forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2024-05-13 9d77db3c730780c8ef5ccd4b66403ff5675cfe4e 
 kernel/net/netfilter/Kconfig
....@@ -1,3 +1,4 @@
1
+# SPDX-License-Identifier: GPL-2.0-only
12 menu "Core Netfilter Configuration"
23 	depends on NET && INET && NETFILTER
34 
....@@ -19,7 +20,7 @@
1920 	bool
2021 
2122 config NETFILTER_NETLINK_ACCT
22
-tristate "Netfilter NFACCT over NFNETLINK interface"
23
+	tristate "Netfilter NFACCT over NFNETLINK interface"
2324 	depends on NETFILTER_ADVANCED
2425 	select NETFILTER_NETLINK
2526 	help
....@@ -33,7 +34,7 @@
3334 	help
3435 	  If this option is enabled, the kernel will include support
3536 	  for queueing packets via NFNETLINK.
36
-	  
37
+
3738 config NETFILTER_NETLINK_LOG
3839 	tristate "Netfilter LOG over NFNETLINK interface"
3940 	default m if NETFILTER_ADVANCED=n
....@@ -117,9 +118,8 @@
117118 
118119 config NF_CONNTRACK_PROCFS
119120 	bool "Supply CT list in procfs (OBSOLETE)"
120
-	default y
121121 	depends on PROC_FS
122
-	---help---
122
+	help
123123 	This option enables for the list of known conntrack entries
124124 	to be shown in procfs under net/netfilter/nf_conntrack. This
125125 	is considered obsolete in favor of using the conntrack(8)
....@@ -174,7 +174,7 @@
174174 	  If unsure, say Y.
175175 
176176 config NF_CT_PROTO_GRE
177
-	tristate
177
+	bool
178178 
179179 config NF_CT_PROTO_SCTP
180180 	bool 'SCTP protocol connection tracking support'
....@@ -222,8 +222,6 @@
222222 	  of Network Address Translation on them.
223223 
224224 	  This is FTP support on Layer 3 independent connection tracking.
225
-	  Layer 3 independent connection tracking is experimental scheme
226
-	  which generalize ip_conntrack to support other layer 3 protocols.
227225 
228226 	  To compile it as a module, choose M here.  If unsure, say N.
229227 
....@@ -337,7 +335,7 @@
337335 	help
338336 	  SIP is an application-layer control protocol that can establish,
339337 	  modify, and terminate multimedia sessions (conferences) such as
340
-	  Internet telephony calls. With the ip_conntrack_sip and
338
+	  Internet telephony calls. With the nf_conntrack_sip and
341339 	  the nf_nat_sip modules you can support the protocol on a connection
342340 	  tracking/NATing firewall.
343341 
....@@ -396,27 +394,13 @@
396394 	  the enqueued via NFNETLINK.
397395 
398396 config NF_NAT
399
-	tristate
400
-
401
-config NF_NAT_NEEDED
402
-	bool
403
-	depends on NF_NAT
404
-	default y
405
-
406
-config NF_NAT_PROTO_DCCP
407
-	bool
408
-	depends on NF_NAT && NF_CT_PROTO_DCCP
409
-	default NF_NAT && NF_CT_PROTO_DCCP
410
-
411
-config NF_NAT_PROTO_UDPLITE
412
-	bool
413
-	depends on NF_NAT && NF_CT_PROTO_UDPLITE
414
-	default NF_NAT && NF_CT_PROTO_UDPLITE
415
-
416
-config NF_NAT_PROTO_SCTP
417
-	bool
418
-	default NF_NAT && NF_CT_PROTO_SCTP
419
-	depends on NF_NAT && NF_CT_PROTO_SCTP
397
+	tristate "Network Address Translation support"
398
+	depends on NF_CONNTRACK
399
+	default m if NETFILTER_ADVANCED=n
400
+	help
401
+	  The NAT option allows masquerading, port forwarding and other
402
+	  forms of full Network Address Port Translation. This can be
403
+	  controlled by iptables, ip6tables or nft.
420404 
421405 config NF_NAT_AMANDA
422406 	tristate
....@@ -446,6 +430,9 @@
446430 config NF_NAT_REDIRECT
447431 	bool
448432 
433
+config NF_NAT_MASQUERADE
434
+	bool
435
+
449436 config NETFILTER_SYNPROXY
450437 	tristate
451438 
....@@ -453,13 +440,14 @@
453440 
454441 config NF_TABLES
455442 	select NETFILTER_NETLINK
443
+	select LIBCRC32C
456444 	tristate "Netfilter nf_tables support"
457445 	help
458446 	  nftables is the new packet classification framework that intends to
459447 	  replace the existing {ip,ip6,arp,eb}_tables infrastructure. It
460448 	  provides a pseudo-state machine with an extensible instruction-set
461449 	  (also known as expressions) that the userspace 'nft' utility
462
-	  (http://www.netfilter.org/projects/nftables) uses to build the
450
+	  (https://www.netfilter.org/projects/nftables) uses to build the
463451 	  rule-set. It also comes with the generic set infrastructure that
464452 	  allows you to construct mappings between matchings and actions
465453 	  for performance lookups.
....@@ -467,14 +455,6 @@
467455 	  To compile it as a module, choose M here.
468456 
469457 if NF_TABLES
470
-
471
-config NF_TABLES_SET
472
-	tristate "Netfilter nf_tables set infrastructure"
473
-	help
474
-	  This option enables the nf_tables set infrastructure that allows to
475
-	  look up for elements in a set and to build one-way mappings between
476
-	  matchings and actions.
477
-
478458 config NF_TABLES_INET
479459 	depends on IPV6
480460 	select NF_TABLES_IPV4
....@@ -538,6 +518,7 @@
538518 config NFT_MASQ
539519 	depends on NF_CONNTRACK
540520 	depends on NF_NAT
521
+	select NF_NAT_MASQUERADE
541522 	tristate "Netfilter nf_tables masquerade support"
542523 	help
543524 	  This option adds the "masquerade" expression that you can use
....@@ -547,6 +528,7 @@
547528 	depends on NF_CONNTRACK
548529 	depends on NF_NAT
549530 	tristate "Netfilter nf_tables redirect support"
531
+	select NF_NAT_REDIRECT
550532 	help
551533 	  This options adds the "redirect" expression that you can use
552534 	  to perform NAT in the redirect flavour.
....@@ -554,6 +536,7 @@
554536 config NFT_NAT
555537 	depends on NF_CONNTRACK
556538 	select NF_NAT
539
+	depends on NF_TABLES_IPV4 || NF_TABLES_IPV6
557540 	tristate "Netfilter nf_tables nat module"
558541 	help
559542 	  This option adds the "nat" expression that you can use to perform
....@@ -625,6 +608,13 @@
625608 	  The lookup will be delegated to the IPv4 or IPv6 FIB depending
626609 	  on the protocol of the packet.
627610 
611
+config NFT_XFRM
612
+	tristate "Netfilter nf_tables xfrm/IPSec security association matching"
613
+	depends on XFRM
614
+	help
615
+	  This option adds an expression that you can use to extract properties
616
+	  of a packets security association.
617
+
628618 config NFT_SOCKET
629619 	tristate "Netfilter nf_tables socket match support"
630620 	depends on IPV6 || IPV6=n
....@@ -650,6 +640,17 @@
650640 	select NF_TPROXY_IPV6 if NF_TABLES_IPV6
651641 	help
652642 	  This makes transparent proxy support available in nftables.
643
+
644
+config NFT_SYNPROXY
645
+	tristate "Netfilter nf_tables SYNPROXY expression support"
646
+	depends on NF_CONNTRACK && NETFILTER_ADVANCED
647
+	select NETFILTER_SYNPROXY
648
+	select SYN_COOKIES
649
+	help
650
+	  The SYNPROXY expression allows you to intercept TCP connections and
651
+	  establish them using syncookies before they are passed on to the
652
+	  server. This allows to avoid conntrack and server resource usage
653
+	  during SYN-flood attacks.
653654 
654655 if NF_TABLES_NETDEV
655656 
....@@ -688,7 +689,7 @@
688689 	tristate "Netfilter flow table mixed IPv4/IPv6 module"
689690 	depends on NF_FLOW_TABLE
690691 	help
691
-          This option adds the flow table mixed IPv4/IPv6 support.
692
+	  This option adds the flow table mixed IPv4/IPv6 support.
692693 
693694 	  To compile it as a module, choose M here.
694695 
....@@ -716,7 +717,7 @@
716717 config NETFILTER_XT_MARK
717718 	tristate 'nfmark target and match support'
718719 	default m if NETFILTER_ADVANCED=n
719
-	---help---
720
+	help
720721 	This option adds the "MARK" target and "mark" match.
721722 
722723 	Netfilter mark matching allows you to match packets based on the
....@@ -732,7 +733,7 @@
732733 	depends on NF_CONNTRACK
733734 	depends on NETFILTER_ADVANCED
734735 	select NF_CONNTRACK_MARK
735
-	---help---
736
+	help
736737 	This option adds the "CONNMARK" target and "connmark" match.
737738 
738739 	Netfilter allows you to store a mark value per connection (a.k.a.
....@@ -759,7 +760,7 @@
759760 	tristate "AUDIT target support"
760761 	depends on AUDIT
761762 	depends on NETFILTER_ADVANCED
762
-	---help---
763
+	help
763764 	  This option adds a 'AUDIT' target, which can be used to create
764765 	  audit records for packets dropped/accepted.
765766 
....@@ -769,7 +770,7 @@
769770 	tristate "CHECKSUM target support"
770771 	depends on IP_NF_MANGLE || IP6_NF_MANGLE
771772 	depends on NETFILTER_ADVANCED
772
-	---help---
773
+	help
773774 	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
774775 	  table to work around buggy DHCP clients in virtualized environments.
775776 
....@@ -798,7 +799,7 @@
798799 	depends on NF_CONNTRACK
799800 	depends on NETFILTER_ADVANCED
800801 	select NETFILTER_XT_CONNMARK
801
-	---help---
802
+	help
802803 	This is a backwards-compat option for the user's convenience
803804 	(e.g. when running oldconfig). It selects
804805 	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
....@@ -847,7 +848,7 @@
847848 	tristate '"HL" hoplimit target support'
848849 	depends on IP_NF_MANGLE || IP6_NF_MANGLE
849850 	depends on NETFILTER_ADVANCED
850
-	---help---
851
+	help
851852 	This option adds the "HL" (for IPv6) and "TTL" (for IPv4)
852853 	targets, which enable the user to change the
853854 	hoplimit/time-to-live value of the IP header.
....@@ -862,7 +863,7 @@
862863 	tristate '"HMARK" target support'
863864 	depends on IP6_NF_IPTABLES || IP6_NF_IPTABLES=n
864865 	depends on NETFILTER_ADVANCED
865
-	---help---
866
+	help
866867 	This option adds the "HMARK" target.
867868 
868869 	The target allows you to create rules in the "raw" and "mangle" tables
....@@ -906,7 +907,7 @@
906907 	    echo netfilter-ssh > /sys/class/leds/<ledname>/trigger
907908 
908909 	  For more information on the LEDs available on your system, see
909
-	  Documentation/leds/leds-class.txt
910
+	  Documentation/leds/leds-class.rst
910911 
911912 config NETFILTER_XT_TARGET_LOG
912913 	tristate "LOG target support"
....@@ -924,7 +925,7 @@
924925 	tristate '"MARK" target support'
925926 	depends on NETFILTER_ADVANCED
926927 	select NETFILTER_XT_MARK
927
-	---help---
928
+	help
928929 	This is a backwards-compat option for the user's convenience
929930 	(e.g. when running oldconfig). It selects
930931 	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
....@@ -932,7 +933,7 @@
932933 config NETFILTER_XT_NAT
933934 	tristate '"SNAT and DNAT" targets support'
934935 	depends on NF_NAT
935
-	---help---
936
+	help
936937 	This option enables the SNAT and DNAT targets.
937938 
938939 	To compile it as a module, choose M here. If unsure, say N.
....@@ -940,7 +941,7 @@
940941 config NETFILTER_XT_TARGET_NETMAP
941942 	tristate '"NETMAP" target support'
942943 	depends on NF_NAT
943
-	---help---
944
+	help
944945 	NETMAP is an implementation of static 1:1 NAT mapping of network
945946 	addresses. It maps the network address part, while keeping the host
946947 	address part intact.
....@@ -990,13 +991,27 @@
990991 	tristate "REDIRECT target support"
991992 	depends on NF_NAT
992993 	select NF_NAT_REDIRECT
993
-	---help---
994
+	help
994995 	REDIRECT is a special case of NAT: all incoming connections are
995996 	mapped onto the incoming interface's address, causing the packets to
996997 	come to the local machine instead of passing through. This is
997998 	useful for transparent proxies.
998999 
9991000 	To compile it as a module, choose M here. If unsure, say N.
1001
+
1002
+config NETFILTER_XT_TARGET_MASQUERADE
1003
+	tristate "MASQUERADE target support"
1004
+	depends on NF_NAT
1005
+	default m if NETFILTER_ADVANCED=n
1006
+	select NF_NAT_MASQUERADE
1007
+	help
1008
+	  Masquerading is a special case of NAT: all outgoing connections are
1009
+	  changed to seem to come from a particular interface's address, and
1010
+	  if the interface goes down, those connections are lost.  This is
1011
+	  only useful for dialup accounts with dynamic IP address (ie. your IP
1012
+	  address will be different on next dialup).
1013
+
1014
+	  To compile it as a module, choose M here.  If unsure, say N.
10001015 
10011016 config NETFILTER_XT_TARGET_TEE
10021017 	tristate '"TEE" - packet cloning to alternate destination'
....@@ -1006,7 +1021,7 @@
10061021 	depends on IP6_NF_IPTABLES || !IP6_NF_IPTABLES
10071022 	select NF_DUP_IPV4
10081023 	select NF_DUP_IPV6 if IP6_NF_IPTABLES
1009
-	---help---
1024
+	help
10101025 	This option adds a "TEE" target with which a packet can be cloned and
10111026 	this clone be rerouted to another nexthop.
10121027 
....@@ -1028,7 +1043,7 @@
10281043 	  on Netfilter connection tracking and NAT, unlike REDIRECT.
10291044 	  For it to work you will have to configure certain iptables rules
10301045 	  and use policy routing. For more information on how to set it up
1031
-	  see Documentation/networking/tproxy.txt.
1046
+	  see Documentation/networking/tproxy.rst.
10321047 
10331048 	  To compile it as a module, choose M here.  If unsure, say N.
10341049 
....@@ -1042,7 +1057,7 @@
10421057 	  the tables, chains, rules.
10431058 
10441059 	  If you want to compile it as a module, say M here and read
1045
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1060
+	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
10461061 
10471062 config NETFILTER_XT_TARGET_SECMARK
10481063 	tristate '"SECMARK" target support'
....@@ -1058,7 +1073,7 @@
10581073 	tristate '"TCPMSS" target support'
10591074 	depends on IPV6 || IPV6=n
10601075 	default m if NETFILTER_ADVANCED=n
1061
-	---help---
1076
+	help
10621077 	  This option adds a `TCPMSS' target, which allows you to alter the
10631078 	  MSS value of TCP SYN packets, to control the maximum size for that
10641079 	  connection (usually limiting it to your outgoing interface's MTU
....@@ -1096,12 +1111,12 @@
10961111 config NETFILTER_XT_MATCH_ADDRTYPE
10971112 	tristate '"addrtype" address type match support'
10981113 	default m if NETFILTER_ADVANCED=n
1099
-	---help---
1114
+	help
11001115 	  This option allows you to match what routing thinks of an address,
11011116 	  eg. UNICAST, LOCAL, BROADCAST, ...
11021117 
11031118 	  If you want to compile it as a module, say M here and read
1104
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1119
+	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
11051120 
11061121 config NETFILTER_XT_MATCH_BPF
11071122 	tristate '"bpf" match support'
....@@ -1117,7 +1132,7 @@
11171132 	depends on NETFILTER_ADVANCED
11181133 	depends on CGROUPS
11191134 	select CGROUP_NET_CLASSID
1120
-	---help---
1135
+	help
11211136 	Socket/process control group matching allows you to match locally
11221137 	generated packets based on which net_cls control group processes
11231138 	belong to.
....@@ -1126,7 +1141,7 @@
11261141 	tristate '"cluster" match support'
11271142 	depends on NF_CONNTRACK
11281143 	depends on NETFILTER_ADVANCED
1129
-	---help---
1144
+	help
11301145 	  This option allows you to build work-load-sharing clusters of
11311146 	  network servers/stateful firewalls without having a dedicated
11321147 	  load-balancing router/server/switch. Basically, this match returns
....@@ -1146,7 +1161,7 @@
11461161 	  comments in your iptables ruleset.
11471162 
11481163 	  If you want to compile it as a module, say M here and read
1149
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1164
+	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
11501165 
11511166 config NETFILTER_XT_MATCH_CONNBYTES
11521167 	tristate  '"connbytes" per-connection counter match support'
....@@ -1157,14 +1172,14 @@
11571172 	  number of bytes and/or packets for each direction within a connection.
11581173 
11591174 	  If you want to compile it as a module, say M here and read
1160
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1175
+	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
11611176 
11621177 config NETFILTER_XT_MATCH_CONNLABEL
11631178 	tristate '"connlabel" match support'
11641179 	select NF_CONNTRACK_LABELS
11651180 	depends on NF_CONNTRACK
11661181 	depends on NETFILTER_ADVANCED
1167
-	---help---
1182
+	help
11681183 	  This match allows you to test and assign userspace-defined labels names
11691184 	  to a connection.  The kernel only stores bit values - mapping
11701185 	  names to bits is done by userspace.
....@@ -1177,7 +1192,7 @@
11771192 	depends on NF_CONNTRACK
11781193 	depends on NETFILTER_ADVANCED
11791194 	select NETFILTER_CONNCOUNT
1180
-	---help---
1195
+	help
11811196 	  This match allows you to match against the number of parallel
11821197 	  connections to a server per client IP address (or address block).
11831198 
....@@ -1186,7 +1201,7 @@
11861201 	depends on NF_CONNTRACK
11871202 	depends on NETFILTER_ADVANCED
11881203 	select NETFILTER_XT_CONNMARK
1189
-	---help---
1204
+	help
11901205 	This is a backwards-compat option for the user's convenience
11911206 	(e.g. when running oldconfig). It selects
11921207 	CONFIG_NETFILTER_XT_CONNMARK (combined connmark/CONNMARK module).
....@@ -1223,7 +1238,7 @@
12231238 	  and DCCP flags.
12241239 
12251240 	  If you want to compile it as a module, say M here and read
1226
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1241
+	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
12271242 
12281243 config NETFILTER_XT_MATCH_DEVGROUP
12291244 	tristate '"devgroup" match support'
....@@ -1252,7 +1267,7 @@
12521267 config NETFILTER_XT_MATCH_ECN
12531268 	tristate '"ecn" match support'
12541269 	depends on NETFILTER_ADVANCED
1255
-	---help---
1270
+	help
12561271 	This option adds an "ECN" match, which allows you to match against
12571272 	the IPv4 and TCP header ECN fields.
12581273 
....@@ -1288,14 +1303,14 @@
12881303 	depends on NETFILTER_ADVANCED
12891304 	help
12901305 	  Helper matching allows you to match packets in dynamic connections
1291
-	  tracked by a conntrack-helper, ie. ip_conntrack_ftp
1306
+	  tracked by a conntrack-helper, ie. nf_conntrack_ftp
12921307 
12931308 	  To compile it as a module, choose M here.  If unsure, say Y.
12941309 
12951310 config NETFILTER_XT_MATCH_HL
12961311 	tristate '"hl" hoplimit/TTL match support'
12971312 	depends on NETFILTER_ADVANCED
1298
-	---help---
1313
+	help
12991314 	HL matching allows you to match packets based on the hoplimit
13001315 	in the IPv6 header, or the time-to-live field in the IPv4
13011316 	header of the packet.
....@@ -1312,7 +1327,7 @@
13121327 config NETFILTER_XT_MATCH_IPRANGE
13131328 	tristate '"iprange" address range match support'
13141329 	depends on NETFILTER_ADVANCED
1315
-	---help---
1330
+	help
13161331 	This option adds a "iprange" match, which allows you to match based on
13171332 	an IP address range. (Normal iptables only matches on single addresses
13181333 	with an optional mask.)
....@@ -1333,7 +1348,7 @@
13331348 	tristate '"l2tp" match support'
13341349 	depends on NETFILTER_ADVANCED
13351350 	default L2TP
1336
-	---help---
1351
+	help
13371352 	This option adds an "L2TP" match, which allows you to match against
13381353 	L2TP protocol header fields.
13391354 
....@@ -1371,7 +1386,7 @@
13711386 	tristate '"mark" match support'
13721387 	depends on NETFILTER_ADVANCED
13731388 	select NETFILTER_XT_MARK
1374
-	---help---
1389
+	help
13751390 	This is a backwards-compat option for the user's convenience
13761391 	(e.g. when running oldconfig). It selects
13771392 	CONFIG_NETFILTER_XT_MARK (combined mark/MARK module).
....@@ -1413,7 +1428,7 @@
14131428 config NETFILTER_XT_MATCH_OWNER
14141429 	tristate '"owner" match support'
14151430 	depends on NETFILTER_ADVANCED
1416
-	---help---
1431
+	help
14171432 	Socket owner matching allows you to match locally-generated packets
14181433 	based on who created the socket: the user or group. It is also
14191434 	possible to check whether a socket actually exists.
....@@ -1459,7 +1474,7 @@
14591474 	  byte counter.
14601475 
14611476 	  If you want to compile it as a module, say M here and read
1462
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1477
+	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
14631478 
14641479 config NETFILTER_XT_MATCH_QUOTA2
14651480 	tristate '"quota2" match support'
....@@ -1502,16 +1517,16 @@
15021517 	  This option adds a `realm' match, which allows you to use the realm
15031518 	  key from the routing subsystem inside iptables.
15041519 
1505
-	  This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option 
1520
+	  This match pretty much resembles the CONFIG_NET_CLS_ROUTE4 option
15061521 	  in tc world.
15071522 
15081523 	  If you want to compile it as a module, say M here and read
1509
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1524
+	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
15101525 
15111526 config NETFILTER_XT_MATCH_RECENT
15121527 	tristate '"recent" match support'
15131528 	depends on NETFILTER_ADVANCED
1514
-	---help---
1529
+	help
15151530 	This match is used for creating one or many lists of recently
15161531 	used addresses and then matching against that/those list(s).
15171532 
....@@ -1523,12 +1538,12 @@
15231538 	depends on NETFILTER_ADVANCED
15241539 	default IP_SCTP
15251540 	help
1526
-	  With this option enabled, you will be able to use the 
1541
+	  With this option enabled, you will be able to use the
15271542 	  `sctp' match in order to match on SCTP source/destination ports
15281543 	  and SCTP chunk types.
15291544 
15301545 	  If you want to compile it as a module, say M here and read
1531
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
1546
+	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
15321547 
15331548 config NETFILTER_XT_MATCH_SOCKET
15341549 	tristate '"socket" match support'
....@@ -1594,7 +1609,7 @@
15941609 config NETFILTER_XT_MATCH_TIME
15951610 	tristate '"time" match support'
15961611 	depends on NETFILTER_ADVANCED
1597
-	---help---
1612
+	help
15981613 	  This option adds a "time" match, which allows you to match based on
15991614 	  the packet arrival time (at the machine which netfilter is running)
16001615 	  on) or departure time/date (for locally generated packets).
....@@ -1608,7 +1623,7 @@
16081623 config NETFILTER_XT_MATCH_U32
16091624 	tristate '"u32" match support'
16101625 	depends on NETFILTER_ADVANCED
1611
-	---help---
1626
+	help
16121627 	  u32 allows you to extract quantities of up to 4 bytes from a packet,
16131628 	  AND them with specified masks, shift them by specified amounts and
16141629 	  test whether the results are in any of a set of specified ranges.