1# SPDX-License-Identifier: GPL-2.0-only
   2menu "Core Netfilter Configuration"
   3	depends on INET && NETFILTER
   4
   5config NETFILTER_INGRESS
   6	bool "Netfilter ingress support"
   7	default y
   8	select NET_INGRESS
   9	help
  10	  This allows you to classify packets from ingress using the Netfilter
  11	  infrastructure.
  12
  13config NETFILTER_NETLINK
  14	tristate
  15
  16config NETFILTER_FAMILY_BRIDGE
  17	bool
  18
  19config NETFILTER_FAMILY_ARP
  20	bool
  21
  22config NETFILTER_NETLINK_HOOK
  23	tristate "Netfilter base hook dump support"
  24	depends on NETFILTER_ADVANCED
  25	depends on NF_TABLES
  26	select NETFILTER_NETLINK
  27	help
  28	  If this option is enabled, the kernel will include support
  29	  to list the base netfilter hooks via NFNETLINK.
  30	  This is helpful for debugging.
  31
  32config NETFILTER_NETLINK_ACCT
  33	tristate "Netfilter NFACCT over NFNETLINK interface"
  34	depends on NETFILTER_ADVANCED
  35	select NETFILTER_NETLINK
  36	help
  37	  If this option is enabled, the kernel will include support
  38	  for extended accounting via NFNETLINK.
  39
  40config NETFILTER_NETLINK_QUEUE
  41	tristate "Netfilter NFQUEUE over NFNETLINK interface"
  42	depends on NETFILTER_ADVANCED
  43	select NETFILTER_NETLINK
  44	help
  45	  If this option is enabled, the kernel will include support
  46	  for queueing packets via NFNETLINK.
  47
  48config NETFILTER_NETLINK_LOG
  49	tristate "Netfilter LOG over NFNETLINK interface"
  50	default m if NETFILTER_ADVANCED=n
  51	select NETFILTER_NETLINK
  52	help
  53	  If this option is enabled, the kernel will include support
  54	  for logging packets via NFNETLINK.
  55
  56	  This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
  57	  and is also scheduled to replace the old syslog-based ipt_LOG
  58	  and ip6t_LOG modules.
  59
  60config NETFILTER_NETLINK_OSF
  61	tristate "Netfilter OSF over NFNETLINK interface"
  62	depends on NETFILTER_ADVANCED
  63	select NETFILTER_NETLINK
  64	help
  65	  If this option is enabled, the kernel will include support
  66	  for passive OS fingerprint via NFNETLINK.
  67
  68config NF_CONNTRACK
  69	tristate "Netfilter connection tracking support"
  70	default m if NETFILTER_ADVANCED=n
  71	select NF_DEFRAG_IPV4
  72	select NF_DEFRAG_IPV6 if IPV6 != n
  73	help
  74	  Connection tracking keeps a record of what packets have passed
  75	  through your machine, in order to figure out how they are related
  76	  into connections.
  77
  78	  This is required to do Masquerading or other kinds of Network
  79	  Address Translation.  It can also be used to enhance packet
  80	  filtering (see `Connection state match support' below).
  81
  82	  To compile it as a module, choose M here.  If unsure, say N.
  83
  84config NF_LOG_SYSLOG
  85	tristate "Syslog packet logging"
  86	default m if NETFILTER_ADVANCED=n
  87	help
  88	  This option enable support for packet logging via syslog.
  89	  It supports IPv4, IPV6, ARP and common transport protocols such
  90	  as TCP and UDP.
  91	  This is a simpler but less flexible logging method compared to
  92	  CONFIG_NETFILTER_NETLINK_LOG.
  93	  If both are enabled the backend to use can be configured at run-time
  94	  by means of per-address-family sysctl tunables.
  95
  96if NF_CONNTRACK
  97config NETFILTER_CONNCOUNT
  98	tristate
  99
 100config NF_CONNTRACK_MARK
 101	bool  'Connection mark tracking support'
 102	depends on NETFILTER_ADVANCED
 103	help
 104	  This option enables support for connection marks, used by the
 105	  `CONNMARK' target and `connmark' match. Similar to the mark value
 106	  of packets, but this mark value is kept in the conntrack session
 107	  instead of the individual packets.
 108
 109config NF_CONNTRACK_SECMARK
 110	bool  'Connection tracking security mark support'
 111	depends on NETWORK_SECMARK
 112	default y if NETFILTER_ADVANCED=n
 113	help
 114	  This option enables security markings to be applied to
 115	  connections.  Typically they are copied to connections from
 116	  packets using the CONNSECMARK target and copied back from
 117	  connections to packets with the same target, with the packets
 118	  being originally labeled via SECMARK.
 119
 120	  If unsure, say 'N'.
 121
 122config NF_CONNTRACK_ZONES
 123	bool  'Connection tracking zones'
 124	depends on NETFILTER_ADVANCED
 
 125	help
 126	  This option enables support for connection tracking zones.
 127	  Normally, each connection needs to have a unique system wide
 128	  identity. Connection tracking zones allow to have multiple
 129	  connections using the same identity, as long as they are
 130	  contained in different zones.
 131
 132	  If unsure, say `N'.
 133
 134config NF_CONNTRACK_PROCFS
 135	bool "Supply CT list in procfs (OBSOLETE)"
 136	default y
 137	depends on PROC_FS
 138	help
 139	This option enables for the list of known conntrack entries
 140	to be shown in procfs under net/netfilter/nf_conntrack. This
 141	is considered obsolete in favor of using the conntrack(8)
 142	tool which uses Netlink.
 143
 144config NF_CONNTRACK_EVENTS
 145	bool "Connection tracking events"
 146	depends on NETFILTER_ADVANCED
 147	help
 148	  If this option is enabled, the connection tracking code will
 149	  provide a notifier chain that can be used by other kernel code
 150	  to get notified about changes in the connection tracking state.
 151
 152	  If unsure, say `N'.
 153
 154config NF_CONNTRACK_TIMEOUT
 155	bool  'Connection tracking timeout'
 156	depends on NETFILTER_ADVANCED
 157	help
 158	  This option enables support for connection tracking timeout
 159	  extension. This allows you to attach timeout policies to flow
 160	  via the CT target.
 161
 162	  If unsure, say `N'.
 163
 164config NF_CONNTRACK_TIMESTAMP
 165	bool  'Connection tracking timestamping'
 166	depends on NETFILTER_ADVANCED
 167	help
 168	  This option enables support for connection tracking timestamping.
 169	  This allows you to store the flow start-time and to obtain
 170	  the flow-stop time (once it has been destroyed) via Connection
 171	  tracking events.
 172
 173	  If unsure, say `N'.
 174
 175config NF_CONNTRACK_LABELS
 176	bool "Connection tracking labels"
 177	help
 178	  This option enables support for assigning user-defined flag bits
 179	  to connection tracking entries.  It can be used with xtables connlabel
 180	  match and the nftables ct expression.
 181
 182config NF_CT_PROTO_DCCP
 183	bool 'DCCP protocol connection tracking support'
 184	depends on NETFILTER_ADVANCED
 185	default y
 186	help
 187	  With this option enabled, the layer 3 independent connection
 188	  tracking code will be able to do state tracking on DCCP connections.
 189
 190	  If unsure, say Y.
 191
 192config NF_CT_PROTO_GRE
 193	bool
 194
 195config NF_CT_PROTO_SCTP
 196	bool 'SCTP protocol connection tracking support'
 197	depends on NETFILTER_ADVANCED
 198	default y
 199	select LIBCRC32C
 200	help
 201	  With this option enabled, the layer 3 independent connection
 202	  tracking code will be able to do state tracking on SCTP connections.
 203
 204	  If unsure, say Y.
 
 205
 206config NF_CT_PROTO_UDPLITE
 207	bool 'UDP-Lite protocol connection tracking support'
 208	depends on NETFILTER_ADVANCED
 209	default y
 210	help
 211	  With this option enabled, the layer 3 independent connection
 212	  tracking code will be able to do state tracking on UDP-Lite
 213	  connections.
 214
 215	  If unsure, say Y.
 216
 217config NF_CONNTRACK_AMANDA
 218	tristate "Amanda backup protocol support"
 219	depends on NETFILTER_ADVANCED
 220	select TEXTSEARCH
 221	select TEXTSEARCH_KMP
 222	help
 223	  If you are running the Amanda backup package <http://www.amanda.org/>
 224	  on this machine or machines that will be MASQUERADED through this
 225	  machine, then you may want to enable this feature.  This allows the
 226	  connection tracking and natting code to allow the sub-channels that
 227	  Amanda requires for communication of the backup data, messages and
 228	  index.
 229
 230	  To compile it as a module, choose M here.  If unsure, say N.
 231
 232config NF_CONNTRACK_FTP
 233	tristate "FTP protocol support"
 234	default m if NETFILTER_ADVANCED=n
 235	help
 236	  Tracking FTP connections is problematic: special helpers are
 237	  required for tracking them, and doing masquerading and other forms
 238	  of Network Address Translation on them.
 239
 240	  This is FTP support on Layer 3 independent connection tracking.
 
 
 241
 242	  To compile it as a module, choose M here.  If unsure, say N.
 243
 244config NF_CONNTRACK_H323
 245	tristate "H.323 protocol support"
 246	depends on IPV6 || IPV6=n
 247	depends on NETFILTER_ADVANCED
 248	help
 249	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
 250	  important VoIP protocols, it is widely used by voice hardware and
 251	  software including voice gateways, IP phones, Netmeeting, OpenPhone,
 252	  Gnomemeeting, etc.
 253
 254	  With this module you can support H.323 on a connection tracking/NAT
 255	  firewall.
 256
 257	  This module supports RAS, Fast Start, H.245 Tunnelling, Call
 258	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
 259	  whiteboard, file transfer, etc. For more information, please
 260	  visit http://nath323.sourceforge.net/.
 261
 262	  To compile it as a module, choose M here.  If unsure, say N.
 263
 264config NF_CONNTRACK_IRC
 265	tristate "IRC protocol support"
 266	default m if NETFILTER_ADVANCED=n
 267	help
 268	  There is a commonly-used extension to IRC called
 269	  Direct Client-to-Client Protocol (DCC).  This enables users to send
 270	  files to each other, and also chat to each other without the need
 271	  of a server.  DCC Sending is used anywhere you send files over IRC,
 272	  and DCC Chat is most commonly used by Eggdrop bots.  If you are
 273	  using NAT, this extension will enable you to send files and initiate
 274	  chats.  Note that you do NOT need this extension to get files or
 275	  have others initiate chats, or everything else in IRC.
 276
 277	  To compile it as a module, choose M here.  If unsure, say N.
 278
 279config NF_CONNTRACK_BROADCAST
 280	tristate
 281
 282config NF_CONNTRACK_NETBIOS_NS
 283	tristate "NetBIOS name service protocol support"
 284	select NF_CONNTRACK_BROADCAST
 285	help
 286	  NetBIOS name service requests are sent as broadcast messages from an
 287	  unprivileged port and responded to with unicast messages to the
 288	  same port. This make them hard to firewall properly because connection
 289	  tracking doesn't deal with broadcasts. This helper tracks locally
 290	  originating NetBIOS name service requests and the corresponding
 291	  responses. It relies on correct IP address configuration, specifically
 292	  netmask and broadcast address. When properly configured, the output
 293	  of "ip address show" should look similar to this:
 294
 295	  $ ip -4 address show eth0
 296	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
 297	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
 298
 299	  To compile it as a module, choose M here.  If unsure, say N.
 300
 301config NF_CONNTRACK_SNMP
 302	tristate "SNMP service protocol support"
 303	depends on NETFILTER_ADVANCED
 304	select NF_CONNTRACK_BROADCAST
 305	help
 306	  SNMP service requests are sent as broadcast messages from an
 307	  unprivileged port and responded to with unicast messages to the
 308	  same port. This make them hard to firewall properly because connection
 309	  tracking doesn't deal with broadcasts. This helper tracks locally
 310	  originating SNMP service requests and the corresponding
 311	  responses. It relies on correct IP address configuration, specifically
 312	  netmask and broadcast address.
 313
 314	  To compile it as a module, choose M here.  If unsure, say N.
 315
 316config NF_CONNTRACK_PPTP
 317	tristate "PPtP protocol support"
 318	depends on NETFILTER_ADVANCED
 319	select NF_CT_PROTO_GRE
 320	help
 321	  This module adds support for PPTP (Point to Point Tunnelling
 322	  Protocol, RFC2637) connection tracking and NAT.
 323
 324	  If you are running PPTP sessions over a stateful firewall or NAT
 325	  box, you may want to enable this feature.
 326
 327	  Please note that not all PPTP modes of operation are supported yet.
 328	  Specifically these limitations exist:
 329	    - Blindly assumes that control connections are always established
 330	      in PNS->PAC direction. This is a violation of RFC2637.
 331	    - Only supports a single call within each session
 332
 333	  To compile it as a module, choose M here.  If unsure, say N.
 334
 335config NF_CONNTRACK_SANE
 336	tristate "SANE protocol support"
 337	depends on NETFILTER_ADVANCED
 338	help
 339	  SANE is a protocol for remote access to scanners as implemented
 340	  by the 'saned' daemon. Like FTP, it uses separate control and
 341	  data connections.
 342
 343	  With this module you can support SANE on a connection tracking
 344	  firewall.
 345
 346	  To compile it as a module, choose M here.  If unsure, say N.
 347
 348config NF_CONNTRACK_SIP
 349	tristate "SIP protocol support"
 350	default m if NETFILTER_ADVANCED=n
 351	help
 352	  SIP is an application-layer control protocol that can establish,
 353	  modify, and terminate multimedia sessions (conferences) such as
 354	  Internet telephony calls. With the nf_conntrack_sip and
 355	  the nf_nat_sip modules you can support the protocol on a connection
 356	  tracking/NATing firewall.
 357
 358	  To compile it as a module, choose M here.  If unsure, say N.
 359
 360config NF_CONNTRACK_TFTP
 361	tristate "TFTP protocol support"
 362	depends on NETFILTER_ADVANCED
 363	help
 364	  TFTP connection tracking helper, this is required depending
 365	  on how restrictive your ruleset is.
 366	  If you are using a tftp client behind -j SNAT or -j MASQUERADING
 367	  you will need this.
 368
 369	  To compile it as a module, choose M here.  If unsure, say N.
 370
 371config NF_CT_NETLINK
 372	tristate 'Connection tracking netlink interface'
 373	select NETFILTER_NETLINK
 374	default m if NETFILTER_ADVANCED=n
 375	help
 376	  This option enables support for a netlink-based userspace interface
 377
 378config NF_CT_NETLINK_TIMEOUT
 379	tristate  'Connection tracking timeout tuning via Netlink'
 380	select NETFILTER_NETLINK
 381	depends on NETFILTER_ADVANCED
 382	depends on NF_CONNTRACK_TIMEOUT
 383	help
 384	  This option enables support for connection tracking timeout
 385	  fine-grain tuning. This allows you to attach specific timeout
 386	  policies to flows, instead of using the global timeout policy.
 387
 388	  If unsure, say `N'.
 389
 390config NF_CT_NETLINK_HELPER
 391	tristate 'Connection tracking helpers in user-space via Netlink'
 392	select NETFILTER_NETLINK
 393	depends on NF_CT_NETLINK
 394	depends on NETFILTER_NETLINK_QUEUE
 395	depends on NETFILTER_NETLINK_GLUE_CT
 396	depends on NETFILTER_ADVANCED
 397	help
 398	  This option enables the user-space connection tracking helpers
 399	  infrastructure.
 400
 401	  If unsure, say `N'.
 402
 403config NETFILTER_NETLINK_GLUE_CT
 404	bool "NFQUEUE and NFLOG integration with Connection Tracking"
 405	default n
 406	depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
 407	help
 408	  If this option is enabled, NFQUEUE and NFLOG can include
 409	  Connection Tracking information together with the packet is
 410	  the enqueued via NFNETLINK.
 411
 412config NF_NAT
 413	tristate "Network Address Translation support"
 414	depends on NF_CONNTRACK
 415	default m if NETFILTER_ADVANCED=n
 416	help
 417	  The NAT option allows masquerading, port forwarding and other
 418	  forms of full Network Address Port Translation. This can be
 419	  controlled by iptables, ip6tables or nft.
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 420
 421config NF_NAT_AMANDA
 422	tristate
 423	depends on NF_CONNTRACK && NF_NAT
 424	default NF_NAT && NF_CONNTRACK_AMANDA
 425
 426config NF_NAT_FTP
 427	tristate
 428	depends on NF_CONNTRACK && NF_NAT
 429	default NF_NAT && NF_CONNTRACK_FTP
 430
 431config NF_NAT_IRC
 432	tristate
 433	depends on NF_CONNTRACK && NF_NAT
 434	default NF_NAT && NF_CONNTRACK_IRC
 435
 436config NF_NAT_SIP
 437	tristate
 438	depends on NF_CONNTRACK && NF_NAT
 439	default NF_NAT && NF_CONNTRACK_SIP
 440
 441config NF_NAT_TFTP
 442	tristate
 443	depends on NF_CONNTRACK && NF_NAT
 444	default NF_NAT && NF_CONNTRACK_TFTP
 445
 446config NF_NAT_REDIRECT
 447	bool
 448
 449config NF_NAT_MASQUERADE
 450	bool
 451
 452config NETFILTER_SYNPROXY
 453	tristate
 454
 455endif # NF_CONNTRACK
 456
 457config NF_TABLES
 458	select NETFILTER_NETLINK
 459	select LIBCRC32C
 460	tristate "Netfilter nf_tables support"
 461	help
 462	  nftables is the new packet classification framework that intends to
 463	  replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
 464	  provides a pseudo-state machine with an extensible instruction-set
 465	  (also known as expressions) that the userspace 'nft' utility
 466	  (https://www.netfilter.org/projects/nftables) uses to build the
 467	  rule-set. It also comes with the generic set infrastructure that
 468	  allows you to construct mappings between matchings and actions
 469	  for performance lookups.
 470
 471	  To compile it as a module, choose M here.
 472
 473if NF_TABLES
 474config NF_TABLES_INET
 475	depends on IPV6
 476	select NF_TABLES_IPV4
 477	select NF_TABLES_IPV6
 478	bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
 479	help
 480	  This option enables support for a mixed IPv4/IPv6 "inet" table.
 481
 482config NF_TABLES_NETDEV
 483	bool "Netfilter nf_tables netdev tables support"
 
 484	help
 485	  This option enables support for the "netdev" table.
 
 486
 487config NFT_NUMGEN
 488	tristate "Netfilter nf_tables number generator module"
 
 489	help
 490	  This option adds the number generator expression used to perform
 491	  incremental counting and random numbers bound to a upper limit.
 492
 493config NFT_CT
 
 494	depends on NF_CONNTRACK
 495	tristate "Netfilter nf_tables conntrack module"
 496	help
 497	  This option adds the "ct" expression that you can use to match
 498	  connection tracking information such as the flow state.
 499
 500config NFT_FLOW_OFFLOAD
 501	depends on NF_CONNTRACK && NF_FLOW_TABLE
 502	tristate "Netfilter nf_tables hardware flow offload module"
 503	help
 504	  This option adds the "flow_offload" expression that you can use to
 505	  choose what flows are placed into the hardware.
 
 
 
 
 
 
 
 506
 507config NFT_COUNTER
 
 508	tristate "Netfilter nf_tables counter module"
 509	help
 510	  This option adds the "counter" expression that you can use to
 511	  include packet and byte counters in a rule.
 512
 513config NFT_CONNLIMIT
 514	tristate "Netfilter nf_tables connlimit module"
 515	depends on NF_CONNTRACK
 516	depends on NETFILTER_ADVANCED
 517	select NETFILTER_CONNCOUNT
 518	help
 519	  This option adds the "connlimit" expression that you can use to
 520	  ratelimit rule matchings per connections.
 521
 522config NFT_LOG
 
 523	tristate "Netfilter nf_tables log module"
 524	help
 525	  This option adds the "log" expression that you can use to log
 526	  packets matching some criteria.
 527
 528config NFT_LIMIT
 
 529	tristate "Netfilter nf_tables limit module"
 530	help
 531	  This option adds the "limit" expression that you can use to
 532	  ratelimit rule matchings.
 533
 534config NFT_MASQ
 535	depends on NF_CONNTRACK
 536	depends on NF_NAT
 537	select NF_NAT_MASQUERADE
 538	tristate "Netfilter nf_tables masquerade support"
 539	help
 540	  This option adds the "masquerade" expression that you can use
 541	  to perform NAT in the masquerade flavour.
 542
 543config NFT_REDIR
 544	depends on NF_CONNTRACK
 545	depends on NF_NAT
 546	tristate "Netfilter nf_tables redirect support"
 547	select NF_NAT_REDIRECT
 548	help
 549	  This options adds the "redirect" expression that you can use
 550	  to perform NAT in the redirect flavour.
 551
 552config NFT_NAT
 
 553	depends on NF_CONNTRACK
 554	select NF_NAT
 555	depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
 556	tristate "Netfilter nf_tables nat module"
 557	help
 558	  This option adds the "nat" expression that you can use to perform
 559	  typical Network Address Translation (NAT) packet transformations.
 560
 561config NFT_TUNNEL
 562	tristate "Netfilter nf_tables tunnel module"
 563	help
 564	  This option adds the "tunnel" expression that you can use to set
 565	  tunneling policies.
 566
 567config NFT_OBJREF
 568	tristate "Netfilter nf_tables stateful object reference module"
 569	help
 570	  This option adds the "objref" expression that allows you to refer to
 571	  stateful objects, such as counters and quotas.
 572
 573config NFT_QUEUE
 
 
 574	depends on NETFILTER_NETLINK_QUEUE
 575	tristate "Netfilter nf_tables queue module"
 576	help
 577	  This is required if you intend to use the userspace queueing
 578	  infrastructure (also known as NFQUEUE) from nftables.
 579
 580config NFT_QUOTA
 581	tristate "Netfilter nf_tables quota module"
 582	help
 583	  This option adds the "quota" expression that you can use to match
 584	  enforce bytes quotas.
 585
 586config NFT_REJECT
 
 587	default m if NETFILTER_ADVANCED=n
 588	tristate "Netfilter nf_tables reject support"
 589	depends on !NF_TABLES_INET || (IPV6!=m || m)
 590	help
 591	  This option adds the "reject" expression that you can use to
 592	  explicitly deny and notify via TCP reset/ICMP informational errors
 593	  unallowed traffic.
 594
 595config NFT_REJECT_INET
 596	depends on NF_TABLES_INET
 597	default NFT_REJECT
 598	tristate
 599
 600config NFT_COMPAT
 
 601	depends on NETFILTER_XTABLES
 602	tristate "Netfilter x_tables over nf_tables module"
 603	help
 604	  This is required if you intend to use any of existing
 605	  x_tables match/target extensions over the nf_tables
 606	  framework.
 607
 608config NFT_HASH
 609	tristate "Netfilter nf_tables hash module"
 610	help
 611	  This option adds the "hash" expression that you can use to perform
 612	  a hash operation on registers.
 613
 614config NFT_FIB
 615	tristate
 616
 617config NFT_FIB_INET
 618	depends on NF_TABLES_INET
 619	depends on NFT_FIB_IPV4
 620	depends on NFT_FIB_IPV6
 621	tristate "Netfilter nf_tables fib inet support"
 622	help
 623	  This option allows using the FIB expression from the inet table.
 624	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
 625	  on the protocol of the packet.
 626
 627config NFT_XFRM
 628	tristate "Netfilter nf_tables xfrm/IPSec security association matching"
 629	depends on XFRM
 630	help
 631	  This option adds an expression that you can use to extract properties
 632	  of a packets security association.
 633
 634config NFT_SOCKET
 635	tristate "Netfilter nf_tables socket match support"
 636	depends on IPV6 || IPV6=n
 637	select NF_SOCKET_IPV4
 638	select NF_SOCKET_IPV6 if NF_TABLES_IPV6
 639	help
 640	  This option allows matching for the presence or absence of a
 641	  corresponding socket and its attributes.
 642
 643config NFT_OSF
 644	tristate "Netfilter nf_tables passive OS fingerprint support"
 645	depends on NETFILTER_ADVANCED
 646	select NETFILTER_NETLINK_OSF
 647	help
 648	  This option allows matching packets from an specific OS.
 649
 650config NFT_TPROXY
 651	tristate "Netfilter nf_tables tproxy support"
 652	depends on IPV6 || IPV6=n
 653	select NF_DEFRAG_IPV4
 654	select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
 655	select NF_TPROXY_IPV4
 656	select NF_TPROXY_IPV6 if NF_TABLES_IPV6
 657	help
 658	  This makes transparent proxy support available in nftables.
 659
 660config NFT_SYNPROXY
 661	tristate "Netfilter nf_tables SYNPROXY expression support"
 662	depends on NF_CONNTRACK && NETFILTER_ADVANCED
 663	select NETFILTER_SYNPROXY
 664	select SYN_COOKIES
 665	help
 666	  The SYNPROXY expression allows you to intercept TCP connections and
 667	  establish them using syncookies before they are passed on to the
 668	  server. This allows to avoid conntrack and server resource usage
 669	  during SYN-flood attacks.
 670
 671if NF_TABLES_NETDEV
 672
 673config NF_DUP_NETDEV
 674	tristate "Netfilter packet duplication support"
 675	help
 676	  This option enables the generic packet duplication infrastructure
 677	  for Netfilter.
 678
 679config NFT_DUP_NETDEV
 680	tristate "Netfilter nf_tables netdev packet duplication support"
 681	select NF_DUP_NETDEV
 682	help
 683	  This option enables packet duplication for the "netdev" family.
 684
 685config NFT_FWD_NETDEV
 686	tristate "Netfilter nf_tables netdev packet forwarding support"
 687	select NF_DUP_NETDEV
 688	help
 689	  This option enables packet forwarding for the "netdev" family.
 690
 691config NFT_FIB_NETDEV
 692	depends on NFT_FIB_IPV4
 693	depends on NFT_FIB_IPV6
 694	tristate "Netfilter nf_tables netdev fib lookups support"
 695	help
 696	  This option allows using the FIB expression from the netdev table.
 697	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
 698	  on the protocol of the packet.
 699
 700config NFT_REJECT_NETDEV
 701	depends on NFT_REJECT_IPV4
 702	depends on NFT_REJECT_IPV6
 703	tristate "Netfilter nf_tables netdev REJECT support"
 704	help
 705	  This option enables the REJECT support from the netdev table.
 706	  The return packet generation will be delegated to the IPv4
 707	  or IPv6 ICMP or TCP RST implementation depending on the
 708	  protocol of the packet.
 709
 710endif # NF_TABLES_NETDEV
 711
 712endif # NF_TABLES
 713
 714config NF_FLOW_TABLE_INET
 715	tristate "Netfilter flow table mixed IPv4/IPv6 module"
 716	depends on NF_FLOW_TABLE
 717	help
 718	  This option adds the flow table mixed IPv4/IPv6 support.
 719
 720	  To compile it as a module, choose M here.
 721
 722config NF_FLOW_TABLE
 723	tristate "Netfilter flow table module"
 724	depends on NETFILTER_INGRESS
 725	depends on NF_CONNTRACK
 726	depends on NF_TABLES
 727	help
 728	  This option adds the flow table core infrastructure.
 729
 730	  To compile it as a module, choose M here.
 731
 732config NETFILTER_XTABLES
 733	tristate "Netfilter Xtables support (required for ip_tables)"
 734	default m if NETFILTER_ADVANCED=n
 735	help
 736	  This is required if you intend to use any of ip_tables,
 737	  ip6_tables or arp_tables.
 738
 739if NETFILTER_XTABLES
 740
 741config NETFILTER_XTABLES_COMPAT
 742	bool "Netfilter Xtables 32bit support"
 743	depends on COMPAT
 744	default y
 745	help
 746	   This option provides a translation layer to run 32bit arp,ip(6),ebtables
 747	   binaries on 64bit kernels.
 748
 749	   If unsure, say N.
 750
 751comment "Xtables combined modules"
 752
 753config NETFILTER_XT_MARK
 754	tristate 'nfmark target and match support'
 755	default m if NETFILTER_ADVANCED=n
 756	help
 757	This option adds the "MARK" target and "mark" match.
 758
 759	Netfilter mark matching allows you to match packets based on the
 760	"nfmark" value in the packet.
 761	The target allows you to create rules in the "mangle" table which alter
 762	the netfilter mark (nfmark) field associated with the packet.
 763
 764	Prior to routing, the nfmark can influence the routing method and can
 765	also be used by other subsystems to change their behavior.
 
 766
 767config NETFILTER_XT_CONNMARK
 768	tristate 'ctmark target and match support'
 769	depends on NF_CONNTRACK
 770	depends on NETFILTER_ADVANCED
 771	select NF_CONNTRACK_MARK
 772	help
 773	This option adds the "CONNMARK" target and "connmark" match.
 774
 775	Netfilter allows you to store a mark value per connection (a.k.a.
 776	ctmark), similarly to the packet mark (nfmark). Using this
 777	target and match, you can set and match on this mark.
 778
 779config NETFILTER_XT_SET
 780	tristate 'set target and match support'
 781	depends on IP_SET
 782	depends on NETFILTER_ADVANCED
 783	help
 784	  This option adds the "SET" target and "set" match.
 785
 786	  Using this target and match, you can add/delete and match
 787	  elements in the sets created by ipset(8).
 788
 789	  To compile it as a module, choose M here.  If unsure, say N.
 790
 791# alphabetically ordered list of targets
 792
 793comment "Xtables targets"
 794
 795config NETFILTER_XT_TARGET_AUDIT
 796	tristate "AUDIT target support"
 797	depends on AUDIT
 798	depends on NETFILTER_ADVANCED
 799	help
 800	  This option adds a 'AUDIT' target, which can be used to create
 801	  audit records for packets dropped/accepted.
 802
 803	  To compileit as a module, choose M here. If unsure, say N.
 804
 805config NETFILTER_XT_TARGET_CHECKSUM
 806	tristate "CHECKSUM target support"
 807	depends on IP_NF_MANGLE || IP6_NF_MANGLE
 808	depends on NETFILTER_ADVANCED
 809	help
 810	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
 811	  table to work around buggy DHCP clients in virtualized environments.
 812
 813	  Some old DHCP clients drop packets because they are not aware
 814	  that the checksum would normally be offloaded to hardware and
 815	  thus should be considered valid.
 816	  This target can be used to fill in the checksum using iptables
 817	  when such packets are sent via a virtual network device.
 818
 819	  To compile it as a module, choose M here.  If unsure, say N.
 820
 821config NETFILTER_XT_TARGET_CLASSIFY
 822	tristate '"CLASSIFY" target support'
 823	depends on NETFILTER_ADVANCED
 824	help
 825	  This option adds a `CLASSIFY' target, which enables the user to set
 826	  the priority of a packet. Some qdiscs can use this value for
 827	  classification, among these are:
 828
 829	  atm, cbq, dsmark, pfifo_fast, htb, prio
 830
 831	  To compile it as a module, choose M here.  If unsure, say N.
 832
 833config NETFILTER_XT_TARGET_CONNMARK
 834	tristate  '"CONNMARK" target support'
 835	depends on NF_CONNTRACK
 836	depends on NETFILTER_ADVANCED
 837	select NETFILTER_XT_CONNMARK
 838	help
 839	This is a backwards-compat option for the user's convenience
 840	(e.g. when running oldconfig). It selects
 841	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
 842
 843config NETFILTER_XT_TARGET_CONNSECMARK
 844	tristate '"CONNSECMARK" target support'
 845	depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
 846	default m if NETFILTER_ADVANCED=n
 847	help
 848	  The CONNSECMARK target copies security markings from packets
 849	  to connections, and restores security markings from connections
 850	  to packets (if the packets are not already marked).  This would
 851	  normally be used in conjunction with the SECMARK target.
 852
 853	  To compile it as a module, choose M here.  If unsure, say N.
 854
 855config NETFILTER_XT_TARGET_CT
 856	tristate '"CT" target support'
 857	depends on NF_CONNTRACK
 858	depends on IP_NF_RAW || IP6_NF_RAW
 859	depends on NETFILTER_ADVANCED
 860	help
 861	  This options adds a `CT' target, which allows to specify initial
 862	  connection tracking parameters like events to be delivered and
 863	  the helper to be used.
 864
 865	  To compile it as a module, choose M here.  If unsure, say N.
 866
 867config NETFILTER_XT_TARGET_DSCP
 868	tristate '"DSCP" and "TOS" target support'
 869	depends on IP_NF_MANGLE || IP6_NF_MANGLE
 870	depends on NETFILTER_ADVANCED
 871	help
 872	  This option adds a `DSCP' target, which allows you to manipulate
 873	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
 874
 875	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
 876
 877	  It also adds the "TOS" target, which allows you to create rules in
 878	  the "mangle" table which alter the Type Of Service field of an IPv4
 879	  or the Priority field of an IPv6 packet, prior to routing.
 880
 881	  To compile it as a module, choose M here.  If unsure, say N.
 882
 883config NETFILTER_XT_TARGET_HL
 884	tristate '"HL" hoplimit target support'
 885	depends on IP_NF_MANGLE || IP6_NF_MANGLE
 886	depends on NETFILTER_ADVANCED
 887	help
 888	This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
 889	targets, which enable the user to change the
 890	hoplimit/time-to-live value of the IP header.
 891
 892	While it is safe to decrement the hoplimit/TTL value, the
 893	modules also allow to increment and set the hoplimit value of
 894	the header to arbitrary values. This is EXTREMELY DANGEROUS
 895	since you can easily create immortal packets that loop
 896	forever on the network.
 897
 898config NETFILTER_XT_TARGET_HMARK
 899	tristate '"HMARK" target support'
 900	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
 901	depends on NETFILTER_ADVANCED
 902	help
 903	This option adds the "HMARK" target.
 904
 905	The target allows you to create rules in the "raw" and "mangle" tables
 906	which set the skbuff mark by means of hash calculation within a given
 907	range. The nfmark can influence the routing method and can also be used
 908	by other subsystems to change their behaviour.
 
 909
 910	To compile it as a module, choose M here. If unsure, say N.
 911
 912config NETFILTER_XT_TARGET_IDLETIMER
 913	tristate  "IDLETIMER target support"
 914	depends on NETFILTER_ADVANCED
 915	help
 916
 917	  This option adds the `IDLETIMER' target.  Each matching packet
 918	  resets the timer associated with label specified when the rule is
 919	  added.  When the timer expires, it triggers a sysfs notification.
 920	  The remaining time for expiration can be read via sysfs.
 921
 922	  To compile it as a module, choose M here.  If unsure, say N.
 923
 924config NETFILTER_XT_TARGET_LED
 925	tristate '"LED" target support'
 926	depends on LEDS_CLASS && LEDS_TRIGGERS
 927	depends on NETFILTER_ADVANCED
 928	help
 929	  This option adds a `LED' target, which allows you to blink LEDs in
 930	  response to particular packets passing through your machine.
 931
 932	  This can be used to turn a spare LED into a network activity LED,
 933	  which only flashes in response to FTP transfers, for example.  Or
 934	  you could have an LED which lights up for a minute or two every time
 935	  somebody connects to your machine via SSH.
 936
 937	  You will need support for the "led" class to make this work.
 938
 939	  To create an LED trigger for incoming SSH traffic:
 940	    iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
 941
 942	  Then attach the new trigger to an LED on your system:
 943	    echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
 944
 945	  For more information on the LEDs available on your system, see
 946	  Documentation/leds/leds-class.rst
 947
 948config NETFILTER_XT_TARGET_LOG
 949	tristate "LOG target support"
 950	select NF_LOG_SYSLOG
 951	select NF_LOG_IPV6 if IP6_NF_IPTABLES
 952	default m if NETFILTER_ADVANCED=n
 953	help
 954	  This option adds a `LOG' target, which allows you to create rules in
 955	  any iptables table which records the packet header to the syslog.
 956
 957	  To compile it as a module, choose M here.  If unsure, say N.
 958
 959config NETFILTER_XT_TARGET_MARK
 960	tristate '"MARK" target support'
 961	depends on NETFILTER_ADVANCED
 962	select NETFILTER_XT_MARK
 963	help
 964	This is a backwards-compat option for the user's convenience
 965	(e.g. when running oldconfig). It selects
 966	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
 967
 968config NETFILTER_XT_NAT
 969	tristate '"SNAT and DNAT" targets support'
 970	depends on NF_NAT
 971	help
 972	This option enables the SNAT and DNAT targets.
 973
 974	To compile it as a module, choose M here. If unsure, say N.
 975
 976config NETFILTER_XT_TARGET_NETMAP
 977	tristate '"NETMAP" target support'
 978	depends on NF_NAT
 979	help
 980	NETMAP is an implementation of static 1:1 NAT mapping of network
 981	addresses. It maps the network address part, while keeping the host
 982	address part intact.
 983
 984	To compile it as a module, choose M here. If unsure, say N.
 985
 986config NETFILTER_XT_TARGET_NFLOG
 987	tristate '"NFLOG" target support'
 988	default m if NETFILTER_ADVANCED=n
 989	select NETFILTER_NETLINK_LOG
 990	help
 991	  This option enables the NFLOG target, which allows to LOG
 992	  messages through nfnetlink_log.
 993
 994	  To compile it as a module, choose M here.  If unsure, say N.
 995
 996config NETFILTER_XT_TARGET_NFQUEUE
 997	tristate '"NFQUEUE" target Support'
 998	depends on NETFILTER_ADVANCED
 999	select NETFILTER_NETLINK_QUEUE
1000	help
1001	  This target replaced the old obsolete QUEUE target.
1002
1003	  As opposed to QUEUE, it supports 65535 different queues,
1004	  not just one.
1005
1006	  To compile it as a module, choose M here.  If unsure, say N.
1007
1008config NETFILTER_XT_TARGET_NOTRACK
1009	tristate  '"NOTRACK" target support (DEPRECATED)'
1010	depends on NF_CONNTRACK
1011	depends on IP_NF_RAW || IP6_NF_RAW
1012	depends on NETFILTER_ADVANCED
1013	select NETFILTER_XT_TARGET_CT
1014
1015config NETFILTER_XT_TARGET_RATEEST
1016	tristate '"RATEEST" target support'
1017	depends on NETFILTER_ADVANCED
1018	help
1019	  This option adds a `RATEEST' target, which allows to measure
1020	  rates similar to TC estimators. The `rateest' match can be
1021	  used to match on the measured rates.
1022
1023	  To compile it as a module, choose M here.  If unsure, say N.
1024
1025config NETFILTER_XT_TARGET_REDIRECT
1026	tristate "REDIRECT target support"
1027	depends on NF_NAT
1028	select NF_NAT_REDIRECT
1029	help
1030	REDIRECT is a special case of NAT: all incoming connections are
1031	mapped onto the incoming interface's address, causing the packets to
1032	come to the local machine instead of passing through. This is
1033	useful for transparent proxies.
1034
1035	To compile it as a module, choose M here. If unsure, say N.
1036
1037config NETFILTER_XT_TARGET_MASQUERADE
1038	tristate "MASQUERADE target support"
1039	depends on NF_NAT
1040	default m if NETFILTER_ADVANCED=n
1041	select NF_NAT_MASQUERADE
1042	help
1043	  Masquerading is a special case of NAT: all outgoing connections are
1044	  changed to seem to come from a particular interface's address, and
1045	  if the interface goes down, those connections are lost.  This is
1046	  only useful for dialup accounts with dynamic IP address (ie. your IP
1047	  address will be different on next dialup).
1048
1049	  To compile it as a module, choose M here.  If unsure, say N.
1050
1051config NETFILTER_XT_TARGET_TEE
1052	tristate '"TEE" - packet cloning to alternate destination'
1053	depends on NETFILTER_ADVANCED
1054	depends on IPV6 || IPV6=n
1055	depends on !NF_CONNTRACK || NF_CONNTRACK
1056	depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1057	select NF_DUP_IPV4
1058	select NF_DUP_IPV6 if IP6_NF_IPTABLES
1059	help
1060	This option adds a "TEE" target with which a packet can be cloned and
1061	this clone be rerouted to another nexthop.
1062
1063config NETFILTER_XT_TARGET_TPROXY
1064	tristate '"TPROXY" target transparent proxying support'
1065	depends on NETFILTER_XTABLES
1066	depends on NETFILTER_ADVANCED
1067	depends on IPV6 || IPV6=n
1068	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1069	depends on IP_NF_MANGLE
1070	select NF_DEFRAG_IPV4
1071	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1072	select NF_TPROXY_IPV4
1073	select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1074	help
1075	  This option adds a `TPROXY' target, which is somewhat similar to
1076	  REDIRECT.  It can only be used in the mangle table and is useful
1077	  to redirect traffic to a transparent proxy.  It does _not_ depend
1078	  on Netfilter connection tracking and NAT, unlike REDIRECT.
1079	  For it to work you will have to configure certain iptables rules
1080	  and use policy routing. For more information on how to set it up
1081	  see Documentation/networking/tproxy.rst.
1082
1083	  To compile it as a module, choose M here.  If unsure, say N.
1084
1085config NETFILTER_XT_TARGET_TRACE
1086	tristate  '"TRACE" target support'
1087	depends on IP_NF_RAW || IP6_NF_RAW
1088	depends on NETFILTER_ADVANCED
1089	help
1090	  The TRACE target allows you to mark packets so that the kernel
1091	  will log every rule which match the packets as those traverse
1092	  the tables, chains, rules.
1093
1094	  If you want to compile it as a module, say M here and read
1095	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1096
1097config NETFILTER_XT_TARGET_SECMARK
1098	tristate '"SECMARK" target support'
1099	depends on NETWORK_SECMARK
1100	default m if NETFILTER_ADVANCED=n
1101	help
1102	  The SECMARK target allows security marking of network
1103	  packets, for use with security subsystems.
1104
1105	  To compile it as a module, choose M here.  If unsure, say N.
1106
1107config NETFILTER_XT_TARGET_TCPMSS
1108	tristate '"TCPMSS" target support'
1109	depends on IPV6 || IPV6=n
1110	default m if NETFILTER_ADVANCED=n
1111	help
1112	  This option adds a `TCPMSS' target, which allows you to alter the
1113	  MSS value of TCP SYN packets, to control the maximum size for that
1114	  connection (usually limiting it to your outgoing interface's MTU
1115	  minus 40).
1116
1117	  This is used to overcome criminally braindead ISPs or servers which
1118	  block ICMP Fragmentation Needed packets.  The symptoms of this
1119	  problem are that everything works fine from your Linux
1120	  firewall/router, but machines behind it can never exchange large
1121	  packets:
1122	        1) Web browsers connect, then hang with no data received.
1123	        2) Small mail works fine, but large emails hang.
1124	        3) ssh works fine, but scp hangs after initial handshaking.
1125
1126	  Workaround: activate this option and add a rule to your firewall
1127	  configuration like:
1128
1129	  iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1130	                 -j TCPMSS --clamp-mss-to-pmtu
1131
1132	  To compile it as a module, choose M here.  If unsure, say N.
1133
1134config NETFILTER_XT_TARGET_TCPOPTSTRIP
1135	tristate '"TCPOPTSTRIP" target support'
1136	depends on IP_NF_MANGLE || IP6_NF_MANGLE
1137	depends on NETFILTER_ADVANCED
1138	help
1139	  This option adds a "TCPOPTSTRIP" target, which allows you to strip
1140	  TCP options from TCP packets.
1141
1142# alphabetically ordered list of matches
1143
1144comment "Xtables matches"
1145
1146config NETFILTER_XT_MATCH_ADDRTYPE
1147	tristate '"addrtype" address type match support'
1148	default m if NETFILTER_ADVANCED=n
1149	help
1150	  This option allows you to match what routing thinks of an address,
1151	  eg. UNICAST, LOCAL, BROADCAST, ...
1152
1153	  If you want to compile it as a module, say M here and read
1154	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1155
1156config NETFILTER_XT_MATCH_BPF
1157	tristate '"bpf" match support'
1158	depends on NETFILTER_ADVANCED
1159	help
1160	  BPF matching applies a linux socket filter to each packet and
1161	  accepts those for which the filter returns non-zero.
1162
1163	  To compile it as a module, choose M here.  If unsure, say N.
1164
1165config NETFILTER_XT_MATCH_CGROUP
1166	tristate '"control group" match support'
1167	depends on NETFILTER_ADVANCED
1168	depends on CGROUPS
1169	select CGROUP_NET_CLASSID
1170	help
1171	Socket/process control group matching allows you to match locally
1172	generated packets based on which net_cls control group processes
1173	belong to.
1174
1175config NETFILTER_XT_MATCH_CLUSTER
1176	tristate '"cluster" match support'
1177	depends on NF_CONNTRACK
1178	depends on NETFILTER_ADVANCED
1179	help
1180	  This option allows you to build work-load-sharing clusters of
1181	  network servers/stateful firewalls without having a dedicated
1182	  load-balancing router/server/switch. Basically, this match returns
1183	  true when the packet must be handled by this cluster node. Thus,
1184	  all nodes see all packets and this match decides which node handles
1185	  what packets. The work-load sharing algorithm is based on source
1186	  address hashing.
1187
1188	  If you say Y or M here, try `iptables -m cluster --help` for
1189	  more information.
1190
1191config NETFILTER_XT_MATCH_COMMENT
1192	tristate  '"comment" match support'
1193	depends on NETFILTER_ADVANCED
1194	help
1195	  This option adds a `comment' dummy-match, which allows you to put
1196	  comments in your iptables ruleset.
1197
1198	  If you want to compile it as a module, say M here and read
1199	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1200
1201config NETFILTER_XT_MATCH_CONNBYTES
1202	tristate  '"connbytes" per-connection counter match support'
1203	depends on NF_CONNTRACK
1204	depends on NETFILTER_ADVANCED
1205	help
1206	  This option adds a `connbytes' match, which allows you to match the
1207	  number of bytes and/or packets for each direction within a connection.
1208
1209	  If you want to compile it as a module, say M here and read
1210	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1211
1212config NETFILTER_XT_MATCH_CONNLABEL
1213	tristate '"connlabel" match support'
1214	select NF_CONNTRACK_LABELS
1215	depends on NF_CONNTRACK
1216	depends on NETFILTER_ADVANCED
1217	help
1218	  This match allows you to test and assign userspace-defined labels names
1219	  to a connection.  The kernel only stores bit values - mapping
1220	  names to bits is done by userspace.
1221
1222	  Unlike connmark, more than 32 flag bits may be assigned to a
1223	  connection simultaneously.
1224
1225config NETFILTER_XT_MATCH_CONNLIMIT
1226	tristate '"connlimit" match support'
1227	depends on NF_CONNTRACK
1228	depends on NETFILTER_ADVANCED
1229	select NETFILTER_CONNCOUNT
1230	help
1231	  This match allows you to match against the number of parallel
1232	  connections to a server per client IP address (or address block).
1233
1234config NETFILTER_XT_MATCH_CONNMARK
1235	tristate  '"connmark" connection mark match support'
1236	depends on NF_CONNTRACK
1237	depends on NETFILTER_ADVANCED
1238	select NETFILTER_XT_CONNMARK
1239	help
1240	This is a backwards-compat option for the user's convenience
1241	(e.g. when running oldconfig). It selects
1242	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1243
1244config NETFILTER_XT_MATCH_CONNTRACK
1245	tristate '"conntrack" connection tracking match support'
1246	depends on NF_CONNTRACK
1247	default m if NETFILTER_ADVANCED=n
1248	help
1249	  This is a general conntrack match module, a superset of the state match.
1250
1251	  It allows matching on additional conntrack information, which is
1252	  useful in complex configurations, such as NAT gateways with multiple
1253	  internet links or tunnels.
1254
1255	  To compile it as a module, choose M here.  If unsure, say N.
1256
1257config NETFILTER_XT_MATCH_CPU
1258	tristate '"cpu" match support'
1259	depends on NETFILTER_ADVANCED
1260	help
1261	  CPU matching allows you to match packets based on the CPU
1262	  currently handling the packet.
1263
1264	  To compile it as a module, choose M here.  If unsure, say N.
1265
1266config NETFILTER_XT_MATCH_DCCP
1267	tristate '"dccp" protocol match support'
1268	depends on NETFILTER_ADVANCED
1269	default IP_DCCP
1270	help
1271	  With this option enabled, you will be able to use the iptables
1272	  `dccp' match in order to match on DCCP source/destination ports
1273	  and DCCP flags.
1274
1275	  If you want to compile it as a module, say M here and read
1276	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1277
1278config NETFILTER_XT_MATCH_DEVGROUP
1279	tristate '"devgroup" match support'
1280	depends on NETFILTER_ADVANCED
1281	help
1282	  This options adds a `devgroup' match, which allows to match on the
1283	  device group a network device is assigned to.
1284
1285	  To compile it as a module, choose M here.  If unsure, say N.
1286
1287config NETFILTER_XT_MATCH_DSCP
1288	tristate '"dscp" and "tos" match support'
1289	depends on NETFILTER_ADVANCED
1290	help
1291	  This option adds a `DSCP' match, which allows you to match against
1292	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1293
1294	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
1295
1296	  It will also add a "tos" match, which allows you to match packets
1297	  based on the Type Of Service fields of the IPv4 packet (which share
1298	  the same bits as DSCP).
1299
1300	  To compile it as a module, choose M here.  If unsure, say N.
1301
1302config NETFILTER_XT_MATCH_ECN
1303	tristate '"ecn" match support'
1304	depends on NETFILTER_ADVANCED
1305	help
1306	This option adds an "ECN" match, which allows you to match against
1307	the IPv4 and TCP header ECN fields.
1308
1309	To compile it as a module, choose M here. If unsure, say N.
1310
1311config NETFILTER_XT_MATCH_ESP
1312	tristate '"esp" match support'
1313	depends on NETFILTER_ADVANCED
1314	help
1315	  This match extension allows you to match a range of SPIs
1316	  inside ESP header of IPSec packets.
1317
1318	  To compile it as a module, choose M here.  If unsure, say N.
1319
1320config NETFILTER_XT_MATCH_HASHLIMIT
1321	tristate '"hashlimit" match support'
1322	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1323	depends on NETFILTER_ADVANCED
1324	help
1325	  This option adds a `hashlimit' match.
1326
1327	  As opposed to `limit', this match dynamically creates a hash table
1328	  of limit buckets, based on your selection of source/destination
1329	  addresses and/or ports.
1330
1331	  It enables you to express policies like `10kpps for any given
1332	  destination address' or `500pps from any given source address'
1333	  with a single rule.
1334
1335config NETFILTER_XT_MATCH_HELPER
1336	tristate '"helper" match support'
1337	depends on NF_CONNTRACK
1338	depends on NETFILTER_ADVANCED
1339	help
1340	  Helper matching allows you to match packets in dynamic connections
1341	  tracked by a conntrack-helper, ie. nf_conntrack_ftp
1342
1343	  To compile it as a module, choose M here.  If unsure, say Y.
1344
1345config NETFILTER_XT_MATCH_HL
1346	tristate '"hl" hoplimit/TTL match support'
1347	depends on NETFILTER_ADVANCED
1348	help
1349	HL matching allows you to match packets based on the hoplimit
1350	in the IPv6 header, or the time-to-live field in the IPv4
1351	header of the packet.
1352
1353config NETFILTER_XT_MATCH_IPCOMP
1354	tristate '"ipcomp" match support'
1355	depends on NETFILTER_ADVANCED
1356	help
1357	  This match extension allows you to match a range of CPIs(16 bits)
1358	  inside IPComp header of IPSec packets.
1359
1360	  To compile it as a module, choose M here.  If unsure, say N.
1361
1362config NETFILTER_XT_MATCH_IPRANGE
1363	tristate '"iprange" address range match support'
1364	depends on NETFILTER_ADVANCED
1365	help
1366	This option adds a "iprange" match, which allows you to match based on
1367	an IP address range. (Normal iptables only matches on single addresses
1368	with an optional mask.)
1369
1370	If unsure, say M.
1371
1372config NETFILTER_XT_MATCH_IPVS
1373	tristate '"ipvs" match support'
1374	depends on IP_VS
1375	depends on NETFILTER_ADVANCED
1376	depends on NF_CONNTRACK
1377	help
1378	  This option allows you to match against IPVS properties of a packet.
1379
1380	  If unsure, say N.
1381
1382config NETFILTER_XT_MATCH_L2TP
1383	tristate '"l2tp" match support'
1384	depends on NETFILTER_ADVANCED
1385	default L2TP
1386	help
1387	This option adds an "L2TP" match, which allows you to match against
1388	L2TP protocol header fields.
1389
1390	To compile it as a module, choose M here. If unsure, say N.
1391
1392config NETFILTER_XT_MATCH_LENGTH
1393	tristate '"length" match support'
1394	depends on NETFILTER_ADVANCED
1395	help
1396	  This option allows you to match the length of a packet against a
1397	  specific value or range of values.
1398
1399	  To compile it as a module, choose M here.  If unsure, say N.
1400
1401config NETFILTER_XT_MATCH_LIMIT
1402	tristate '"limit" match support'
1403	depends on NETFILTER_ADVANCED
1404	help
1405	  limit matching allows you to control the rate at which a rule can be
1406	  matched: mainly useful in combination with the LOG target ("LOG
1407	  target support", below) and to avoid some Denial of Service attacks.
1408
1409	  To compile it as a module, choose M here.  If unsure, say N.
1410
1411config NETFILTER_XT_MATCH_MAC
1412	tristate '"mac" address match support'
1413	depends on NETFILTER_ADVANCED
1414	help
1415	  MAC matching allows you to match packets based on the source
1416	  Ethernet address of the packet.
1417
1418	  To compile it as a module, choose M here.  If unsure, say N.
1419
1420config NETFILTER_XT_MATCH_MARK
1421	tristate '"mark" match support'
1422	depends on NETFILTER_ADVANCED
1423	select NETFILTER_XT_MARK
1424	help
1425	This is a backwards-compat option for the user's convenience
1426	(e.g. when running oldconfig). It selects
1427	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1428
1429config NETFILTER_XT_MATCH_MULTIPORT
1430	tristate '"multiport" Multiple port match support'
1431	depends on NETFILTER_ADVANCED
1432	help
1433	  Multiport matching allows you to match TCP or UDP packets based on
1434	  a series of source or destination ports: normally a rule can only
1435	  match a single range of ports.
1436
1437	  To compile it as a module, choose M here.  If unsure, say N.
1438
1439config NETFILTER_XT_MATCH_NFACCT
1440	tristate '"nfacct" match support'
1441	depends on NETFILTER_ADVANCED
1442	select NETFILTER_NETLINK_ACCT
1443	help
1444	  This option allows you to use the extended accounting through
1445	  nfnetlink_acct.
1446
1447	  To compile it as a module, choose M here.  If unsure, say N.
1448
1449config NETFILTER_XT_MATCH_OSF
1450	tristate '"osf" Passive OS fingerprint match'
1451	depends on NETFILTER_ADVANCED
1452	select NETFILTER_NETLINK_OSF
1453	help
1454	  This option selects the Passive OS Fingerprinting match module
1455	  that allows to passively match the remote operating system by
1456	  analyzing incoming TCP SYN packets.
1457
1458	  Rules and loading software can be downloaded from
1459	  http://www.ioremap.net/projects/osf
1460
1461	  To compile it as a module, choose M here.  If unsure, say N.
1462
1463config NETFILTER_XT_MATCH_OWNER
1464	tristate '"owner" match support'
1465	depends on NETFILTER_ADVANCED
1466	help
1467	Socket owner matching allows you to match locally-generated packets
1468	based on who created the socket: the user or group. It is also
1469	possible to check whether a socket actually exists.
1470
1471config NETFILTER_XT_MATCH_POLICY
1472	tristate 'IPsec "policy" match support'
1473	depends on XFRM
1474	default m if NETFILTER_ADVANCED=n
1475	help
1476	  Policy matching allows you to match packets based on the
1477	  IPsec policy that was used during decapsulation/will
1478	  be used during encapsulation.
1479
1480	  To compile it as a module, choose M here.  If unsure, say N.
1481
1482config NETFILTER_XT_MATCH_PHYSDEV
1483	tristate '"physdev" match support'
1484	depends on BRIDGE && BRIDGE_NETFILTER
1485	depends on NETFILTER_ADVANCED
1486	help
1487	  Physdev packet matching matches against the physical bridge ports
1488	  the IP packet arrived on or will leave by.
1489
1490	  To compile it as a module, choose M here.  If unsure, say N.
1491
1492config NETFILTER_XT_MATCH_PKTTYPE
1493	tristate '"pkttype" packet type match support'
1494	depends on NETFILTER_ADVANCED
1495	help
1496	  Packet type matching allows you to match a packet by
1497	  its "class", eg. BROADCAST, MULTICAST, ...
1498
1499	  Typical usage:
1500	  iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1501
1502	  To compile it as a module, choose M here.  If unsure, say N.
1503
1504config NETFILTER_XT_MATCH_QUOTA
1505	tristate '"quota" match support'
1506	depends on NETFILTER_ADVANCED
1507	help
1508	  This option adds a `quota' match, which allows to match on a
1509	  byte counter.
1510
1511	  If you want to compile it as a module, say M here and read
1512	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1513
1514config NETFILTER_XT_MATCH_RATEEST
1515	tristate '"rateest" match support'
1516	depends on NETFILTER_ADVANCED
1517	select NETFILTER_XT_TARGET_RATEEST
1518	help
1519	  This option adds a `rateest' match, which allows to match on the
1520	  rate estimated by the RATEEST target.
1521
1522	  To compile it as a module, choose M here.  If unsure, say N.
1523
1524config NETFILTER_XT_MATCH_REALM
1525	tristate  '"realm" match support'
1526	depends on NETFILTER_ADVANCED
1527	select IP_ROUTE_CLASSID
1528	help
1529	  This option adds a `realm' match, which allows you to use the realm
1530	  key from the routing subsystem inside iptables.
1531
1532	  This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1533	  in tc world.
1534
1535	  If you want to compile it as a module, say M here and read
1536	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1537
1538config NETFILTER_XT_MATCH_RECENT
1539	tristate '"recent" match support'
1540	depends on NETFILTER_ADVANCED
1541	help
1542	This match is used for creating one or many lists of recently
1543	used addresses and then matching against that/those list(s).
1544
1545	Short options are available by using 'iptables -m recent -h'
1546	Official Website: <http://snowman.net/projects/ipt_recent/>
1547
1548config NETFILTER_XT_MATCH_SCTP
1549	tristate  '"sctp" protocol match support'
1550	depends on NETFILTER_ADVANCED
1551	default IP_SCTP
1552	help
1553	  With this option enabled, you will be able to use the
1554	  `sctp' match in order to match on SCTP source/destination ports
1555	  and SCTP chunk types.
1556
1557	  If you want to compile it as a module, say M here and read
1558	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1559
1560config NETFILTER_XT_MATCH_SOCKET
1561	tristate '"socket" match support'
1562	depends on NETFILTER_XTABLES
1563	depends on NETFILTER_ADVANCED
1564	depends on IPV6 || IPV6=n
1565	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1566	select NF_SOCKET_IPV4
1567	select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1568	select NF_DEFRAG_IPV4
1569	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1570	help
1571	  This option adds a `socket' match, which can be used to match
1572	  packets for which a TCP or UDP socket lookup finds a valid socket.
1573	  It can be used in combination with the MARK target and policy
1574	  routing to implement full featured non-locally bound sockets.
1575
1576	  To compile it as a module, choose M here.  If unsure, say N.
1577
1578config NETFILTER_XT_MATCH_STATE
1579	tristate '"state" match support'
1580	depends on NF_CONNTRACK
1581	default m if NETFILTER_ADVANCED=n
1582	help
1583	  Connection state matching allows you to match packets based on their
1584	  relationship to a tracked connection (ie. previous packets).  This
1585	  is a powerful tool for packet classification.
1586
1587	  To compile it as a module, choose M here.  If unsure, say N.
1588
1589config NETFILTER_XT_MATCH_STATISTIC
1590	tristate '"statistic" match support'
1591	depends on NETFILTER_ADVANCED
1592	help
1593	  This option adds a `statistic' match, which allows you to match
1594	  on packets periodically or randomly with a given percentage.
1595
1596	  To compile it as a module, choose M here.  If unsure, say N.
1597
1598config NETFILTER_XT_MATCH_STRING
1599	tristate  '"string" match support'
1600	depends on NETFILTER_ADVANCED
1601	select TEXTSEARCH
1602	select TEXTSEARCH_KMP
1603	select TEXTSEARCH_BM
1604	select TEXTSEARCH_FSM
1605	help
1606	  This option adds a `string' match, which allows you to look for
1607	  pattern matchings in packets.
1608
1609	  To compile it as a module, choose M here.  If unsure, say N.
1610
1611config NETFILTER_XT_MATCH_TCPMSS
1612	tristate '"tcpmss" match support'
1613	depends on NETFILTER_ADVANCED
1614	help
1615	  This option adds a `tcpmss' match, which allows you to examine the
1616	  MSS value of TCP SYN packets, which control the maximum packet size
1617	  for that connection.
1618
1619	  To compile it as a module, choose M here.  If unsure, say N.
1620
1621config NETFILTER_XT_MATCH_TIME
1622	tristate '"time" match support'
1623	depends on NETFILTER_ADVANCED
1624	help
1625	  This option adds a "time" match, which allows you to match based on
1626	  the packet arrival time (at the machine which netfilter is running)
1627	  on) or departure time/date (for locally generated packets).
1628
1629	  If you say Y here, try `iptables -m time --help` for
1630	  more information.
1631
1632	  If you want to compile it as a module, say M here.
1633	  If unsure, say N.
1634
1635config NETFILTER_XT_MATCH_U32
1636	tristate '"u32" match support'
1637	depends on NETFILTER_ADVANCED
1638	help
1639	  u32 allows you to extract quantities of up to 4 bytes from a packet,
1640	  AND them with specified masks, shift them by specified amounts and
1641	  test whether the results are in any of a set of specified ranges.
1642	  The specification of what to extract is general enough to skip over
1643	  headers with lengths stored in the packet, as in IP or TCP header
1644	  lengths.
1645
1646	  Details and examples are in the kernel module source.
1647
1648endif # NETFILTER_XTABLES
1649
1650endmenu
1651
1652source "net/netfilter/ipset/Kconfig"
1653
1654source "net/netfilter/ipvs/Kconfig"