CONFIG_IP_NF_MATCH_TOS
Condition variable match support
CONFIG_IP_NF_MATCH_CONDITION
  This option allows you to match firewall rules against condition
  variables stored in the /proc/net/ipt_condition directory.

  If you want to compile it as a module, say M here and read
  Documentation/modules.txt.  If unsure, say `N'.