net/netfilter/Kconfig

   1 menu "Core Netfilter Configuration"
   2         depends on NET && INET && NETFILTER
   3
   4 config NETFILTER_NETLINK
   5         tristate
   6
   7 config NETFILTER_NETLINK_ACCT
   8 tristate "Netfilter NFACCT over NFNETLINK interface"
   9         depends on NETFILTER_ADVANCED
  10         select NETFILTER_NETLINK
  11         help
  12           If this option is enabled, the kernel will include support
  13           for extended accounting via NFNETLINK.
  14
  15 config NETFILTER_NETLINK_QUEUE
  16         tristate "Netfilter NFQUEUE over NFNETLINK interface"
  17         depends on NETFILTER_ADVANCED
  18         select NETFILTER_NETLINK
  19         help
  20           If this option is enabled, the kernel will include support
  21           for queueing packets via NFNETLINK.
  22
  23 config NETFILTER_NETLINK_LOG
  24         tristate "Netfilter LOG over NFNETLINK interface"
  25         default m if NETFILTER_ADVANCED=n
  26         select NETFILTER_NETLINK
  27         help
  28           If this option is enabled, the kernel will include support
  29           for logging packets via NFNETLINK.
  30
  31           This obsoletes the existing ipt_ULOG and ebg_ulog mechanisms,
  32           and is also scheduled to replace the old syslog-based ipt_LOG
  33           and ip6t_LOG modules.
  34
  35 config NF_CONNTRACK
  36         tristate "Netfilter connection tracking support"
  37         default m if NETFILTER_ADVANCED=n
  38         help
  39           Connection tracking keeps a record of what packets have passed
  40           through your machine, in order to figure out how they are related
  41           into connections.
  42
  43           This is required to do Masquerading or other kinds of Network
  44           Address Translation.  It can also be used to enhance packet
  45           filtering (see `Connection state match support' below).
  46
  47           To compile it as a module, choose M here.  If unsure, say N.
  48
  49 if NF_CONNTRACK
  50
  51 config NF_CONNTRACK_MARK
  52         bool  'Connection mark tracking support'
  53         depends on NETFILTER_ADVANCED
  54         help
  55           This option enables support for connection marks, used by the
  56           `CONNMARK' target and `connmark' match. Similar to the mark value
  57           of packets, but this mark value is kept in the conntrack session
  58           instead of the individual packets.
  59
  60 config NF_CONNTRACK_SECMARK
  61         bool  'Connection tracking security mark support'
  62         depends on NETWORK_SECMARK
  63         default m if NETFILTER_ADVANCED=n
  64         help
  65           This option enables security markings to be applied to
  66           connections.  Typically they are copied to connections from
  67           packets using the CONNSECMARK target and copied back from
  68           connections to packets with the same target, with the packets
  69           being originally labeled via SECMARK.
  70
  71           If unsure, say 'N'.
  72
  73 config NF_CONNTRACK_ZONES
  74         bool  'Connection tracking zones'
  75         depends on NETFILTER_ADVANCED
  76         depends on NETFILTER_XT_TARGET_CT
  77         help
  78           This option enables support for connection tracking zones.
  79           Normally, each connection needs to have a unique system wide
  80           identity. Connection tracking zones allow to have multiple
  81           connections using the same identity, as long as they are
  82           contained in different zones.
  83
  84           If unsure, say `N'.
  85
  86 config NF_CONNTRACK_PROCFS
  87         bool "Supply CT list in procfs (OBSOLETE)"
  88         default y
  89         depends on PROC_FS
  90         ---help---
  91         This option enables for the list of known conntrack entries
  92         to be shown in procfs under net/netfilter/nf_conntrack. This
  93         is considered obsolete in favor of using the conntrack(8)
  94         tool which uses Netlink.
  95
  96 config NF_CONNTRACK_EVENTS
  97         bool "Connection tracking events"
  98         depends on NETFILTER_ADVANCED
  99         help
 100           If this option is enabled, the connection tracking code will
 101           provide a notifier chain that can be used by other kernel code
 102           to get notified about changes in the connection tracking state.
 103
 104           If unsure, say `N'.
 105
 106 config NF_CONNTRACK_TIMEOUT
 107         bool  'Connection tracking timeout'
 108         depends on NETFILTER_ADVANCED
 109         help
 110           This option enables support for connection tracking timeout
 111           extension. This allows you to attach timeout policies to flow
 112           via the CT target.
 113
 114           If unsure, say `N'.
 115
 116 config NF_CONNTRACK_TIMESTAMP
 117         bool  'Connection tracking timestamping'
 118         depends on NETFILTER_ADVANCED
 119         help
 120           This option enables support for connection tracking timestamping.
 121           This allows you to store the flow start-time and to obtain
 122           the flow-stop time (once it has been destroyed) via Connection
 123           tracking events.
 124
 125           If unsure, say `N'.
 126
 127 config NF_CT_PROTO_DCCP
 128         tristate 'DCCP protocol connection tracking support (EXPERIMENTAL)'
 129         depends on EXPERIMENTAL
 130         depends on NETFILTER_ADVANCED
 131         default IP_DCCP
 132         help
 133           With this option enabled, the layer 3 independent connection
 134           tracking code will be able to do state tracking on DCCP connections.
 135
 136           If unsure, say 'N'.
 137
 138 config NF_CT_PROTO_GRE
 139         tristate
 140
 141 config NF_CT_PROTO_SCTP
 142         tristate 'SCTP protocol connection tracking support (EXPERIMENTAL)'
 143         depends on EXPERIMENTAL
 144         depends on NETFILTER_ADVANCED
 145         default IP_SCTP
 146         help
 147           With this option enabled, the layer 3 independent connection
 148           tracking code will be able to do state tracking on SCTP connections.
 149
 150           If you want to compile it as a module, say M here and read
 151           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 152
 153 config NF_CT_PROTO_UDPLITE
 154         tristate 'UDP-Lite protocol connection tracking support'
 155         depends on NETFILTER_ADVANCED
 156         help
 157           With this option enabled, the layer 3 independent connection
 158           tracking code will be able to do state tracking on UDP-Lite
 159           connections.
 160
 161           To compile it as a module, choose M here.  If unsure, say N.
 162
 163 config NF_CONNTRACK_AMANDA
 164         tristate "Amanda backup protocol support"
 165         depends on NETFILTER_ADVANCED
 166         select TEXTSEARCH
 167         select TEXTSEARCH_KMP
 168         help
 169           If you are running the Amanda backup package <http://www.amanda.org/>
 170           on this machine or machines that will be MASQUERADED through this
 171           machine, then you may want to enable this feature.  This allows the
 172           connection tracking and natting code to allow the sub-channels that
 173           Amanda requires for communication of the backup data, messages and
 174           index.
 175
 176           To compile it as a module, choose M here.  If unsure, say N.
 177
 178 config NF_CONNTRACK_FTP
 179         tristate "FTP protocol support"
 180         default m if NETFILTER_ADVANCED=n
 181         help
 182           Tracking FTP connections is problematic: special helpers are
 183           required for tracking them, and doing masquerading and other forms
 184           of Network Address Translation on them.
 185
 186           This is FTP support on Layer 3 independent connection tracking.
 187           Layer 3 independent connection tracking is experimental scheme
 188           which generalize ip_conntrack to support other layer 3 protocols.
 189
 190           To compile it as a module, choose M here.  If unsure, say N.
 191
 192 config NF_CONNTRACK_H323
 193         tristate "H.323 protocol support"
 194         depends on (IPV6 || IPV6=n)
 195         depends on NETFILTER_ADVANCED
 196         help
 197           H.323 is a VoIP signalling protocol from ITU-T. As one of the most
 198           important VoIP protocols, it is widely used by voice hardware and
 199           software including voice gateways, IP phones, Netmeeting, OpenPhone,
 200           Gnomemeeting, etc.
 201
 202           With this module you can support H.323 on a connection tracking/NAT
 203           firewall.
 204
 205           This module supports RAS, Fast Start, H.245 Tunnelling, Call
 206           Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
 207           whiteboard, file transfer, etc. For more information, please
 208           visit http://nath323.sourceforge.net/.
 209
 210           To compile it as a module, choose M here.  If unsure, say N.
 211
 212 config NF_CONNTRACK_IRC
 213         tristate "IRC protocol support"
 214         default m if NETFILTER_ADVANCED=n
 215         help
 216           There is a commonly-used extension to IRC called
 217           Direct Client-to-Client Protocol (DCC).  This enables users to send
 218           files to each other, and also chat to each other without the need
 219           of a server.  DCC Sending is used anywhere you send files over IRC,
 220           and DCC Chat is most commonly used by Eggdrop bots.  If you are
 221           using NAT, this extension will enable you to send files and initiate
 222           chats.  Note that you do NOT need this extension to get files or
 223           have others initiate chats, or everything else in IRC.
 224
 225           To compile it as a module, choose M here.  If unsure, say N.
 226
 227 config NF_CONNTRACK_BROADCAST
 228         tristate
 229
 230 config NF_CONNTRACK_NETBIOS_NS
 231         tristate "NetBIOS name service protocol support"
 232         select NF_CONNTRACK_BROADCAST
 233         help
 234           NetBIOS name service requests are sent as broadcast messages from an
 235           unprivileged port and responded to with unicast messages to the
 236           same port. This make them hard to firewall properly because connection
 237           tracking doesn't deal with broadcasts. This helper tracks locally
 238           originating NetBIOS name service requests and the corresponding
 239           responses. It relies on correct IP address configuration, specifically
 240           netmask and broadcast address. When properly configured, the output
 241           of "ip address show" should look similar to this:
 242
 243           $ ip -4 address show eth0
 244           4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
 245               inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
 246
 247           To compile it as a module, choose M here.  If unsure, say N.
 248
 249 config NF_CONNTRACK_SNMP
 250         tristate "SNMP service protocol support"
 251         depends on NETFILTER_ADVANCED
 252         select NF_CONNTRACK_BROADCAST
 253         help
 254           SNMP service requests are sent as broadcast messages from an
 255           unprivileged port and responded to with unicast messages to the
 256           same port. This make them hard to firewall properly because connection
 257           tracking doesn't deal with broadcasts. This helper tracks locally
 258           originating SNMP service requests and the corresponding
 259           responses. It relies on correct IP address configuration, specifically
 260           netmask and broadcast address.
 261
 262           To compile it as a module, choose M here.  If unsure, say N.
 263
 264 config NF_CONNTRACK_PPTP
 265         tristate "PPtP protocol support"
 266         depends on NETFILTER_ADVANCED
 267         select NF_CT_PROTO_GRE
 268         help
 269           This module adds support for PPTP (Point to Point Tunnelling
 270           Protocol, RFC2637) connection tracking and NAT.
 271
 272           If you are running PPTP sessions over a stateful firewall or NAT
 273           box, you may want to enable this feature.
 274
 275           Please note that not all PPTP modes of operation are supported yet.
 276           Specifically these limitations exist:
 277             - Blindly assumes that control connections are always established
 278               in PNS->PAC direction. This is a violation of RFC2637.
 279             - Only supports a single call within each session
 280
 281           To compile it as a module, choose M here.  If unsure, say N.
 282
 283 config NF_CONNTRACK_SANE
 284         tristate "SANE protocol support (EXPERIMENTAL)"
 285         depends on EXPERIMENTAL
 286         depends on NETFILTER_ADVANCED
 287         help
 288           SANE is a protocol for remote access to scanners as implemented
 289           by the 'saned' daemon. Like FTP, it uses separate control and
 290           data connections.
 291
 292           With this module you can support SANE on a connection tracking
 293           firewall.
 294
 295           To compile it as a module, choose M here.  If unsure, say N.
 296
 297 config NF_CONNTRACK_SIP
 298         tristate "SIP protocol support"
 299         default m if NETFILTER_ADVANCED=n
 300         help
 301           SIP is an application-layer control protocol that can establish,
 302           modify, and terminate multimedia sessions (conferences) such as
 303           Internet telephony calls. With the ip_conntrack_sip and
 304           the nf_nat_sip modules you can support the protocol on a connection
 305           tracking/NATing firewall.
 306
 307           To compile it as a module, choose M here.  If unsure, say N.
 308
 309 config NF_CONNTRACK_TFTP
 310         tristate "TFTP protocol support"
 311         depends on NETFILTER_ADVANCED
 312         help
 313           TFTP connection tracking helper, this is required depending
 314           on how restrictive your ruleset is.
 315           If you are using a tftp client behind -j SNAT or -j MASQUERADING
 316           you will need this.
 317
 318           To compile it as a module, choose M here.  If unsure, say N.
 319
 320 config NF_CT_NETLINK
 321         tristate 'Connection tracking netlink interface'
 322         select NETFILTER_NETLINK
 323         default m if NETFILTER_ADVANCED=n
 324         help
 325           This option enables support for a netlink-based userspace interface
 326
 327 config NF_CT_NETLINK_TIMEOUT
 328         tristate  'Connection tracking timeout tuning via Netlink'
 329         select NETFILTER_NETLINK
 330         depends on NETFILTER_ADVANCED
 331         help
 332           This option enables support for connection tracking timeout
 333           fine-grain tuning. This allows you to attach specific timeout
 334           policies to flows, instead of using the global timeout policy.
 335
 336           If unsure, say `N'.
 337
 338 endif # NF_CONNTRACK
 339
 340 # transparent proxy support
 341 config NETFILTER_TPROXY
 342         tristate "Transparent proxying support (EXPERIMENTAL)"
 343         depends on EXPERIMENTAL
 344         depends on IP_NF_MANGLE
 345         depends on NETFILTER_ADVANCED
 346         help
 347           This option enables transparent proxying support, that is,
 348           support for handling non-locally bound IPv4 TCP and UDP sockets.
 349           For it to work you will have to configure certain iptables rules
 350           and use policy routing. For more information on how to set it up
 351           see Documentation/networking/tproxy.txt.
 352
 353           To compile it as a module, choose M here.  If unsure, say N.
 354
 355 config NETFILTER_XTABLES
 356         tristate "Netfilter Xtables support (required for ip_tables)"
 357         default m if NETFILTER_ADVANCED=n
 358         help
 359           This is required if you intend to use any of ip_tables,
 360           ip6_tables or arp_tables.
 361
 362 if NETFILTER_XTABLES
 363
 364 comment "Xtables combined modules"
 365
 366 config NETFILTER_XT_MARK
 367         tristate 'nfmark target and match support'
 368         default m if NETFILTER_ADVANCED=n
 369         ---help---
 370         This option adds the "MARK" target and "mark" match.
 371
 372         Netfilter mark matching allows you to match packets based on the
 373         "nfmark" value in the packet.
 374         The target allows you to create rules in the "mangle" table which alter
 375         the netfilter mark (nfmark) field associated with the packet.
 376
 377         Prior to routing, the nfmark can influence the routing method (see
 378         "Use netfilter MARK value as routing key") and can also be used by
 379         other subsystems to change their behavior.
 380
 381 config NETFILTER_XT_CONNMARK
 382         tristate 'ctmark target and match support'
 383         depends on NF_CONNTRACK
 384         depends on NETFILTER_ADVANCED
 385         select NF_CONNTRACK_MARK
 386         ---help---
 387         This option adds the "CONNMARK" target and "connmark" match.
 388
 389         Netfilter allows you to store a mark value per connection (a.k.a.
 390         ctmark), similarly to the packet mark (nfmark). Using this
 391         target and match, you can set and match on this mark.
 392
 393 config NETFILTER_XT_SET
 394         tristate 'set target and match support'
 395         depends on IP_SET
 396         depends on NETFILTER_ADVANCED
 397         help
 398           This option adds the "SET" target and "set" match.
 399
 400           Using this target and match, you can add/delete and match
 401           elements in the sets created by ipset(8).
 402
 403           To compile it as a module, choose M here.  If unsure, say N.
 404
 405 # alphabetically ordered list of targets
 406
 407 comment "Xtables targets"
 408
 409 config NETFILTER_XT_TARGET_AUDIT
 410         tristate "AUDIT target support"
 411         depends on AUDIT
 412         depends on NETFILTER_ADVANCED
 413         ---help---
 414           This option adds a 'AUDIT' target, which can be used to create
 415           audit records for packets dropped/accepted.
 416
 417           To compileit as a module, choose M here. If unsure, say N.
 418
 419 config NETFILTER_XT_TARGET_CHECKSUM
 420         tristate "CHECKSUM target support"
 421         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 422         depends on NETFILTER_ADVANCED
 423         ---help---
 424           This option adds a `CHECKSUM' target, which can be used in the iptables mangle
 425           table.
 426
 427           You can use this target to compute and fill in the checksum in
 428           a packet that lacks a checksum.  This is particularly useful,
 429           if you need to work around old applications such as dhcp clients,
 430           that do not work well with checksum offloads, but don't want to disable
 431           checksum offload in your device.
 432
 433           To compile it as a module, choose M here.  If unsure, say N.
 434
 435 config NETFILTER_XT_TARGET_CLASSIFY
 436         tristate '"CLASSIFY" target support'
 437         depends on NETFILTER_ADVANCED
 438         help
 439           This option adds a `CLASSIFY' target, which enables the user to set
 440           the priority of a packet. Some qdiscs can use this value for
 441           classification, among these are:
 442
 443           atm, cbq, dsmark, pfifo_fast, htb, prio
 444
 445           To compile it as a module, choose M here.  If unsure, say N.
 446
 447 config NETFILTER_XT_TARGET_CONNMARK
 448         tristate  '"CONNMARK" target support'
 449         depends on NF_CONNTRACK
 450         depends on NETFILTER_ADVANCED
 451         select NETFILTER_XT_CONNMARK
 452         ---help---
 453         This is a backwards-compat option for the user's convenience
 454         (e.g. when running oldconfig). It selects
 455         CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
 456
 457 config NETFILTER_XT_TARGET_CONNSECMARK
 458         tristate '"CONNSECMARK" target support'
 459         depends on NF_CONNTRACK && NF_CONNTRACK_SECMARK
 460         default m if NETFILTER_ADVANCED=n
 461         help
 462           The CONNSECMARK target copies security markings from packets
 463           to connections, and restores security markings from connections
 464           to packets (if the packets are not already marked).  This would
 465           normally be used in conjunction with the SECMARK target.
 466
 467           To compile it as a module, choose M here.  If unsure, say N.
 468
 469 config NETFILTER_XT_TARGET_CT
 470         tristate '"CT" target support'
 471         depends on NF_CONNTRACK
 472         depends on IP_NF_RAW || IP6_NF_RAW
 473         depends on NETFILTER_ADVANCED
 474         help
 475           This options adds a `CT' target, which allows to specify initial
 476           connection tracking parameters like events to be delivered and
 477           the helper to be used.
 478
 479           To compile it as a module, choose M here.  If unsure, say N.
 480
 481 config NETFILTER_XT_TARGET_DSCP
 482         tristate '"DSCP" and "TOS" target support'
 483         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 484         depends on NETFILTER_ADVANCED
 485         help
 486           This option adds a `DSCP' target, which allows you to manipulate
 487           the IPv4/IPv6 header DSCP field (differentiated services codepoint).
 488
 489           The DSCP field can have any value between 0x0 and 0x3f inclusive.
 490
 491           It also adds the "TOS" target, which allows you to create rules in
 492           the "mangle" table which alter the Type Of Service field of an IPv4
 493           or the Priority field of an IPv6 packet, prior to routing.
 494
 495           To compile it as a module, choose M here.  If unsure, say N.
 496
 497 config NETFILTER_XT_TARGET_HL
 498         tristate '"HL" hoplimit target support'
 499         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 500         depends on NETFILTER_ADVANCED
 501         ---help---
 502         This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
 503         targets, which enable the user to change the
 504         hoplimit/time-to-live value of the IP header.
 505
 506         While it is safe to decrement the hoplimit/TTL value, the
 507         modules also allow to increment and set the hoplimit value of
 508         the header to arbitrary values. This is EXTREMELY DANGEROUS
 509         since you can easily create immortal packets that loop
 510         forever on the network.
 511
 512 config NETFILTER_XT_TARGET_HMARK
 513         tristate '"HMARK" target support'
 514         depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
 515         depends on NETFILTER_ADVANCED
 516         ---help---
 517         This option adds the "HMARK" target.
 518
 519         The target allows you to create rules in the "raw" and "mangle" tables
 520         which set the skbuff mark by means of hash calculation within a given
 521         range. The nfmark can influence the routing method (see "Use netfilter
 522         MARK value as routing key") and can also be used by other subsystems to
 523         change their behaviour.
 524
 525         To compile it as a module, choose M here. If unsure, say N.
 526
 527 config NETFILTER_XT_TARGET_IDLETIMER
 528         tristate  "IDLETIMER target support"
 529         depends on NETFILTER_ADVANCED
 530         help
 531
 532           This option adds the `IDLETIMER' target.  Each matching packet
 533           resets the timer associated with label specified when the rule is
 534           added.  When the timer expires, it triggers a sysfs notification.
 535           The remaining time for expiration can be read via sysfs.
 536
 537           To compile it as a module, choose M here.  If unsure, say N.
 538
 539 config NETFILTER_XT_TARGET_LED
 540         tristate '"LED" target support'
 541         depends on LEDS_CLASS && LEDS_TRIGGERS
 542         depends on NETFILTER_ADVANCED
 543         help
 544           This option adds a `LED' target, which allows you to blink LEDs in
 545           response to particular packets passing through your machine.
 546
 547           This can be used to turn a spare LED into a network activity LED,
 548           which only flashes in response to FTP transfers, for example.  Or
 549           you could have an LED which lights up for a minute or two every time
 550           somebody connects to your machine via SSH.
 551
 552           You will need support for the "led" class to make this work.
 553
 554           To create an LED trigger for incoming SSH traffic:
 555             iptables -A INPUT -p tcp --dport 22 -j LED --led-trigger-id ssh --led-delay 1000
 556
 557           Then attach the new trigger to an LED on your system:
 558             echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
 559
 560           For more information on the LEDs available on your system, see
 561           Documentation/leds/leds-class.txt
 562
 563 config NETFILTER_XT_TARGET_LOG
 564         tristate "LOG target support"
 565         default m if NETFILTER_ADVANCED=n
 566         help
 567           This option adds a `LOG' target, which allows you to create rules in
 568           any iptables table which records the packet header to the syslog.
 569
 570           To compile it as a module, choose M here.  If unsure, say N.
 571
 572 config NETFILTER_XT_TARGET_MARK
 573         tristate '"MARK" target support'
 574         depends on NETFILTER_ADVANCED
 575         select NETFILTER_XT_MARK
 576         ---help---
 577         This is a backwards-compat option for the user's convenience
 578         (e.g. when running oldconfig). It selects
 579         CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
 580
 581 config NETFILTER_XT_TARGET_NFLOG
 582         tristate '"NFLOG" target support'
 583         default m if NETFILTER_ADVANCED=n
 584         select NETFILTER_NETLINK_LOG
 585         help
 586           This option enables the NFLOG target, which allows to LOG
 587           messages through nfnetlink_log.
 588
 589           To compile it as a module, choose M here.  If unsure, say N.
 590
 591 config NETFILTER_XT_TARGET_NFQUEUE
 592         tristate '"NFQUEUE" target Support'
 593         depends on NETFILTER_ADVANCED
 594         select NETFILTER_NETLINK_QUEUE
 595         help
 596           This target replaced the old obsolete QUEUE target.
 597
 598           As opposed to QUEUE, it supports 65535 different queues,
 599           not just one.
 600
 601           To compile it as a module, choose M here.  If unsure, say N.
 602
 603 config NETFILTER_XT_TARGET_NOTRACK
 604         tristate  '"NOTRACK" target support'
 605         depends on IP_NF_RAW || IP6_NF_RAW
 606         depends on NF_CONNTRACK
 607         help
 608           The NOTRACK target allows a select rule to specify
 609           which packets *not* to enter the conntrack/NAT
 610           subsystem with all the consequences (no ICMP error tracking,
 611           no protocol helpers for the selected packets).
 612
 613           If you want to compile it as a module, say M here and read
 614           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 615
 616 config NETFILTER_XT_TARGET_RATEEST
 617         tristate '"RATEEST" target support'
 618         depends on NETFILTER_ADVANCED
 619         help
 620           This option adds a `RATEEST' target, which allows to measure
 621           rates similar to TC estimators. The `rateest' match can be
 622           used to match on the measured rates.
 623
 624           To compile it as a module, choose M here.  If unsure, say N.
 625
 626 config NETFILTER_XT_TARGET_TEE
 627         tristate '"TEE" - packet cloning to alternate destination'
 628         depends on NETFILTER_ADVANCED
 629         depends on (IPV6 || IPV6=n)
 630         depends on !NF_CONNTRACK || NF_CONNTRACK
 631         ---help---
 632         This option adds a "TEE" target with which a packet can be cloned and
 633         this clone be rerouted to another nexthop.
 634
 635 config NETFILTER_XT_TARGET_TPROXY
 636         tristate '"TPROXY" target support (EXPERIMENTAL)'
 637         depends on EXPERIMENTAL
 638         depends on NETFILTER_TPROXY
 639         depends on NETFILTER_XTABLES
 640         depends on NETFILTER_ADVANCED
 641         select NF_DEFRAG_IPV4
 642         select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
 643         help
 644           This option adds a `TPROXY' target, which is somewhat similar to
 645           REDIRECT.  It can only be used in the mangle table and is useful
 646           to redirect traffic to a transparent proxy.  It does _not_ depend
 647           on Netfilter connection tracking and NAT, unlike REDIRECT.
 648
 649           To compile it as a module, choose M here.  If unsure, say N.
 650
 651 config NETFILTER_XT_TARGET_TRACE
 652         tristate  '"TRACE" target support'
 653         depends on IP_NF_RAW || IP6_NF_RAW
 654         depends on NETFILTER_ADVANCED
 655         help
 656           The TRACE target allows you to mark packets so that the kernel
 657           will log every rule which match the packets as those traverse
 658           the tables, chains, rules.
 659
 660           If you want to compile it as a module, say M here and read
 661           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 662
 663 config NETFILTER_XT_TARGET_SECMARK
 664         tristate '"SECMARK" target support'
 665         depends on NETWORK_SECMARK
 666         default m if NETFILTER_ADVANCED=n
 667         help
 668           The SECMARK target allows security marking of network
 669           packets, for use with security subsystems.
 670
 671           To compile it as a module, choose M here.  If unsure, say N.
 672
 673 config NETFILTER_XT_TARGET_TCPMSS
 674         tristate '"TCPMSS" target support'
 675         depends on (IPV6 || IPV6=n)
 676         default m if NETFILTER_ADVANCED=n
 677         ---help---
 678           This option adds a `TCPMSS' target, which allows you to alter the
 679           MSS value of TCP SYN packets, to control the maximum size for that
 680           connection (usually limiting it to your outgoing interface's MTU
 681           minus 40).
 682
 683           This is used to overcome criminally braindead ISPs or servers which
 684           block ICMP Fragmentation Needed packets.  The symptoms of this
 685           problem are that everything works fine from your Linux
 686           firewall/router, but machines behind it can never exchange large
 687           packets:
 688                 1) Web browsers connect, then hang with no data received.
 689                 2) Small mail works fine, but large emails hang.
 690                 3) ssh works fine, but scp hangs after initial handshaking.
 691
 692           Workaround: activate this option and add a rule to your firewall
 693           configuration like:
 694
 695           iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
 696                          -j TCPMSS --clamp-mss-to-pmtu
 697
 698           To compile it as a module, choose M here.  If unsure, say N.
 699
 700 config NETFILTER_XT_TARGET_TCPOPTSTRIP
 701         tristate '"TCPOPTSTRIP" target support (EXPERIMENTAL)'
 702         depends on EXPERIMENTAL
 703         depends on IP_NF_MANGLE || IP6_NF_MANGLE
 704         depends on NETFILTER_ADVANCED
 705         help
 706           This option adds a "TCPOPTSTRIP" target, which allows you to strip
 707           TCP options from TCP packets.
 708
 709 # alphabetically ordered list of matches
 710
 711 comment "Xtables matches"
 712
 713 config NETFILTER_XT_MATCH_ADDRTYPE
 714         tristate '"addrtype" address type match support'
 715         depends on NETFILTER_ADVANCED
 716         ---help---
 717           This option allows you to match what routing thinks of an address,
 718           eg. UNICAST, LOCAL, BROADCAST, ...
 719
 720           If you want to compile it as a module, say M here and read
 721           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 722
 723 config NETFILTER_XT_MATCH_CLUSTER
 724         tristate '"cluster" match support'
 725         depends on NF_CONNTRACK
 726         depends on NETFILTER_ADVANCED
 727         ---help---
 728           This option allows you to build work-load-sharing clusters of
 729           network servers/stateful firewalls without having a dedicated
 730           load-balancing router/server/switch. Basically, this match returns
 731           true when the packet must be handled by this cluster node. Thus,
 732           all nodes see all packets and this match decides which node handles
 733           what packets. The work-load sharing algorithm is based on source
 734           address hashing.
 735
 736           If you say Y or M here, try `iptables -m cluster --help` for
 737           more information.
 738
 739 config NETFILTER_XT_MATCH_COMMENT
 740         tristate  '"comment" match support'
 741         depends on NETFILTER_ADVANCED
 742         help
 743           This option adds a `comment' dummy-match, which allows you to put
 744           comments in your iptables ruleset.
 745
 746           If you want to compile it as a module, say M here and read
 747           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 748
 749 config NETFILTER_XT_MATCH_CONNBYTES
 750         tristate  '"connbytes" per-connection counter match support'
 751         depends on NF_CONNTRACK
 752         depends on NETFILTER_ADVANCED
 753         help
 754           This option adds a `connbytes' match, which allows you to match the
 755           number of bytes and/or packets for each direction within a connection.
 756
 757           If you want to compile it as a module, say M here and read
 758           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 759
 760 config NETFILTER_XT_MATCH_CONNLIMIT
 761         tristate '"connlimit" match support"'
 762         depends on NF_CONNTRACK
 763         depends on NETFILTER_ADVANCED
 764         ---help---
 765           This match allows you to match against the number of parallel
 766           connections to a server per client IP address (or address block).
 767
 768 config NETFILTER_XT_MATCH_CONNMARK
 769         tristate  '"connmark" connection mark match support'
 770         depends on NF_CONNTRACK
 771         depends on NETFILTER_ADVANCED
 772         select NETFILTER_XT_CONNMARK
 773         ---help---
 774         This is a backwards-compat option for the user's convenience
 775         (e.g. when running oldconfig). It selects
 776         CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
 777
 778 config NETFILTER_XT_MATCH_CONNTRACK
 779         tristate '"conntrack" connection tracking match support'
 780         depends on NF_CONNTRACK
 781         default m if NETFILTER_ADVANCED=n
 782         help
 783           This is a general conntrack match module, a superset of the state match.
 784
 785           It allows matching on additional conntrack information, which is
 786           useful in complex configurations, such as NAT gateways with multiple
 787           internet links or tunnels.
 788
 789           To compile it as a module, choose M here.  If unsure, say N.
 790
 791 config NETFILTER_XT_MATCH_CPU
 792         tristate '"cpu" match support'
 793         depends on NETFILTER_ADVANCED
 794         help
 795           CPU matching allows you to match packets based on the CPU
 796           currently handling the packet.
 797
 798           To compile it as a module, choose M here.  If unsure, say N.
 799
 800 config NETFILTER_XT_MATCH_DCCP
 801         tristate '"dccp" protocol match support'
 802         depends on NETFILTER_ADVANCED
 803         default IP_DCCP
 804         help
 805           With this option enabled, you will be able to use the iptables
 806           `dccp' match in order to match on DCCP source/destination ports
 807           and DCCP flags.
 808
 809           If you want to compile it as a module, say M here and read
 810           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 811
 812 config NETFILTER_XT_MATCH_DEVGROUP
 813         tristate '"devgroup" match support'
 814         depends on NETFILTER_ADVANCED
 815         help
 816           This options adds a `devgroup' match, which allows to match on the
 817           device group a network device is assigned to.
 818
 819           To compile it as a module, choose M here.  If unsure, say N.
 820
 821 config NETFILTER_XT_MATCH_DSCP
 822         tristate '"dscp" and "tos" match support'
 823         depends on NETFILTER_ADVANCED
 824         help
 825           This option adds a `DSCP' match, which allows you to match against
 826           the IPv4/IPv6 header DSCP field (differentiated services codepoint).
 827
 828           The DSCP field can have any value between 0x0 and 0x3f inclusive.
 829
 830           It will also add a "tos" match, which allows you to match packets
 831           based on the Type Of Service fields of the IPv4 packet (which share
 832           the same bits as DSCP).
 833
 834           To compile it as a module, choose M here.  If unsure, say N.
 835
 836 config NETFILTER_XT_MATCH_ECN
 837         tristate '"ecn" match support'
 838         depends on NETFILTER_ADVANCED
 839         ---help---
 840         This option adds an "ECN" match, which allows you to match against
 841         the IPv4 and TCP header ECN fields.
 842
 843         To compile it as a module, choose M here. If unsure, say N.
 844
 845 config NETFILTER_XT_MATCH_ESP
 846         tristate '"esp" match support'
 847         depends on NETFILTER_ADVANCED
 848         help
 849           This match extension allows you to match a range of SPIs
 850           inside ESP header of IPSec packets.
 851
 852           To compile it as a module, choose M here.  If unsure, say N.
 853
 854 config NETFILTER_XT_MATCH_HASHLIMIT
 855         tristate '"hashlimit" match support'
 856         depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
 857         depends on NETFILTER_ADVANCED
 858         help
 859           This option adds a `hashlimit' match.
 860
 861           As opposed to `limit', this match dynamically creates a hash table
 862           of limit buckets, based on your selection of source/destination
 863           addresses and/or ports.
 864
 865           It enables you to express policies like `10kpps for any given
 866           destination address' or `500pps from any given source address'
 867           with a single rule.
 868
 869 config NETFILTER_XT_MATCH_HELPER
 870         tristate '"helper" match support'
 871         depends on NF_CONNTRACK
 872         depends on NETFILTER_ADVANCED
 873         help
 874           Helper matching allows you to match packets in dynamic connections
 875           tracked by a conntrack-helper, ie. ip_conntrack_ftp
 876
 877           To compile it as a module, choose M here.  If unsure, say Y.
 878
 879 config NETFILTER_XT_MATCH_HL
 880         tristate '"hl" hoplimit/TTL match support'
 881         depends on NETFILTER_ADVANCED
 882         ---help---
 883         HL matching allows you to match packets based on the hoplimit
 884         in the IPv6 header, or the time-to-live field in the IPv4
 885         header of the packet.
 886
 887 config NETFILTER_XT_MATCH_IPRANGE
 888         tristate '"iprange" address range match support'
 889         depends on NETFILTER_ADVANCED
 890         ---help---
 891         This option adds a "iprange" match, which allows you to match based on
 892         an IP address range. (Normal iptables only matches on single addresses
 893         with an optional mask.)
 894
 895         If unsure, say M.
 896
 897 config NETFILTER_XT_MATCH_IPVS
 898         tristate '"ipvs" match support'
 899         depends on IP_VS
 900         depends on NETFILTER_ADVANCED
 901         depends on NF_CONNTRACK
 902         help
 903           This option allows you to match against IPVS properties of a packet.
 904
 905           If unsure, say N.
 906
 907 config NETFILTER_XT_MATCH_LENGTH
 908         tristate '"length" match support'
 909         depends on NETFILTER_ADVANCED
 910         help
 911           This option allows you to match the length of a packet against a
 912           specific value or range of values.
 913
 914           To compile it as a module, choose M here.  If unsure, say N.
 915
 916 config NETFILTER_XT_MATCH_LIMIT
 917         tristate '"limit" match support'
 918         depends on NETFILTER_ADVANCED
 919         help
 920           limit matching allows you to control the rate at which a rule can be
 921           matched: mainly useful in combination with the LOG target ("LOG
 922           target support", below) and to avoid some Denial of Service attacks.
 923
 924           To compile it as a module, choose M here.  If unsure, say N.
 925
 926 config NETFILTER_XT_MATCH_MAC
 927         tristate '"mac" address match support'
 928         depends on NETFILTER_ADVANCED
 929         help
 930           MAC matching allows you to match packets based on the source
 931           Ethernet address of the packet.
 932
 933           To compile it as a module, choose M here.  If unsure, say N.
 934
 935 config NETFILTER_XT_MATCH_MARK
 936         tristate '"mark" match support'
 937         depends on NETFILTER_ADVANCED
 938         select NETFILTER_XT_MARK
 939         ---help---
 940         This is a backwards-compat option for the user's convenience
 941         (e.g. when running oldconfig). It selects
 942         CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
 943
 944 config NETFILTER_XT_MATCH_MULTIPORT
 945         tristate '"multiport" Multiple port match support'
 946         depends on NETFILTER_ADVANCED
 947         help
 948           Multiport matching allows you to match TCP or UDP packets based on
 949           a series of source or destination ports: normally a rule can only
 950           match a single range of ports.
 951
 952           To compile it as a module, choose M here.  If unsure, say N.
 953
 954 config NETFILTER_XT_MATCH_NFACCT
 955         tristate '"nfacct" match support'
 956         depends on NETFILTER_ADVANCED
 957         select NETFILTER_NETLINK_ACCT
 958         help
 959           This option allows you to use the extended accounting through
 960           nfnetlink_acct.
 961
 962           To compile it as a module, choose M here.  If unsure, say N.
 963
 964 config NETFILTER_XT_MATCH_OSF
 965         tristate '"osf" Passive OS fingerprint match'
 966         depends on NETFILTER_ADVANCED && NETFILTER_NETLINK
 967         help
 968           This option selects the Passive OS Fingerprinting match module
 969           that allows to passively match the remote operating system by
 970           analyzing incoming TCP SYN packets.
 971
 972           Rules and loading software can be downloaded from
 973           http://www.ioremap.net/projects/osf
 974
 975           To compile it as a module, choose M here.  If unsure, say N.
 976
 977 config NETFILTER_XT_MATCH_OWNER
 978         tristate '"owner" match support'
 979         depends on NETFILTER_ADVANCED
 980         ---help---
 981         Socket owner matching allows you to match locally-generated packets
 982         based on who created the socket: the user or group. It is also
 983         possible to check whether a socket actually exists.
 984
 985 config NETFILTER_XT_MATCH_POLICY
 986         tristate 'IPsec "policy" match support'
 987         depends on XFRM
 988         default m if NETFILTER_ADVANCED=n
 989         help
 990           Policy matching allows you to match packets based on the
 991           IPsec policy that was used during decapsulation/will
 992           be used during encapsulation.
 993
 994           To compile it as a module, choose M here.  If unsure, say N.
 995
 996 config NETFILTER_XT_MATCH_PHYSDEV
 997         tristate '"physdev" match support'
 998         depends on BRIDGE && BRIDGE_NETFILTER
 999         depends on NETFILTER_ADVANCED
1000         help
1001           Physdev packet matching matches against the physical bridge ports
1002           the IP packet arrived on or will leave by.
1003
1004           To compile it as a module, choose M here.  If unsure, say N.
1005
1006 config NETFILTER_XT_MATCH_PKTTYPE
1007         tristate '"pkttype" packet type match support'
1008         depends on NETFILTER_ADVANCED
1009         help
1010           Packet type matching allows you to match a packet by
1011           its "class", eg. BROADCAST, MULTICAST, ...
1012
1013           Typical usage:
1014           iptables -A INPUT -m pkttype --pkt-type broadcast -j LOG
1015
1016           To compile it as a module, choose M here.  If unsure, say N.
1017
1018 config NETFILTER_XT_MATCH_QUOTA
1019         tristate '"quota" match support'
1020         depends on NETFILTER_ADVANCED
1021         help
1022           This option adds a `quota' match, which allows to match on a
1023           byte counter.
1024
1025           If you want to compile it as a module, say M here and read
1026           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1027
1028 config NETFILTER_XT_MATCH_RATEEST
1029         tristate '"rateest" match support'
1030         depends on NETFILTER_ADVANCED
1031         select NETFILTER_XT_TARGET_RATEEST
1032         help
1033           This option adds a `rateest' match, which allows to match on the
1034           rate estimated by the RATEEST target.
1035
1036           To compile it as a module, choose M here.  If unsure, say N.
1037
1038 config NETFILTER_XT_MATCH_REALM
1039         tristate  '"realm" match support'
1040         depends on NETFILTER_ADVANCED
1041         select IP_ROUTE_CLASSID
1042         help
1043           This option adds a `realm' match, which allows you to use the realm
1044           key from the routing subsystem inside iptables.
1045
1046           This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
1047           in tc world.
1048
1049           If you want to compile it as a module, say M here and read
1050           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1051
1052 config NETFILTER_XT_MATCH_RECENT
1053         tristate '"recent" match support'
1054         depends on NETFILTER_ADVANCED
1055         ---help---
1056         This match is used for creating one or many lists of recently
1057         used addresses and then matching against that/those list(s).
1058
1059         Short options are available by using 'iptables -m recent -h'
1060         Official Website: <http://snowman.net/projects/ipt_recent/>
1061
1062 config NETFILTER_XT_MATCH_SCTP
1063         tristate  '"sctp" protocol match support (EXPERIMENTAL)'
1064         depends on EXPERIMENTAL
1065         depends on NETFILTER_ADVANCED
1066         default IP_SCTP
1067         help
1068           With this option enabled, you will be able to use the
1069           `sctp' match in order to match on SCTP source/destination ports
1070           and SCTP chunk types.
1071
1072           If you want to compile it as a module, say M here and read
1073           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1074
1075 config NETFILTER_XT_MATCH_SOCKET
1076         tristate '"socket" match support (EXPERIMENTAL)'
1077         depends on EXPERIMENTAL
1078         depends on NETFILTER_TPROXY
1079         depends on NETFILTER_XTABLES
1080         depends on NETFILTER_ADVANCED
1081         depends on !NF_CONNTRACK || NF_CONNTRACK
1082         select NF_DEFRAG_IPV4
1083         select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
1084         help
1085           This option adds a `socket' match, which can be used to match
1086           packets for which a TCP or UDP socket lookup finds a valid socket.
1087           It can be used in combination with the MARK target and policy
1088           routing to implement full featured non-locally bound sockets.
1089
1090           To compile it as a module, choose M here.  If unsure, say N.
1091
1092 config NETFILTER_XT_MATCH_STATE
1093         tristate '"state" match support'
1094         depends on NF_CONNTRACK
1095         default m if NETFILTER_ADVANCED=n
1096         help
1097           Connection state matching allows you to match packets based on their
1098           relationship to a tracked connection (ie. previous packets).  This
1099           is a powerful tool for packet classification.
1100
1101           To compile it as a module, choose M here.  If unsure, say N.
1102
1103 config NETFILTER_XT_MATCH_STATISTIC
1104         tristate '"statistic" match support'
1105         depends on NETFILTER_ADVANCED
1106         help
1107           This option adds a `statistic' match, which allows you to match
1108           on packets periodically or randomly with a given percentage.
1109
1110           To compile it as a module, choose M here.  If unsure, say N.
1111
1112 config NETFILTER_XT_MATCH_STRING
1113         tristate  '"string" match support'
1114         depends on NETFILTER_ADVANCED
1115         select TEXTSEARCH
1116         select TEXTSEARCH_KMP
1117         select TEXTSEARCH_BM
1118         select TEXTSEARCH_FSM
1119         help
1120           This option adds a `string' match, which allows you to look for
1121           pattern matchings in packets.
1122
1123           To compile it as a module, choose M here.  If unsure, say N.
1124
1125 config NETFILTER_XT_MATCH_TCPMSS
1126         tristate '"tcpmss" match support'
1127         depends on NETFILTER_ADVANCED
1128         help
1129           This option adds a `tcpmss' match, which allows you to examine the
1130           MSS value of TCP SYN packets, which control the maximum packet size
1131           for that connection.
1132
1133           To compile it as a module, choose M here.  If unsure, say N.
1134
1135 config NETFILTER_XT_MATCH_TIME
1136         tristate '"time" match support'
1137         depends on NETFILTER_ADVANCED
1138         ---help---
1139           This option adds a "time" match, which allows you to match based on
1140           the packet arrival time (at the machine which netfilter is running)
1141           on) or departure time/date (for locally generated packets).
1142
1143           If you say Y here, try `iptables -m time --help` for
1144           more information.
1145
1146           If you want to compile it as a module, say M here.
1147           If unsure, say N.
1148
1149 config NETFILTER_XT_MATCH_U32
1150         tristate '"u32" match support'
1151         depends on NETFILTER_ADVANCED
1152         ---help---
1153           u32 allows you to extract quantities of up to 4 bytes from a packet,
1154           AND them with specified masks, shift them by specified amounts and
1155           test whether the results are in any of a set of specified ranges.
1156           The specification of what to extract is general enough to skip over
1157           headers with lengths stored in the packet, as in IP or TCP header
1158           lengths.
1159
1160           Details and examples are in the kernel module source.
1161
1162 endif # NETFILTER_XTABLES
1163
1164 endmenu
1165
1166 source "net/netfilter/ipset/Kconfig"
1167
1168 source "net/netfilter/ipvs/Kconfig"