Kconfig

  1# SPDX-License-Identifier: GPL-2.0-only
  2#
  3# Bridge netfilter configuration
  4#
  5#
  6menuconfig NF_TABLES_BRIDGE
  7	depends on BRIDGE && NETFILTER && NF_TABLES
  8	select NETFILTER_FAMILY_BRIDGE
  9	tristate "Ethernet Bridge nf_tables support"
 10
 11if NF_TABLES_BRIDGE
 12
 13config NFT_BRIDGE_META
 14	tristate "Netfilter nf_table bridge meta support"
 15	help
 16	  Add support for bridge dedicated meta key.
 17
 18config NFT_BRIDGE_REJECT
 19	tristate "Netfilter nf_tables bridge reject support"
 20	depends on NFT_REJECT
 21	depends on NF_REJECT_IPV4
 22	depends on NF_REJECT_IPV6
 23	help
 24	  Add support to reject packets.
 25
 26endif # NF_TABLES_BRIDGE
 27
 28config NF_CONNTRACK_BRIDGE
 29	tristate "IPv4/IPV6 bridge connection tracking support"
 30	depends on NF_CONNTRACK
 31	default n
 32	help
 33	  Connection tracking keeps a record of what packets have passed
 34	  through your machine, in order to figure out how they are related
 35	  into connections. This is used to enhance packet filtering via
 36	  stateful policies. Enable this if you want native tracking from
 37	  the bridge. This provides a replacement for the `br_netfilter'
 38	  infrastructure.
 39
 40	  To compile it as a module, choose M here.  If unsure, say N.
 41
 42# old sockopt interface and eval loop
 43config BRIDGE_NF_EBTABLES_LEGACY
 44	tristate "Legacy EBTABLES support"
 45	depends on BRIDGE && NETFILTER_XTABLES_LEGACY
 46	depends on NETFILTER_XTABLES
 47	default	n
 48	help
 49	 Legacy ebtables packet/frame classifier.
 50	 This is not needed if you are using ebtables over nftables
 51	 (iptables-nft).
 52
 53menuconfig BRIDGE_NF_EBTABLES
 54	tristate "Ethernet Bridge tables (ebtables) support"
 55	depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
 56	select NETFILTER_FAMILY_BRIDGE
 57	help
 58	  ebtables is a general, extensible frame/packet identification
 59	  framework. Say 'Y' or 'M' here if you want to do Ethernet
 60	  filtering/NAT/brouting on the Ethernet bridge.
 61
 62if BRIDGE_NF_EBTABLES
 63
 64#
 65# tables
 66#
 67config BRIDGE_EBT_BROUTE
 68	tristate "ebt: broute table support"
 69	depends on BRIDGE_NF_EBTABLES_LEGACY
 70	help
 71	  The ebtables broute table is used to define rules that decide between
 72	  bridging and routing frames, giving Linux the functionality of a
 73	  brouter. See the man page for ebtables(8) and examples on the ebtables
 74	  website.
 75
 76	  To compile it as a module, choose M here.  If unsure, say N.
 77
 78config BRIDGE_EBT_T_FILTER
 79	tristate "ebt: filter table support"
 80	depends on BRIDGE_NF_EBTABLES_LEGACY
 81	help
 82	  The ebtables filter table is used to define frame filtering rules at
 83	  local input, forwarding and local output. See the man page for
 84	  ebtables(8).
 85
 86	  To compile it as a module, choose M here.  If unsure, say N.
 87
 88config BRIDGE_EBT_T_NAT
 89	tristate "ebt: nat table support"
 90	depends on BRIDGE_NF_EBTABLES_LEGACY
 91	help
 92	  The ebtables nat table is used to define rules that alter the MAC
 93	  source address (MAC SNAT) or the MAC destination address (MAC DNAT).
 94	  See the man page for ebtables(8).
 95
 96	  To compile it as a module, choose M here.  If unsure, say N.
 97#
 98# matches
 99#
100config BRIDGE_EBT_802_3
101	tristate "ebt: 802.3 filter support"
102	help
103	  This option adds matching support for 802.3 Ethernet frames.
104
105	  To compile it as a module, choose M here.  If unsure, say N.
106
107config BRIDGE_EBT_AMONG
108	tristate "ebt: among filter support"
109	help
110	  This option adds the among match, which allows matching the MAC source
111	  and/or destination address on a list of addresses. Optionally,
112	  MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
113
114	  To compile it as a module, choose M here.  If unsure, say N.
115
116config BRIDGE_EBT_ARP
117	tristate "ebt: ARP filter support"
118	help
119	  This option adds the ARP match, which allows ARP and RARP header field
120	  filtering.
121
122	  To compile it as a module, choose M here.  If unsure, say N.
123
124config BRIDGE_EBT_IP
125	tristate "ebt: IP filter support"
126	help
127	  This option adds the IP match, which allows basic IP header field
128	  filtering.
129
130	  To compile it as a module, choose M here.  If unsure, say N.
131
132config BRIDGE_EBT_IP6
133	tristate "ebt: IP6 filter support"
134	depends on BRIDGE_NF_EBTABLES && IPV6
135	help
136	  This option adds the IP6 match, which allows basic IPV6 header field
137	  filtering.
138
139	  To compile it as a module, choose M here.  If unsure, say N.
140
141config BRIDGE_EBT_LIMIT
142	tristate "ebt: limit match support"
143	help
144	  This option adds the limit match, which allows you to control
145	  the rate at which a rule can be matched. This match is the
146	  equivalent of the iptables limit match.
147
148	  If you want to compile it as a module, say M here and read
149	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
150
151config BRIDGE_EBT_MARK
152	tristate "ebt: mark filter support"
153	help
154	  This option adds the mark match, which allows matching frames based on
155	  the 'nfmark' value in the frame. This can be set by the mark target.
156	  This value is the same as the one used in the iptables mark match and
157	  target.
158
159	  To compile it as a module, choose M here.  If unsure, say N.
160
161config BRIDGE_EBT_PKTTYPE
162	tristate "ebt: packet type filter support"
163	help
164	  This option adds the packet type match, which allows matching on the
165	  type of packet based on its Ethernet "class" (as determined by
166	  the generic networking code): broadcast, multicast,
167	  for this host alone or for another host.
168
169	  To compile it as a module, choose M here.  If unsure, say N.
170
171config BRIDGE_EBT_STP
172	tristate "ebt: STP filter support"
173	help
174	  This option adds the Spanning Tree Protocol match, which
175	  allows STP header field filtering.
176
177	  To compile it as a module, choose M here.  If unsure, say N.
178
179config BRIDGE_EBT_VLAN
180	tristate "ebt: 802.1Q VLAN filter support"
181	help
182	  This option adds the 802.1Q vlan match, which allows the filtering of
183	  802.1Q vlan fields.
184
185	  To compile it as a module, choose M here.  If unsure, say N.
186#
187# targets
188#
189config BRIDGE_EBT_ARPREPLY
190	tristate "ebt: arp reply target support"
191	depends on BRIDGE_NF_EBTABLES && INET
192	help
193	  This option adds the arp reply target, which allows
194	  automatically sending arp replies to arp requests.
195
196	  To compile it as a module, choose M here.  If unsure, say N.
197
198config BRIDGE_EBT_DNAT
199	tristate "ebt: dnat target support"
200	help
201	  This option adds the MAC DNAT target, which allows altering the MAC
202	  destination address of frames.
203
204	  To compile it as a module, choose M here.  If unsure, say N.
205
206config BRIDGE_EBT_MARK_T
207	tristate "ebt: mark target support"
208	help
209	  This option adds the mark target, which allows marking frames by
210	  setting the 'nfmark' value in the frame.
211	  This value is the same as the one used in the iptables mark match and
212	  target.
213
214	  To compile it as a module, choose M here.  If unsure, say N.
215
216config BRIDGE_EBT_REDIRECT
217	tristate "ebt: redirect target support"
218	help
219	  This option adds the MAC redirect target, which allows altering the MAC
220	  destination address of a frame to that of the device it arrived on.
221
222	  To compile it as a module, choose M here.  If unsure, say N.
223
224config BRIDGE_EBT_SNAT
225	tristate "ebt: snat target support"
226	help
227	  This option adds the MAC SNAT target, which allows altering the MAC
228	  source address of frames.
229
230	  To compile it as a module, choose M here.  If unsure, say N.
231#
232# watchers
233#
234config BRIDGE_EBT_LOG
235	tristate "ebt: log support"
236	help
237	  This option adds the log watcher, that you can use in any rule
238	  in any ebtables table. It records info about the frame header
239	  to the syslog.
240
241	  To compile it as a module, choose M here.  If unsure, say N.
242
243config BRIDGE_EBT_NFLOG
244	tristate "ebt: nflog support"
245	help
246	  This option enables the nflog watcher, which allows to LOG
247	  messages through the netfilter logging API, which can use
248	  either the old LOG target, the old ULOG target or nfnetlink_log
249	  as backend.
250
251	  This option adds the nflog watcher, that you can use in any rule
252	  in any ebtables table.
253
254	  To compile it as a module, choose M here.  If unsure, say N.
255
256endif # BRIDGE_NF_EBTABLES