xref: /linux/net/netfilter/Kconfig (revision a9525c7f)
1# SPDX-License-Identifier: GPL-2.0-only
2menu "Core Netfilter Configuration"
3	depends on INET && NETFILTER
4
5config NETFILTER_INGRESS
6	bool "Netfilter ingress support"
7	default y
8	select NET_INGRESS
9	help
10	  This allows you to classify packets from ingress using the Netfilter
11	  infrastructure.
12
13config NETFILTER_EGRESS
14	bool "Netfilter egress support"
15	default y
16	select NET_EGRESS
17	help
18	  This allows you to classify packets before transmission using the
19	  Netfilter infrastructure.
20
21config NETFILTER_SKIP_EGRESS
22	def_bool NETFILTER_EGRESS && (NET_CLS_ACT || IFB)
23
24config NETFILTER_NETLINK
25	tristate
26
27config NETFILTER_FAMILY_BRIDGE
28	bool
29
30config NETFILTER_FAMILY_ARP
31	bool
32
33config NETFILTER_BPF_LINK
34	def_bool BPF_SYSCALL
35
36config NETFILTER_NETLINK_HOOK
37	tristate "Netfilter base hook dump support"
38	depends on NETFILTER_ADVANCED
39	depends on NF_TABLES
40	select NETFILTER_NETLINK
41	help
42	  If this option is enabled, the kernel will include support
43	  to list the base netfilter hooks via NFNETLINK.
44	  This is helpful for debugging.
45
46config NETFILTER_NETLINK_ACCT
47	tristate "Netfilter NFACCT over NFNETLINK interface"
48	depends on NETFILTER_ADVANCED
49	select NETFILTER_NETLINK
50	help
51	  If this option is enabled, the kernel will include support
52	  for extended accounting via NFNETLINK.
53
54config NETFILTER_NETLINK_QUEUE
55	tristate "Netfilter NFQUEUE over NFNETLINK interface"
56	depends on NETFILTER_ADVANCED
57	select NETFILTER_NETLINK
58	help
59	  If this option is enabled, the kernel will include support
60	  for queueing packets via NFNETLINK.
61
62config NETFILTER_NETLINK_LOG
63	tristate "Netfilter LOG over NFNETLINK interface"
64	default m if NETFILTER_ADVANCED=n
65	select NETFILTER_NETLINK
66	help
67	  If this option is enabled, the kernel will include support
68	  for logging packets via NFNETLINK.
69
70	  This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
71	  and is also scheduled to replace the old syslog-based ipt_LOG
72	  and ip6t_LOG modules.
73
74config NETFILTER_NETLINK_OSF
75	tristate "Netfilter OSF over NFNETLINK interface"
76	depends on NETFILTER_ADVANCED
77	select NETFILTER_NETLINK
78	help
79	  If this option is enabled, the kernel will include support
80	  for passive OS fingerprint via NFNETLINK.
81
82config NF_CONNTRACK
83	tristate "Netfilter connection tracking support"
84	default m if NETFILTER_ADVANCED=n
85	select NF_DEFRAG_IPV4
86	select NF_DEFRAG_IPV6 if IPV6 != n
87	help
88	  Connection tracking keeps a record of what packets have passed
89	  through your machine, in order to figure out how they are related
90	  into connections.
91
92	  This is required to do Masquerading or other kinds of Network
93	  Address Translation.  It can also be used to enhance packet
94	  filtering (see `Connection state match support' below).
95
96	  To compile it as a module, choose M here.  If unsure, say N.
97
98config NF_LOG_SYSLOG
99	tristate "Syslog packet logging"
100	default m if NETFILTER_ADVANCED=n
101	help
102	  This option enable support for packet logging via syslog.
103	  It supports IPv4, IPV6, ARP and common transport protocols such
104	  as TCP and UDP.
105	  This is a simpler but less flexible logging method compared to
106	  CONFIG_NETFILTER_NETLINK_LOG.
107	  If both are enabled the backend to use can be configured at run-time
108	  by means of per-address-family sysctl tunables.
109
110if NF_CONNTRACK
111config NETFILTER_CONNCOUNT
112	tristate
113
114config NF_CONNTRACK_MARK
115	bool  'Connection mark tracking support'
116	depends on NETFILTER_ADVANCED
117	help
118	  This option enables support for connection marks, used by the
119	  `CONNMARK' target and `connmark' match. Similar to the mark value
120	  of packets, but this mark value is kept in the conntrack session
121	  instead of the individual packets.
122
123config NF_CONNTRACK_SECMARK
124	bool  'Connection tracking security mark support'
125	depends on NETWORK_SECMARK
126	default y if NETFILTER_ADVANCED=n
127	help
128	  This option enables security markings to be applied to
129	  connections.  Typically they are copied to connections from
130	  packets using the CONNSECMARK target and copied back from
131	  connections to packets with the same target, with the packets
132	  being originally labeled via SECMARK.
133
134	  If unsure, say 'N'.
135
136config NF_CONNTRACK_ZONES
137	bool  'Connection tracking zones'
138	depends on NETFILTER_ADVANCED
139	help
140	  This option enables support for connection tracking zones.
141	  Normally, each connection needs to have a unique system wide
142	  identity. Connection tracking zones allow to have multiple
143	  connections using the same identity, as long as they are
144	  contained in different zones.
145
146	  If unsure, say `N'.
147
148config NF_CONNTRACK_PROCFS
149	bool "Supply CT list in procfs (OBSOLETE)"
150	depends on PROC_FS
151	help
152	This option enables for the list of known conntrack entries
153	to be shown in procfs under net/netfilter/nf_conntrack. This
154	is considered obsolete in favor of using the conntrack(8)
155	tool which uses Netlink.
156
157config NF_CONNTRACK_EVENTS
158	bool "Connection tracking events"
159	depends on NETFILTER_ADVANCED
160	help
161	  If this option is enabled, the connection tracking code will
162	  provide a notifier chain that can be used by other kernel code
163	  to get notified about changes in the connection tracking state.
164
165	  If unsure, say `N'.
166
167config NF_CONNTRACK_TIMEOUT
168	bool  'Connection tracking timeout'
169	depends on NETFILTER_ADVANCED
170	help
171	  This option enables support for connection tracking timeout
172	  extension. This allows you to attach timeout policies to flow
173	  via the CT target.
174
175	  If unsure, say `N'.
176
177config NF_CONNTRACK_TIMESTAMP
178	bool  'Connection tracking timestamping'
179	depends on NETFILTER_ADVANCED
180	help
181	  This option enables support for connection tracking timestamping.
182	  This allows you to store the flow start-time and to obtain
183	  the flow-stop time (once it has been destroyed) via Connection
184	  tracking events.
185
186	  If unsure, say `N'.
187
188config NF_CONNTRACK_LABELS
189	bool "Connection tracking labels"
190	help
191	  This option enables support for assigning user-defined flag bits
192	  to connection tracking entries.  It can be used with xtables connlabel
193	  match and the nftables ct expression.
194
195config NF_CONNTRACK_OVS
196	bool
197
198config NF_CT_PROTO_DCCP
199	bool 'DCCP protocol connection tracking support'
200	depends on NETFILTER_ADVANCED
201	default y
202	help
203	  With this option enabled, the layer 3 independent connection
204	  tracking code will be able to do state tracking on DCCP connections.
205
206	  If unsure, say Y.
207
208config NF_CT_PROTO_GRE
209	bool
210
211config NF_CT_PROTO_SCTP
212	bool 'SCTP protocol connection tracking support'
213	depends on NETFILTER_ADVANCED
214	default y
215	select LIBCRC32C
216	help
217	  With this option enabled, the layer 3 independent connection
218	  tracking code will be able to do state tracking on SCTP connections.
219
220	  If unsure, say Y.
221
222config NF_CT_PROTO_UDPLITE
223	bool 'UDP-Lite protocol connection tracking support'
224	depends on NETFILTER_ADVANCED
225	default y
226	help
227	  With this option enabled, the layer 3 independent connection
228	  tracking code will be able to do state tracking on UDP-Lite
229	  connections.
230
231	  If unsure, say Y.
232
233config NF_CONNTRACK_AMANDA
234	tristate "Amanda backup protocol support"
235	depends on NETFILTER_ADVANCED
236	select TEXTSEARCH
237	select TEXTSEARCH_KMP
238	help
239	  If you are running the Amanda backup package <http://www.amanda.org/>
240	  on this machine or machines that will be MASQUERADED through this
241	  machine, then you may want to enable this feature.  This allows the
242	  connection tracking and natting code to allow the sub-channels that
243	  Amanda requires for communication of the backup data, messages and
244	  index.
245
246	  To compile it as a module, choose M here.  If unsure, say N.
247
248config NF_CONNTRACK_FTP
249	tristate "FTP protocol support"
250	default m if NETFILTER_ADVANCED=n
251	help
252	  Tracking FTP connections is problematic: special helpers are
253	  required for tracking them, and doing masquerading and other forms
254	  of Network Address Translation on them.
255
256	  This is FTP support on Layer 3 independent connection tracking.
257
258	  To compile it as a module, choose M here.  If unsure, say N.
259
260config NF_CONNTRACK_H323
261	tristate "H.323 protocol support"
262	depends on IPV6 || IPV6=n
263	depends on NETFILTER_ADVANCED
264	help
265	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
266	  important VoIP protocols, it is widely used by voice hardware and
267	  software including voice gateways, IP phones, Netmeeting, OpenPhone,
268	  Gnomemeeting, etc.
269
270	  With this module you can support H.323 on a connection tracking/NAT
271	  firewall.
272
273	  This module supports RAS, Fast Start, H.245 Tunnelling, Call
274	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
275	  whiteboard, file transfer, etc. For more information, please
276	  visit http://nath323.sourceforge.net/.
277
278	  To compile it as a module, choose M here.  If unsure, say N.
279
280config NF_CONNTRACK_IRC
281	tristate "IRC protocol support"
282	default m if NETFILTER_ADVANCED=n
283	help
284	  There is a commonly-used extension to IRC called
285	  Direct Client-to-Client Protocol (DCC).  This enables users to send
286	  files to each other, and also chat to each other without the need
287	  of a server.  DCC Sending is used anywhere you send files over IRC,
288	  and DCC Chat is most commonly used by Eggdrop bots.  If you are
289	  using NAT, this extension will enable you to send files and initiate
290	  chats.  Note that you do NOT need this extension to get files or
291	  have others initiate chats, or everything else in IRC.
292
293	  To compile it as a module, choose M here.  If unsure, say N.
294
295config NF_CONNTRACK_BROADCAST
296	tristate
297
298config NF_CONNTRACK_NETBIOS_NS
299	tristate "NetBIOS name service protocol support"
300	select NF_CONNTRACK_BROADCAST
301	help
302	  NetBIOS name service requests are sent as broadcast messages from an
303	  unprivileged port and responded to with unicast messages to the
304	  same port. This make them hard to firewall properly because connection
305	  tracking doesn't deal with broadcasts. This helper tracks locally
306	  originating NetBIOS name service requests and the corresponding
307	  responses. It relies on correct IP address configuration, specifically
308	  netmask and broadcast address. When properly configured, the output
309	  of "ip address show" should look similar to this:
310
311	  $ ip -4 address show eth0
312	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
313	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
314
315	  To compile it as a module, choose M here.  If unsure, say N.
316
317config NF_CONNTRACK_SNMP
318	tristate "SNMP service protocol support"
319	depends on NETFILTER_ADVANCED
320	select NF_CONNTRACK_BROADCAST
321	help
322	  SNMP service requests are sent as broadcast messages from an
323	  unprivileged port and responded to with unicast messages to the
324	  same port. This make them hard to firewall properly because connection
325	  tracking doesn't deal with broadcasts. This helper tracks locally
326	  originating SNMP service requests and the corresponding
327	  responses. It relies on correct IP address configuration, specifically
328	  netmask and broadcast address.
329
330	  To compile it as a module, choose M here.  If unsure, say N.
331
332config NF_CONNTRACK_PPTP
333	tristate "PPtP protocol support"
334	depends on NETFILTER_ADVANCED
335	select NF_CT_PROTO_GRE
336	help
337	  This module adds support for PPTP (Point to Point Tunnelling
338	  Protocol, RFC2637) connection tracking and NAT.
339
340	  If you are running PPTP sessions over a stateful firewall or NAT
341	  box, you may want to enable this feature.
342
343	  Please note that not all PPTP modes of operation are supported yet.
344	  Specifically these limitations exist:
345	    - Blindly assumes that control connections are always established
346	      in PNS->PAC direction. This is a violation of RFC2637.
347	    - Only supports a single call within each session
348
349	  To compile it as a module, choose M here.  If unsure, say N.
350
351config NF_CONNTRACK_SANE
352	tristate "SANE protocol support"
353	depends on NETFILTER_ADVANCED
354	help
355	  SANE is a protocol for remote access to scanners as implemented
356	  by the 'saned' daemon. Like FTP, it uses separate control and
357	  data connections.
358
359	  With this module you can support SANE on a connection tracking
360	  firewall.
361
362	  To compile it as a module, choose M here.  If unsure, say N.
363
364config NF_CONNTRACK_SIP
365	tristate "SIP protocol support"
366	default m if NETFILTER_ADVANCED=n
367	help
368	  SIP is an application-layer control protocol that can establish,
369	  modify, and terminate multimedia sessions (conferences) such as
370	  Internet telephony calls. With the nf_conntrack_sip and
371	  the nf_nat_sip modules you can support the protocol on a connection
372	  tracking/NATing firewall.
373
374	  To compile it as a module, choose M here.  If unsure, say N.
375
376config NF_CONNTRACK_TFTP
377	tristate "TFTP protocol support"
378	depends on NETFILTER_ADVANCED
379	help
380	  TFTP connection tracking helper, this is required depending
381	  on how restrictive your ruleset is.
382	  If you are using a tftp client behind -j SNAT or -j MASQUERADING
383	  you will need this.
384
385	  To compile it as a module, choose M here.  If unsure, say N.
386
387config NF_CT_NETLINK
388	tristate 'Connection tracking netlink interface'
389	select NETFILTER_NETLINK
390	default m if NETFILTER_ADVANCED=n
391	help
392	  This option enables support for a netlink-based userspace interface
393
394config NF_CT_NETLINK_TIMEOUT
395	tristate  'Connection tracking timeout tuning via Netlink'
396	select NETFILTER_NETLINK
397	depends on NETFILTER_ADVANCED
398	depends on NF_CONNTRACK_TIMEOUT
399	help
400	  This option enables support for connection tracking timeout
401	  fine-grain tuning. This allows you to attach specific timeout
402	  policies to flows, instead of using the global timeout policy.
403
404	  If unsure, say `N'.
405
406config NF_CT_NETLINK_HELPER
407	tristate 'Connection tracking helpers in user-space via Netlink'
408	select NETFILTER_NETLINK
409	depends on NF_CT_NETLINK
410	depends on NETFILTER_NETLINK_QUEUE
411	depends on NETFILTER_NETLINK_GLUE_CT
412	depends on NETFILTER_ADVANCED
413	help
414	  This option enables the user-space connection tracking helpers
415	  infrastructure.
416
417	  If unsure, say `N'.
418
419config NETFILTER_NETLINK_GLUE_CT
420	bool "NFQUEUE and NFLOG integration with Connection Tracking"
421	default n
422	depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
423	help
424	  If this option is enabled, NFQUEUE and NFLOG can include
425	  Connection Tracking information together with the packet is
426	  the enqueued via NFNETLINK.
427
428config NF_NAT
429	tristate "Network Address Translation support"
430	depends on NF_CONNTRACK
431	default m if NETFILTER_ADVANCED=n
432	help
433	  The NAT option allows masquerading, port forwarding and other
434	  forms of full Network Address Port Translation. This can be
435	  controlled by iptables, ip6tables or nft.
436
437config NF_NAT_AMANDA
438	tristate
439	depends on NF_CONNTRACK && NF_NAT
440	default NF_NAT && NF_CONNTRACK_AMANDA
441
442config NF_NAT_FTP
443	tristate
444	depends on NF_CONNTRACK && NF_NAT
445	default NF_NAT && NF_CONNTRACK_FTP
446
447config NF_NAT_IRC
448	tristate
449	depends on NF_CONNTRACK && NF_NAT
450	default NF_NAT && NF_CONNTRACK_IRC
451
452config NF_NAT_SIP
453	tristate
454	depends on NF_CONNTRACK && NF_NAT
455	default NF_NAT && NF_CONNTRACK_SIP
456
457config NF_NAT_TFTP
458	tristate
459	depends on NF_CONNTRACK && NF_NAT
460	default NF_NAT && NF_CONNTRACK_TFTP
461
462config NF_NAT_REDIRECT
463	bool
464
465config NF_NAT_MASQUERADE
466	bool
467
468config NF_NAT_OVS
469	bool
470
471config NETFILTER_SYNPROXY
472	tristate
473
474endif # NF_CONNTRACK
475
476config NF_TABLES
477	select NETFILTER_NETLINK
478	select LIBCRC32C
479	tristate "Netfilter nf_tables support"
480	help
481	  nftables is the new packet classification framework that intends to
482	  replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
483	  provides a pseudo-state machine with an extensible instruction-set
484	  (also known as expressions) that the userspace 'nft' utility
485	  (https://www.netfilter.org/projects/nftables) uses to build the
486	  rule-set. It also comes with the generic set infrastructure that
487	  allows you to construct mappings between matchings and actions
488	  for performance lookups.
489
490	  To compile it as a module, choose M here.
491
492if NF_TABLES
493config NF_TABLES_INET
494	depends on IPV6
495	select NF_TABLES_IPV4
496	select NF_TABLES_IPV6
497	bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
498	help
499	  This option enables support for a mixed IPv4/IPv6 "inet" table.
500
501config NF_TABLES_NETDEV
502	bool "Netfilter nf_tables netdev tables support"
503	help
504	  This option enables support for the "netdev" table.
505
506config NFT_NUMGEN
507	tristate "Netfilter nf_tables number generator module"
508	help
509	  This option adds the number generator expression used to perform
510	  incremental counting and random numbers bound to a upper limit.
511
512config NFT_CT
513	depends on NF_CONNTRACK
514	tristate "Netfilter nf_tables conntrack module"
515	help
516	  This option adds the "ct" expression that you can use to match
517	  connection tracking information such as the flow state.
518
519config NFT_FLOW_OFFLOAD
520	depends on NF_CONNTRACK && NF_FLOW_TABLE
521	tristate "Netfilter nf_tables hardware flow offload module"
522	help
523	  This option adds the "flow_offload" expression that you can use to
524	  choose what flows are placed into the hardware.
525
526config NFT_CONNLIMIT
527	tristate "Netfilter nf_tables connlimit module"
528	depends on NF_CONNTRACK
529	depends on NETFILTER_ADVANCED
530	select NETFILTER_CONNCOUNT
531	help
532	  This option adds the "connlimit" expression that you can use to
533	  ratelimit rule matchings per connections.
534
535config NFT_LOG
536	tristate "Netfilter nf_tables log module"
537	help
538	  This option adds the "log" expression that you can use to log
539	  packets matching some criteria.
540
541config NFT_LIMIT
542	tristate "Netfilter nf_tables limit module"
543	help
544	  This option adds the "limit" expression that you can use to
545	  ratelimit rule matchings.
546
547config NFT_MASQ
548	depends on NF_CONNTRACK
549	depends on NF_NAT
550	select NF_NAT_MASQUERADE
551	tristate "Netfilter nf_tables masquerade support"
552	help
553	  This option adds the "masquerade" expression that you can use
554	  to perform NAT in the masquerade flavour.
555
556config NFT_REDIR
557	depends on NF_CONNTRACK
558	depends on NF_NAT
559	tristate "Netfilter nf_tables redirect support"
560	select NF_NAT_REDIRECT
561	help
562	  This options adds the "redirect" expression that you can use
563	  to perform NAT in the redirect flavour.
564
565config NFT_NAT
566	depends on NF_CONNTRACK
567	select NF_NAT
568	depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
569	tristate "Netfilter nf_tables nat module"
570	help
571	  This option adds the "nat" expression that you can use to perform
572	  typical Network Address Translation (NAT) packet transformations.
573
574config NFT_TUNNEL
575	tristate "Netfilter nf_tables tunnel module"
576	help
577	  This option adds the "tunnel" expression that you can use to set
578	  tunneling policies.
579
580config NFT_QUEUE
581	depends on NETFILTER_NETLINK_QUEUE
582	tristate "Netfilter nf_tables queue module"
583	help
584	  This is required if you intend to use the userspace queueing
585	  infrastructure (also known as NFQUEUE) from nftables.
586
587config NFT_QUOTA
588	tristate "Netfilter nf_tables quota module"
589	help
590	  This option adds the "quota" expression that you can use to match
591	  enforce bytes quotas.
592
593config NFT_REJECT
594	default m if NETFILTER_ADVANCED=n
595	tristate "Netfilter nf_tables reject support"
596	depends on !NF_TABLES_INET || (IPV6!=m || m)
597	help
598	  This option adds the "reject" expression that you can use to
599	  explicitly deny and notify via TCP reset/ICMP informational errors
600	  unallowed traffic.
601
602config NFT_REJECT_INET
603	depends on NF_TABLES_INET
604	default NFT_REJECT
605	tristate
606
607config NFT_COMPAT
608	depends on NETFILTER_XTABLES
609	tristate "Netfilter x_tables over nf_tables module"
610	help
611	  This is required if you intend to use any of existing
612	  x_tables match/target extensions over the nf_tables
613	  framework.
614
615config NFT_HASH
616	tristate "Netfilter nf_tables hash module"
617	help
618	  This option adds the "hash" expression that you can use to perform
619	  a hash operation on registers.
620
621config NFT_FIB
622	tristate
623
624config NFT_FIB_INET
625	depends on NF_TABLES_INET
626	depends on NFT_FIB_IPV4
627	depends on NFT_FIB_IPV6
628	tristate "Netfilter nf_tables fib inet support"
629	help
630	  This option allows using the FIB expression from the inet table.
631	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
632	  on the protocol of the packet.
633
634config NFT_XFRM
635	tristate "Netfilter nf_tables xfrm/IPSec security association matching"
636	depends on XFRM
637	help
638	  This option adds an expression that you can use to extract properties
639	  of a packets security association.
640
641config NFT_SOCKET
642	tristate "Netfilter nf_tables socket match support"
643	depends on IPV6 || IPV6=n
644	select NF_SOCKET_IPV4
645	select NF_SOCKET_IPV6 if NF_TABLES_IPV6
646	help
647	  This option allows matching for the presence or absence of a
648	  corresponding socket and its attributes.
649
650config NFT_OSF
651	tristate "Netfilter nf_tables passive OS fingerprint support"
652	depends on NETFILTER_ADVANCED
653	select NETFILTER_NETLINK_OSF
654	help
655	  This option allows matching packets from an specific OS.
656
657config NFT_TPROXY
658	tristate "Netfilter nf_tables tproxy support"
659	depends on IPV6 || IPV6=n
660	select NF_DEFRAG_IPV4
661	select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
662	select NF_TPROXY_IPV4
663	select NF_TPROXY_IPV6 if NF_TABLES_IPV6
664	help
665	  This makes transparent proxy support available in nftables.
666
667config NFT_SYNPROXY
668	tristate "Netfilter nf_tables SYNPROXY expression support"
669	depends on NF_CONNTRACK && NETFILTER_ADVANCED
670	select NETFILTER_SYNPROXY
671	select SYN_COOKIES
672	help
673	  The SYNPROXY expression allows you to intercept TCP connections and
674	  establish them using syncookies before they are passed on to the
675	  server. This allows to avoid conntrack and server resource usage
676	  during SYN-flood attacks.
677
678if NF_TABLES_NETDEV
679
680config NF_DUP_NETDEV
681	tristate "Netfilter packet duplication support"
682	help
683	  This option enables the generic packet duplication infrastructure
684	  for Netfilter.
685
686config NFT_DUP_NETDEV
687	tristate "Netfilter nf_tables netdev packet duplication support"
688	select NF_DUP_NETDEV
689	help
690	  This option enables packet duplication for the "netdev" family.
691
692config NFT_FWD_NETDEV
693	tristate "Netfilter nf_tables netdev packet forwarding support"
694	select NF_DUP_NETDEV
695	help
696	  This option enables packet forwarding for the "netdev" family.
697
698config NFT_FIB_NETDEV
699	depends on NFT_FIB_IPV4
700	depends on NFT_FIB_IPV6
701	tristate "Netfilter nf_tables netdev fib lookups support"
702	help
703	  This option allows using the FIB expression from the netdev table.
704	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
705	  on the protocol of the packet.
706
707config NFT_REJECT_NETDEV
708	depends on NFT_REJECT_IPV4
709	depends on NFT_REJECT_IPV6
710	tristate "Netfilter nf_tables netdev REJECT support"
711	help
712	  This option enables the REJECT support from the netdev table.
713	  The return packet generation will be delegated to the IPv4
714	  or IPv6 ICMP or TCP RST implementation depending on the
715	  protocol of the packet.
716
717endif # NF_TABLES_NETDEV
718
719endif # NF_TABLES
720
721config NF_FLOW_TABLE_INET
722	tristate "Netfilter flow table mixed IPv4/IPv6 module"
723	depends on NF_FLOW_TABLE
724	help
725	  This option adds the flow table mixed IPv4/IPv6 support.
726
727	  To compile it as a module, choose M here.
728
729config NF_FLOW_TABLE
730	tristate "Netfilter flow table module"
731	depends on NETFILTER_INGRESS
732	depends on NF_CONNTRACK
733	depends on NF_TABLES
734	help
735	  This option adds the flow table core infrastructure.
736
737	  To compile it as a module, choose M here.
738
739config NF_FLOW_TABLE_PROCFS
740	bool "Supply flow table statistics in procfs"
741	depends on NF_FLOW_TABLE
742	depends on PROC_FS
743	help
744	  This option enables for the flow table offload statistics
745	  to be shown in procfs under net/netfilter/nf_flowtable.
746
747config NETFILTER_XTABLES
748	tristate "Netfilter Xtables support (required for ip_tables)"
749	default m if NETFILTER_ADVANCED=n
750	help
751	  This is required if you intend to use any of ip_tables,
752	  ip6_tables or arp_tables.
753
754if NETFILTER_XTABLES
755
756config NETFILTER_XTABLES_COMPAT
757	bool "Netfilter Xtables 32bit support"
758	depends on COMPAT
759	help
760	   This option provides a translation layer to run 32bit arp,ip(6),ebtables
761	   binaries on 64bit kernels.
762
763	   If unsure, say N.
764
765comment "Xtables combined modules"
766
767config NETFILTER_XT_MARK
768	tristate 'nfmark target and match support'
769	default m if NETFILTER_ADVANCED=n
770	help
771	This option adds the "MARK" target and "mark" match.
772
773	Netfilter mark matching allows you to match packets based on the
774	"nfmark" value in the packet.
775	The target allows you to create rules in the "mangle" table which alter
776	the netfilter mark (nfmark) field associated with the packet.
777
778	Prior to routing, the nfmark can influence the routing method and can
779	also be used by other subsystems to change their behavior.
780
781config NETFILTER_XT_CONNMARK
782	tristate 'ctmark target and match support'
783	depends on NF_CONNTRACK
784	depends on NETFILTER_ADVANCED
785	select NF_CONNTRACK_MARK
786	help
787	This option adds the "CONNMARK" target and "connmark" match.
788
789	Netfilter allows you to store a mark value per connection (a.k.a.
790	ctmark), similarly to the packet mark (nfmark). Using this
791	target and match, you can set and match on this mark.
792
793config NETFILTER_XT_SET
794	tristate 'set target and match support'
795	depends on IP_SET
796	depends on NETFILTER_ADVANCED
797	help
798	  This option adds the "SET" target and "set" match.
799
800	  Using this target and match, you can add/delete and match
801	  elements in the sets created by ipset(8).
802
803	  To compile it as a module, choose M here.  If unsure, say N.
804
805# alphabetically ordered list of targets
806
807comment "Xtables targets"
808
809config NETFILTER_XT_TARGET_AUDIT
810	tristate "AUDIT target support"
811	depends on AUDIT
812	depends on NETFILTER_ADVANCED
813	help
814	  This option adds a 'AUDIT' target, which can be used to create
815	  audit records for packets dropped/accepted.
816
817	  To compileit as a module, choose M here. If unsure, say N.
818
819config NETFILTER_XT_TARGET_CHECKSUM
820	tristate "CHECKSUM target support"
821	depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT
822	depends on NETFILTER_ADVANCED
823	help
824	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
825	  table to work around buggy DHCP clients in virtualized environments.
826
827	  Some old DHCP clients drop packets because they are not aware
828	  that the checksum would normally be offloaded to hardware and
829	  thus should be considered valid.
830	  This target can be used to fill in the checksum using iptables
831	  when such packets are sent via a virtual network device.
832
833	  To compile it as a module, choose M here.  If unsure, say N.
834
835config NETFILTER_XT_TARGET_CLASSIFY
836	tristate '"CLASSIFY" target support'
837	depends on NETFILTER_ADVANCED
838	help
839	  This option adds a `CLASSIFY' target, which enables the user to set
840	  the priority of a packet. Some qdiscs can use this value for
841	  classification, among these are:
842
843	  atm, cbq, dsmark, pfifo_fast, htb, prio
844
845	  To compile it as a module, choose M here.  If unsure, say N.
846
847config NETFILTER_XT_TARGET_CONNMARK
848	tristate  '"CONNMARK" target support'
849	depends on NF_CONNTRACK
850	depends on NETFILTER_ADVANCED
851	select NETFILTER_XT_CONNMARK
852	help
853	This is a backwards-compat option for the user's convenience
854	(e.g. when running oldconfig). It selects
855	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
856
857config NETFILTER_XT_TARGET_CONNSECMARK
858	tristate '"CONNSECMARK" target support'
859	depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
860	default m if NETFILTER_ADVANCED=n
861	help
862	  The CONNSECMARK target copies security markings from packets
863	  to connections, and restores security markings from connections
864	  to packets (if the packets are not already marked).  This would
865	  normally be used in conjunction with the SECMARK target.
866
867	  To compile it as a module, choose M here.  If unsure, say N.
868
869config NETFILTER_XT_TARGET_CT
870	tristate '"CT" target support'
871	depends on NF_CONNTRACK
872	depends on IP_NF_RAW || IP6_NF_RAW || NFT_COMPAT
873	depends on NETFILTER_ADVANCED
874	help
875	  This options adds a `CT' target, which allows to specify initial
876	  connection tracking parameters like events to be delivered and
877	  the helper to be used.
878
879	  To compile it as a module, choose M here.  If unsure, say N.
880
881config NETFILTER_XT_TARGET_DSCP
882	tristate '"DSCP" and "TOS" target support'
883	depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT
884	depends on NETFILTER_ADVANCED
885	help
886	  This option adds a `DSCP' target, which allows you to manipulate
887	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
888
889	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
890
891	  It also adds the "TOS" target, which allows you to create rules in
892	  the "mangle" table which alter the Type Of Service field of an IPv4
893	  or the Priority field of an IPv6 packet, prior to routing.
894
895	  To compile it as a module, choose M here.  If unsure, say N.
896
897config NETFILTER_XT_TARGET_HL
898	tristate '"HL" hoplimit target support'
899	depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT
900	depends on NETFILTER_ADVANCED
901	help
902	This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
903	targets, which enable the user to change the
904	hoplimit/time-to-live value of the IP header.
905
906	While it is safe to decrement the hoplimit/TTL value, the
907	modules also allow to increment and set the hoplimit value of
908	the header to arbitrary values. This is EXTREMELY DANGEROUS
909	since you can easily create immortal packets that loop
910	forever on the network.
911
912config NETFILTER_XT_TARGET_HMARK
913	tristate '"HMARK" target support'
914	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
915	depends on NETFILTER_ADVANCED
916	help
917	This option adds the "HMARK" target.
918
919	The target allows you to create rules in the "raw" and "mangle" tables
920	which set the skbuff mark by means of hash calculation within a given
921	range. The nfmark can influence the routing method and can also be used
922	by other subsystems to change their behaviour.
923
924	To compile it as a module, choose M here. If unsure, say N.
925
926config NETFILTER_XT_TARGET_IDLETIMER
927	tristate  "IDLETIMER target support"
928	depends on NETFILTER_ADVANCED
929	help
930
931	  This option adds the `IDLETIMER' target.  Each matching packet
932	  resets the timer associated with label specified when the rule is
933	  added.  When the timer expires, it triggers a sysfs notification.
934	  The remaining time for expiration can be read via sysfs.
935
936	  To compile it as a module, choose M here.  If unsure, say N.
937
938config NETFILTER_XT_TARGET_LED
939	tristate '"LED" target support'
940	depends on LEDS_CLASS && LEDS_TRIGGERS
941	depends on NETFILTER_ADVANCED
942	help
943	  This option adds a `LED' target, which allows you to blink LEDs in
944	  response to particular packets passing through your machine.
945
946	  This can be used to turn a spare LED into a network activity LED,
947	  which only flashes in response to FTP transfers, for example.  Or
948	  you could have an LED which lights up for a minute or two every time
949	  somebody connects to your machine via SSH.
950
951	  You will need support for the "led" class to make this work.
952
953	  To create an LED trigger for incoming SSH traffic:
954	    iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
955
956	  Then attach the new trigger to an LED on your system:
957	    echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
958
959	  For more information on the LEDs available on your system, see
960	  Documentation/leds/leds-class.rst
961
962config NETFILTER_XT_TARGET_LOG
963	tristate "LOG target support"
964	select NF_LOG_SYSLOG
965	select NF_LOG_IPV6 if IP6_NF_IPTABLES
966	default m if NETFILTER_ADVANCED=n
967	help
968	  This option adds a `LOG' target, which allows you to create rules in
969	  any iptables table which records the packet header to the syslog.
970
971	  To compile it as a module, choose M here.  If unsure, say N.
972
973config NETFILTER_XT_TARGET_MARK
974	tristate '"MARK" target support'
975	depends on NETFILTER_ADVANCED
976	select NETFILTER_XT_MARK
977	help
978	This is a backwards-compat option for the user's convenience
979	(e.g. when running oldconfig). It selects
980	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
981
982config NETFILTER_XT_NAT
983	tristate '"SNAT and DNAT" targets support'
984	depends on NF_NAT
985	help
986	This option enables the SNAT and DNAT targets.
987
988	To compile it as a module, choose M here. If unsure, say N.
989
990config NETFILTER_XT_TARGET_NETMAP
991	tristate '"NETMAP" target support'
992	depends on NF_NAT
993	help
994	NETMAP is an implementation of static 1:1 NAT mapping of network
995	addresses. It maps the network address part, while keeping the host
996	address part intact.
997
998	To compile it as a module, choose M here. If unsure, say N.
999
1000config NETFILTER_XT_TARGET_NFLOG
1001	tristate '"NFLOG" target support'
1002	default m if NETFILTER_ADVANCED=n
1003	select NETFILTER_NETLINK_LOG
1004	help
1005	  This option enables the NFLOG target, which allows to LOG
1006	  messages through nfnetlink_log.
1007
1008	  To compile it as a module, choose M here.  If unsure, say N.
1009
1010config NETFILTER_XT_TARGET_NFQUEUE
1011	tristate '"NFQUEUE" target Support'
1012	depends on NETFILTER_ADVANCED
1013	select NETFILTER_NETLINK_QUEUE
1014	help
1015	  This target replaced the old obsolete QUEUE target.
1016
1017	  As opposed to QUEUE, it supports 65535 different queues,
1018	  not just one.
1019
1020	  To compile it as a module, choose M here.  If unsure, say N.
1021
1022config NETFILTER_XT_TARGET_NOTRACK
1023	tristate  '"NOTRACK" target support (DEPRECATED)'
1024	depends on NF_CONNTRACK
1025	depends on IP_NF_RAW || IP6_NF_RAW
1026	depends on NETFILTER_ADVANCED
1027	select NETFILTER_XT_TARGET_CT
1028
1029config NETFILTER_XT_TARGET_RATEEST
1030	tristate '"RATEEST" target support'
1031	depends on NETFILTER_ADVANCED
1032	help
1033	  This option adds a `RATEEST' target, which allows to measure
1034	  rates similar to TC estimators. The `rateest' match can be
1035	  used to match on the measured rates.
1036
1037	  To compile it as a module, choose M here.  If unsure, say N.
1038
1039config NETFILTER_XT_TARGET_REDIRECT
1040	tristate "REDIRECT target support"
1041	depends on NF_NAT
1042	select NF_NAT_REDIRECT
1043	help
1044	REDIRECT is a special case of NAT: all incoming connections are
1045	mapped onto the incoming interface's address, causing the packets to
1046	come to the local machine instead of passing through. This is
1047	useful for transparent proxies.
1048
1049	To compile it as a module, choose M here. If unsure, say N.
1050
1051config NETFILTER_XT_TARGET_MASQUERADE
1052	tristate "MASQUERADE target support"
1053	depends on NF_NAT
1054	default m if NETFILTER_ADVANCED=n
1055	select NF_NAT_MASQUERADE
1056	help
1057	  Masquerading is a special case of NAT: all outgoing connections are
1058	  changed to seem to come from a particular interface's address, and
1059	  if the interface goes down, those connections are lost.  This is
1060	  only useful for dialup accounts with dynamic IP address (ie. your IP
1061	  address will be different on next dialup).
1062
1063	  To compile it as a module, choose M here.  If unsure, say N.
1064
1065config NETFILTER_XT_TARGET_TEE
1066	tristate '"TEE" - packet cloning to alternate destination'
1067	depends on NETFILTER_ADVANCED
1068	depends on IPV6 || IPV6=n
1069	depends on !NF_CONNTRACK || NF_CONNTRACK
1070	depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1071	select NF_DUP_IPV4
1072	select NF_DUP_IPV6 if IP6_NF_IPTABLES
1073	help
1074	This option adds a "TEE" target with which a packet can be cloned and
1075	this clone be rerouted to another nexthop.
1076
1077config NETFILTER_XT_TARGET_TPROXY
1078	tristate '"TPROXY" target transparent proxying support'
1079	depends on NETFILTER_XTABLES
1080	depends on NETFILTER_ADVANCED
1081	depends on IPV6 || IPV6=n
1082	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1083	depends on IP_NF_MANGLE || NFT_COMPAT
1084	select NF_DEFRAG_IPV4
1085	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1086	select NF_TPROXY_IPV4
1087	select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1088	help
1089	  This option adds a `TPROXY' target, which is somewhat similar to
1090	  REDIRECT.  It can only be used in the mangle table and is useful
1091	  to redirect traffic to a transparent proxy.  It does _not_ depend
1092	  on Netfilter connection tracking and NAT, unlike REDIRECT.
1093	  For it to work you will have to configure certain iptables rules
1094	  and use policy routing. For more information on how to set it up
1095	  see Documentation/networking/tproxy.rst.
1096
1097	  To compile it as a module, choose M here.  If unsure, say N.
1098
1099config NETFILTER_XT_TARGET_TRACE
1100	tristate  '"TRACE" target support'
1101	depends on IP_NF_RAW || IP6_NF_RAW
1102	depends on NETFILTER_ADVANCED
1103	help
1104	  The TRACE target allows you to mark packets so that the kernel
1105	  will log every rule which match the packets as those traverse
1106	  the tables, chains, rules.
1107
1108	  If you want to compile it as a module, say M here and read
1109	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1110
1111config NETFILTER_XT_TARGET_SECMARK
1112	tristate '"SECMARK" target support'
1113	depends on NETWORK_SECMARK
1114	default m if NETFILTER_ADVANCED=n
1115	help
1116	  The SECMARK target allows security marking of network
1117	  packets, for use with security subsystems.
1118
1119	  To compile it as a module, choose M here.  If unsure, say N.
1120
1121config NETFILTER_XT_TARGET_TCPMSS
1122	tristate '"TCPMSS" target support'
1123	depends on IPV6 || IPV6=n
1124	default m if NETFILTER_ADVANCED=n
1125	help
1126	  This option adds a `TCPMSS' target, which allows you to alter the
1127	  MSS value of TCP SYN packets, to control the maximum size for that
1128	  connection (usually limiting it to your outgoing interface's MTU
1129	  minus 40).
1130
1131	  This is used to overcome criminally braindead ISPs or servers which
1132	  block ICMP Fragmentation Needed packets.  The symptoms of this
1133	  problem are that everything works fine from your Linux
1134	  firewall/router, but machines behind it can never exchange large
1135	  packets:
1136	        1) Web browsers connect, then hang with no data received.
1137	        2) Small mail works fine, but large emails hang.
1138	        3) ssh works fine, but scp hangs after initial handshaking.
1139
1140	  Workaround: activate this option and add a rule to your firewall
1141	  configuration like:
1142
1143	  iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1144	                 -j TCPMSS --clamp-mss-to-pmtu
1145
1146	  To compile it as a module, choose M here.  If unsure, say N.
1147
1148config NETFILTER_XT_TARGET_TCPOPTSTRIP
1149	tristate '"TCPOPTSTRIP" target support'
1150	depends on IP_NF_MANGLE || IP6_NF_MANGLE || NFT_COMPAT
1151	depends on NETFILTER_ADVANCED
1152	help
1153	  This option adds a "TCPOPTSTRIP" target, which allows you to strip
1154	  TCP options from TCP packets.
1155
1156# alphabetically ordered list of matches
1157
1158comment "Xtables matches"
1159
1160config NETFILTER_XT_MATCH_ADDRTYPE
1161	tristate '"addrtype" address type match support'
1162	default m if NETFILTER_ADVANCED=n
1163	help
1164	  This option allows you to match what routing thinks of an address,
1165	  eg. UNICAST, LOCAL, BROADCAST, ...
1166
1167	  If you want to compile it as a module, say M here and read
1168	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1169
1170config NETFILTER_XT_MATCH_BPF
1171	tristate '"bpf" match support'
1172	depends on NETFILTER_ADVANCED
1173	help
1174	  BPF matching applies a linux socket filter to each packet and
1175	  accepts those for which the filter returns non-zero.
1176
1177	  To compile it as a module, choose M here.  If unsure, say N.
1178
1179config NETFILTER_XT_MATCH_CGROUP
1180	tristate '"control group" match support'
1181	depends on NETFILTER_ADVANCED
1182	depends on CGROUPS
1183	select CGROUP_NET_CLASSID
1184	help
1185	Socket/process control group matching allows you to match locally
1186	generated packets based on which net_cls control group processes
1187	belong to.
1188
1189config NETFILTER_XT_MATCH_CLUSTER
1190	tristate '"cluster" match support'
1191	depends on NF_CONNTRACK
1192	depends on NETFILTER_ADVANCED
1193	help
1194	  This option allows you to build work-load-sharing clusters of
1195	  network servers/stateful firewalls without having a dedicated
1196	  load-balancing router/server/switch. Basically, this match returns
1197	  true when the packet must be handled by this cluster node. Thus,
1198	  all nodes see all packets and this match decides which node handles
1199	  what packets. The work-load sharing algorithm is based on source
1200	  address hashing.
1201
1202	  If you say Y or M here, try `iptables -m cluster --help` for
1203	  more information.
1204
1205config NETFILTER_XT_MATCH_COMMENT
1206	tristate  '"comment" match support'
1207	depends on NETFILTER_ADVANCED
1208	help
1209	  This option adds a `comment' dummy-match, which allows you to put
1210	  comments in your iptables ruleset.
1211
1212	  If you want to compile it as a module, say M here and read
1213	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1214
1215config NETFILTER_XT_MATCH_CONNBYTES
1216	tristate  '"connbytes" per-connection counter match support'
1217	depends on NF_CONNTRACK
1218	depends on NETFILTER_ADVANCED
1219	help
1220	  This option adds a `connbytes' match, which allows you to match the
1221	  number of bytes and/or packets for each direction within a connection.
1222
1223	  If you want to compile it as a module, say M here and read
1224	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1225
1226config NETFILTER_XT_MATCH_CONNLABEL
1227	tristate '"connlabel" match support'
1228	select NF_CONNTRACK_LABELS
1229	depends on NF_CONNTRACK
1230	depends on NETFILTER_ADVANCED
1231	help
1232	  This match allows you to test and assign userspace-defined labels names
1233	  to a connection.  The kernel only stores bit values - mapping
1234	  names to bits is done by userspace.
1235
1236	  Unlike connmark, more than 32 flag bits may be assigned to a
1237	  connection simultaneously.
1238
1239config NETFILTER_XT_MATCH_CONNLIMIT
1240	tristate '"connlimit" match support'
1241	depends on NF_CONNTRACK
1242	depends on NETFILTER_ADVANCED
1243	select NETFILTER_CONNCOUNT
1244	help
1245	  This match allows you to match against the number of parallel
1246	  connections to a server per client IP address (or address block).
1247
1248config NETFILTER_XT_MATCH_CONNMARK
1249	tristate  '"connmark" connection mark match support'
1250	depends on NF_CONNTRACK
1251	depends on NETFILTER_ADVANCED
1252	select NETFILTER_XT_CONNMARK
1253	help
1254	This is a backwards-compat option for the user's convenience
1255	(e.g. when running oldconfig). It selects
1256	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1257
1258config NETFILTER_XT_MATCH_CONNTRACK
1259	tristate '"conntrack" connection tracking match support'
1260	depends on NF_CONNTRACK
1261	default m if NETFILTER_ADVANCED=n
1262	help
1263	  This is a general conntrack match module, a superset of the state match.
1264
1265	  It allows matching on additional conntrack information, which is
1266	  useful in complex configurations, such as NAT gateways with multiple
1267	  internet links or tunnels.
1268
1269	  To compile it as a module, choose M here.  If unsure, say N.
1270
1271config NETFILTER_XT_MATCH_CPU
1272	tristate '"cpu" match support'
1273	depends on NETFILTER_ADVANCED
1274	help
1275	  CPU matching allows you to match packets based on the CPU
1276	  currently handling the packet.
1277
1278	  To compile it as a module, choose M here.  If unsure, say N.
1279
1280config NETFILTER_XT_MATCH_DCCP
1281	tristate '"dccp" protocol match support'
1282	depends on NETFILTER_ADVANCED
1283	default IP_DCCP
1284	help
1285	  With this option enabled, you will be able to use the iptables
1286	  `dccp' match in order to match on DCCP source/destination ports
1287	  and DCCP flags.
1288
1289	  If you want to compile it as a module, say M here and read
1290	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1291
1292config NETFILTER_XT_MATCH_DEVGROUP
1293	tristate '"devgroup" match support'
1294	depends on NETFILTER_ADVANCED
1295	help
1296	  This options adds a `devgroup' match, which allows to match on the
1297	  device group a network device is assigned to.
1298
1299	  To compile it as a module, choose M here.  If unsure, say N.
1300
1301config NETFILTER_XT_MATCH_DSCP
1302	tristate '"dscp" and "tos" match support'
1303	depends on NETFILTER_ADVANCED
1304	help
1305	  This option adds a `DSCP' match, which allows you to match against
1306	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1307
1308	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
1309
1310	  It will also add a "tos" match, which allows you to match packets
1311	  based on the Type Of Service fields of the IPv4 packet (which share
1312	  the same bits as DSCP).
1313
1314	  To compile it as a module, choose M here.  If unsure, say N.
1315
1316config NETFILTER_XT_MATCH_ECN
1317	tristate '"ecn" match support'
1318	depends on NETFILTER_ADVANCED
1319	help
1320	This option adds an "ECN" match, which allows you to match against
1321	the IPv4 and TCP header ECN fields.
1322
1323	To compile it as a module, choose M here. If unsure, say N.
1324
1325config NETFILTER_XT_MATCH_ESP
1326	tristate '"esp" match support'
1327	depends on NETFILTER_ADVANCED
1328	help
1329	  This match extension allows you to match a range of SPIs
1330	  inside ESP header of IPSec packets.
1331
1332	  To compile it as a module, choose M here.  If unsure, say N.
1333
1334config NETFILTER_XT_MATCH_HASHLIMIT
1335	tristate '"hashlimit" match support'
1336	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1337	depends on NETFILTER_ADVANCED
1338	help
1339	  This option adds a `hashlimit' match.
1340
1341	  As opposed to `limit', this match dynamically creates a hash table
1342	  of limit buckets, based on your selection of source/destination
1343	  addresses and/or ports.
1344
1345	  It enables you to express policies like `10kpps for any given
1346	  destination address' or `500pps from any given source address'
1347	  with a single rule.
1348
1349config NETFILTER_XT_MATCH_HELPER
1350	tristate '"helper" match support'
1351	depends on NF_CONNTRACK
1352	depends on NETFILTER_ADVANCED
1353	help
1354	  Helper matching allows you to match packets in dynamic connections
1355	  tracked by a conntrack-helper, ie. nf_conntrack_ftp
1356
1357	  To compile it as a module, choose M here.  If unsure, say Y.
1358
1359config NETFILTER_XT_MATCH_HL
1360	tristate '"hl" hoplimit/TTL match support'
1361	depends on NETFILTER_ADVANCED
1362	help
1363	HL matching allows you to match packets based on the hoplimit
1364	in the IPv6 header, or the time-to-live field in the IPv4
1365	header of the packet.
1366
1367config NETFILTER_XT_MATCH_IPCOMP
1368	tristate '"ipcomp" match support'
1369	depends on NETFILTER_ADVANCED
1370	help
1371	  This match extension allows you to match a range of CPIs(16 bits)
1372	  inside IPComp header of IPSec packets.
1373
1374	  To compile it as a module, choose M here.  If unsure, say N.
1375
1376config NETFILTER_XT_MATCH_IPRANGE
1377	tristate '"iprange" address range match support'
1378	depends on NETFILTER_ADVANCED
1379	help
1380	This option adds a "iprange" match, which allows you to match based on
1381	an IP address range. (Normal iptables only matches on single addresses
1382	with an optional mask.)
1383
1384	If unsure, say M.
1385
1386config NETFILTER_XT_MATCH_IPVS
1387	tristate '"ipvs" match support'
1388	depends on IP_VS
1389	depends on NETFILTER_ADVANCED
1390	depends on NF_CONNTRACK
1391	help
1392	  This option allows you to match against IPVS properties of a packet.
1393
1394	  If unsure, say N.
1395
1396config NETFILTER_XT_MATCH_L2TP
1397	tristate '"l2tp" match support'
1398	depends on NETFILTER_ADVANCED
1399	default L2TP
1400	help
1401	This option adds an "L2TP" match, which allows you to match against
1402	L2TP protocol header fields.
1403
1404	To compile it as a module, choose M here. If unsure, say N.
1405
1406config NETFILTER_XT_MATCH_LENGTH
1407	tristate '"length" match support'
1408	depends on NETFILTER_ADVANCED
1409	help
1410	  This option allows you to match the length of a packet against a
1411	  specific value or range of values.
1412
1413	  To compile it as a module, choose M here.  If unsure, say N.
1414
1415config NETFILTER_XT_MATCH_LIMIT
1416	tristate '"limit" match support'
1417	depends on NETFILTER_ADVANCED
1418	help
1419	  limit matching allows you to control the rate at which a rule can be
1420	  matched: mainly useful in combination with the LOG target ("LOG
1421	  target support", below) and to avoid some Denial of Service attacks.
1422
1423	  To compile it as a module, choose M here.  If unsure, say N.
1424
1425config NETFILTER_XT_MATCH_MAC
1426	tristate '"mac" address match support'
1427	depends on NETFILTER_ADVANCED
1428	help
1429	  MAC matching allows you to match packets based on the source
1430	  Ethernet address of the packet.
1431
1432	  To compile it as a module, choose M here.  If unsure, say N.
1433
1434config NETFILTER_XT_MATCH_MARK
1435	tristate '"mark" match support'
1436	depends on NETFILTER_ADVANCED
1437	select NETFILTER_XT_MARK
1438	help
1439	This is a backwards-compat option for the user's convenience
1440	(e.g. when running oldconfig). It selects
1441	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1442
1443config NETFILTER_XT_MATCH_MULTIPORT
1444	tristate '"multiport" Multiple port match support'
1445	depends on NETFILTER_ADVANCED
1446	help
1447	  Multiport matching allows you to match TCP or UDP packets based on
1448	  a series of source or destination ports: normally a rule can only
1449	  match a single range of ports.
1450
1451	  To compile it as a module, choose M here.  If unsure, say N.
1452
1453config NETFILTER_XT_MATCH_NFACCT
1454	tristate '"nfacct" match support'
1455	depends on NETFILTER_ADVANCED
1456	select NETFILTER_NETLINK_ACCT
1457	help
1458	  This option allows you to use the extended accounting through
1459	  nfnetlink_acct.
1460
1461	  To compile it as a module, choose M here.  If unsure, say N.
1462
1463config NETFILTER_XT_MATCH_OSF
1464	tristate '"osf" Passive OS fingerprint match'
1465	depends on NETFILTER_ADVANCED
1466	select NETFILTER_NETLINK_OSF
1467	help
1468	  This option selects the Passive OS Fingerprinting match module
1469	  that allows to passively match the remote operating system by
1470	  analyzing incoming TCP SYN packets.
1471
1472	  Rules and loading software can be downloaded from
1473	  http://www.ioremap.net/projects/osf
1474
1475	  To compile it as a module, choose M here.  If unsure, say N.
1476
1477config NETFILTER_XT_MATCH_OWNER
1478	tristate '"owner" match support'
1479	depends on NETFILTER_ADVANCED
1480	help
1481	Socket owner matching allows you to match locally-generated packets
1482	based on who created the socket: the user or group. It is also
1483	possible to check whether a socket actually exists.
1484
1485config NETFILTER_XT_MATCH_POLICY
1486	tristate 'IPsec "policy" match support'
1487	depends on XFRM
1488	default m if NETFILTER_ADVANCED=n
1489	help
1490	  Policy matching allows you to match packets based on the
1491	  IPsec policy that was used during decapsulation/will
1492	  be used during encapsulation.
1493
1494	  To compile it as a module, choose M here.  If unsure, say N.
1495
1496config NETFILTER_XT_MATCH_PHYSDEV
1497	tristate '"physdev" match support'
1498	depends on BRIDGE && BRIDGE_NETFILTER
1499	depends on NETFILTER_ADVANCED
1500	help
1501	  Physdev packet matching matches against the physical bridge ports
1502	  the IP packet arrived on or will leave by.
1503
1504	  To compile it as a module, choose M here.  If unsure, say N.
1505
1506config NETFILTER_XT_MATCH_PKTTYPE
1507	tristate '"pkttype" packet type match support'
1508	depends on NETFILTER_ADVANCED
1509	help
1510	  Packet type matching allows you to match a packet by
1511	  its "class", eg. BROADCAST, MULTICAST, ...
1512
1513	  Typical usage:
1514	  iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1515
1516	  To compile it as a module, choose M here.  If unsure, say N.
1517
1518config NETFILTER_XT_MATCH_QUOTA
1519	tristate '"quota" match support'
1520	depends on NETFILTER_ADVANCED
1521	help
1522	  This option adds a `quota' match, which allows to match on a
1523	  byte counter.
1524
1525	  If you want to compile it as a module, say M here and read
1526	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1527
1528config NETFILTER_XT_MATCH_RATEEST
1529	tristate '"rateest" match support'
1530	depends on NETFILTER_ADVANCED
1531	select NETFILTER_XT_TARGET_RATEEST
1532	help
1533	  This option adds a `rateest' match, which allows to match on the
1534	  rate estimated by the RATEEST target.
1535
1536	  To compile it as a module, choose M here.  If unsure, say N.
1537
1538config NETFILTER_XT_MATCH_REALM
1539	tristate  '"realm" match support'
1540	depends on NETFILTER_ADVANCED
1541	select IP_ROUTE_CLASSID
1542	help
1543	  This option adds a `realm' match, which allows you to use the realm
1544	  key from the routing subsystem inside iptables.
1545
1546	  This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1547	  in tc world.
1548
1549	  If you want to compile it as a module, say M here and read
1550	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1551
1552config NETFILTER_XT_MATCH_RECENT
1553	tristate '"recent" match support'
1554	depends on NETFILTER_ADVANCED
1555	help
1556	This match is used for creating one or many lists of recently
1557	used addresses and then matching against that/those list(s).
1558
1559	Short options are available by using 'iptables -m recent -h'
1560	Official Website: <http://snowman.net/projects/ipt_recent/>
1561
1562config NETFILTER_XT_MATCH_SCTP
1563	tristate  '"sctp" protocol match support'
1564	depends on NETFILTER_ADVANCED
1565	default IP_SCTP
1566	help
1567	  With this option enabled, you will be able to use the
1568	  `sctp' match in order to match on SCTP source/destination ports
1569	  and SCTP chunk types.
1570
1571	  If you want to compile it as a module, say M here and read
1572	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1573
1574config NETFILTER_XT_MATCH_SOCKET
1575	tristate '"socket" match support'
1576	depends on NETFILTER_XTABLES
1577	depends on NETFILTER_ADVANCED
1578	depends on IPV6 || IPV6=n
1579	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1580	select NF_SOCKET_IPV4
1581	select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1582	select NF_DEFRAG_IPV4
1583	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1584	help
1585	  This option adds a `socket' match, which can be used to match
1586	  packets for which a TCP or UDP socket lookup finds a valid socket.
1587	  It can be used in combination with the MARK target and policy
1588	  routing to implement full featured non-locally bound sockets.
1589
1590	  To compile it as a module, choose M here.  If unsure, say N.
1591
1592config NETFILTER_XT_MATCH_STATE
1593	tristate '"state" match support'
1594	depends on NF_CONNTRACK
1595	default m if NETFILTER_ADVANCED=n
1596	help
1597	  Connection state matching allows you to match packets based on their
1598	  relationship to a tracked connection (ie. previous packets).  This
1599	  is a powerful tool for packet classification.
1600
1601	  To compile it as a module, choose M here.  If unsure, say N.
1602
1603config NETFILTER_XT_MATCH_STATISTIC
1604	tristate '"statistic" match support'
1605	depends on NETFILTER_ADVANCED
1606	help
1607	  This option adds a `statistic' match, which allows you to match
1608	  on packets periodically or randomly with a given percentage.
1609
1610	  To compile it as a module, choose M here.  If unsure, say N.
1611
1612config NETFILTER_XT_MATCH_STRING
1613	tristate  '"string" match support'
1614	depends on NETFILTER_ADVANCED
1615	select TEXTSEARCH
1616	select TEXTSEARCH_KMP
1617	select TEXTSEARCH_BM
1618	select TEXTSEARCH_FSM
1619	help
1620	  This option adds a `string' match, which allows you to look for
1621	  pattern matchings in packets.
1622
1623	  To compile it as a module, choose M here.  If unsure, say N.
1624
1625config NETFILTER_XT_MATCH_TCPMSS
1626	tristate '"tcpmss" match support'
1627	depends on NETFILTER_ADVANCED
1628	help
1629	  This option adds a `tcpmss' match, which allows you to examine the
1630	  MSS value of TCP SYN packets, which control the maximum packet size
1631	  for that connection.
1632
1633	  To compile it as a module, choose M here.  If unsure, say N.
1634
1635config NETFILTER_XT_MATCH_TIME
1636	tristate '"time" match support'
1637	depends on NETFILTER_ADVANCED
1638	help
1639	  This option adds a "time" match, which allows you to match based on
1640	  the packet arrival time (at the machine which netfilter is running)
1641	  on) or departure time/date (for locally generated packets).
1642
1643	  If you say Y here, try `iptables -m time --help` for
1644	  more information.
1645
1646	  If you want to compile it as a module, say M here.
1647	  If unsure, say N.
1648
1649config NETFILTER_XT_MATCH_U32
1650	tristate '"u32" match support'
1651	depends on NETFILTER_ADVANCED
1652	help
1653	  u32 allows you to extract quantities of up to 4 bytes from a packet,
1654	  AND them with specified masks, shift them by specified amounts and
1655	  test whether the results are in any of a set of specified ranges.
1656	  The specification of what to extract is general enough to skip over
1657	  headers with lengths stored in the packet, as in IP or TCP header
1658	  lengths.
1659
1660	  Details and examples are in the kernel module source.
1661
1662endif # NETFILTER_XTABLES
1663
1664endmenu
1665
1666source "net/netfilter/ipset/Kconfig"
1667
1668source "net/netfilter/ipvs/Kconfig"
1669