Kconfig 7.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244
  1. # SPDX-License-Identifier: GPL-2.0-only
  2. #
  3. # Bridge netfilter configuration
  4. #
  5. #
  6. menuconfig NF_TABLES_BRIDGE
  7. depends on BRIDGE && NETFILTER && NF_TABLES
  8. select NETFILTER_FAMILY_BRIDGE
  9. tristate "Ethernet Bridge nf_tables support"
  10. if NF_TABLES_BRIDGE
  11. config NFT_BRIDGE_META
  12. tristate "Netfilter nf_table bridge meta support"
  13. help
  14. Add support for bridge dedicated meta key.
  15. config NFT_BRIDGE_REJECT
  16. tristate "Netfilter nf_tables bridge reject support"
  17. depends on NFT_REJECT && NFT_REJECT_IPV4 && NFT_REJECT_IPV6
  18. help
  19. Add support to reject packets.
  20. config NF_LOG_BRIDGE
  21. tristate "Bridge packet logging"
  22. select NF_LOG_COMMON
  23. endif # NF_TABLES_BRIDGE
  24. config NF_CONNTRACK_BRIDGE
  25. tristate "IPv4/IPV6 bridge connection tracking support"
  26. depends on NF_CONNTRACK
  27. default n
  28. help
  29. Connection tracking keeps a record of what packets have passed
  30. through your machine, in order to figure out how they are related
  31. into connections. This is used to enhance packet filtering via
  32. stateful policies. Enable this if you want native tracking from
  33. the bridge. This provides a replacement for the `br_netfilter'
  34. infrastructure.
  35. To compile it as a module, choose M here. If unsure, say N.
  36. menuconfig BRIDGE_NF_EBTABLES
  37. tristate "Ethernet Bridge tables (ebtables) support"
  38. depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
  39. select NETFILTER_FAMILY_BRIDGE
  40. help
  41. ebtables is a general, extensible frame/packet identification
  42. framework. Say 'Y' or 'M' here if you want to do Ethernet
  43. filtering/NAT/brouting on the Ethernet bridge.
  44. if BRIDGE_NF_EBTABLES
  45. #
  46. # tables
  47. #
  48. config BRIDGE_EBT_BROUTE
  49. tristate "ebt: broute table support"
  50. help
  51. The ebtables broute table is used to define rules that decide between
  52. bridging and routing frames, giving Linux the functionality of a
  53. brouter. See the man page for ebtables(8) and examples on the ebtables
  54. website.
  55. To compile it as a module, choose M here. If unsure, say N.
  56. config BRIDGE_EBT_T_FILTER
  57. tristate "ebt: filter table support"
  58. help
  59. The ebtables filter table is used to define frame filtering rules at
  60. local input, forwarding and local output. See the man page for
  61. ebtables(8).
  62. To compile it as a module, choose M here. If unsure, say N.
  63. config BRIDGE_EBT_T_NAT
  64. tristate "ebt: nat table support"
  65. help
  66. The ebtables nat table is used to define rules that alter the MAC
  67. source address (MAC SNAT) or the MAC destination address (MAC DNAT).
  68. See the man page for ebtables(8).
  69. To compile it as a module, choose M here. If unsure, say N.
  70. #
  71. # matches
  72. #
  73. config BRIDGE_EBT_802_3
  74. tristate "ebt: 802.3 filter support"
  75. help
  76. This option adds matching support for 802.3 Ethernet frames.
  77. To compile it as a module, choose M here. If unsure, say N.
  78. config BRIDGE_EBT_AMONG
  79. tristate "ebt: among filter support"
  80. help
  81. This option adds the among match, which allows matching the MAC source
  82. and/or destination address on a list of addresses. Optionally,
  83. MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
  84. To compile it as a module, choose M here. If unsure, say N.
  85. config BRIDGE_EBT_ARP
  86. tristate "ebt: ARP filter support"
  87. help
  88. This option adds the ARP match, which allows ARP and RARP header field
  89. filtering.
  90. To compile it as a module, choose M here. If unsure, say N.
  91. config BRIDGE_EBT_IP
  92. tristate "ebt: IP filter support"
  93. help
  94. This option adds the IP match, which allows basic IP header field
  95. filtering.
  96. To compile it as a module, choose M here. If unsure, say N.
  97. config BRIDGE_EBT_IP6
  98. tristate "ebt: IP6 filter support"
  99. depends on BRIDGE_NF_EBTABLES && IPV6
  100. help
  101. This option adds the IP6 match, which allows basic IPV6 header field
  102. filtering.
  103. To compile it as a module, choose M here. If unsure, say N.
  104. config BRIDGE_EBT_LIMIT
  105. tristate "ebt: limit match support"
  106. help
  107. This option adds the limit match, which allows you to control
  108. the rate at which a rule can be matched. This match is the
  109. equivalent of the iptables limit match.
  110. If you want to compile it as a module, say M here and read
  111. <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
  112. config BRIDGE_EBT_MARK
  113. tristate "ebt: mark filter support"
  114. help
  115. This option adds the mark match, which allows matching frames based on
  116. the 'nfmark' value in the frame. This can be set by the mark target.
  117. This value is the same as the one used in the iptables mark match and
  118. target.
  119. To compile it as a module, choose M here. If unsure, say N.
  120. config BRIDGE_EBT_PKTTYPE
  121. tristate "ebt: packet type filter support"
  122. help
  123. This option adds the packet type match, which allows matching on the
  124. type of packet based on its Ethernet "class" (as determined by
  125. the generic networking code): broadcast, multicast,
  126. for this host alone or for another host.
  127. To compile it as a module, choose M here. If unsure, say N.
  128. config BRIDGE_EBT_STP
  129. tristate "ebt: STP filter support"
  130. help
  131. This option adds the Spanning Tree Protocol match, which
  132. allows STP header field filtering.
  133. To compile it as a module, choose M here. If unsure, say N.
  134. config BRIDGE_EBT_VLAN
  135. tristate "ebt: 802.1Q VLAN filter support"
  136. help
  137. This option adds the 802.1Q vlan match, which allows the filtering of
  138. 802.1Q vlan fields.
  139. To compile it as a module, choose M here. If unsure, say N.
  140. #
  141. # targets
  142. #
  143. config BRIDGE_EBT_ARPREPLY
  144. tristate "ebt: arp reply target support"
  145. depends on BRIDGE_NF_EBTABLES && INET
  146. help
  147. This option adds the arp reply target, which allows
  148. automatically sending arp replies to arp requests.
  149. To compile it as a module, choose M here. If unsure, say N.
  150. config BRIDGE_EBT_DNAT
  151. tristate "ebt: dnat target support"
  152. help
  153. This option adds the MAC DNAT target, which allows altering the MAC
  154. destination address of frames.
  155. To compile it as a module, choose M here. If unsure, say N.
  156. config BRIDGE_EBT_MARK_T
  157. tristate "ebt: mark target support"
  158. help
  159. This option adds the mark target, which allows marking frames by
  160. setting the 'nfmark' value in the frame.
  161. This value is the same as the one used in the iptables mark match and
  162. target.
  163. To compile it as a module, choose M here. If unsure, say N.
  164. config BRIDGE_EBT_REDIRECT
  165. tristate "ebt: redirect target support"
  166. help
  167. This option adds the MAC redirect target, which allows altering the MAC
  168. destination address of a frame to that of the device it arrived on.
  169. To compile it as a module, choose M here. If unsure, say N.
  170. config BRIDGE_EBT_SNAT
  171. tristate "ebt: snat target support"
  172. help
  173. This option adds the MAC SNAT target, which allows altering the MAC
  174. source address of frames.
  175. To compile it as a module, choose M here. If unsure, say N.
  176. #
  177. # watchers
  178. #
  179. config BRIDGE_EBT_LOG
  180. tristate "ebt: log support"
  181. help
  182. This option adds the log watcher, that you can use in any rule
  183. in any ebtables table. It records info about the frame header
  184. to the syslog.
  185. To compile it as a module, choose M here. If unsure, say N.
  186. config BRIDGE_EBT_NFLOG
  187. tristate "ebt: nflog support"
  188. help
  189. This option enables the nflog watcher, which allows to LOG
  190. messages through the netfilter logging API, which can use
  191. either the old LOG target, the old ULOG target or nfnetlink_log
  192. as backend.
  193. This option adds the nflog watcher, that you can use in any rule
  194. in any ebtables table.
  195. To compile it as a module, choose M here. If unsure, say N.
  196. endif # BRIDGE_NF_EBTABLES