 115
 116 config NF_CONNTRACK_TIMESTAMP
 117         bool  'Connection tracking timestamping'
 118         depends on NETFILTER_ADVANCED
 119         help
 120           This option enables support for connection tracking timestamping.
 121           This allows you to store the flow start-time and to obtain
 122           the flow-stop time (once it has been destroyed) via Connection
 123           tracking events.
 124
 125           If unsure, say `N'.
 126
 127 config NF_CONNTRACK_LABELS
 128         bool
 129         help
 130           This option enables support for assigning user-defined flag bits
 131           to connection tracking entries.  It selected by the connlabel match.
 132
 133 config NF_CT_PROTO_DCCP
 134         tristate 'DCCP protocol connection tracking support'
 135         depends on NETFILTER_ADVANCED
 136         default IP_DCCP
 137         help
 138           With this option enabled, the layer 3 independent connection
 139           tracking code will be able to do state tracking on DCCP connections.
 140
 141           If unsure, say 'N'.
 142
 143 config NF_CT_PROTO_GRE
 144         tristate
 145
 146 config NF_CT_PROTO_SCTP
 147         tristate 'SCTP protocol connection tracking support'
 148         depends on NETFILTER_ADVANCED
 149         default IP_SCTP
 150         help
 151           With this option enabled, the layer 3 independent connection
 152           tracking code will be able to do state tracking on SCTP connections.
 153
 154           If you want to compile it as a module, say M here and read
 155           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 156
 157 config NF_CT_PROTO_UDPLITE
 158         tristate 'UDP-Lite protocol connection tracking support'
 159         depends on NETFILTER_ADVANCED
 160         help
 161           With this option enabled, the layer 3 independent connection
 162           tracking code will be able to do state tracking on UDP-Lite
 163           connections.
 164
 165           To compile it as a module, choose M here.  If unsure, say N.
 166
 167 config NF_CONNTRACK_AMANDA
 168         tristate "Amanda backup protocol support"
 169         depends on NETFILTER_ADVANCED
 170         select TEXTSEARCH
 171         select TEXTSEARCH_KMP
 172         help
 173           If you are running the Amanda backup package <http://www.amanda.org/>
 174           on this machine or machines that will be MASQUERADED through this
 175           machine, then you may want to enable this feature.  This allows the
 176           connection tracking and natting code to allow the sub-channels that
 177           Amanda requires for communication of the backup data, messages and
 178           index.
 179
 180           To compile it as a module, choose M here.  If unsure, say N.
 181
 182 config NF_CONNTRACK_FTP
 183         tristate "FTP protocol support"
 184         default m if NETFILTER_ADVANCED=n
 185         help
 186           Tracking FTP connections is problematic: special helpers are
 187           required for tracking them, and doing masquerading and other forms
 188           of Network Address Translation on them.
 189
 190           This is FTP support on Layer 3 independent connection tracking.
 191           Layer 3 independent connection tracking is experimental scheme
 192           which generalize ip_conntrack to support other layer 3 protocols.
 193
 194           To compile it as a module, choose M here.  If unsure, say N.
 195
 196 config NF_CONNTRACK_H323
 197         tristate "H.323 protocol support"
 198         depends on (IPV6 || IPV6=n)
 199         depends on NETFILTER_ADVANCED
 200         help
 201           H.323 is a VoIP signalling protocol from ITU-T. As one of the most
 202           important VoIP protocols, it is widely used by voice hardware and
 203           software including voice gateways, IP phones, Netmeeting, OpenPhone,
 204           Gnomemeeting, etc.
 205
 206           With this module you can support H.323 on a connection tracking/NAT
 207           firewall.
 208
 209           This module supports RAS, Fast Start, H.245 Tunnelling, Call
 210           Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
 211           whiteboard, file transfer, etc. For more information, please
 212           visit http://nath323.sourceforge.net/.
 213
 214           To compile it as a module, choose M here.  If unsure, say N.
 215
 216 config NF_CONNTRACK_IRC
 217         tristate "IRC protocol support"
 218         default m if NETFILTER_ADVANCED=n
 219         help
 220           There is a commonly-used extension to IRC called
 221           Direct Client-to-Client Protocol (DCC).  This enables users to send
 222           files to each other, and also chat to each other without the need
 223           of a server.  DCC Sending is used anywhere you send files over IRC,
 224           and DCC Chat is most commonly used by Eggdrop bots.  If you are
 225           using NAT, this extension will enable you to send files and initiate
 226           chats.  Note that you do NOT need this extension to get files or
 227           have others initiate chats, or everything else in IRC.
 228
 229           To compile it as a module, choose M here.  If unsure, say N.
 230
 231 config NF_CONNTRACK_BROADCAST
 232         tristate
 233
 234 config NF_CONNTRACK_NETBIOS_NS
 235         tristate "NetBIOS name service protocol support"
 236         select NF_CONNTRACK_BROADCAST
 237         help
 238           NetBIOS name service requests are sent as broadcast messages from an
 239           unprivileged port and responded to with unicast messages to the
 240           same port. This make them hard to firewall properly because connection
 241           tracking doesn't deal with broadcasts. This helper tracks locally
 242           originating NetBIOS name service requests and the corresponding
 243           responses. It relies on correct IP address configuration, specifically
 244           netmask and broadcast address. When properly configured, the output
 245           of "ip address show" should look similar to this:
 246
 247           $ ip -4 address show eth0
 248           4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
 249               inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
 250
 251           To compile it as a module, choose M here.  If unsure, say N.
 252
 253 config NF_CONNTRACK_SNMP
 254         tristate "SNMP service protocol support"
 255         depends on NETFILTER_ADVANCED
 256         select NF_CONNTRACK_BROADCAST
 257         help
 258           SNMP service requests are sent as broadcast messages from an
 259           unprivileged port and responded to with unicast messages to the
 260           same port. This make them hard to firewall properly because connection
 261           tracking doesn't deal with broadcasts. This helper tracks locally
 262           originating SNMP service requests and the corresponding
 263           responses. It relies on correct IP address configuration, specifically
 264           netmask and broadcast address.
 265
 266           To compile it as a module, choose M here.  If unsure, say N.
 267
 268 config NF_CONNTRACK_PPTP
 269         tristate "PPtP protocol support"
 270         depends on NETFILTER_ADVANCED
 271         select NF_CT_PROTO_GRE
 272         help
 273           This module adds support for PPTP (Point to Point Tunnelling
 274           Protocol, RFC2637) connection tracking and NAT.
 275
 276           If you are running PPTP sessions over a stateful firewall or NAT
 277           box, you may want to enable this feature.
 278
 279           Please note that not all PPTP modes of operation are supported yet.
 280           Specifically these limitations exist:
 281             - Blindly assumes that control connections are always established
 282               in PNS->PAC direction. This is a violation of RFC2637.
 283             - Only supports a single call within each session
 284
 285           To compile it as a module, choose M here.  If unsure, say N.
 286
 287 config NF_CONNTRACK_SANE
 288         tristate "SANE protocol support"
 289         depends on NETFILTER_ADVANCED
 290         help
 291           SANE is a protocol for remote access to scanners as implemented
 292           by the 'saned' daemon. Like FTP, it uses separate control and
 293           data connections.
 294
 295           With this module you can support SANE on a connection tracking
 296           firewall.
 297
 298           To compile it as a module, choose M here.  If unsure, say N.
 299
 300 config NF_CONNTRACK_SIP
 301         tristate "SIP protocol support"
 302         default m if NETFILTER_ADVANCED=n
 303         help
 304           SIP is an application-layer control protocol that can establish,
 305           modify, and terminate multimedia sessions (conferences) such as
 306           Internet telephony calls. With the ip_conntrack_sip and
 307           the nf_nat_sip modules you can support the protocol on a connection
 308           tracking/NATing firewall.
 309
 310           To compile it as a module, choose M here.  If unsure, say N.
 311
 312 config NF_CONNTRACK_TFTP
 313         tristate "TFTP protocol support"
 314         depends on NETFILTER_ADVANCED
 315         help
 316           TFTP connection tracking helper, this is required depending
 317           on how restrictive your ruleset is.
 318           If you are using a tftp client behind -j SNAT or -j MASQUERADING
 319           you will need this.
 320
 321           To compile it as a module, choose M here.  If unsure, say N.
 322
 323 config NF_CT_NETLINK
 324         tristate 'Connection tracking netlink interface'
 325         select NETFILTER_NETLINK
 326         default m if NETFILTER_ADVANCED=n
 327         help
 328           This option enables support for a netlink-based userspace interface
 329
 330 config NF_CT_NETLINK_TIMEOUT
 331         tristate  'Connection tracking timeout tuning via Netlink'
 332         select NETFILTER_NETLINK
 333         depends on NETFILTER_ADVANCED
 334         help
 335           This option enables support for connection tracking timeout
 336           fine-grain tuning. This allows you to attach specific timeout
 337           policies to flows, instead of using the global timeout policy.
 338
 339           If unsure, say `N'.
 340
 341 config NF_CT_NETLINK_HELPER
 342         tristate 'Connection tracking helpers in user-space via Netlink'
 343         select NETFILTER_NETLINK
 344         depends on NF_CT_NETLINK
 345         depends on NETFILTER_NETLINK_QUEUE
 346         depends on NETFILTER_NETLINK_QUEUE_CT
 347         depends on NETFILTER_ADVANCED
 348         help
 349           This option enables the user-space connection tracking helpers
 350           infrastructure.
 351
 352           If unsure, say `N'.
 353
 354 config NETFILTER_NETLINK_QUEUE_CT
 355         bool "NFQUEUE integration with Connection Tracking"
 356         default n
 357         depends on NETFILTER_NETLINK_QUEUE
 358         help
 359           If this option is enabled, NFQUEUE can include Connection Tracking
 360           information together with the packet is the enqueued via NFNETLINK.
 361
 362 config NF_NAT
 363         tristate
 364
 365 config NF_NAT_NEEDED
 366         bool
 367         depends on NF_NAT
 368         default y
 369
 370 config NF_NAT_PROTO_DCCP
 371         tristate
 372         depends on NF_NAT && NF_CT_PROTO_DCCP
 373         default NF_NAT && NF_CT_PROTO_DCCP
 374
 375 config NF_NAT_PROTO_UDPLITE
 376         tristate
 377         depends on NF_NAT && NF_CT_PROTO_UDPLITE
 378         default NF_NAT && NF_CT_PROTO_UDPLITE
 379
 380 config NF_NAT_PROTO_SCTP
 381         tristate
 382         default NF_NAT && NF_CT_PROTO_SCTP
 383         depends on NF_NAT && NF_CT_PROTO_SCTP
 384         select LIBCRC32C
 385
 386 config NF_NAT_AMANDA
 387         tristate
 388         depends on NF_CONNTRACK && NF_NAT
 389         default NF_NAT && NF_CONNTRACK_AMANDA
 390
 391 config NF_NAT_FTP
 392         tristate
 393         depends on NF_CONNTRACK && NF_NAT
 394         default NF_NAT && NF_CONNTRACK_FTP
 395
 396 config NF_NAT_IRC
 397         tristate
 398         depends on NF_CONNTRACK && NF_NAT
 399         default NF_NAT && NF_CONNTRACK_IRC
 400
 401 config NF_NAT_SIP
 402         tristate
 403         depends on NF_CONNTRACK && NF_NAT
 404         default NF_NAT && NF_CONNTRACK_SIP
 405
 406 config NF_NAT_TFTP
 407         tristate
 408         depends on NF_CONNTRACK && NF_NAT
 409         default NF_NAT && NF_CONNTRACK_TFTP
 410
 411 config NETFILTER_SYNPROXY
 412         tristate
 413
 414 endif # NF_CONNTRACK
 415
 416 config NF_TABLES
 417         select NETFILTER_NETLINK
 418         tristate "Netfilter nf_tables support"
 419         help
 420           nftables is the new packet classification framework that intends to
 421           replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
 422           provides a pseudo-state machine with an extensible instruction-set
 423           (also known as expressions) that the userspace 'nft' utility
 424           (http://www.netfilter.org/projects/nftables) uses to build the
 425           rule-set. It also comes with the generic set infrastructure that
 426           allows you to construct mappings between matchings and actions
 427           for performance lookups.
 428
 429           To compile it as a module, choose M here.
 430
 431 config NF_TABLES_INET
 432         depends on NF_TABLES && IPV6
 433         select NF_TABLES_IPV4
 434         select NF_TABLES_IPV6
 435         tristate "Netfilter nf_tables mixed IPv4/IPv6 tables support"
 436         help
 437           This option enables support for a mixed IPv4/IPv6 "inet" table.
 438
 439 config NFT_EXTHDR
 440         depends on NF_TABLES
 441         tristate "Netfilter nf_tables IPv6 exthdr module"
 442         help
 443           This option adds the "exthdr" expression that you can use to match
 444           IPv6 extension headers.
 445
 446 config NFT_META
 447         depends on NF_TABLES
 448         tristate "Netfilter nf_tables meta module"
 449         help
 450           This option adds the "meta" expression that you can use to match and
 451           to set packet metainformation such as the packet mark.
 452
 453 config NFT_CT
 454         depends on NF_TABLES
 455         depends on NF_CONNTRACK
 456         tristate "Netfilter nf_tables conntrack module"
 457         help
 458           This option adds the "meta" expression that you can use to match
 459           connection tracking information such as the flow state.
 460
 461 config NFT_RBTREE
 462         depends on NF_TABLES
 463         tristate "Netfilter nf_tables rbtree set module"
 464         help
 465           This option adds the "rbtree" set type (Red Black tree) that is used
 466           to build interval-based sets.
 467
 468 config NFT_HASH
 469         depends on NF_TABLES
 470         tristate "Netfilter nf_tables hash set module"
 471         help
 472           This option adds the "hash" set type that is used to build one-way
 473           mappings between matchings and actions.
 474
 475 config NFT_COUNTER
 476         depends on NF_TABLES
 477         tristate "Netfilter nf_tables counter module"
 478         help
 479           This option adds the "counter" expression that you can use to
 480           include packet and byte counters in a rule.
 481
 482 config NFT_LOG
 483         depends on NF_TABLES
 484         tristate "Netfilter nf_tables log module"
 485         help
 486           This option adds the "log" expression that you can use to log
 487           packets matching some criteria.
 488
 489 config NFT_LIMIT
 490         depends on NF_TABLES
 491         tristate "Netfilter nf_tables limit module"
 492         help
 493           This option adds the "limit" expression that you can use to
 494           ratelimit rule matchings.
 495
 496 config NFT_NAT
 497         depends on NF_TABLES
 498         depends on NF_CONNTRACK
 499         depends on NF_NAT
 500         tristate "Netfilter nf_tables nat module"
 501         help
 502           This option adds the "nat" expression that you can use to perform
 503           typical Network Address Translation (NAT) packet transformations.
 504
 505 config NFT_QUEUE
 506         depends on NF_TABLES
 507         depends on NETFILTER_XTABLES
 508         depends on NETFILTER_NETLINK_QUEUE
 509         tristate "Netfilter nf_tables queue module"
 510         help
 511           This is required if you intend to use the userspace queueing
 512           infrastructure (also known as NFQUEUE) from nftables.
 513
 514 config NFT_REJECT
 515         depends on NF_TABLES
 516         depends on NF_TABLES_IPV6 || !NF_TABLES_IPV6
 517         default m if NETFILTER_ADVANCED=n
 518         tristate "Netfilter nf_tables reject support"
 519         help
 520           This option adds the "reject" expression that you can use to
 521           explicitly deny and notify via TCP reset/ICMP informational errors
 522           unallowed traffic.
 523
 524 config NFT_COMPAT
 525         depends on NF_TABLES
 526         depends on NETFILTER_XTABLES
 527         tristate "Netfilter x_tables over nf_tables module"
 528         help
 529           This is required if you intend to use any of existing
 530           x_tables match/target extensions over the nf_tables
 531           framework.
 532
 533 config NETFILTER_XTABLES
 534         tristate "Netfilter Xtables support (required for ip_tables)"
 535         default m if NETFILTER_ADVANCED=n
 536         help
 537           This is required if you intend to use any of ip_tables,
 538           ip6_tables or arp_tables.
 539
 540 if NETFILTER_XTABLES
 541
 542 comment "Xtables combined modules"
 543
 544 config NETFILTER_XT_MARK
 545         tristate 'nfmark target and match support'
 546         default m if NETFILTER_ADVANCED=n
 547         ---help---
 548         This option adds the "MARK" target and "mark" match.
 549
 550         Netfilter mark matching allows you to match packets based on the
 551         "nfmark" value in the packet.
 552         The target allows you to create rules in the "mangle" table which alter
 553         the netfilter mark (nfmark) field associated with the packet.
 554
 555         Prior to routing, the nfmark can influence the routing method (see
 556         "Use netfilter MARK value as routing key") and can also be used by
 557         other subsystems to change their behavior.
 558
 559 config NETFILTER_XT_CONNMARK
 560         tristate 'ctmark target and match support'
 561         depends on NF_CONNTRACK
 562         depends on NETFILTER_ADVANCED
 563         select NF_CONNTRACK_MARK
 564         ---help---
 565         This option adds the "CONNMARK" target and "connmark" match.
 566
 567         Netfilter allows you to store a mark value per connection (a.k.a.
 568         ctmark), similarly to the packet mark (nfmark). Using this
 569         target and match, you can set and match on this mark.
 570
 571 config NETFILTER_XT_SET
 572         tristate 'set target and match support'
 573         depends on IP_SET
 574         depends on NETFILTER_ADVANCED
 575         help
 576           This option adds the "SET" target and "set" match.
 577
 578           Using this target and match, you can add/delete and match
 579           elements in the sets created by ipset(8).
 580
 581           To compile it as a module, choose M here.  If unsure, say N.
 582
 583 # alphabetically ordered list of targets
 584
 585 comment "Xtables targets"
 586
 587 config NETFILTER_XT_TARGET_AUDIT
 588         tristate "AUDIT target support"
 589         depends on AUDIT
 590         depends on NETFILTER_ADVANCED
 591         ---help---
 592           This option adds a 'AUDIT' target, which can be used to create
 593           audit records for packets dropped/accepted.
 594
 595           To compileit as a module, choose M here. If unsure, say N.
 596
 597 config NETFILTER_XT_TARGET_CHECKSUM
 598         tristate "CHECKSUM target support"
 599         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 600         depends on NETFILTER_ADVANCED
 601         ---help---
 602           This option adds a `CHECKSUM' target, which can be used in the iptables mangle
 603           table.
 604
 605           You can use this target to compute and fill in the checksum in
 606           a packet that lacks a checksum.  This is particularly useful,
 607           if you need to work around old applications such as dhcp clients,
 608           that do not work well with checksum offloads, but don't want to disable
 609           checksum offload in your device.
 610
 611           To compile it as a module, choose M here.  If unsure, say N.
 612
 613 config NETFILTER_XT_TARGET_CLASSIFY
 614         tristate '"CLASSIFY" target support'
 615         depends on NETFILTER_ADVANCED
 616         help
 617           This option adds a `CLASSIFY' target, which enables the user to set
 618           the priority of a packet. Some qdiscs can use this value for
 619           classification, among these are:
 620
 621           atm, cbq, dsmark, pfifo_fast, htb, prio
 622
 623           To compile it as a module, choose M here.  If unsure, say N.
 624
 625 config NETFILTER_XT_TARGET_CONNMARK
 626         tristate  '"CONNMARK" target support'
 627         depends on NF_CONNTRACK
 628         depends on NETFILTER_ADVANCED
 629         select NETFILTER_XT_CONNMARK
 630         ---help---
 631         This is a backwards-compat option for the user's convenience
 632         (e.g. when running oldconfig). It selects
 633         CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
 634
 635 config NETFILTER_XT_TARGET_CONNSECMARK
 636         tristate '"CONNSECMARK" target support'
 637         depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
 638         default m if NETFILTER_ADVANCED=n
 639         help
 640           The CONNSECMARK target copies security markings from packets
 641           to connections, and restores security markings from connections
 642           to packets (if the packets are not already marked).  This would
 643           normally be used in conjunction with the SECMARK target.
 644
 645           To compile it as a module, choose M here.  If unsure, say N.
 646
 647 config NETFILTER_XT_TARGET_CT
 648         tristate '"CT" target support'
 649         depends on NF_CONNTRACK
 650         depends on IP_NF_RAW || IP6_NF_RAW
 651         depends on NETFILTER_ADVANCED
 652         help
 653           This options adds a `CT' target, which allows to specify initial
 654           connection tracking parameters like events to be delivered and
 655           the helper to be used.
 656
 657           To compile it as a module, choose M here.  If unsure, say N.
 658
 659 config NETFILTER_XT_TARGET_DSCP
 660         tristate '"DSCP" and "TOS" target support'
 661         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 662         depends on NETFILTER_ADVANCED
 663         help
 664           This option adds a `DSCP' target, which allows you to manipulate
 665           the IPv4/IPv6 header DSCP field (differentiated services codepoint).
 666
 667           The DSCP field can have any value between 0x0 and 0x3f inclusive.
 668
 669           It also adds the "TOS" target, which allows you to create rules in
 670           the "mangle" table which alter the Type Of Service field of an IPv4
 671           or the Priority field of an IPv6 packet, prior to routing.
 672
 673           To compile it as a module, choose M here.  If unsure, say N.
 674
 675 config NETFILTER_XT_TARGET_HL
 676         tristate '"HL" hoplimit target support'
 677         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 678         depends on NETFILTER_ADVANCED
 679         ---help---
 680         This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
 681         targets, which enable the user to change the
 682         hoplimit/time-to-live value of the IP header.
 683
 684         While it is safe to decrement the hoplimit/TTL value, the
 685         modules also allow to increment and set the hoplimit value of
 686         the header to arbitrary values. This is EXTREMELY DANGEROUS
 687         since you can easily create immortal packets that loop
 688         forever on the network.
 689
 690 config NETFILTER_XT_TARGET_HMARK
 691         tristate '"HMARK" target support'
 692         depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
 693         depends on NETFILTER_ADVANCED
 694         ---help---
 695         This option adds the "HMARK" target.
 696
 697         The target allows you to create rules in the "raw" and "mangle" tables
 698         which set the skbuff mark by means of hash calculation within a given
 699         range. The nfmark can influence the routing method (see "Use netfilter
 700         MARK value as routing key") and can also be used by other subsystems to
 701         change their behaviour.
 702
 703         To compile it as a module, choose M here. If unsure, say N.
 704
 705 config NETFILTER_XT_TARGET_IDLETIMER
 706         tristate  "IDLETIMER target support"
 707         depends on NETFILTER_ADVANCED
 708         help
 709
 710           This option adds the `IDLETIMER' target.  Each matching packet
 711           resets the timer associated with label specified when the rule is
 712           added.  When the timer expires, it triggers a sysfs notification.
 713           The remaining time for expiration can be read via sysfs.
 714
 715           To compile it as a module, choose M here.  If unsure, say N.
 716
 717 config NETFILTER_XT_TARGET_LED
 718         tristate '"LED" target support'
 719         depends on LEDS_CLASS && LEDS_TRIGGERS
 720         depends on NETFILTER_ADVANCED
 721         help
 722           This option adds a `LED' target, which allows you to blink LEDs in
 723           response to particular packets passing through your machine.
 724
 725           This can be used to turn a spare LED into a network activity LED,
 726           which only flashes in response to FTP transfers, for example.  Or
 727           you could have an LED which lights up for a minute or two every time
 728           somebody connects to your machine via SSH.
 729
 730           You will need support for the "led" class to make this work.
 731
 732           To create an LED trigger for incoming SSH traffic:
 733             iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
 734
 735           Then attach the new trigger to an LED on your system:
 736             echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
 737
 738           For more information on the LEDs available on your system, see
 739           Documentation/leds/leds-class.txt
 740
 741 config NETFILTER_XT_TARGET_LOG
 742         tristate "LOG target support"
 743         default m if NETFILTER_ADVANCED=n
 744         help
 745           This option adds a `LOG' target, which allows you to create rules in
 746           any iptables table which records the packet header to the syslog.
 747
 748           To compile it as a module, choose M here.  If unsure, say N.
 749
 750 config NETFILTER_XT_TARGET_MARK
 751         tristate '"MARK" target support'
 752         depends on NETFILTER_ADVANCED
 753         select NETFILTER_XT_MARK
 754         ---help---
 755         This is a backwards-compat option for the user's convenience
 756         (e.g. when running oldconfig). It selects
 757         CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
 758
 759 config NETFILTER_XT_TARGET_NETMAP
 760         tristate '"NETMAP" target support'
 761         depends on NF_NAT
 762         ---help---
 763         NETMAP is an implementation of static 1:1 NAT mapping of network
 764         addresses. It maps the network address part, while keeping the host
 765         address part intact.
 766
 767         To compile it as a module, choose M here. If unsure, say N.
 768
 769 config NETFILTER_XT_TARGET_NFLOG
 770         tristate '"NFLOG" target support'
 771         default m if NETFILTER_ADVANCED=n
 772         select NETFILTER_NETLINK_LOG
 773         help
 774           This option enables the NFLOG target, which allows to LOG
 775           messages through nfnetlink_log.
 776
 777           To compile it as a module, choose M here.  If unsure, say N.
 778
 779 config NETFILTER_XT_TARGET_NFQUEUE
 780         tristate '"NFQUEUE" target Support'
 781         depends on NETFILTER_ADVANCED
 782         select NETFILTER_NETLINK_QUEUE
 783         help
 784           This target replaced the old obsolete QUEUE target.
 785
 786           As opposed to QUEUE, it supports 65535 different queues,
 787           not just one.
 788
 789           To compile it as a module, choose M here.  If unsure, say N.
 790
 791 config NETFILTER_XT_TARGET_NOTRACK
 792         tristate  '"NOTRACK" target support (DEPRECATED)'
 793         depends on NF_CONNTRACK
 794         depends on IP_NF_RAW || IP6_NF_RAW
 795         depends on NETFILTER_ADVANCED
 796         select NETFILTER_XT_TARGET_CT
 797
 798 config NETFILTER_XT_TARGET_RATEEST
 799         tristate '"RATEEST" target support'
 800         depends on NETFILTER_ADVANCED
 801         help
 802           This option adds a `RATEEST' target, which allows to measure
 803           rates similar to TC estimators. The `rateest' match can be
 804           used to match on the measured rates.
 805
 806           To compile it as a module, choose M here.  If unsure, say N.
 807
 808 config NETFILTER_XT_TARGET_REDIRECT
 809         tristate "REDIRECT target support"
 810         depends on NF_NAT
 811         ---help---
 812         REDIRECT is a special case of NAT: all incoming connections are
 813         mapped onto the incoming interface's address, causing the packets to
 814         come to the local machine instead of passing through. This is
 815         useful for transparent proxies.
 816
 817         To compile it as a module, choose M here. If unsure, say N.
 818
 819 config NETFILTER_XT_TARGET_TEE
 820         tristate '"TEE" - packet cloning to alternate destination'
 821         depends on NETFILTER_ADVANCED
 822         depends on (IPV6 || IPV6=n)
 823         depends on !NF_CONNTRACK || NF_CONNTRACK
 824         ---help---
 825         This option adds a "TEE" target with which a packet can be cloned and
 826         this clone be rerouted to another nexthop.
 827
 828 config NETFILTER_XT_TARGET_TPROXY
 829         tristate '"TPROXY" target transparent proxying support'
 830         depends on NETFILTER_XTABLES
 831         depends on NETFILTER_ADVANCED
 832         depends on IP_NF_MANGLE
 833         select NF_DEFRAG_IPV4
 834         select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
 835         help
 836           This option adds a `TPROXY' target, which is somewhat similar to
 837           REDIRECT.  It can only be used in the mangle table and is useful
 838           to redirect traffic to a transparent proxy.  It does _not_ depend
 839           on Netfilter connection tracking and NAT, unlike REDIRECT.
 840           For it to work you will have to configure certain iptables rules
 841           and use policy routing. For more information on how to set it up
 842           see Documentation/networking/tproxy.txt.
 843
 844           To compile it as a module, choose M here.  If unsure, say N.
 845
 846 config NETFILTER_XT_TARGET_TRACE
 847         tristate  '"TRACE" target support'
 848         depends on IP_NF_RAW || IP6_NF_RAW
 849         depends on NETFILTER_ADVANCED
 850         help
 851           The TRACE target allows you to mark packets so that the kernel
 852           will log every rule which match the packets as those traverse
 853           the tables, chains, rules.
 854
 855           If you want to compile it as a module, say M here and read
 856           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 857
 858 config NETFILTER_XT_TARGET_SECMARK
 859         tristate '"SECMARK" target support'
 860         depends on NETWORK_SECMARK
 861         default m if NETFILTER_ADVANCED=n
 862         help
 863           The SECMARK target allows security marking of network
 864           packets, for use with security subsystems.
 865
 866           To compile it as a module, choose M here.  If unsure, say N.
 867
 868 config NETFILTER_XT_TARGET_TCPMSS
 869         tristate '"TCPMSS" target support'
 870         depends on (IPV6 || IPV6=n)
 871         default m if NETFILTER_ADVANCED=n
 872         ---help---
 873           This option adds a `TCPMSS' target, which allows you to alter the
 874           MSS value of TCP SYN packets, to control the maximum size for that
 875           connection (usually limiting it to your outgoing interface's MTU
 876           minus 40).
 877
 878           This is used to overcome criminally braindead ISPs or servers which
 879           block ICMP Fragmentation Needed packets.  The symptoms of this
 880           problem are that everything works fine from your Linux
 881           firewall/router, but machines behind it can never exchange large
 882           packets:
 883                 1) Web browsers connect, then hang with no data received.
 884                 2) Small mail works fine, but large emails hang.
 885                 3) ssh works fine, but scp hangs after initial handshaking.
 886
 887           Workaround: activate this option and add a rule to your firewall
 888           configuration like:
 889
 890           iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
 891                          -j TCPMSS --clamp-mss-to-pmtu
 892
 893           To compile it as a module, choose M here.  If unsure, say N.
 894
 895 config NETFILTER_XT_TARGET_TCPOPTSTRIP
 896         tristate '"TCPOPTSTRIP" target support'
 897         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 898         depends on NETFILTER_ADVANCED
 899         help
 900           This option adds a "TCPOPTSTRIP" target, which allows you to strip
 901           TCP options from TCP packets.
 902
 903 # alphabetically ordered list of matches
 904
 905 comment "Xtables matches"
 906
 907 config NETFILTER_XT_MATCH_ADDRTYPE
 908         tristate '"addrtype" address type match support'
 909         depends on NETFILTER_ADVANCED
 910         ---help---
 911           This option allows you to match what routing thinks of an address,
 912           eg. UNICAST, LOCAL, BROADCAST, ...
 913
 914           If you want to compile it as a module, say M here and read
 915           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 916
 917 config NETFILTER_XT_MATCH_BPF
 918         tristate '"bpf" match support'
 919         depends on NETFILTER_ADVANCED
 920         help
 921           BPF matching applies a linux socket filter to each packet and
 922           accepts those for which the filter returns non-zero.
 923
 924           To compile it as a module, choose M here.  If unsure, say N.
 925
 926 config NETFILTER_XT_MATCH_CGROUP
 927         tristate '"control group" match support'
 928         depends on NETFILTER_ADVANCED
 929         depends on CGROUPS
 930         select CGROUP_NET_CLASSID
 931         ---help---
 932         Socket/process control group matching allows you to match locally
 933         generated packets based on which net_cls control group processes
 934         belong to.
 935
 936 config NETFILTER_XT_MATCH_CLUSTER
 937         tristate '"cluster" match support'
 938         depends on NF_CONNTRACK
 939         depends on NETFILTER_ADVANCED
 940         ---help---
 941           This option allows you to build work-load-sharing clusters of
 942           network servers/stateful firewalls without having a dedicated
 943           load-balancing router/server/switch. Basically, this match returns
 944           true when the packet must be handled by this cluster node. Thus,
 945           all nodes see all packets and this match decides which node handles
 946           what packets. The work-load sharing algorithm is based on source
 947           address hashing.
 948
 949           If you say Y or M here, try `iptables -m cluster --help` for
 950           more information.
 951
 952 config NETFILTER_XT_MATCH_COMMENT
 953         tristate  '"comment" match support'
 954         depends on NETFILTER_ADVANCED
 955         help
 956           This option adds a `comment' dummy-match, which allows you to put
 957           comments in your iptables ruleset.
 958
 959           If you want to compile it as a module, say M here and read
 960           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 961
 962 config NETFILTER_XT_MATCH_CONNBYTES
 963         tristate  '"connbytes" per-connection counter match support'
 964         depends on NF_CONNTRACK
 965         depends on NETFILTER_ADVANCED
 966         help
 967           This option adds a `connbytes' match, which allows you to match the
 968           number of bytes and/or packets for each direction within a connection.
 969
 970           If you want to compile it as a module, say M here and read
 971           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 972
 973 config NETFILTER_XT_MATCH_CONNLABEL
 974         tristate '"connlabel" match support'
 975         select NF_CONNTRACK_LABELS
 976         depends on NF_CONNTRACK
 977         depends on NETFILTER_ADVANCED
 978         ---help---
 979           This match allows you to test and assign userspace-defined labels names
 980           to a connection.  The kernel only stores bit values - mapping
 981           names to bits is done by userspace.
 982
 983           Unlike connmark, more than 32 flag bits may be assigned to a
 984           connection simultaneously.
 985
 986 config NETFILTER_XT_MATCH_CONNLIMIT
 987         tristate '"connlimit" match support'
 988         depends on NF_CONNTRACK
 989         depends on NETFILTER_ADVANCED
 990         ---help---
 991           This match allows you to match against the number of parallel
 992           connections to a server per client IP address (or address block).
 993
 994 config NETFILTER_XT_MATCH_CONNMARK
 995         tristate  '"connmark" connection mark match support'
 996         depends on NF_CONNTRACK
 997         depends on NETFILTER_ADVANCED
 998         select NETFILTER_XT_CONNMARK
 999         ---help---
1000         This is a backwards-compat option for the user's convenience
1001         (e.g. when running oldconfig). It selects
1002         CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1003
1004 config NETFILTER_XT_MATCH_CONNTRACK
1005         tristate '"conntrack" connection tracking match support'
1006         depends on NF_CONNTRACK
1007         default m if NETFILTER_ADVANCED=n
1008         help
1009           This is a general conntrack match module, a superset of the state match.
1010
1011           It allows matching on additional conntrack information, which is
1012           useful in complex configurations, such as NAT gateways with multiple
1013           internet links or tunnels.
1014
1015           To compile it as a module, choose M here.  If unsure, say N.
1016
1017 config NETFILTER_XT_MATCH_CPU
1018         tristate '"cpu" match support'
1019         depends on NETFILTER_ADVANCED
1020         help
1021           CPU matching allows you to match packets based on the CPU
1022           currently handling the packet.
1023
1024           To compile it as a module, choose M here.  If unsure, say N.
1025
1026 config NETFILTER_XT_MATCH_DCCP
1027         tristate '"dccp" protocol match support'
1028         depends on NETFILTER_ADVANCED
1029         default IP_DCCP
1030         help
1031           With this option enabled, you will be able to use the iptables
1032           `dccp' match in order to match on DCCP source/destination ports
1033           and DCCP flags.
1034
1035           If you want to compile it as a module, say M here and read
1036           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1037
1038 config NETFILTER_XT_MATCH_DEVGROUP
1039         tristate '"devgroup" match support'
1040         depends on NETFILTER_ADVANCED
1041         help
1042           This options adds a `devgroup' match, which allows to match on the
1043           device group a network device is assigned to.
1044
1045           To compile it as a module, choose M here.  If unsure, say N.
1046
1047 config NETFILTER_XT_MATCH_DSCP
1048         tristate '"dscp" and "tos" match support'
1049         depends on NETFILTER_ADVANCED
1050         help
1051           This option adds a `DSCP' match, which allows you to match against
1052           the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1053
1054           The DSCP field can have any value between 0x0 and 0x3f inclusive.
1055
1056           It will also add a "tos" match, which allows you to match packets
1057           based on the Type Of Service fields of the IPv4 packet (which share
1058           the same bits as DSCP).
1059
1060           To compile it as a module, choose M here.  If unsure, say N.
1061
1062 config NETFILTER_XT_MATCH_ECN
1063         tristate '"ecn" match support'
1064         depends on NETFILTER_ADVANCED
1065         ---help---
1066         This option adds an "ECN" match, which allows you to match against
1067         the IPv4 and TCP header ECN fields.
1068
1069         To compile it as a module, choose M here. If unsure, say N.
1070
1071 config NETFILTER_XT_MATCH_ESP
1072         tristate '"esp" match support'
1073         depends on NETFILTER_ADVANCED
1074         help
1075           This match extension allows you to match a range of SPIs
1076           inside ESP header of IPSec packets.
1077
1078           To compile it as a module, choose M here.  If unsure, say N.
1079
1080 config NETFILTER_XT_MATCH_HASHLIMIT
1081         tristate '"hashlimit" match support'
1082         depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
1083         depends on NETFILTER_ADVANCED
1084         help
1085           This option adds a `hashlimit' match.
1086
1087           As opposed to `limit', this match dynamically creates a hash table
1088           of limit buckets, based on your selection of source/destination
1089           addresses and/or ports.
1090
1091           It enables you to express policies like `10kpps for any given
1092           destination address' or `500pps from any given source address'
1093           with a single rule.
1094
1095 config NETFILTER_XT_MATCH_HELPER
1096         tristate '"helper" match support'
1097         depends on NF_CONNTRACK
1098         depends on NETFILTER_ADVANCED
1099         help
1100           Helper matching allows you to match packets in dynamic connections
1101           tracked by a conntrack-helper, ie. ip_conntrack_ftp
1102
1103           To compile it as a module, choose M here.  If unsure, say Y.
1104
1105 config NETFILTER_XT_MATCH_HL
1106         tristate '"hl" hoplimit/TTL match support'
1107         depends on NETFILTER_ADVANCED
1108         ---help---
1109         HL matching allows you to match packets based on the hoplimit
1110         in the IPv6 header, or the time-to-live field in the IPv4
1111         header of the packet.
1112
1113 config NETFILTER_XT_MATCH_IPCOMP
1114         tristate '"ipcomp" match support'
1115         depends on NETFILTER_ADVANCED
1116         help
1117           This match extension allows you to match a range of CPIs(16 bits)
1118           inside IPComp header of IPSec packets.
1119
1120           To compile it as a module, choose M here.  If unsure, say N.
1121
1122 config NETFILTER_XT_MATCH_IPRANGE
1123         tristate '"iprange" address range match support'
1124         depends on NETFILTER_ADVANCED
1125         ---help---
1126         This option adds a "iprange" match, which allows you to match based on
1127         an IP address range. (Normal iptables only matches on single addresses
1128         with an optional mask.)
1129
1130         If unsure, say M.
1131
1132 config NETFILTER_XT_MATCH_IPVS
1133         tristate '"ipvs" match support'
1134         depends on IP_VS
1135         depends on NETFILTER_ADVANCED
1136         depends on NF_CONNTRACK
1137         help
1138           This option allows you to match against IPVS properties of a packet.
1139
1140           If unsure, say N.
1141
1142 config NETFILTER_XT_MATCH_L2TP
1143         tristate '"l2tp" match support'
1144         depends on NETFILTER_ADVANCED
1145         default L2TP
1146         ---help---
1147         This option adds an "L2TP" match, which allows you to match against
1148         L2TP protocol header fields.
1149
1150         To compile it as a module, choose M here. If unsure, say N.
1151
1152 config NETFILTER_XT_MATCH_LENGTH
1153         tristate '"length" match support'
1154         depends on NETFILTER_ADVANCED
1155         help
1156           This option allows you to match the length of a packet against a
1157           specific value or range of values.
1158
1159           To compile it as a module, choose M here.  If unsure, say N.
1160
1161 config NETFILTER_XT_MATCH_LIMIT
1162         tristate '"limit" match support'
1163         depends on NETFILTER_ADVANCED
1164         help
1165           limit matching allows you to control the rate at which a rule can be
1166           matched: mainly useful in combination with the LOG target ("LOG
1167           target support", below) and to avoid some Denial of Service attacks.
1168
1169           To compile it as a module, choose M here.  If unsure, say N.
1170
1171 config NETFILTER_XT_MATCH_MAC
1172         tristate '"mac" address match support'
1173         depends on NETFILTER_ADVANCED
1174         help
1175           MAC matching allows you to match packets based on the source
1176           Ethernet address of the packet.
1177
1178           To compile it as a module, choose M here.  If unsure, say N.
1179
1180 config NETFILTER_XT_MATCH_MARK
1181         tristate '"mark" match support'
1182         depends on NETFILTER_ADVANCED
1183         select NETFILTER_XT_MARK
1184         ---help---
1185         This is a backwards-compat option for the user's convenience
1186         (e.g. when running oldconfig). It selects
1187         CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1188
1189 config NETFILTER_XT_MATCH_MULTIPORT
1190         tristate '"multiport" Multiple port match support'
1191         depends on NETFILTER_ADVANCED
1192         help
1193           Multiport matching allows you to match TCP or UDP packets based on
1194           a series of source or destination ports: normally a rule can only
1195           match a single range of ports.
1196
1197           To compile it as a module, choose M here.  If unsure, say N.
1198
1199 config NETFILTER_XT_MATCH_NFACCT
1200         tristate '"nfacct" match support'
1201         depends on NETFILTER_ADVANCED
1202         select NETFILTER_NETLINK_ACCT
1203         help
1204           This option allows you to use the extended accounting through
1205           nfnetlink_acct.
1206
1207           To compile it as a module, choose M here.  If unsure, say N.
1208
1209 config NETFILTER_XT_MATCH_OSF
1210         tristate '"osf" Passive OS fingerprint match'
1211         depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
1212         help
1213           This option selects the Passive OS Fingerprinting match module
1214           that allows to passively match the remote operating system by
1215           analyzing incoming TCP SYN packets.
1216
1217           Rules and loading software can be downloaded from
1218           http://www.ioremap.net/projects/osf
1219
1220           To compile it as a module, choose M here.  If unsure, say N.
1221
1222 config NETFILTER_XT_MATCH_OWNER
1223         tristate '"owner" match support'
1224         depends on NETFILTER_ADVANCED
1225         ---help---
1226         Socket owner matching allows you to match locally-generated packets
1227         based on who created the socket: the user or group. It is also
1228         possible to check whether a socket actually exists.
1229
1230 config NETFILTER_XT_MATCH_POLICY
1231         tristate 'IPsec "policy" match support'
1232         depends on XFRM
1233         default m if NETFILTER_ADVANCED=n
1234         help
1235           Policy matching allows you to match packets based on the
1236           IPsec policy that was used during decapsulation/will
1237           be used during encapsulation.
1238
1239           To compile it as a module, choose M here.  If unsure, say N.
1240
1241 config NETFILTER_XT_MATCH_PHYSDEV
1242         tristate '"physdev" match support'
1243         depends on BRIDGE && BRIDGE_NETFILTER
1244         depends on NETFILTER_ADVANCED
1245         help
1246           Physdev packet matching matches against the physical bridge ports
1247           the IP packet arrived on or will leave by.
1248
1249           To compile it as a module, choose M here.  If unsure, say N.
1250
1251 config NETFILTER_XT_MATCH_PKTTYPE
1252         tristate '"pkttype" packet type match support'
1253         depends on NETFILTER_ADVANCED
1254         help
1255           Packet type matching allows you to match a packet by
1256           its "class", eg. BROADCAST, MULTICAST, ...
1257
1258           Typical usage:
1259           iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1260
1261           To compile it as a module, choose M here.  If unsure, say N.
1262
1263 config NETFILTER_XT_MATCH_QUOTA
1264         tristate '"quota" match support'
1265         depends on NETFILTER_ADVANCED
1266         help
1267           This option adds a `quota' match, which allows to match on a
1268           byte counter.
1269
1270           If you want to compile it as a module, say M here and read
1271           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1272
1273 config NETFILTER_XT_MATCH_RATEEST
1274         tristate '"rateest" match support'
1275         depends on NETFILTER_ADVANCED
1276         select NETFILTER_XT_TARGET_RATEEST
1277         help
1278           This option adds a `rateest' match, which allows to match on the
1279           rate estimated by the RATEEST target.
1280
1281           To compile it as a module, choose M here.  If unsure, say N.
1282
1283 config NETFILTER_XT_MATCH_REALM
1284         tristate  '"realm" match support'
1285         depends on NETFILTER_ADVANCED
1286         select IP_ROUTE_CLASSID
1287         help
1288           This option adds a `realm' match, which allows you to use the realm
1289           key from the routing subsystem inside iptables.
1290
1291           This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1292           in tc world.
1293
1294           If you want to compile it as a module, say M here and read
1295           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1296
1297 config NETFILTER_XT_MATCH_RECENT
1298         tristate '"recent" match support'
1299         depends on NETFILTER_ADVANCED
1300         ---help---
1301         This match is used for creating one or many lists of recently
1302         used addresses and then matching against that/those list(s).
1303
1304         Short options are available by using 'iptables -m recent -h'
1305         Official Website: <http://snowman.net/projects/ipt_recent/>
1306
1307 config NETFILTER_XT_MATCH_SCTP
1308         tristate  '"sctp" protocol match support'
1309         depends on NETFILTER_ADVANCED
1310         default IP_SCTP
1311         help
1312           With this option enabled, you will be able to use the
1313           `sctp' match in order to match on SCTP source/destination ports
1314           and SCTP chunk types.
1315
1316           If you want to compile it as a module, say M here and read
1317           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1318
1319 config NETFILTER_XT_MATCH_SOCKET
1320         tristate '"socket" match support'
1321         depends on NETFILTER_XTABLES
1322         depends on NETFILTER_ADVANCED
1323         depends on !NF_CONNTRACK || NF_CONNTRACK
1324         depends on (IPV6 || IPV6=n)
1325         select NF_DEFRAG_IPV4
1326         select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
1327         help
1328           This option adds a `socket' match, which can be used to match
1329           packets for which a TCP or UDP socket lookup finds a valid socket.
1330           It can be used in combination with the MARK target and policy
1331           routing to implement full featured non-locally bound sockets.
1332
1333           To compile it as a module, choose M here.  If unsure, say N.
1334
1335 config NETFILTER_XT_MATCH_STATE
1336         tristate '"state" match support'
1337         depends on NF_CONNTRACK
1338         default m if NETFILTER_ADVANCED=n
1339         help
1340           Connection state matching allows you to match packets based on their
1341           relationship to a tracked connection (ie. previous packets).  This
1342           is a powerful tool for packet classification.
1343
1344           To compile it as a module, choose M here.  If unsure, say N.
1345
1346 config NETFILTER_XT_MATCH_STATISTIC
1347         tristate '"statistic" match support'
1348         depends on NETFILTER_ADVANCED
1349         help
1350           This option adds a `statistic' match, which allows you to match
1351           on packets periodically or randomly with a given percentage.
1352
1353           To compile it as a module, choose M here.  If unsure, say N.
1354
1355 config NETFILTER_XT_MATCH_STRING
1356         tristate  '"string" match support'
1357         depends on NETFILTER_ADVANCED
1358         select TEXTSEARCH
1359         select TEXTSEARCH_KMP
1360         select TEXTSEARCH_BM
1361         select TEXTSEARCH_FSM
1362         help
1363           This option adds a `string' match, which allows you to look for
1364           pattern matchings in packets.
1365
1366           To compile it as a module, choose M here.  If unsure, say N.
1367
1368 config NETFILTER_XT_MATCH_TCPMSS
1369         tristate '"tcpmss" match support'
1370         depends on NETFILTER_ADVANCED
1371         help
1372           This option adds a `tcpmss' match, which allows you to examine the
1373           MSS value of TCP SYN packets, which control the maximum packet size
1374           for that connection.
1375
1376           To compile it as a module, choose M here.  If unsure, say N.
1377
1378 config NETFILTER_XT_MATCH_TIME
1379         tristate '"time" match support'
1380         depends on NETFILTER_ADVANCED
1381         ---help---
1382           This option adds a "time" match, which allows you to match based on
1383           the packet arrival time (at the machine which netfilter is running)
1384           on) or departure time/date (for locally generated packets).
1385
1386           If you say Y here, try `iptables -m time --help` for
1387           more information.
1388
1389           If you want to compile it as a module, say M here.
1390           If unsure, say N.
1391
1392 config NETFILTER_XT_MATCH_U32
1393         tristate '"u32" match support'
1394         depends on NETFILTER_ADVANCED
1395         ---help---
1396           u32 allows you to extract quantities of up to 4 bytes from a packet,
1397           AND them with specified masks, shift them by specified amounts and
1398           test whether the results are in any of a set of specified ranges.
1399           The specification of what to extract is general enough to skip over
1400           headers with lengths stored in the packet, as in IP or TCP header
1401           lengths.
1402
1403           Details and examples are in the kernel module source.
1404
1405 endif # NETFILTER_XTABLES
1406
1407 endmenu
1408
1409 source "net/netfilter/ipset/Kconfig"
1410
1411 source "net/netfilter/ipvs/Kconfig"