1# SPDX-License-Identifier: GPL-2.0-only
2menu "Core Netfilter Configuration"
3	depends on INET && NETFILTER
4
5config NETFILTER_INGRESS
6	bool "Netfilter ingress support"
7	default y
8	select NET_INGRESS
9	help
10	  This allows you to classify packets from ingress using the Netfilter
11	  infrastructure.
12
13config NETFILTER_NETLINK
14	tristate
15
16config NETFILTER_FAMILY_BRIDGE
17	bool
18
19config NETFILTER_FAMILY_ARP
20	bool
21
22config NETFILTER_NETLINK_HOOK
23	tristate "Netfilter base hook dump support"
24	depends on NETFILTER_ADVANCED
25	depends on NF_TABLES
26	select NETFILTER_NETLINK
27	help
28	  If this option is enabled, the kernel will include support
29	  to list the base netfilter hooks via NFNETLINK.
30	  This is helpful for debugging.
31
32config NETFILTER_NETLINK_ACCT
33	tristate "Netfilter NFACCT over NFNETLINK interface"
34	depends on NETFILTER_ADVANCED
35	select NETFILTER_NETLINK
36	help
37	  If this option is enabled, the kernel will include support
38	  for extended accounting via NFNETLINK.
39
40config NETFILTER_NETLINK_QUEUE
41	tristate "Netfilter NFQUEUE over NFNETLINK interface"
42	depends on NETFILTER_ADVANCED
43	select NETFILTER_NETLINK
44	help
45	  If this option is enabled, the kernel will include support
46	  for queueing packets via NFNETLINK.
47
48config NETFILTER_NETLINK_LOG
49	tristate "Netfilter LOG over NFNETLINK interface"
50	default m if NETFILTER_ADVANCED=n
51	select NETFILTER_NETLINK
52	help
53	  If this option is enabled, the kernel will include support
54	  for logging packets via NFNETLINK.
55
56	  This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
57	  and is also scheduled to replace the old syslog-based ipt_LOG
58	  and ip6t_LOG modules.
59
60config NETFILTER_NETLINK_OSF
61	tristate "Netfilter OSF over NFNETLINK interface"
62	depends on NETFILTER_ADVANCED
63	select NETFILTER_NETLINK
64	help
65	  If this option is enabled, the kernel will include support
66	  for passive OS fingerprint via NFNETLINK.
67
68config NF_CONNTRACK
69	tristate "Netfilter connection tracking support"
70	default m if NETFILTER_ADVANCED=n
71	select NF_DEFRAG_IPV4
72	select NF_DEFRAG_IPV6 if IPV6 != n
73	help
74	  Connection tracking keeps a record of what packets have passed
75	  through your machine, in order to figure out how they are related
76	  into connections.
77
78	  This is required to do Masquerading or other kinds of Network
79	  Address Translation.  It can also be used to enhance packet
80	  filtering (see `Connection state match support' below).
81
82	  To compile it as a module, choose M here.  If unsure, say N.
83
84config NF_LOG_SYSLOG
85	tristate "Syslog packet logging"
86	default m if NETFILTER_ADVANCED=n
87	help
88	  This option enable support for packet logging via syslog.
89	  It supports IPv4, IPV6, ARP and common transport protocols such
90	  as TCP and UDP.
91	  This is a simpler but less flexible logging method compared to
92	  CONFIG_NETFILTER_NETLINK_LOG.
93	  If both are enabled the backend to use can be configured at run-time
94	  by means of per-address-family sysctl tunables.
95
96if NF_CONNTRACK
97config NETFILTER_CONNCOUNT
98	tristate
99
100config NF_CONNTRACK_MARK
101	bool  'Connection mark tracking support'
102	depends on NETFILTER_ADVANCED
103	help
104	  This option enables support for connection marks, used by the
105	  `CONNMARK' target and `connmark' match. Similar to the mark value
106	  of packets, but this mark value is kept in the conntrack session
107	  instead of the individual packets.
108
109config NF_CONNTRACK_SECMARK
110	bool  'Connection tracking security mark support'
111	depends on NETWORK_SECMARK
112	default y if NETFILTER_ADVANCED=n
113	help
114	  This option enables security markings to be applied to
115	  connections.  Typically they are copied to connections from
116	  packets using the CONNSECMARK target and copied back from
117	  connections to packets with the same target, with the packets
118	  being originally labeled via SECMARK.
119
120	  If unsure, say 'N'.
121
122config NF_CONNTRACK_ZONES
123	bool  'Connection tracking zones'
124	depends on NETFILTER_ADVANCED
125	help
126	  This option enables support for connection tracking zones.
127	  Normally, each connection needs to have a unique system wide
128	  identity. Connection tracking zones allow to have multiple
129	  connections using the same identity, as long as they are
130	  contained in different zones.
131
132	  If unsure, say `N'.
133
134config NF_CONNTRACK_PROCFS
135	bool "Supply CT list in procfs (OBSOLETE)"
136	default y
137	depends on PROC_FS
138	help
139	This option enables for the list of known conntrack entries
140	to be shown in procfs under net/netfilter/nf_conntrack. This
141	is considered obsolete in favor of using the conntrack(8)
142	tool which uses Netlink.
143
144config NF_CONNTRACK_EVENTS
145	bool "Connection tracking events"
146	depends on NETFILTER_ADVANCED
147	help
148	  If this option is enabled, the connection tracking code will
149	  provide a notifier chain that can be used by other kernel code
150	  to get notified about changes in the connection tracking state.
151
152	  If unsure, say `N'.
153
154config NF_CONNTRACK_TIMEOUT
155	bool  'Connection tracking timeout'
156	depends on NETFILTER_ADVANCED
157	help
158	  This option enables support for connection tracking timeout
159	  extension. This allows you to attach timeout policies to flow
160	  via the CT target.
161
162	  If unsure, say `N'.
163
164config NF_CONNTRACK_TIMESTAMP
165	bool  'Connection tracking timestamping'
166	depends on NETFILTER_ADVANCED
167	help
168	  This option enables support for connection tracking timestamping.
169	  This allows you to store the flow start-time and to obtain
170	  the flow-stop time (once it has been destroyed) via Connection
171	  tracking events.
172
173	  If unsure, say `N'.
174
175config NF_CONNTRACK_LABELS
176	bool "Connection tracking labels"
177	help
178	  This option enables support for assigning user-defined flag bits
179	  to connection tracking entries.  It can be used with xtables connlabel
180	  match and the nftables ct expression.
181
182config NF_CT_PROTO_DCCP
183	bool 'DCCP protocol connection tracking support'
184	depends on NETFILTER_ADVANCED
185	default y
186	help
187	  With this option enabled, the layer 3 independent connection
188	  tracking code will be able to do state tracking on DCCP connections.
189
190	  If unsure, say Y.
191
192config NF_CT_PROTO_GRE
193	bool
194
195config NF_CT_PROTO_SCTP
196	bool 'SCTP protocol connection tracking support'
197	depends on NETFILTER_ADVANCED
198	default y
199	select LIBCRC32C
200	help
201	  With this option enabled, the layer 3 independent connection
202	  tracking code will be able to do state tracking on SCTP connections.
203
204	  If unsure, say Y.
205
206config NF_CT_PROTO_UDPLITE
207	bool 'UDP-Lite protocol connection tracking support'
208	depends on NETFILTER_ADVANCED
209	default y
210	help
211	  With this option enabled, the layer 3 independent connection
212	  tracking code will be able to do state tracking on UDP-Lite
213	  connections.
214
215	  If unsure, say Y.
216
217config NF_CONNTRACK_AMANDA
218	tristate "Amanda backup protocol support"
219	depends on NETFILTER_ADVANCED
220	select TEXTSEARCH
221	select TEXTSEARCH_KMP
222	help
223	  If you are running the Amanda backup package <http://www.amanda.org/>
224	  on this machine or machines that will be MASQUERADED through this
225	  machine, then you may want to enable this feature.  This allows the
226	  connection tracking and natting code to allow the sub-channels that
227	  Amanda requires for communication of the backup data, messages and
228	  index.
229
230	  To compile it as a module, choose M here.  If unsure, say N.
231
232config NF_CONNTRACK_FTP
233	tristate "FTP protocol support"
234	default m if NETFILTER_ADVANCED=n
235	help
236	  Tracking FTP connections is problematic: special helpers are
237	  required for tracking them, and doing masquerading and other forms
238	  of Network Address Translation on them.
239
240	  This is FTP support on Layer 3 independent connection tracking.
241
242	  To compile it as a module, choose M here.  If unsure, say N.
243
244config NF_CONNTRACK_H323
245	tristate "H.323 protocol support"
246	depends on IPV6 || IPV6=n
247	depends on NETFILTER_ADVANCED
248	help
249	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
250	  important VoIP protocols, it is widely used by voice hardware and
251	  software including voice gateways, IP phones, Netmeeting, OpenPhone,
252	  Gnomemeeting, etc.
253
254	  With this module you can support H.323 on a connection tracking/NAT
255	  firewall.
256
257	  This module supports RAS, Fast Start, H.245 Tunnelling, Call
258	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
259	  whiteboard, file transfer, etc. For more information, please
260	  visit http://nath323.sourceforge.net/.
261
262	  To compile it as a module, choose M here.  If unsure, say N.
263
264config NF_CONNTRACK_IRC
265	tristate "IRC protocol support"
266	default m if NETFILTER_ADVANCED=n
267	help
268	  There is a commonly-used extension to IRC called
269	  Direct Client-to-Client Protocol (DCC).  This enables users to send
270	  files to each other, and also chat to each other without the need
271	  of a server.  DCC Sending is used anywhere you send files over IRC,
272	  and DCC Chat is most commonly used by Eggdrop bots.  If you are
273	  using NAT, this extension will enable you to send files and initiate
274	  chats.  Note that you do NOT need this extension to get files or
275	  have others initiate chats, or everything else in IRC.
276
277	  To compile it as a module, choose M here.  If unsure, say N.
278
279config NF_CONNTRACK_BROADCAST
280	tristate
281
282config NF_CONNTRACK_NETBIOS_NS
283	tristate "NetBIOS name service protocol support"
284	select NF_CONNTRACK_BROADCAST
285	help
286	  NetBIOS name service requests are sent as broadcast messages from an
287	  unprivileged port and responded to with unicast messages to the
288	  same port. This make them hard to firewall properly because connection
289	  tracking doesn't deal with broadcasts. This helper tracks locally
290	  originating NetBIOS name service requests and the corresponding
291	  responses. It relies on correct IP address configuration, specifically
292	  netmask and broadcast address. When properly configured, the output
293	  of "ip address show" should look similar to this:
294
295	  $ ip -4 address show eth0
296	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
297	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
298
299	  To compile it as a module, choose M here.  If unsure, say N.
300
301config NF_CONNTRACK_SNMP
302	tristate "SNMP service protocol support"
303	depends on NETFILTER_ADVANCED
304	select NF_CONNTRACK_BROADCAST
305	help
306	  SNMP service requests are sent as broadcast messages from an
307	  unprivileged port and responded to with unicast messages to the
308	  same port. This make them hard to firewall properly because connection
309	  tracking doesn't deal with broadcasts. This helper tracks locally
310	  originating SNMP service requests and the corresponding
311	  responses. It relies on correct IP address configuration, specifically
312	  netmask and broadcast address.
313
314	  To compile it as a module, choose M here.  If unsure, say N.
315
316config NF_CONNTRACK_PPTP
317	tristate "PPtP protocol support"
318	depends on NETFILTER_ADVANCED
319	select NF_CT_PROTO_GRE
320	help
321	  This module adds support for PPTP (Point to Point Tunnelling
322	  Protocol, RFC2637) connection tracking and NAT.
323
324	  If you are running PPTP sessions over a stateful firewall or NAT
325	  box, you may want to enable this feature.
326
327	  Please note that not all PPTP modes of operation are supported yet.
328	  Specifically these limitations exist:
329	    - Blindly assumes that control connections are always established
330	      in PNS->PAC direction. This is a violation of RFC2637.
331	    - Only supports a single call within each session
332
333	  To compile it as a module, choose M here.  If unsure, say N.
334
335config NF_CONNTRACK_SANE
336	tristate "SANE protocol support"
337	depends on NETFILTER_ADVANCED
338	help
339	  SANE is a protocol for remote access to scanners as implemented
340	  by the 'saned' daemon. Like FTP, it uses separate control and
341	  data connections.
342
343	  With this module you can support SANE on a connection tracking
344	  firewall.
345
346	  To compile it as a module, choose M here.  If unsure, say N.
347
348config NF_CONNTRACK_SIP
349	tristate "SIP protocol support"
350	default m if NETFILTER_ADVANCED=n
351	help
352	  SIP is an application-layer control protocol that can establish,
353	  modify, and terminate multimedia sessions (conferences) such as
354	  Internet telephony calls. With the nf_conntrack_sip and
355	  the nf_nat_sip modules you can support the protocol on a connection
356	  tracking/NATing firewall.
357
358	  To compile it as a module, choose M here.  If unsure, say N.
359
360config NF_CONNTRACK_TFTP
361	tristate "TFTP protocol support"
362	depends on NETFILTER_ADVANCED
363	help
364	  TFTP connection tracking helper, this is required depending
365	  on how restrictive your ruleset is.
366	  If you are using a tftp client behind -j SNAT or -j MASQUERADING
367	  you will need this.
368
369	  To compile it as a module, choose M here.  If unsure, say N.
370
371config NF_CT_NETLINK
372	tristate 'Connection tracking netlink interface'
373	select NETFILTER_NETLINK
374	default m if NETFILTER_ADVANCED=n
375	help
376	  This option enables support for a netlink-based userspace interface
377
378config NF_CT_NETLINK_TIMEOUT
379	tristate  'Connection tracking timeout tuning via Netlink'
380	select NETFILTER_NETLINK
381	depends on NETFILTER_ADVANCED
382	depends on NF_CONNTRACK_TIMEOUT
383	help
384	  This option enables support for connection tracking timeout
385	  fine-grain tuning. This allows you to attach specific timeout
386	  policies to flows, instead of using the global timeout policy.
387
388	  If unsure, say `N'.
389
390config NF_CT_NETLINK_HELPER
391	tristate 'Connection tracking helpers in user-space via Netlink'
392	select NETFILTER_NETLINK
393	depends on NF_CT_NETLINK
394	depends on NETFILTER_NETLINK_QUEUE
395	depends on NETFILTER_NETLINK_GLUE_CT
396	depends on NETFILTER_ADVANCED
397	help
398	  This option enables the user-space connection tracking helpers
399	  infrastructure.
400
401	  If unsure, say `N'.
402
403config NETFILTER_NETLINK_GLUE_CT
404	bool "NFQUEUE and NFLOG integration with Connection Tracking"
405	default n
406	depends on (NETFILTER_NETLINK_QUEUE || NETFILTER_NETLINK_LOG) && NF_CT_NETLINK
407	help
408	  If this option is enabled, NFQUEUE and NFLOG can include
409	  Connection Tracking information together with the packet is
410	  the enqueued via NFNETLINK.
411
412config NF_NAT
413	tristate "Network Address Translation support"
414	depends on NF_CONNTRACK
415	default m if NETFILTER_ADVANCED=n
416	help
417	  The NAT option allows masquerading, port forwarding and other
418	  forms of full Network Address Port Translation. This can be
419	  controlled by iptables, ip6tables or nft.
420
421config NF_NAT_AMANDA
422	tristate
423	depends on NF_CONNTRACK && NF_NAT
424	default NF_NAT && NF_CONNTRACK_AMANDA
425
426config NF_NAT_FTP
427	tristate
428	depends on NF_CONNTRACK && NF_NAT
429	default NF_NAT && NF_CONNTRACK_FTP
430
431config NF_NAT_IRC
432	tristate
433	depends on NF_CONNTRACK && NF_NAT
434	default NF_NAT && NF_CONNTRACK_IRC
435
436config NF_NAT_SIP
437	tristate
438	depends on NF_CONNTRACK && NF_NAT
439	default NF_NAT && NF_CONNTRACK_SIP
440
441config NF_NAT_TFTP
442	tristate
443	depends on NF_CONNTRACK && NF_NAT
444	default NF_NAT && NF_CONNTRACK_TFTP
445
446config NF_NAT_REDIRECT
447	bool
448
449config NF_NAT_MASQUERADE
450	bool
451
452config NETFILTER_SYNPROXY
453	tristate
454
455endif # NF_CONNTRACK
456
457config NF_TABLES
458	select NETFILTER_NETLINK
459	select LIBCRC32C
460	tristate "Netfilter nf_tables support"
461	help
462	  nftables is the new packet classification framework that intends to
463	  replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
464	  provides a pseudo-state machine with an extensible instruction-set
465	  (also known as expressions) that the userspace 'nft' utility
466	  (https://www.netfilter.org/projects/nftables) uses to build the
467	  rule-set. It also comes with the generic set infrastructure that
468	  allows you to construct mappings between matchings and actions
469	  for performance lookups.
470
471	  To compile it as a module, choose M here.
472
473if NF_TABLES
474config NF_TABLES_INET
475	depends on IPV6
476	select NF_TABLES_IPV4
477	select NF_TABLES_IPV6
478	bool "Netfilter nf_tables mixed IPv4/IPv6 tables support"
479	help
480	  This option enables support for a mixed IPv4/IPv6 "inet" table.
481
482config NF_TABLES_NETDEV
483	bool "Netfilter nf_tables netdev tables support"
484	help
485	  This option enables support for the "netdev" table.
486
487config NFT_NUMGEN
488	tristate "Netfilter nf_tables number generator module"
489	help
490	  This option adds the number generator expression used to perform
491	  incremental counting and random numbers bound to a upper limit.
492
493config NFT_CT
494	depends on NF_CONNTRACK
495	tristate "Netfilter nf_tables conntrack module"
496	help
497	  This option adds the "ct" expression that you can use to match
498	  connection tracking information such as the flow state.
499
500config NFT_FLOW_OFFLOAD
501	depends on NF_CONNTRACK && NF_FLOW_TABLE
502	tristate "Netfilter nf_tables hardware flow offload module"
503	help
504	  This option adds the "flow_offload" expression that you can use to
505	  choose what flows are placed into the hardware.
506
507config NFT_COUNTER
508	tristate "Netfilter nf_tables counter module"
509	help
510	  This option adds the "counter" expression that you can use to
511	  include packet and byte counters in a rule.
512
513config NFT_CONNLIMIT
514	tristate "Netfilter nf_tables connlimit module"
515	depends on NF_CONNTRACK
516	depends on NETFILTER_ADVANCED
517	select NETFILTER_CONNCOUNT
518	help
519	  This option adds the "connlimit" expression that you can use to
520	  ratelimit rule matchings per connections.
521
522config NFT_LOG
523	tristate "Netfilter nf_tables log module"
524	help
525	  This option adds the "log" expression that you can use to log
526	  packets matching some criteria.
527
528config NFT_LIMIT
529	tristate "Netfilter nf_tables limit module"
530	help
531	  This option adds the "limit" expression that you can use to
532	  ratelimit rule matchings.
533
534config NFT_MASQ
535	depends on NF_CONNTRACK
536	depends on NF_NAT
537	select NF_NAT_MASQUERADE
538	tristate "Netfilter nf_tables masquerade support"
539	help
540	  This option adds the "masquerade" expression that you can use
541	  to perform NAT in the masquerade flavour.
542
543config NFT_REDIR
544	depends on NF_CONNTRACK
545	depends on NF_NAT
546	tristate "Netfilter nf_tables redirect support"
547	select NF_NAT_REDIRECT
548	help
549	  This options adds the "redirect" expression that you can use
550	  to perform NAT in the redirect flavour.
551
552config NFT_NAT
553	depends on NF_CONNTRACK
554	select NF_NAT
555	depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
556	tristate "Netfilter nf_tables nat module"
557	help
558	  This option adds the "nat" expression that you can use to perform
559	  typical Network Address Translation (NAT) packet transformations.
560
561config NFT_TUNNEL
562	tristate "Netfilter nf_tables tunnel module"
563	help
564	  This option adds the "tunnel" expression that you can use to set
565	  tunneling policies.
566
567config NFT_OBJREF
568	tristate "Netfilter nf_tables stateful object reference module"
569	help
570	  This option adds the "objref" expression that allows you to refer to
571	  stateful objects, such as counters and quotas.
572
573config NFT_QUEUE
574	depends on NETFILTER_NETLINK_QUEUE
575	tristate "Netfilter nf_tables queue module"
576	help
577	  This is required if you intend to use the userspace queueing
578	  infrastructure (also known as NFQUEUE) from nftables.
579
580config NFT_QUOTA
581	tristate "Netfilter nf_tables quota module"
582	help
583	  This option adds the "quota" expression that you can use to match
584	  enforce bytes quotas.
585
586config NFT_REJECT
587	default m if NETFILTER_ADVANCED=n
588	tristate "Netfilter nf_tables reject support"
589	depends on !NF_TABLES_INET || (IPV6!=m || m)
590	help
591	  This option adds the "reject" expression that you can use to
592	  explicitly deny and notify via TCP reset/ICMP informational errors
593	  unallowed traffic.
594
595config NFT_REJECT_INET
596	depends on NF_TABLES_INET
597	default NFT_REJECT
598	tristate
599
600config NFT_COMPAT
601	depends on NETFILTER_XTABLES
602	tristate "Netfilter x_tables over nf_tables module"
603	help
604	  This is required if you intend to use any of existing
605	  x_tables match/target extensions over the nf_tables
606	  framework.
607
608config NFT_HASH
609	tristate "Netfilter nf_tables hash module"
610	help
611	  This option adds the "hash" expression that you can use to perform
612	  a hash operation on registers.
613
614config NFT_FIB
615	tristate
616
617config NFT_FIB_INET
618	depends on NF_TABLES_INET
619	depends on NFT_FIB_IPV4
620	depends on NFT_FIB_IPV6
621	tristate "Netfilter nf_tables fib inet support"
622	help
623	  This option allows using the FIB expression from the inet table.
624	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
625	  on the protocol of the packet.
626
627config NFT_XFRM
628	tristate "Netfilter nf_tables xfrm/IPSec security association matching"
629	depends on XFRM
630	help
631	  This option adds an expression that you can use to extract properties
632	  of a packets security association.
633
634config NFT_SOCKET
635	tristate "Netfilter nf_tables socket match support"
636	depends on IPV6 || IPV6=n
637	select NF_SOCKET_IPV4
638	select NF_SOCKET_IPV6 if NF_TABLES_IPV6
639	help
640	  This option allows matching for the presence or absence of a
641	  corresponding socket and its attributes.
642
643config NFT_OSF
644	tristate "Netfilter nf_tables passive OS fingerprint support"
645	depends on NETFILTER_ADVANCED
646	select NETFILTER_NETLINK_OSF
647	help
648	  This option allows matching packets from an specific OS.
649
650config NFT_TPROXY
651	tristate "Netfilter nf_tables tproxy support"
652	depends on IPV6 || IPV6=n
653	select NF_DEFRAG_IPV4
654	select NF_DEFRAG_IPV6 if NF_TABLES_IPV6
655	select NF_TPROXY_IPV4
656	select NF_TPROXY_IPV6 if NF_TABLES_IPV6
657	help
658	  This makes transparent proxy support available in nftables.
659
660config NFT_SYNPROXY
661	tristate "Netfilter nf_tables SYNPROXY expression support"
662	depends on NF_CONNTRACK && NETFILTER_ADVANCED
663	select NETFILTER_SYNPROXY
664	select SYN_COOKIES
665	help
666	  The SYNPROXY expression allows you to intercept TCP connections and
667	  establish them using syncookies before they are passed on to the
668	  server. This allows to avoid conntrack and server resource usage
669	  during SYN-flood attacks.
670
671if NF_TABLES_NETDEV
672
673config NF_DUP_NETDEV
674	tristate "Netfilter packet duplication support"
675	help
676	  This option enables the generic packet duplication infrastructure
677	  for Netfilter.
678
679config NFT_DUP_NETDEV
680	tristate "Netfilter nf_tables netdev packet duplication support"
681	select NF_DUP_NETDEV
682	help
683	  This option enables packet duplication for the "netdev" family.
684
685config NFT_FWD_NETDEV
686	tristate "Netfilter nf_tables netdev packet forwarding support"
687	select NF_DUP_NETDEV
688	help
689	  This option enables packet forwarding for the "netdev" family.
690
691config NFT_FIB_NETDEV
692	depends on NFT_FIB_IPV4
693	depends on NFT_FIB_IPV6
694	tristate "Netfilter nf_tables netdev fib lookups support"
695	help
696	  This option allows using the FIB expression from the netdev table.
697	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
698	  on the protocol of the packet.
699
700config NFT_REJECT_NETDEV
701	depends on NFT_REJECT_IPV4
702	depends on NFT_REJECT_IPV6
703	tristate "Netfilter nf_tables netdev REJECT support"
704	help
705	  This option enables the REJECT support from the netdev table.
706	  The return packet generation will be delegated to the IPv4
707	  or IPv6 ICMP or TCP RST implementation depending on the
708	  protocol of the packet.
709
710endif # NF_TABLES_NETDEV
711
712endif # NF_TABLES
713
714config NF_FLOW_TABLE_INET
715	tristate "Netfilter flow table mixed IPv4/IPv6 module"
716	depends on NF_FLOW_TABLE
717	help
718	  This option adds the flow table mixed IPv4/IPv6 support.
719
720	  To compile it as a module, choose M here.
721
722config NF_FLOW_TABLE
723	tristate "Netfilter flow table module"
724	depends on NETFILTER_INGRESS
725	depends on NF_CONNTRACK
726	depends on NF_TABLES
727	help
728	  This option adds the flow table core infrastructure.
729
730	  To compile it as a module, choose M here.
731
732config NETFILTER_XTABLES
733	tristate "Netfilter Xtables support (required for ip_tables)"
734	default m if NETFILTER_ADVANCED=n
735	help
736	  This is required if you intend to use any of ip_tables,
737	  ip6_tables or arp_tables.
738
739if NETFILTER_XTABLES
740
741config NETFILTER_XTABLES_COMPAT
742	bool "Netfilter Xtables 32bit support"
743	depends on COMPAT
744	default y
745	help
746	   This option provides a translation layer to run 32bit arp,ip(6),ebtables
747	   binaries on 64bit kernels.
748
749	   If unsure, say N.
750
751comment "Xtables combined modules"
752
753config NETFILTER_XT_MARK
754	tristate 'nfmark target and match support'
755	default m if NETFILTER_ADVANCED=n
756	help
757	This option adds the "MARK" target and "mark" match.
758
759	Netfilter mark matching allows you to match packets based on the
760	"nfmark" value in the packet.
761	The target allows you to create rules in the "mangle" table which alter
762	the netfilter mark (nfmark) field associated with the packet.
763
764	Prior to routing, the nfmark can influence the routing method and can
765	also be used by other subsystems to change their behavior.
766
767config NETFILTER_XT_CONNMARK
768	tristate 'ctmark target and match support'
769	depends on NF_CONNTRACK
770	depends on NETFILTER_ADVANCED
771	select NF_CONNTRACK_MARK
772	help
773	This option adds the "CONNMARK" target and "connmark" match.
774
775	Netfilter allows you to store a mark value per connection (a.k.a.
776	ctmark), similarly to the packet mark (nfmark). Using this
777	target and match, you can set and match on this mark.
778
779config NETFILTER_XT_SET
780	tristate 'set target and match support'
781	depends on IP_SET
782	depends on NETFILTER_ADVANCED
783	help
784	  This option adds the "SET" target and "set" match.
785
786	  Using this target and match, you can add/delete and match
787	  elements in the sets created by ipset(8).
788
789	  To compile it as a module, choose M here.  If unsure, say N.
790
791# alphabetically ordered list of targets
792
793comment "Xtables targets"
794
795config NETFILTER_XT_TARGET_AUDIT
796	tristate "AUDIT target support"
797	depends on AUDIT
798	depends on NETFILTER_ADVANCED
799	help
800	  This option adds a 'AUDIT' target, which can be used to create
801	  audit records for packets dropped/accepted.
802
803	  To compileit as a module, choose M here. If unsure, say N.
804
805config NETFILTER_XT_TARGET_CHECKSUM
806	tristate "CHECKSUM target support"
807	depends on IP_NF_MANGLE || IP6_NF_MANGLE
808	depends on NETFILTER_ADVANCED
809	help
810	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
811	  table to work around buggy DHCP clients in virtualized environments.
812
813	  Some old DHCP clients drop packets because they are not aware
814	  that the checksum would normally be offloaded to hardware and
815	  thus should be considered valid.
816	  This target can be used to fill in the checksum using iptables
817	  when such packets are sent via a virtual network device.
818
819	  To compile it as a module, choose M here.  If unsure, say N.
820
821config NETFILTER_XT_TARGET_CLASSIFY
822	tristate '"CLASSIFY" target support'
823	depends on NETFILTER_ADVANCED
824	help
825	  This option adds a `CLASSIFY' target, which enables the user to set
826	  the priority of a packet. Some qdiscs can use this value for
827	  classification, among these are:
828
829	  atm, cbq, dsmark, pfifo_fast, htb, prio
830
831	  To compile it as a module, choose M here.  If unsure, say N.
832
833config NETFILTER_XT_TARGET_CONNMARK
834	tristate  '"CONNMARK" target support'
835	depends on NF_CONNTRACK
836	depends on NETFILTER_ADVANCED
837	select NETFILTER_XT_CONNMARK
838	help
839	This is a backwards-compat option for the user's convenience
840	(e.g. when running oldconfig). It selects
841	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
842
843config NETFILTER_XT_TARGET_CONNSECMARK
844	tristate '"CONNSECMARK" target support'
845	depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
846	default m if NETFILTER_ADVANCED=n
847	help
848	  The CONNSECMARK target copies security markings from packets
849	  to connections, and restores security markings from connections
850	  to packets (if the packets are not already marked).  This would
851	  normally be used in conjunction with the SECMARK target.
852
853	  To compile it as a module, choose M here.  If unsure, say N.
854
855config NETFILTER_XT_TARGET_CT
856	tristate '"CT" target support'
857	depends on NF_CONNTRACK
858	depends on IP_NF_RAW || IP6_NF_RAW
859	depends on NETFILTER_ADVANCED
860	help
861	  This options adds a `CT' target, which allows to specify initial
862	  connection tracking parameters like events to be delivered and
863	  the helper to be used.
864
865	  To compile it as a module, choose M here.  If unsure, say N.
866
867config NETFILTER_XT_TARGET_DSCP
868	tristate '"DSCP" and "TOS" target support'
869	depends on IP_NF_MANGLE || IP6_NF_MANGLE
870	depends on NETFILTER_ADVANCED
871	help
872	  This option adds a `DSCP' target, which allows you to manipulate
873	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
874
875	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
876
877	  It also adds the "TOS" target, which allows you to create rules in
878	  the "mangle" table which alter the Type Of Service field of an IPv4
879	  or the Priority field of an IPv6 packet, prior to routing.
880
881	  To compile it as a module, choose M here.  If unsure, say N.
882
883config NETFILTER_XT_TARGET_HL
884	tristate '"HL" hoplimit target support'
885	depends on IP_NF_MANGLE || IP6_NF_MANGLE
886	depends on NETFILTER_ADVANCED
887	help
888	This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
889	targets, which enable the user to change the
890	hoplimit/time-to-live value of the IP header.
891
892	While it is safe to decrement the hoplimit/TTL value, the
893	modules also allow to increment and set the hoplimit value of
894	the header to arbitrary values. This is EXTREMELY DANGEROUS
895	since you can easily create immortal packets that loop
896	forever on the network.
897
898config NETFILTER_XT_TARGET_HMARK
899	tristate '"HMARK" target support'
900	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
901	depends on NETFILTER_ADVANCED
902	help
903	This option adds the "HMARK" target.
904
905	The target allows you to create rules in the "raw" and "mangle" tables
906	which set the skbuff mark by means of hash calculation within a given
907	range. The nfmark can influence the routing method and can also be used
908	by other subsystems to change their behaviour.
909
910	To compile it as a module, choose M here. If unsure, say N.
911
912config NETFILTER_XT_TARGET_IDLETIMER
913	tristate  "IDLETIMER target support"
914	depends on NETFILTER_ADVANCED
915	help
916
917	  This option adds the `IDLETIMER' target.  Each matching packet
918	  resets the timer associated with label specified when the rule is
919	  added.  When the timer expires, it triggers a sysfs notification.
920	  The remaining time for expiration can be read via sysfs.
921
922	  To compile it as a module, choose M here.  If unsure, say N.
923
924config NETFILTER_XT_TARGET_LED
925	tristate '"LED" target support'
926	depends on LEDS_CLASS && LEDS_TRIGGERS
927	depends on NETFILTER_ADVANCED
928	help
929	  This option adds a `LED' target, which allows you to blink LEDs in
930	  response to particular packets passing through your machine.
931
932	  This can be used to turn a spare LED into a network activity LED,
933	  which only flashes in response to FTP transfers, for example.  Or
934	  you could have an LED which lights up for a minute or two every time
935	  somebody connects to your machine via SSH.
936
937	  You will need support for the "led" class to make this work.
938
939	  To create an LED trigger for incoming SSH traffic:
940	    iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
941
942	  Then attach the new trigger to an LED on your system:
943	    echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
944
945	  For more information on the LEDs available on your system, see
946	  Documentation/leds/leds-class.rst
947
948config NETFILTER_XT_TARGET_LOG
949	tristate "LOG target support"
950	select NF_LOG_SYSLOG
951	select NF_LOG_IPV6 if IP6_NF_IPTABLES
952	default m if NETFILTER_ADVANCED=n
953	help
954	  This option adds a `LOG' target, which allows you to create rules in
955	  any iptables table which records the packet header to the syslog.
956
957	  To compile it as a module, choose M here.  If unsure, say N.
958
959config NETFILTER_XT_TARGET_MARK
960	tristate '"MARK" target support'
961	depends on NETFILTER_ADVANCED
962	select NETFILTER_XT_MARK
963	help
964	This is a backwards-compat option for the user's convenience
965	(e.g. when running oldconfig). It selects
966	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
967
968config NETFILTER_XT_NAT
969	tristate '"SNAT and DNAT" targets support'
970	depends on NF_NAT
971	help
972	This option enables the SNAT and DNAT targets.
973
974	To compile it as a module, choose M here. If unsure, say N.
975
976config NETFILTER_XT_TARGET_NETMAP
977	tristate '"NETMAP" target support'
978	depends on NF_NAT
979	help
980	NETMAP is an implementation of static 1:1 NAT mapping of network
981	addresses. It maps the network address part, while keeping the host
982	address part intact.
983
984	To compile it as a module, choose M here. If unsure, say N.
985
986config NETFILTER_XT_TARGET_NFLOG
987	tristate '"NFLOG" target support'
988	default m if NETFILTER_ADVANCED=n
989	select NETFILTER_NETLINK_LOG
990	help
991	  This option enables the NFLOG target, which allows to LOG
992	  messages through nfnetlink_log.
993
994	  To compile it as a module, choose M here.  If unsure, say N.
995
996config NETFILTER_XT_TARGET_NFQUEUE
997	tristate '"NFQUEUE" target Support'
998	depends on NETFILTER_ADVANCED
999	select NETFILTER_NETLINK_QUEUE
1000	help
1001	  This target replaced the old obsolete QUEUE target.
1002
1003	  As opposed to QUEUE, it supports 65535 different queues,
1004	  not just one.
1005
1006	  To compile it as a module, choose M here.  If unsure, say N.
1007
1008config NETFILTER_XT_TARGET_NOTRACK
1009	tristate  '"NOTRACK" target support (DEPRECATED)'
1010	depends on NF_CONNTRACK
1011	depends on IP_NF_RAW || IP6_NF_RAW
1012	depends on NETFILTER_ADVANCED
1013	select NETFILTER_XT_TARGET_CT
1014
1015config NETFILTER_XT_TARGET_RATEEST
1016	tristate '"RATEEST" target support'
1017	depends on NETFILTER_ADVANCED
1018	help
1019	  This option adds a `RATEEST' target, which allows to measure
1020	  rates similar to TC estimators. The `rateest' match can be
1021	  used to match on the measured rates.
1022
1023	  To compile it as a module, choose M here.  If unsure, say N.
1024
1025config NETFILTER_XT_TARGET_REDIRECT
1026	tristate "REDIRECT target support"
1027	depends on NF_NAT
1028	select NF_NAT_REDIRECT
1029	help
1030	REDIRECT is a special case of NAT: all incoming connections are
1031	mapped onto the incoming interface's address, causing the packets to
1032	come to the local machine instead of passing through. This is
1033	useful for transparent proxies.
1034
1035	To compile it as a module, choose M here. If unsure, say N.
1036
1037config NETFILTER_XT_TARGET_MASQUERADE
1038	tristate "MASQUERADE target support"
1039	depends on NF_NAT
1040	default m if NETFILTER_ADVANCED=n
1041	select NF_NAT_MASQUERADE
1042	help
1043	  Masquerading is a special case of NAT: all outgoing connections are
1044	  changed to seem to come from a particular interface's address, and
1045	  if the interface goes down, those connections are lost.  This is
1046	  only useful for dialup accounts with dynamic IP address (ie. your IP
1047	  address will be different on next dialup).
1048
1049	  To compile it as a module, choose M here.  If unsure, say N.
1050
1051config NETFILTER_XT_TARGET_TEE
1052	tristate '"TEE" - packet cloning to alternate destination'
1053	depends on NETFILTER_ADVANCED
1054	depends on IPV6 || IPV6=n
1055	depends on !NF_CONNTRACK || NF_CONNTRACK
1056	depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
1057	select NF_DUP_IPV4
1058	select NF_DUP_IPV6 if IP6_NF_IPTABLES
1059	help
1060	This option adds a "TEE" target with which a packet can be cloned and
1061	this clone be rerouted to another nexthop.
1062
1063config NETFILTER_XT_TARGET_TPROXY
1064	tristate '"TPROXY" target transparent proxying support'
1065	depends on NETFILTER_XTABLES
1066	depends on NETFILTER_ADVANCED
1067	depends on IPV6 || IPV6=n
1068	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1069	depends on IP_NF_MANGLE
1070	select NF_DEFRAG_IPV4
1071	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1072	select NF_TPROXY_IPV4
1073	select NF_TPROXY_IPV6 if IP6_NF_IPTABLES
1074	help
1075	  This option adds a `TPROXY' target, which is somewhat similar to
1076	  REDIRECT.  It can only be used in the mangle table and is useful
1077	  to redirect traffic to a transparent proxy.  It does _not_ depend
1078	  on Netfilter connection tracking and NAT, unlike REDIRECT.
1079	  For it to work you will have to configure certain iptables rules
1080	  and use policy routing. For more information on how to set it up
1081	  see Documentation/networking/tproxy.rst.
1082
1083	  To compile it as a module, choose M here.  If unsure, say N.
1084
1085config NETFILTER_XT_TARGET_TRACE
1086	tristate  '"TRACE" target support'
1087	depends on IP_NF_RAW || IP6_NF_RAW
1088	depends on NETFILTER_ADVANCED
1089	help
1090	  The TRACE target allows you to mark packets so that the kernel
1091	  will log every rule which match the packets as those traverse
1092	  the tables, chains, rules.
1093
1094	  If you want to compile it as a module, say M here and read
1095	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1096
1097config NETFILTER_XT_TARGET_SECMARK
1098	tristate '"SECMARK" target support'
1099	depends on NETWORK_SECMARK
1100	default m if NETFILTER_ADVANCED=n
1101	help
1102	  The SECMARK target allows security marking of network
1103	  packets, for use with security subsystems.
1104
1105	  To compile it as a module, choose M here.  If unsure, say N.
1106
1107config NETFILTER_XT_TARGET_TCPMSS
1108	tristate '"TCPMSS" target support'
1109	depends on IPV6 || IPV6=n
1110	default m if NETFILTER_ADVANCED=n
1111	help
1112	  This option adds a `TCPMSS' target, which allows you to alter the
1113	  MSS value of TCP SYN packets, to control the maximum size for that
1114	  connection (usually limiting it to your outgoing interface's MTU
1115	  minus 40).
1116
1117	  This is used to overcome criminally braindead ISPs or servers which
1118	  block ICMP Fragmentation Needed packets.  The symptoms of this
1119	  problem are that everything works fine from your Linux
1120	  firewall/router, but machines behind it can never exchange large
1121	  packets:
1122	        1) Web browsers connect, then hang with no data received.
1123	        2) Small mail works fine, but large emails hang.
1124	        3) ssh works fine, but scp hangs after initial handshaking.
1125
1126	  Workaround: activate this option and add a rule to your firewall
1127	  configuration like:
1128
1129	  iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
1130	                 -j TCPMSS --clamp-mss-to-pmtu
1131
1132	  To compile it as a module, choose M here.  If unsure, say N.
1133
1134config NETFILTER_XT_TARGET_TCPOPTSTRIP
1135	tristate '"TCPOPTSTRIP" target support'
1136	depends on IP_NF_MANGLE || IP6_NF_MANGLE
1137	depends on NETFILTER_ADVANCED
1138	help
1139	  This option adds a "TCPOPTSTRIP" target, which allows you to strip
1140	  TCP options from TCP packets.
1141
1142# alphabetically ordered list of matches
1143
1144comment "Xtables matches"
1145
1146config NETFILTER_XT_MATCH_ADDRTYPE
1147	tristate '"addrtype" address type match support'
1148	default m if NETFILTER_ADVANCED=n
1149	help
1150	  This option allows you to match what routing thinks of an address,
1151	  eg. UNICAST, LOCAL, BROADCAST, ...
1152
1153	  If you want to compile it as a module, say M here and read
1154	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1155
1156config NETFILTER_XT_MATCH_BPF
1157	tristate '"bpf" match support'
1158	depends on NETFILTER_ADVANCED
1159	help
1160	  BPF matching applies a linux socket filter to each packet and
1161	  accepts those for which the filter returns non-zero.
1162
1163	  To compile it as a module, choose M here.  If unsure, say N.
1164
1165config NETFILTER_XT_MATCH_CGROUP
1166	tristate '"control group" match support'
1167	depends on NETFILTER_ADVANCED
1168	depends on CGROUPS
1169	select CGROUP_NET_CLASSID
1170	help
1171	Socket/process control group matching allows you to match locally
1172	generated packets based on which net_cls control group processes
1173	belong to.
1174
1175config NETFILTER_XT_MATCH_CLUSTER
1176	tristate '"cluster" match support'
1177	depends on NF_CONNTRACK
1178	depends on NETFILTER_ADVANCED
1179	help
1180	  This option allows you to build work-load-sharing clusters of
1181	  network servers/stateful firewalls without having a dedicated
1182	  load-balancing router/server/switch. Basically, this match returns
1183	  true when the packet must be handled by this cluster node. Thus,
1184	  all nodes see all packets and this match decides which node handles
1185	  what packets. The work-load sharing algorithm is based on source
1186	  address hashing.
1187
1188	  If you say Y or M here, try `iptables -m cluster --help` for
1189	  more information.
1190
1191config NETFILTER_XT_MATCH_COMMENT
1192	tristate  '"comment" match support'
1193	depends on NETFILTER_ADVANCED
1194	help
1195	  This option adds a `comment' dummy-match, which allows you to put
1196	  comments in your iptables ruleset.
1197
1198	  If you want to compile it as a module, say M here and read
1199	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1200
1201config NETFILTER_XT_MATCH_CONNBYTES
1202	tristate  '"connbytes" per-connection counter match support'
1203	depends on NF_CONNTRACK
1204	depends on NETFILTER_ADVANCED
1205	help
1206	  This option adds a `connbytes' match, which allows you to match the
1207	  number of bytes and/or packets for each direction within a connection.
1208
1209	  If you want to compile it as a module, say M here and read
1210	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1211
1212config NETFILTER_XT_MATCH_CONNLABEL
1213	tristate '"connlabel" match support'
1214	select NF_CONNTRACK_LABELS
1215	depends on NF_CONNTRACK
1216	depends on NETFILTER_ADVANCED
1217	help
1218	  This match allows you to test and assign userspace-defined labels names
1219	  to a connection.  The kernel only stores bit values - mapping
1220	  names to bits is done by userspace.
1221
1222	  Unlike connmark, more than 32 flag bits may be assigned to a
1223	  connection simultaneously.
1224
1225config NETFILTER_XT_MATCH_CONNLIMIT
1226	tristate '"connlimit" match support'
1227	depends on NF_CONNTRACK
1228	depends on NETFILTER_ADVANCED
1229	select NETFILTER_CONNCOUNT
1230	help
1231	  This match allows you to match against the number of parallel
1232	  connections to a server per client IP address (or address block).
1233
1234config NETFILTER_XT_MATCH_CONNMARK
1235	tristate  '"connmark" connection mark match support'
1236	depends on NF_CONNTRACK
1237	depends on NETFILTER_ADVANCED
1238	select NETFILTER_XT_CONNMARK
1239	help
1240	This is a backwards-compat option for the user's convenience
1241	(e.g. when running oldconfig). It selects
1242	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
1243
1244config NETFILTER_XT_MATCH_CONNTRACK
1245	tristate '"conntrack" connection tracking match support'
1246	depends on NF_CONNTRACK
1247	default m if NETFILTER_ADVANCED=n
1248	help
1249	  This is a general conntrack match module, a superset of the state match.
1250
1251	  It allows matching on additional conntrack information, which is
1252	  useful in complex configurations, such as NAT gateways with multiple
1253	  internet links or tunnels.
1254
1255	  To compile it as a module, choose M here.  If unsure, say N.
1256
1257config NETFILTER_XT_MATCH_CPU
1258	tristate '"cpu" match support'
1259	depends on NETFILTER_ADVANCED
1260	help
1261	  CPU matching allows you to match packets based on the CPU
1262	  currently handling the packet.
1263
1264	  To compile it as a module, choose M here.  If unsure, say N.
1265
1266config NETFILTER_XT_MATCH_DCCP
1267	tristate '"dccp" protocol match support'
1268	depends on NETFILTER_ADVANCED
1269	default IP_DCCP
1270	help
1271	  With this option enabled, you will be able to use the iptables
1272	  `dccp' match in order to match on DCCP source/destination ports
1273	  and DCCP flags.
1274
1275	  If you want to compile it as a module, say M here and read
1276	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1277
1278config NETFILTER_XT_MATCH_DEVGROUP
1279	tristate '"devgroup" match support'
1280	depends on NETFILTER_ADVANCED
1281	help
1282	  This options adds a `devgroup' match, which allows to match on the
1283	  device group a network device is assigned to.
1284
1285	  To compile it as a module, choose M here.  If unsure, say N.
1286
1287config NETFILTER_XT_MATCH_DSCP
1288	tristate '"dscp" and "tos" match support'
1289	depends on NETFILTER_ADVANCED
1290	help
1291	  This option adds a `DSCP' match, which allows you to match against
1292	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
1293
1294	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
1295
1296	  It will also add a "tos" match, which allows you to match packets
1297	  based on the Type Of Service fields of the IPv4 packet (which share
1298	  the same bits as DSCP).
1299
1300	  To compile it as a module, choose M here.  If unsure, say N.
1301
1302config NETFILTER_XT_MATCH_ECN
1303	tristate '"ecn" match support'
1304	depends on NETFILTER_ADVANCED
1305	help
1306	This option adds an "ECN" match, which allows you to match against
1307	the IPv4 and TCP header ECN fields.
1308
1309	To compile it as a module, choose M here. If unsure, say N.
1310
1311config NETFILTER_XT_MATCH_ESP
1312	tristate '"esp" match support'
1313	depends on NETFILTER_ADVANCED
1314	help
1315	  This match extension allows you to match a range of SPIs
1316	  inside ESP header of IPSec packets.
1317
1318	  To compile it as a module, choose M here.  If unsure, say N.
1319
1320config NETFILTER_XT_MATCH_HASHLIMIT
1321	tristate '"hashlimit" match support'
1322	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1323	depends on NETFILTER_ADVANCED
1324	help
1325	  This option adds a `hashlimit' match.
1326
1327	  As opposed to `limit', this match dynamically creates a hash table
1328	  of limit buckets, based on your selection of source/destination
1329	  addresses and/or ports.
1330
1331	  It enables you to express policies like `10kpps for any given
1332	  destination address' or `500pps from any given source address'
1333	  with a single rule.
1334
1335config NETFILTER_XT_MATCH_HELPER
1336	tristate '"helper" match support'
1337	depends on NF_CONNTRACK
1338	depends on NETFILTER_ADVANCED
1339	help
1340	  Helper matching allows you to match packets in dynamic connections
1341	  tracked by a conntrack-helper, ie. nf_conntrack_ftp
1342
1343	  To compile it as a module, choose M here.  If unsure, say Y.
1344
1345config NETFILTER_XT_MATCH_HL
1346	tristate '"hl" hoplimit/TTL match support'
1347	depends on NETFILTER_ADVANCED
1348	help
1349	HL matching allows you to match packets based on the hoplimit
1350	in the IPv6 header, or the time-to-live field in the IPv4
1351	header of the packet.
1352
1353config NETFILTER_XT_MATCH_IPCOMP
1354	tristate '"ipcomp" match support'
1355	depends on NETFILTER_ADVANCED
1356	help
1357	  This match extension allows you to match a range of CPIs(16 bits)
1358	  inside IPComp header of IPSec packets.
1359
1360	  To compile it as a module, choose M here.  If unsure, say N.
1361
1362config NETFILTER_XT_MATCH_IPRANGE
1363	tristate '"iprange" address range match support'
1364	depends on NETFILTER_ADVANCED
1365	help
1366	This option adds a "iprange" match, which allows you to match based on
1367	an IP address range. (Normal iptables only matches on single addresses
1368	with an optional mask.)
1369
1370	If unsure, say M.
1371
1372config NETFILTER_XT_MATCH_IPVS
1373	tristate '"ipvs" match support'
1374	depends on IP_VS
1375	depends on NETFILTER_ADVANCED
1376	depends on NF_CONNTRACK
1377	help
1378	  This option allows you to match against IPVS properties of a packet.
1379
1380	  If unsure, say N.
1381
1382config NETFILTER_XT_MATCH_L2TP
1383	tristate '"l2tp" match support'
1384	depends on NETFILTER_ADVANCED
1385	default L2TP
1386	help
1387	This option adds an "L2TP" match, which allows you to match against
1388	L2TP protocol header fields.
1389
1390	To compile it as a module, choose M here. If unsure, say N.
1391
1392config NETFILTER_XT_MATCH_LENGTH
1393	tristate '"length" match support'
1394	depends on NETFILTER_ADVANCED
1395	help
1396	  This option allows you to match the length of a packet against a
1397	  specific value or range of values.
1398
1399	  To compile it as a module, choose M here.  If unsure, say N.
1400
1401config NETFILTER_XT_MATCH_LIMIT
1402	tristate '"limit" match support'
1403	depends on NETFILTER_ADVANCED
1404	help
1405	  limit matching allows you to control the rate at which a rule can be
1406	  matched: mainly useful in combination with the LOG target ("LOG
1407	  target support", below) and to avoid some Denial of Service attacks.
1408
1409	  To compile it as a module, choose M here.  If unsure, say N.
1410
1411config NETFILTER_XT_MATCH_MAC
1412	tristate '"mac" address match support'
1413	depends on NETFILTER_ADVANCED
1414	help
1415	  MAC matching allows you to match packets based on the source
1416	  Ethernet address of the packet.
1417
1418	  To compile it as a module, choose M here.  If unsure, say N.
1419
1420config NETFILTER_XT_MATCH_MARK
1421	tristate '"mark" match support'
1422	depends on NETFILTER_ADVANCED
1423	select NETFILTER_XT_MARK
1424	help
1425	This is a backwards-compat option for the user's convenience
1426	(e.g. when running oldconfig). It selects
1427	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1428
1429config NETFILTER_XT_MATCH_MULTIPORT
1430	tristate '"multiport" Multiple port match support'
1431	depends on NETFILTER_ADVANCED
1432	help
1433	  Multiport matching allows you to match TCP or UDP packets based on
1434	  a series of source or destination ports: normally a rule can only
1435	  match a single range of ports.
1436
1437	  To compile it as a module, choose M here.  If unsure, say N.
1438
1439config NETFILTER_XT_MATCH_NFACCT
1440	tristate '"nfacct" match support'
1441	depends on NETFILTER_ADVANCED
1442	select NETFILTER_NETLINK_ACCT
1443	help
1444	  This option allows you to use the extended accounting through
1445	  nfnetlink_acct.
1446
1447	  To compile it as a module, choose M here.  If unsure, say N.
1448
1449config NETFILTER_XT_MATCH_OSF
1450	tristate '"osf" Passive OS fingerprint match'
1451	depends on NETFILTER_ADVANCED
1452	select NETFILTER_NETLINK_OSF
1453	help
1454	  This option selects the Passive OS Fingerprinting match module
1455	  that allows to passively match the remote operating system by
1456	  analyzing incoming TCP SYN packets.
1457
1458	  Rules and loading software can be downloaded from
1459	  http://www.ioremap.net/projects/osf
1460
1461	  To compile it as a module, choose M here.  If unsure, say N.
1462
1463config NETFILTER_XT_MATCH_OWNER
1464	tristate '"owner" match support'
1465	depends on NETFILTER_ADVANCED
1466	help
1467	Socket owner matching allows you to match locally-generated packets
1468	based on who created the socket: the user or group. It is also
1469	possible to check whether a socket actually exists.
1470
1471config NETFILTER_XT_MATCH_POLICY
1472	tristate 'IPsec "policy" match support'
1473	depends on XFRM
1474	default m if NETFILTER_ADVANCED=n
1475	help
1476	  Policy matching allows you to match packets based on the
1477	  IPsec policy that was used during decapsulation/will
1478	  be used during encapsulation.
1479
1480	  To compile it as a module, choose M here.  If unsure, say N.
1481
1482config NETFILTER_XT_MATCH_PHYSDEV
1483	tristate '"physdev" match support'
1484	depends on BRIDGE && BRIDGE_NETFILTER
1485	depends on NETFILTER_ADVANCED
1486	help
1487	  Physdev packet matching matches against the physical bridge ports
1488	  the IP packet arrived on or will leave by.
1489
1490	  To compile it as a module, choose M here.  If unsure, say N.
1491
1492config NETFILTER_XT_MATCH_PKTTYPE
1493	tristate '"pkttype" packet type match support'
1494	depends on NETFILTER_ADVANCED
1495	help
1496	  Packet type matching allows you to match a packet by
1497	  its "class", eg. BROADCAST, MULTICAST, ...
1498
1499	  Typical usage:
1500	  iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1501
1502	  To compile it as a module, choose M here.  If unsure, say N.
1503
1504config NETFILTER_XT_MATCH_QUOTA
1505	tristate '"quota" match support'
1506	depends on NETFILTER_ADVANCED
1507	help
1508	  This option adds a `quota' match, which allows to match on a
1509	  byte counter.
1510
1511	  If you want to compile it as a module, say M here and read
1512	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1513
1514config NETFILTER_XT_MATCH_RATEEST
1515	tristate '"rateest" match support'
1516	depends on NETFILTER_ADVANCED
1517	select NETFILTER_XT_TARGET_RATEEST
1518	help
1519	  This option adds a `rateest' match, which allows to match on the
1520	  rate estimated by the RATEEST target.
1521
1522	  To compile it as a module, choose M here.  If unsure, say N.
1523
1524config NETFILTER_XT_MATCH_REALM
1525	tristate  '"realm" match support'
1526	depends on NETFILTER_ADVANCED
1527	select IP_ROUTE_CLASSID
1528	help
1529	  This option adds a `realm' match, which allows you to use the realm
1530	  key from the routing subsystem inside iptables.
1531
1532	  This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1533	  in tc world.
1534
1535	  If you want to compile it as a module, say M here and read
1536	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1537
1538config NETFILTER_XT_MATCH_RECENT
1539	tristate '"recent" match support'
1540	depends on NETFILTER_ADVANCED
1541	help
1542	This match is used for creating one or many lists of recently
1543	used addresses and then matching against that/those list(s).
1544
1545	Short options are available by using 'iptables -m recent -h'
1546	Official Website: <http://snowman.net/projects/ipt_recent/>
1547
1548config NETFILTER_XT_MATCH_SCTP
1549	tristate  '"sctp" protocol match support'
1550	depends on NETFILTER_ADVANCED
1551	default IP_SCTP
1552	help
1553	  With this option enabled, you will be able to use the
1554	  `sctp' match in order to match on SCTP source/destination ports
1555	  and SCTP chunk types.
1556
1557	  If you want to compile it as a module, say M here and read
1558	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
1559
1560config NETFILTER_XT_MATCH_SOCKET
1561	tristate '"socket" match support'
1562	depends on NETFILTER_XTABLES
1563	depends on NETFILTER_ADVANCED
1564	depends on IPV6 || IPV6=n
1565	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
1566	select NF_SOCKET_IPV4
1567	select NF_SOCKET_IPV6 if IP6_NF_IPTABLES
1568	select NF_DEFRAG_IPV4
1569	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES != n
1570	help
1571	  This option adds a `socket' match, which can be used to match
1572	  packets for which a TCP or UDP socket lookup finds a valid socket.
1573	  It can be used in combination with the MARK target and policy
1574	  routing to implement full featured non-locally bound sockets.
1575
1576	  To compile it as a module, choose M here.  If unsure, say N.
1577
1578config NETFILTER_XT_MATCH_STATE
1579	tristate '"state" match support'
1580	depends on NF_CONNTRACK
1581	default m if NETFILTER_ADVANCED=n
1582	help
1583	  Connection state matching allows you to match packets based on their
1584	  relationship to a tracked connection (ie. previous packets).  This
1585	  is a powerful tool for packet classification.
1586
1587	  To compile it as a module, choose M here.  If unsure, say N.
1588
1589config NETFILTER_XT_MATCH_STATISTIC
1590	tristate '"statistic" match support'
1591	depends on NETFILTER_ADVANCED
1592	help
1593	  This option adds a `statistic' match, which allows you to match
1594	  on packets periodically or randomly with a given percentage.
1595
1596	  To compile it as a module, choose M here.  If unsure, say N.
1597
1598config NETFILTER_XT_MATCH_STRING
1599	tristate  '"string" match support'
1600	depends on NETFILTER_ADVANCED
1601	select TEXTSEARCH
1602	select TEXTSEARCH_KMP
1603	select TEXTSEARCH_BM
1604	select TEXTSEARCH_FSM
1605	help
1606	  This option adds a `string' match, which allows you to look for
1607	  pattern matchings in packets.
1608
1609	  To compile it as a module, choose M here.  If unsure, say N.
1610
1611config NETFILTER_XT_MATCH_TCPMSS
1612	tristate '"tcpmss" match support'
1613	depends on NETFILTER_ADVANCED
1614	help
1615	  This option adds a `tcpmss' match, which allows you to examine the
1616	  MSS value of TCP SYN packets, which control the maximum packet size
1617	  for that connection.
1618
1619	  To compile it as a module, choose M here.  If unsure, say N.
1620
1621config NETFILTER_XT_MATCH_TIME
1622	tristate '"time" match support'
1623	depends on NETFILTER_ADVANCED
1624	help
1625	  This option adds a "time" match, which allows you to match based on
1626	  the packet arrival time (at the machine which netfilter is running)
1627	  on) or departure time/date (for locally generated packets).
1628
1629	  If you say Y here, try `iptables -m time --help` for
1630	  more information.
1631
1632	  If you want to compile it as a module, say M here.
1633	  If unsure, say N.
1634
1635config NETFILTER_XT_MATCH_U32
1636	tristate '"u32" match support'
1637	depends on NETFILTER_ADVANCED
1638	help
1639	  u32 allows you to extract quantities of up to 4 bytes from a packet,
1640	  AND them with specified masks, shift them by specified amounts and
1641	  test whether the results are in any of a set of specified ranges.
1642	  The specification of what to extract is general enough to skip over
1643	  headers with lengths stored in the packet, as in IP or TCP header
1644	  lengths.
1645
1646	  Details and examples are in the kernel module source.
1647
1648endif # NETFILTER_XTABLES
1649
1650endmenu
1651
1652source "net/netfilter/ipset/Kconfig"
1653
1654source "net/netfilter/ipvs/Kconfig"
1655