• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1menu "Core Netfilter Configuration"
2	depends on NET && INET && NETFILTER
3
4config NETFILTER_NETLINK
5	tristate
6
7config NETFILTER_NETLINK_ACCT
8tristate "Netfilter NFACCT over NFNETLINK interface"
9	depends on NETFILTER_ADVANCED
10	select NETFILTER_NETLINK
11	help
12	  If this option is enabled, the kernel will include support
13	  for extended accounting via NFNETLINK.
14
15config NETFILTER_NETLINK_QUEUE
16	tristate "Netfilter NFQUEUE over NFNETLINK interface"
17	depends on NETFILTER_ADVANCED
18	select NETFILTER_NETLINK
19	help
20	  If this option is enabled, the kernel will include support
21	  for queueing packets via NFNETLINK.
22
23config NETFILTER_NETLINK_LOG
24	tristate "Netfilter LOG over NFNETLINK interface"
25	default m if NETFILTER_ADVANCED=n
26	select NETFILTER_NETLINK
27	help
28	  If this option is enabled, the kernel will include support
29	  for logging packets via NFNETLINK.
30
31	  This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
32	  and is also scheduled to replace the old syslog-based ipt_LOG
33	  and ip6t_LOG modules.
34
35config NF_CONNTRACK
36	tristate "Netfilter connection tracking support"
37	default m if NETFILTER_ADVANCED=n
38	help
39	  Connection tracking keeps a record of what packets have passed
40	  through your machine, in order to figure out how they are related
41	  into connections.
42
43	  This is required to do Masquerading or other kinds of Network
44	  Address Translation.  It can also be used to enhance packet
45	  filtering (see `Connection state match support' below).
46
47	  To compile it as a module, choose M here.  If unsure, say N.
48
49if NF_CONNTRACK
50
51config NF_CONNTRACK_MARK
52	bool  'Connection mark tracking support'
53	depends on NETFILTER_ADVANCED
54	help
55	  This option enables support for connection marks, used by the
56	  `CONNMARK' target and `connmark' match. Similar to the mark value
57	  of packets, but this mark value is kept in the conntrack session
58	  instead of the individual packets.
59
60config NF_CONNTRACK_SECMARK
61	bool  'Connection tracking security mark support'
62	depends on NETWORK_SECMARK
63	default m if NETFILTER_ADVANCED=n
64	help
65	  This option enables security markings to be applied to
66	  connections.  Typically they are copied to connections from
67	  packets using the CONNSECMARK target and copied back from
68	  connections to packets with the same target, with the packets
69	  being originally labeled via SECMARK.
70
71	  If unsure, say 'N'.
72
73config NF_CONNTRACK_ZONES
74	bool  'Connection tracking zones'
75	depends on NETFILTER_ADVANCED
76	depends on NETFILTER_XT_TARGET_CT
77	help
78	  This option enables support for connection tracking zones.
79	  Normally, each connection needs to have a unique system wide
80	  identity. Connection tracking zones allow to have multiple
81	  connections using the same identity, as long as they are
82	  contained in different zones.
83
84	  If unsure, say `N'.
85
86config NF_CONNTRACK_PROCFS
87	bool "Supply CT list in procfs (OBSOLETE)"
88	default y
89	depends on PROC_FS
90	---help---
91	This option enables for the list of known conntrack entries
92	to be shown in procfs under net/netfilter/nf_conntrack. This
93	is considered obsolete in favor of using the conntrack(8)
94	tool which uses Netlink.
95
96config NF_CONNTRACK_EVENTS
97	bool "Connection tracking events"
98	depends on NETFILTER_ADVANCED
99	help
100	  If this option is enabled, the connection tracking code will
101	  provide a notifier chain that can be used by other kernel code
102	  to get notified about changes in the connection tracking state.
103
104	  If unsure, say `N'.
105
106config NF_CONNTRACK_TIMEOUT
107	bool  'Connection tracking timeout'
108	depends on NETFILTER_ADVANCED
109	help
110	  This option enables support for connection tracking timeout
111	  extension. This allows you to attach timeout policies to flow
112	  via the CT target.
113
114	  If unsure, say `N'.
115
116config NF_CONNTRACK_TIMESTAMP
117	bool  'Connection tracking timestamping'
118	depends on NETFILTER_ADVANCED
119	help
120	  This option enables support for connection tracking timestamping.
121	  This allows you to store the flow start-time and to obtain
122	  the flow-stop time (once it has been destroyed) via Connection
123	  tracking events.
124
125	  If unsure, say `N'.
126
127config NF_CONNTRACK_LABELS
128	bool
129	help
130	  This option enables support for assigning user-defined flag bits
131	  to connection tracking entries.  It selected by the connlabel match.
132
133config NF_CT_PROTO_DCCP
134	tristate 'DCCP protocol connection tracking support'
135	depends on NETFILTER_ADVANCED
136	default IP_DCCP
137	help
138	  With this option enabled, the layer 3 independent connection
139	  tracking code will be able to do state tracking on DCCP connections.
140
141	  If unsure, say 'N'.
142
143config NF_CT_PROTO_GRE
144	tristate
145
146config NF_CT_PROTO_SCTP
147	tristate 'SCTP protocol connection tracking support'
148	depends on NETFILTER_ADVANCED
149	default IP_SCTP
150	help
151	  With this option enabled, the layer 3 independent connection
152	  tracking code will be able to do state tracking on SCTP connections.
153
154	  If you want to compile it as a module, say M here and read
155	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
156
157config NF_CT_PROTO_UDPLITE
158	tristate 'UDP-Lite protocol connection tracking support'
159	depends on NETFILTER_ADVANCED
160	help
161	  With this option enabled, the layer 3 independent connection
162	  tracking code will be able to do state tracking on UDP-Lite
163	  connections.
164
165	  To compile it as a module, choose M here.  If unsure, say N.
166
167config NF_CONNTRACK_AMANDA
168	tristate "Amanda backup protocol support"
169	depends on NETFILTER_ADVANCED
170	select TEXTSEARCH
171	select TEXTSEARCH_KMP
172	help
173	  If you are running the Amanda backup package <http://www.amanda.org/>
174	  on this machine or machines that will be MASQUERADED through this
175	  machine, then you may want to enable this feature.  This allows the
176	  connection tracking and natting code to allow the sub-channels that
177	  Amanda requires for communication of the backup data, messages and
178	  index.
179
180	  To compile it as a module, choose M here.  If unsure, say N.
181
182config NF_CONNTRACK_FTP
183	tristate "FTP protocol support"
184	default m if NETFILTER_ADVANCED=n
185	help
186	  Tracking FTP connections is problematic: special helpers are
187	  required for tracking them, and doing masquerading and other forms
188	  of Network Address Translation on them.
189
190	  This is FTP support on Layer 3 independent connection tracking.
191	  Layer 3 independent connection tracking is experimental scheme
192	  which generalize ip_conntrack to support other layer 3 protocols.
193
194	  To compile it as a module, choose M here.  If unsure, say N.
195
196config NF_CONNTRACK_H323
197	tristate "H.323 protocol support"
198	depends on IPV6 || IPV6=n
199	depends on NETFILTER_ADVANCED
200	help
201	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
202	  important VoIP protocols, it is widely used by voice hardware and
203	  software including voice gateways, IP phones, Netmeeting, OpenPhone,
204	  Gnomemeeting, etc.
205
206	  With this module you can support H.323 on a connection tracking/NAT
207	  firewall.
208
209	  This module supports RAS, Fast Start, H.245 Tunnelling, Call
210	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
211	  whiteboard, file transfer, etc. For more information, please
212	  visit http://nath323.sourceforge.net/.
213
214	  To compile it as a module, choose M here.  If unsure, say N.
215
216config NF_CONNTRACK_IRC
217	tristate "IRC protocol support"
218	default m if NETFILTER_ADVANCED=n
219	help
220	  There is a commonly-used extension to IRC called
221	  Direct Client-to-Client Protocol (DCC).  This enables users to send
222	  files to each other, and also chat to each other without the need
223	  of a server.  DCC Sending is used anywhere you send files over IRC,
224	  and DCC Chat is most commonly used by Eggdrop bots.  If you are
225	  using NAT, this extension will enable you to send files and initiate
226	  chats.  Note that you do NOT need this extension to get files or
227	  have others initiate chats, or everything else in IRC.
228
229	  To compile it as a module, choose M here.  If unsure, say N.
230
231config NF_CONNTRACK_BROADCAST
232	tristate
233
234config NF_CONNTRACK_NETBIOS_NS
235	tristate "NetBIOS name service protocol support"
236	select NF_CONNTRACK_BROADCAST
237	help
238	  NetBIOS name service requests are sent as broadcast messages from an
239	  unprivileged port and responded to with unicast messages to the
240	  same port. This make them hard to firewall properly because connection
241	  tracking doesn't deal with broadcasts. This helper tracks locally
242	  originating NetBIOS name service requests and the corresponding
243	  responses. It relies on correct IP address configuration, specifically
244	  netmask and broadcast address. When properly configured, the output
245	  of "ip address show" should look similar to this:
246
247	  $ ip -4 address show eth0
248	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
249	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
250
251	  To compile it as a module, choose M here.  If unsure, say N.
252
253config NF_CONNTRACK_SNMP
254	tristate "SNMP service protocol support"
255	depends on NETFILTER_ADVANCED
256	select NF_CONNTRACK_BROADCAST
257	help
258	  SNMP service requests are sent as broadcast messages from an
259	  unprivileged port and responded to with unicast messages to the
260	  same port. This make them hard to firewall properly because connection
261	  tracking doesn't deal with broadcasts. This helper tracks locally
262	  originating SNMP service requests and the corresponding
263	  responses. It relies on correct IP address configuration, specifically
264	  netmask and broadcast address.
265
266	  To compile it as a module, choose M here.  If unsure, say N.
267
268config NF_CONNTRACK_PPTP
269	tristate "PPtP protocol support"
270	depends on NETFILTER_ADVANCED
271	select NF_CT_PROTO_GRE
272	help
273	  This module adds support for PPTP (Point to Point Tunnelling
274	  Protocol, RFC2637) connection tracking and NAT.
275
276	  If you are running PPTP sessions over a stateful firewall or NAT
277	  box, you may want to enable this feature.
278
279	  Please note that not all PPTP modes of operation are supported yet.
280	  Specifically these limitations exist:
281	    - Blindly assumes that control connections are always established
282	      in PNS->PAC direction. This is a violation of RFC2637.
283	    - Only supports a single call within each session
284
285	  To compile it as a module, choose M here.  If unsure, say N.
286
287config NF_CONNTRACK_SANE
288	tristate "SANE protocol support"
289	depends on NETFILTER_ADVANCED
290	help
291	  SANE is a protocol for remote access to scanners as implemented
292	  by the 'saned' daemon. Like FTP, it uses separate control and
293	  data connections.
294
295	  With this module you can support SANE on a connection tracking
296	  firewall.
297
298	  To compile it as a module, choose M here.  If unsure, say N.
299
300config NF_CONNTRACK_SIP
301	tristate "SIP protocol support"
302	default m if NETFILTER_ADVANCED=n
303	help
304	  SIP is an application-layer control protocol that can establish,
305	  modify, and terminate multimedia sessions (conferences) such as
306	  Internet telephony calls. With the ip_conntrack_sip and
307	  the nf_nat_sip modules you can support the protocol on a connection
308	  tracking/NATing firewall.
309
310	  To compile it as a module, choose M here.  If unsure, say N.
311
312config NF_CONNTRACK_TFTP
313	tristate "TFTP protocol support"
314	depends on NETFILTER_ADVANCED
315	help
316	  TFTP connection tracking helper, this is required depending
317	  on how restrictive your ruleset is.
318	  If you are using a tftp client behind -j SNAT or -j MASQUERADING
319	  you will need this.
320
321	  To compile it as a module, choose M here.  If unsure, say N.
322
323config NF_CT_NETLINK
324	tristate 'Connection tracking netlink interface'
325	select NETFILTER_NETLINK
326	default m if NETFILTER_ADVANCED=n
327	help
328	  This option enables support for a netlink-based userspace interface
329
330config NF_CT_NETLINK_TIMEOUT
331	tristate  'Connection tracking timeout tuning via Netlink'
332	select NETFILTER_NETLINK
333	depends on NETFILTER_ADVANCED
334	help
335	  This option enables support for connection tracking timeout
336	  fine-grain tuning. This allows you to attach specific timeout
337	  policies to flows, instead of using the global timeout policy.
338
339	  If unsure, say `N'.
340
341config NF_CT_NETLINK_HELPER
342	tristate 'Connection tracking helpers in user-space via Netlink'
343	select NETFILTER_NETLINK
344	depends on NF_CT_NETLINK
345	depends on NETFILTER_NETLINK_QUEUE
346	depends on NETFILTER_NETLINK_QUEUE_CT
347	depends on NETFILTER_ADVANCED
348	help
349	  This option enables the user-space connection tracking helpers
350	  infrastructure.
351
352	  If unsure, say `N'.
353
354config NETFILTER_NETLINK_QUEUE_CT
355        bool "NFQUEUE integration with Connection Tracking"
356        default n
357        depends on NETFILTER_NETLINK_QUEUE
358	help
359	  If this option is enabled, NFQUEUE can include Connection Tracking
360	  information together with the packet is the enqueued via NFNETLINK.
361
362config NF_NAT
363	tristate
364
365config NF_NAT_NEEDED
366	bool
367	depends on NF_NAT
368	default y
369
370config NF_NAT_PROTO_DCCP
371	tristate
372	depends on NF_NAT && NF_CT_PROTO_DCCP
373	default NF_NAT && NF_CT_PROTO_DCCP
374
375config NF_NAT_PROTO_UDPLITE
376	tristate
377	depends on NF_NAT && NF_CT_PROTO_UDPLITE
378	default NF_NAT && NF_CT_PROTO_UDPLITE
379
380config NF_NAT_PROTO_SCTP
381	tristate
382	default NF_NAT && NF_CT_PROTO_SCTP
383	depends on NF_NAT && NF_CT_PROTO_SCTP
384	select LIBCRC32C
385
386config NF_NAT_AMANDA
387	tristate
388	depends on NF_CONNTRACK && NF_NAT
389	default NF_NAT && NF_CONNTRACK_AMANDA
390
391config NF_NAT_FTP
392	tristate
393	depends on NF_CONNTRACK && NF_NAT
394	default NF_NAT && NF_CONNTRACK_FTP
395
396config NF_NAT_IRC
397	tristate
398	depends on NF_CONNTRACK && NF_NAT
399	default NF_NAT && NF_CONNTRACK_IRC
400
401config NF_NAT_SIP
402	tristate
403	depends on NF_CONNTRACK && NF_NAT
404	default NF_NAT && NF_CONNTRACK_SIP
405
406config NF_NAT_TFTP
407	tristate
408	depends on NF_CONNTRACK && NF_NAT
409	default NF_NAT && NF_CONNTRACK_TFTP
410
411endif # NF_CONNTRACK
412
413# transparent proxy support
414config NETFILTER_TPROXY
415	tristate "Transparent proxying support"
416	depends on IP_NF_MANGLE
417	depends on NETFILTER_ADVANCED
418	help
419	  This option enables transparent proxying support, that is,
420	  support for handling non-locally bound IPv4 TCP and UDP sockets.
421	  For it to work you will have to configure certain iptables rules
422	  and use policy routing. For more information on how to set it up
423	  see Documentation/networking/tproxy.txt.
424
425	  To compile it as a module, choose M here.  If unsure, say N.
426
427config NETFILTER_XTABLES
428	tristate "Netfilter Xtables support (required for ip_tables)"
429	default m if NETFILTER_ADVANCED=n
430	help
431	  This is required if you intend to use any of ip_tables,
432	  ip6_tables or arp_tables.
433
434if NETFILTER_XTABLES
435
436comment "Xtables combined modules"
437
438config NETFILTER_XT_MARK
439	tristate 'nfmark target and match support'
440	default m if NETFILTER_ADVANCED=n
441	---help---
442	This option adds the "MARK" target and "mark" match.
443
444	Netfilter mark matching allows you to match packets based on the
445	"nfmark" value in the packet.
446	The target allows you to create rules in the "mangle" table which alter
447	the netfilter mark (nfmark) field associated with the packet.
448
449	Prior to routing, the nfmark can influence the routing method (see
450	"Use netfilter MARK value as routing key") and can also be used by
451	other subsystems to change their behavior.
452
453config NETFILTER_XT_CONNMARK
454	tristate 'ctmark target and match support'
455	depends on NF_CONNTRACK
456	depends on NETFILTER_ADVANCED
457	select NF_CONNTRACK_MARK
458	---help---
459	This option adds the "CONNMARK" target and "connmark" match.
460
461	Netfilter allows you to store a mark value per connection (a.k.a.
462	ctmark), similarly to the packet mark (nfmark). Using this
463	target and match, you can set and match on this mark.
464
465config NETFILTER_XT_SET
466	tristate 'set target and match support'
467	depends on IP_SET
468	depends on NETFILTER_ADVANCED
469	help
470	  This option adds the "SET" target and "set" match.
471
472	  Using this target and match, you can add/delete and match
473	  elements in the sets created by ipset(8).
474
475	  To compile it as a module, choose M here.  If unsure, say N.
476
477# alphabetically ordered list of targets
478
479comment "Xtables targets"
480
481config NETFILTER_XT_TARGET_AUDIT
482	tristate "AUDIT target support"
483	depends on AUDIT
484	depends on NETFILTER_ADVANCED
485	---help---
486	  This option adds a 'AUDIT' target, which can be used to create
487	  audit records for packets dropped/accepted.
488
489	  To compileit as a module, choose M here. If unsure, say N.
490
491config NETFILTER_XT_TARGET_CHECKSUM
492	tristate "CHECKSUM target support"
493	depends on IP_NF_MANGLE || IP6_NF_MANGLE
494	depends on NETFILTER_ADVANCED
495	---help---
496	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
497	  table.
498
499	  You can use this target to compute and fill in the checksum in
500	  a packet that lacks a checksum.  This is particularly useful,
501	  if you need to work around old applications such as dhcp clients,
502	  that do not work well with checksum offloads, but don't want to disable
503	  checksum offload in your device.
504
505	  To compile it as a module, choose M here.  If unsure, say N.
506
507config NETFILTER_XT_TARGET_CLASSIFY
508	tristate '"CLASSIFY" target support'
509	depends on NETFILTER_ADVANCED
510	help
511	  This option adds a `CLASSIFY' target, which enables the user to set
512	  the priority of a packet. Some qdiscs can use this value for
513	  classification, among these are:
514
515  	  atm, cbq, dsmark, pfifo_fast, htb, prio
516
517	  To compile it as a module, choose M here.  If unsure, say N.
518
519config NETFILTER_XT_TARGET_CONNMARK
520	tristate  '"CONNMARK" target support'
521	depends on NF_CONNTRACK
522	depends on NETFILTER_ADVANCED
523	select NETFILTER_XT_CONNMARK
524	---help---
525	This is a backwards-compat option for the user's convenience
526	(e.g. when running oldconfig). It selects
527	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
528
529config NETFILTER_XT_TARGET_CONNSECMARK
530	tristate '"CONNSECMARK" target support'
531	depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
532	default m if NETFILTER_ADVANCED=n
533	help
534	  The CONNSECMARK target copies security markings from packets
535	  to connections, and restores security markings from connections
536	  to packets (if the packets are not already marked).  This would
537	  normally be used in conjunction with the SECMARK target.
538
539	  To compile it as a module, choose M here.  If unsure, say N.
540
541config NETFILTER_XT_TARGET_CT
542	tristate '"CT" target support'
543	depends on NF_CONNTRACK
544	depends on IP_NF_RAW || IP6_NF_RAW
545	depends on NETFILTER_ADVANCED
546	help
547	  This options adds a `CT' target, which allows to specify initial
548	  connection tracking parameters like events to be delivered and
549	  the helper to be used.
550
551	  To compile it as a module, choose M here.  If unsure, say N.
552
553config NETFILTER_XT_TARGET_DSCP
554	tristate '"DSCP" and "TOS" target support'
555	depends on IP_NF_MANGLE || IP6_NF_MANGLE
556	depends on NETFILTER_ADVANCED
557	help
558	  This option adds a `DSCP' target, which allows you to manipulate
559	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
560
561	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
562
563	  It also adds the "TOS" target, which allows you to create rules in
564	  the "mangle" table which alter the Type Of Service field of an IPv4
565	  or the Priority field of an IPv6 packet, prior to routing.
566
567	  To compile it as a module, choose M here.  If unsure, say N.
568
569config NETFILTER_XT_TARGET_HL
570	tristate '"HL" hoplimit target support'
571	depends on IP_NF_MANGLE || IP6_NF_MANGLE
572	depends on NETFILTER_ADVANCED
573	---help---
574	This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
575	targets, which enable the user to change the
576	hoplimit/time-to-live value of the IP header.
577
578	While it is safe to decrement the hoplimit/TTL value, the
579	modules also allow to increment and set the hoplimit value of
580	the header to arbitrary values. This is EXTREMELY DANGEROUS
581	since you can easily create immortal packets that loop
582	forever on the network.
583
584config NETFILTER_XT_TARGET_HMARK
585	tristate '"HMARK" target support'
586	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
587	depends on NETFILTER_ADVANCED
588	---help---
589	This option adds the "HMARK" target.
590
591	The target allows you to create rules in the "raw" and "mangle" tables
592	which set the skbuff mark by means of hash calculation within a given
593	range. The nfmark can influence the routing method (see "Use netfilter
594	MARK value as routing key") and can also be used by other subsystems to
595	change their behaviour.
596
597	To compile it as a module, choose M here. If unsure, say N.
598
599config NETFILTER_XT_TARGET_IDLETIMER
600	tristate  "IDLETIMER target support"
601	depends on NETFILTER_ADVANCED
602	help
603
604	  This option adds the `IDLETIMER' target.  Each matching packet
605	  resets the timer associated with label specified when the rule is
606	  added.  When the timer expires, it triggers a sysfs notification.
607	  The remaining time for expiration can be read via sysfs.
608
609	  To compile it as a module, choose M here.  If unsure, say N.
610
611config NETFILTER_XT_TARGET_LED
612	tristate '"LED" target support'
613	depends on LEDS_CLASS && LEDS_TRIGGERS
614	depends on NETFILTER_ADVANCED
615	help
616	  This option adds a `LED' target, which allows you to blink LEDs in
617	  response to particular packets passing through your machine.
618
619	  This can be used to turn a spare LED into a network activity LED,
620	  which only flashes in response to FTP transfers, for example.  Or
621	  you could have an LED which lights up for a minute or two every time
622	  somebody connects to your machine via SSH.
623
624	  You will need support for the "led" class to make this work.
625
626	  To create an LED trigger for incoming SSH traffic:
627	    iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
628
629	  Then attach the new trigger to an LED on your system:
630	    echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
631
632	  For more information on the LEDs available on your system, see
633	  Documentation/leds/leds-class.txt
634
635config NETFILTER_XT_TARGET_LOG
636	tristate "LOG target support"
637	default m if NETFILTER_ADVANCED=n
638	help
639	  This option adds a `LOG' target, which allows you to create rules in
640	  any iptables table which records the packet header to the syslog.
641
642	  To compile it as a module, choose M here.  If unsure, say N.
643
644config NETFILTER_XT_TARGET_MARK
645	tristate '"MARK" target support'
646	depends on NETFILTER_ADVANCED
647	select NETFILTER_XT_MARK
648	---help---
649	This is a backwards-compat option for the user's convenience
650	(e.g. when running oldconfig). It selects
651	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
652
653config NETFILTER_XT_TARGET_NETMAP
654	tristate '"NETMAP" target support'
655	depends on NF_NAT
656	---help---
657	NETMAP is an implementation of static 1:1 NAT mapping of network
658	addresses. It maps the network address part, while keeping the host
659	address part intact.
660
661	To compile it as a module, choose M here. If unsure, say N.
662
663config NETFILTER_XT_TARGET_NFLOG
664	tristate '"NFLOG" target support'
665	default m if NETFILTER_ADVANCED=n
666	select NETFILTER_NETLINK_LOG
667	help
668	  This option enables the NFLOG target, which allows to LOG
669	  messages through nfnetlink_log.
670
671	  To compile it as a module, choose M here.  If unsure, say N.
672
673config NETFILTER_XT_TARGET_NFQUEUE
674	tristate '"NFQUEUE" target Support'
675	depends on NETFILTER_ADVANCED
676	select NETFILTER_NETLINK_QUEUE
677	help
678	  This target replaced the old obsolete QUEUE target.
679
680	  As opposed to QUEUE, it supports 65535 different queues,
681	  not just one.
682
683	  To compile it as a module, choose M here.  If unsure, say N.
684
685config NETFILTER_XT_TARGET_NOTRACK
686	tristate  '"NOTRACK" target support (DEPRECATED)'
687	depends on NF_CONNTRACK
688	depends on IP_NF_RAW || IP6_NF_RAW
689	depends on NETFILTER_ADVANCED
690	select NETFILTER_XT_TARGET_CT
691
692config NETFILTER_XT_TARGET_RATEEST
693	tristate '"RATEEST" target support'
694	depends on NETFILTER_ADVANCED
695	help
696	  This option adds a `RATEEST' target, which allows to measure
697	  rates similar to TC estimators. The `rateest' match can be
698	  used to match on the measured rates.
699
700	  To compile it as a module, choose M here.  If unsure, say N.
701
702config NETFILTER_XT_TARGET_REDIRECT
703	tristate "REDIRECT target support"
704	depends on NF_NAT
705	---help---
706	REDIRECT is a special case of NAT: all incoming connections are
707	mapped onto the incoming interface's address, causing the packets to
708	come to the local machine instead of passing through. This is
709	useful for transparent proxies.
710
711	To compile it as a module, choose M here. If unsure, say N.
712
713config NETFILTER_XT_TARGET_TEE
714	tristate '"TEE" - packet cloning to alternate destination'
715	depends on NETFILTER_ADVANCED
716	depends on IPV6 || IPV6=n
717	depends on !NF_CONNTRACK || NF_CONNTRACK
718	---help---
719	This option adds a "TEE" target with which a packet can be cloned and
720	this clone be rerouted to another nexthop.
721
722config NETFILTER_XT_TARGET_TPROXY
723	tristate '"TPROXY" target support'
724	depends on NETFILTER_TPROXY
725	depends on NETFILTER_XTABLES
726	depends on NETFILTER_ADVANCED
727	depends on IPV6 || IPV6=n
728	select NF_DEFRAG_IPV4
729	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
730	help
731	  This option adds a `TPROXY' target, which is somewhat similar to
732	  REDIRECT.  It can only be used in the mangle table and is useful
733	  to redirect traffic to a transparent proxy.  It does _not_ depend
734	  on Netfilter connection tracking and NAT, unlike REDIRECT.
735
736	  To compile it as a module, choose M here.  If unsure, say N.
737
738config NETFILTER_XT_TARGET_TRACE
739	tristate  '"TRACE" target support'
740	depends on IP_NF_RAW || IP6_NF_RAW
741	depends on NETFILTER_ADVANCED
742	help
743	  The TRACE target allows you to mark packets so that the kernel
744	  will log every rule which match the packets as those traverse
745	  the tables, chains, rules.
746
747	  If you want to compile it as a module, say M here and read
748	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
749
750config NETFILTER_XT_TARGET_SECMARK
751	tristate '"SECMARK" target support'
752	depends on NETWORK_SECMARK
753	default m if NETFILTER_ADVANCED=n
754	help
755	  The SECMARK target allows security marking of network
756	  packets, for use with security subsystems.
757
758	  To compile it as a module, choose M here.  If unsure, say N.
759
760config NETFILTER_XT_TARGET_TCPMSS
761	tristate '"TCPMSS" target support'
762	depends on IPV6 || IPV6=n
763	default m if NETFILTER_ADVANCED=n
764	---help---
765	  This option adds a `TCPMSS' target, which allows you to alter the
766	  MSS value of TCP SYN packets, to control the maximum size for that
767	  connection (usually limiting it to your outgoing interface's MTU
768	  minus 40).
769
770	  This is used to overcome criminally braindead ISPs or servers which
771	  block ICMP Fragmentation Needed packets.  The symptoms of this
772	  problem are that everything works fine from your Linux
773	  firewall/router, but machines behind it can never exchange large
774	  packets:
775	        1) Web browsers connect, then hang with no data received.
776	        2) Small mail works fine, but large emails hang.
777	        3) ssh works fine, but scp hangs after initial handshaking.
778
779	  Workaround: activate this option and add a rule to your firewall
780	  configuration like:
781
782	  iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
783	                 -j TCPMSS --clamp-mss-to-pmtu
784
785	  To compile it as a module, choose M here.  If unsure, say N.
786
787config NETFILTER_XT_TARGET_TCPOPTSTRIP
788	tristate '"TCPOPTSTRIP" target support'
789	depends on IP_NF_MANGLE || IP6_NF_MANGLE
790	depends on NETFILTER_ADVANCED
791	help
792	  This option adds a "TCPOPTSTRIP" target, which allows you to strip
793	  TCP options from TCP packets.
794
795# alphabetically ordered list of matches
796
797comment "Xtables matches"
798
799config NETFILTER_XT_MATCH_ADDRTYPE
800	tristate '"addrtype" address type match support'
801	depends on NETFILTER_ADVANCED
802	---help---
803	  This option allows you to match what routing thinks of an address,
804	  eg. UNICAST, LOCAL, BROADCAST, ...
805
806	  If you want to compile it as a module, say M here and read
807	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
808
809config NETFILTER_XT_MATCH_BPF
810	tristate '"bpf" match support'
811	depends on NETFILTER_ADVANCED
812	help
813	  BPF matching applies a linux socket filter to each packet and
814	  accepts those for which the filter returns non-zero.
815
816	  To compile it as a module, choose M here.  If unsure, say N.
817
818config NETFILTER_XT_MATCH_CLUSTER
819	tristate '"cluster" match support'
820	depends on NF_CONNTRACK
821	depends on NETFILTER_ADVANCED
822	---help---
823	  This option allows you to build work-load-sharing clusters of
824	  network servers/stateful firewalls without having a dedicated
825	  load-balancing router/server/switch. Basically, this match returns
826	  true when the packet must be handled by this cluster node. Thus,
827	  all nodes see all packets and this match decides which node handles
828	  what packets. The work-load sharing algorithm is based on source
829	  address hashing.
830
831	  If you say Y or M here, try `iptables -m cluster --help` for
832	  more information.
833
834config NETFILTER_XT_MATCH_COMMENT
835	tristate  '"comment" match support'
836	depends on NETFILTER_ADVANCED
837	help
838	  This option adds a `comment' dummy-match, which allows you to put
839	  comments in your iptables ruleset.
840
841	  If you want to compile it as a module, say M here and read
842	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
843
844config NETFILTER_XT_MATCH_CONNBYTES
845	tristate  '"connbytes" per-connection counter match support'
846	depends on NF_CONNTRACK
847	depends on NETFILTER_ADVANCED
848	help
849	  This option adds a `connbytes' match, which allows you to match the
850	  number of bytes and/or packets for each direction within a connection.
851
852	  If you want to compile it as a module, say M here and read
853	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
854
855config NETFILTER_XT_MATCH_CONNLABEL
856	tristate '"connlabel" match support'
857	select NF_CONNTRACK_LABELS
858	depends on NF_CONNTRACK
859	depends on NETFILTER_ADVANCED
860	---help---
861	  This match allows you to test and assign userspace-defined labels names
862	  to a connection.  The kernel only stores bit values - mapping
863	  names to bits is done by userspace.
864
865	  Unlike connmark, more than 32 flag bits may be assigned to a
866	  connection simultaneously.
867
868config NETFILTER_XT_MATCH_CONNLIMIT
869	tristate '"connlimit" match support"'
870	depends on NF_CONNTRACK
871	depends on NETFILTER_ADVANCED
872	---help---
873	  This match allows you to match against the number of parallel
874	  connections to a server per client IP address (or address block).
875
876config NETFILTER_XT_MATCH_CONNMARK
877	tristate  '"connmark" connection mark match support'
878	depends on NF_CONNTRACK
879	depends on NETFILTER_ADVANCED
880	select NETFILTER_XT_CONNMARK
881	---help---
882	This is a backwards-compat option for the user's convenience
883	(e.g. when running oldconfig). It selects
884	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
885
886config NETFILTER_XT_MATCH_CONNTRACK
887	tristate '"conntrack" connection tracking match support'
888	depends on NF_CONNTRACK
889	default m if NETFILTER_ADVANCED=n
890	help
891	  This is a general conntrack match module, a superset of the state match.
892
893	  It allows matching on additional conntrack information, which is
894	  useful in complex configurations, such as NAT gateways with multiple
895	  internet links or tunnels.
896
897	  To compile it as a module, choose M here.  If unsure, say N.
898
899config NETFILTER_XT_MATCH_CPU
900	tristate '"cpu" match support'
901	depends on NETFILTER_ADVANCED
902	help
903	  CPU matching allows you to match packets based on the CPU
904	  currently handling the packet.
905
906	  To compile it as a module, choose M here.  If unsure, say N.
907
908config NETFILTER_XT_MATCH_DCCP
909	tristate '"dccp" protocol match support'
910	depends on NETFILTER_ADVANCED
911	default IP_DCCP
912	help
913	  With this option enabled, you will be able to use the iptables
914	  `dccp' match in order to match on DCCP source/destination ports
915	  and DCCP flags.
916
917	  If you want to compile it as a module, say M here and read
918	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
919
920config NETFILTER_XT_MATCH_DEVGROUP
921	tristate '"devgroup" match support'
922	depends on NETFILTER_ADVANCED
923	help
924	  This options adds a `devgroup' match, which allows to match on the
925	  device group a network device is assigned to.
926
927	  To compile it as a module, choose M here.  If unsure, say N.
928
929config NETFILTER_XT_MATCH_DSCP
930	tristate '"dscp" and "tos" match support'
931	depends on NETFILTER_ADVANCED
932	help
933	  This option adds a `DSCP' match, which allows you to match against
934	  the IPv4/IPv6 header DSCP field (differentiated services codepoint).
935
936	  The DSCP field can have any value between 0x0 and 0x3f inclusive.
937
938	  It will also add a "tos" match, which allows you to match packets
939	  based on the Type Of Service fields of the IPv4 packet (which share
940	  the same bits as DSCP).
941
942	  To compile it as a module, choose M here.  If unsure, say N.
943
944config NETFILTER_XT_MATCH_ECN
945	tristate '"ecn" match support'
946	depends on NETFILTER_ADVANCED
947	---help---
948	This option adds an "ECN" match, which allows you to match against
949	the IPv4 and TCP header ECN fields.
950
951	To compile it as a module, choose M here. If unsure, say N.
952
953config NETFILTER_XT_MATCH_ESP
954	tristate '"esp" match support'
955	depends on NETFILTER_ADVANCED
956	help
957	  This match extension allows you to match a range of SPIs
958	  inside ESP header of IPSec packets.
959
960	  To compile it as a module, choose M here.  If unsure, say N.
961
962config NETFILTER_XT_MATCH_HASHLIMIT
963	tristate '"hashlimit" match support'
964	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
965	depends on NETFILTER_ADVANCED
966	help
967	  This option adds a `hashlimit' match.
968
969	  As opposed to `limit', this match dynamically creates a hash table
970	  of limit buckets, based on your selection of source/destination
971	  addresses and/or ports.
972
973	  It enables you to express policies like `10kpps for any given
974	  destination address' or `500pps from any given source address'
975	  with a single rule.
976
977config NETFILTER_XT_MATCH_HELPER
978	tristate '"helper" match support'
979	depends on NF_CONNTRACK
980	depends on NETFILTER_ADVANCED
981	help
982	  Helper matching allows you to match packets in dynamic connections
983	  tracked by a conntrack-helper, ie. ip_conntrack_ftp
984
985	  To compile it as a module, choose M here.  If unsure, say Y.
986
987config NETFILTER_XT_MATCH_HL
988	tristate '"hl" hoplimit/TTL match support'
989	depends on NETFILTER_ADVANCED
990	---help---
991	HL matching allows you to match packets based on the hoplimit
992	in the IPv6 header, or the time-to-live field in the IPv4
993	header of the packet.
994
995config NETFILTER_XT_MATCH_IPRANGE
996	tristate '"iprange" address range match support'
997	depends on NETFILTER_ADVANCED
998	---help---
999	This option adds a "iprange" match, which allows you to match based on
1000	an IP address range. (Normal iptables only matches on single addresses
1001	with an optional mask.)
1002
1003	If unsure, say M.
1004
1005config NETFILTER_XT_MATCH_IPVS
1006	tristate '"ipvs" match support'
1007	depends on IP_VS
1008	depends on NETFILTER_ADVANCED
1009	depends on NF_CONNTRACK
1010	help
1011	  This option allows you to match against IPVS properties of a packet.
1012
1013	  If unsure, say N.
1014
1015config NETFILTER_XT_MATCH_LENGTH
1016	tristate '"length" match support'
1017	depends on NETFILTER_ADVANCED
1018	help
1019	  This option allows you to match the length of a packet against a
1020	  specific value or range of values.
1021
1022	  To compile it as a module, choose M here.  If unsure, say N.
1023
1024config NETFILTER_XT_MATCH_LIMIT
1025	tristate '"limit" match support'
1026	depends on NETFILTER_ADVANCED
1027	help
1028	  limit matching allows you to control the rate at which a rule can be
1029	  matched: mainly useful in combination with the LOG target ("LOG
1030	  target support", below) and to avoid some Denial of Service attacks.
1031
1032	  To compile it as a module, choose M here.  If unsure, say N.
1033
1034config NETFILTER_XT_MATCH_MAC
1035	tristate '"mac" address match support'
1036	depends on NETFILTER_ADVANCED
1037	help
1038	  MAC matching allows you to match packets based on the source
1039	  Ethernet address of the packet.
1040
1041	  To compile it as a module, choose M here.  If unsure, say N.
1042
1043config NETFILTER_XT_MATCH_MARK
1044	tristate '"mark" match support'
1045	depends on NETFILTER_ADVANCED
1046	select NETFILTER_XT_MARK
1047	---help---
1048	This is a backwards-compat option for the user's convenience
1049	(e.g. when running oldconfig). It selects
1050	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
1051
1052config NETFILTER_XT_MATCH_MULTIPORT
1053	tristate '"multiport" Multiple port match support'
1054	depends on NETFILTER_ADVANCED
1055	help
1056	  Multiport matching allows you to match TCP or UDP packets based on
1057	  a series of source or destination ports: normally a rule can only
1058	  match a single range of ports.
1059
1060	  To compile it as a module, choose M here.  If unsure, say N.
1061
1062config NETFILTER_XT_MATCH_NFACCT
1063	tristate '"nfacct" match support'
1064	depends on NETFILTER_ADVANCED
1065	select NETFILTER_NETLINK_ACCT
1066	help
1067	  This option allows you to use the extended accounting through
1068	  nfnetlink_acct.
1069
1070	  To compile it as a module, choose M here.  If unsure, say N.
1071
1072config NETFILTER_XT_MATCH_OSF
1073	tristate '"osf" Passive OS fingerprint match'
1074	depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
1075	help
1076	  This option selects the Passive OS Fingerprinting match module
1077	  that allows to passively match the remote operating system by
1078	  analyzing incoming TCP SYN packets.
1079
1080	  Rules and loading software can be downloaded from
1081	  http://www.ioremap.net/projects/osf
1082
1083	  To compile it as a module, choose M here.  If unsure, say N.
1084
1085config NETFILTER_XT_MATCH_OWNER
1086	tristate '"owner" match support'
1087	depends on NETFILTER_ADVANCED
1088	---help---
1089	Socket owner matching allows you to match locally-generated packets
1090	based on who created the socket: the user or group. It is also
1091	possible to check whether a socket actually exists.
1092
1093	Conflicts with '"quota, tag, uid" match'
1094
1095config NETFILTER_XT_MATCH_POLICY
1096	tristate 'IPsec "policy" match support'
1097	depends on XFRM
1098	default m if NETFILTER_ADVANCED=n
1099	help
1100	  Policy matching allows you to match packets based on the
1101	  IPsec policy that was used during decapsulation/will
1102	  be used during encapsulation.
1103
1104	  To compile it as a module, choose M here.  If unsure, say N.
1105
1106config NETFILTER_XT_MATCH_PHYSDEV
1107	tristate '"physdev" match support'
1108	depends on BRIDGE && BRIDGE_NETFILTER
1109	depends on NETFILTER_ADVANCED
1110	help
1111	  Physdev packet matching matches against the physical bridge ports
1112	  the IP packet arrived on or will leave by.
1113
1114	  To compile it as a module, choose M here.  If unsure, say N.
1115
1116config NETFILTER_XT_MATCH_PKTTYPE
1117	tristate '"pkttype" packet type match support'
1118	depends on NETFILTER_ADVANCED
1119	help
1120	  Packet type matching allows you to match a packet by
1121	  its "class", eg. BROADCAST, MULTICAST, ...
1122
1123	  Typical usage:
1124	  iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1125
1126	  To compile it as a module, choose M here.  If unsure, say N.
1127
1128config NETFILTER_XT_MATCH_QTAGUID
1129	bool '"quota, tag, owner" match and stats support'
1130        depends on NETFILTER_XT_MATCH_SOCKET
1131	depends on NETFILTER_XT_MATCH_OWNER=n
1132	help
1133	  This option replaces the `owner' match. In addition to matching
1134	  on uid, it keeps stats based on a tag assigned to a socket.
1135	  The full tag is comprised of a UID and an accounting tag.
1136	  The tags are assignable to sockets from user space (e.g. a download
1137	  manager can assign the socket to another UID for accounting).
1138	  Stats and control are done via /proc/net/xt_qtaguid/.
1139	  It replaces owner as it takes the same arguments, but should
1140	  really be recognized by the iptables tool.
1141
1142	  If unsure, say `N'.
1143
1144config NETFILTER_XT_MATCH_QUOTA
1145	tristate '"quota" match support'
1146	depends on NETFILTER_ADVANCED
1147	help
1148	  This option adds a `quota' match, which allows to match on a
1149	  byte counter.
1150
1151	  If you want to compile it as a module, say M here and read
1152	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1153
1154config NETFILTER_XT_MATCH_QUOTA2
1155	tristate '"quota2" match support'
1156	depends on NETFILTER_ADVANCED
1157	help
1158	  This option adds a `quota2' match, which allows to match on a
1159	  byte counter correctly and not per CPU.
1160	  It allows naming the quotas.
1161	  This is based on http://xtables-addons.git.sourceforge.net
1162
1163	  If you want to compile it as a module, say M here and read
1164	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1165
1166config NETFILTER_XT_MATCH_QUOTA2_LOG
1167	bool '"quota2" Netfilter LOG support'
1168	depends on NETFILTER_XT_MATCH_QUOTA2
1169	depends on IP_NF_TARGET_ULOG=n    # not yes, not module, just no
1170	default n
1171	help
1172	  This option allows `quota2' to log ONCE when a quota limit
1173	  is passed. It logs via NETLINK using the NETLINK_NFLOG family.
1174	  It logs similarly to how ipt_ULOG would without data.
1175
1176	  If unsure, say `N'.
1177
1178config NETFILTER_XT_MATCH_RATEEST
1179	tristate '"rateest" match support'
1180	depends on NETFILTER_ADVANCED
1181	select NETFILTER_XT_TARGET_RATEEST
1182	help
1183	  This option adds a `rateest' match, which allows to match on the
1184	  rate estimated by the RATEEST target.
1185
1186	  To compile it as a module, choose M here.  If unsure, say N.
1187
1188config NETFILTER_XT_MATCH_REALM
1189	tristate  '"realm" match support'
1190	depends on NETFILTER_ADVANCED
1191	select IP_ROUTE_CLASSID
1192	help
1193	  This option adds a `realm' match, which allows you to use the realm
1194	  key from the routing subsystem inside iptables.
1195
1196	  This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1197	  in tc world.
1198
1199	  If you want to compile it as a module, say M here and read
1200	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1201
1202config NETFILTER_XT_MATCH_RECENT
1203	tristate '"recent" match support'
1204	depends on NETFILTER_ADVANCED
1205	---help---
1206	This match is used for creating one or many lists of recently
1207	used addresses and then matching against that/those list(s).
1208
1209	Short options are available by using 'iptables -m recent -h'
1210	Official Website: <http://snowman.net/projects/ipt_recent/>
1211
1212config NETFILTER_XT_MATCH_SCTP
1213	tristate  '"sctp" protocol match support'
1214	depends on NETFILTER_ADVANCED
1215	default IP_SCTP
1216	help
1217	  With this option enabled, you will be able to use the
1218	  `sctp' match in order to match on SCTP source/destination ports
1219	  and SCTP chunk types.
1220
1221	  If you want to compile it as a module, say M here and read
1222	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1223
1224config NETFILTER_XT_MATCH_SOCKET
1225	tristate '"socket" match support'
1226	depends on NETFILTER_TPROXY
1227	depends on NETFILTER_XTABLES
1228	depends on NETFILTER_ADVANCED
1229	depends on !NF_CONNTRACK || NF_CONNTRACK
1230	depends on IPV6 || IPV6=n
1231	select NF_DEFRAG_IPV4
1232	select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
1233	help
1234	  This option adds a `socket' match, which can be used to match
1235	  packets for which a TCP or UDP socket lookup finds a valid socket.
1236	  It can be used in combination with the MARK target and policy
1237	  routing to implement full featured non-locally bound sockets.
1238
1239	  To compile it as a module, choose M here.  If unsure, say N.
1240
1241config NETFILTER_XT_MATCH_STATE
1242	tristate '"state" match support'
1243	depends on NF_CONNTRACK
1244	default m if NETFILTER_ADVANCED=n
1245	help
1246	  Connection state matching allows you to match packets based on their
1247	  relationship to a tracked connection (ie. previous packets).  This
1248	  is a powerful tool for packet classification.
1249
1250	  To compile it as a module, choose M here.  If unsure, say N.
1251
1252config NETFILTER_XT_MATCH_STATISTIC
1253	tristate '"statistic" match support'
1254	depends on NETFILTER_ADVANCED
1255	help
1256	  This option adds a `statistic' match, which allows you to match
1257	  on packets periodically or randomly with a given percentage.
1258
1259	  To compile it as a module, choose M here.  If unsure, say N.
1260
1261config NETFILTER_XT_MATCH_STRING
1262	tristate  '"string" match support'
1263	depends on NETFILTER_ADVANCED
1264	select TEXTSEARCH
1265	select TEXTSEARCH_KMP
1266	select TEXTSEARCH_BM
1267	select TEXTSEARCH_FSM
1268	help
1269	  This option adds a `string' match, which allows you to look for
1270	  pattern matchings in packets.
1271
1272	  To compile it as a module, choose M here.  If unsure, say N.
1273
1274config NETFILTER_XT_MATCH_TCPMSS
1275	tristate '"tcpmss" match support'
1276	depends on NETFILTER_ADVANCED
1277	help
1278	  This option adds a `tcpmss' match, which allows you to examine the
1279	  MSS value of TCP SYN packets, which control the maximum packet size
1280	  for that connection.
1281
1282	  To compile it as a module, choose M here.  If unsure, say N.
1283
1284config NETFILTER_XT_MATCH_TIME
1285	tristate '"time" match support'
1286	depends on NETFILTER_ADVANCED
1287	---help---
1288	  This option adds a "time" match, which allows you to match based on
1289	  the packet arrival time (at the machine which netfilter is running)
1290	  on) or departure time/date (for locally generated packets).
1291
1292	  If you say Y here, try `iptables -m time --help` for
1293	  more information.
1294
1295	  If you want to compile it as a module, say M here.
1296	  If unsure, say N.
1297
1298config NETFILTER_XT_MATCH_U32
1299	tristate '"u32" match support'
1300	depends on NETFILTER_ADVANCED
1301	---help---
1302	  u32 allows you to extract quantities of up to 4 bytes from a packet,
1303	  AND them with specified masks, shift them by specified amounts and
1304	  test whether the results are in any of a set of specified ranges.
1305	  The specification of what to extract is general enough to skip over
1306	  headers with lengths stored in the packet, as in IP or TCP header
1307	  lengths.
1308
1309	  Details and examples are in the kernel module source.
1310
1311endif # NETFILTER_XTABLES
1312
1313endmenu
1314
1315source "net/netfilter/ipset/Kconfig"
1316
1317source "net/netfilter/ipvs/Kconfig"
1318