xref: /linux/net/bridge/netfilter/Kconfig (revision 60675d4ca1ef0857e44eba5849b74a3a998d0c0f)
1# SPDX-License-Identifier: GPL-2.0-only
2#
3# Bridge netfilter configuration
4#
5#
6menuconfig NF_TABLES_BRIDGE
7	depends on BRIDGE && NETFILTER && NF_TABLES
8	select NETFILTER_FAMILY_BRIDGE
9	tristate "Ethernet Bridge nf_tables support"
10
11if NF_TABLES_BRIDGE
12
13config NFT_BRIDGE_META
14	tristate "Netfilter nf_table bridge meta support"
15	help
16	  Add support for bridge dedicated meta key.
17
18config NFT_BRIDGE_REJECT
19	tristate "Netfilter nf_tables bridge reject support"
20	depends on NFT_REJECT
21	depends on NF_REJECT_IPV4
22	depends on NF_REJECT_IPV6
23	help
24	  Add support to reject packets.
25
26endif # NF_TABLES_BRIDGE
27
28config NF_CONNTRACK_BRIDGE
29	tristate "IPv4/IPV6 bridge connection tracking support"
30	depends on NF_CONNTRACK
31	default n
32	help
33	  Connection tracking keeps a record of what packets have passed
34	  through your machine, in order to figure out how they are related
35	  into connections. This is used to enhance packet filtering via
36	  stateful policies. Enable this if you want native tracking from
37	  the bridge. This provides a replacement for the `br_netfilter'
38	  infrastructure.
39
40	  To compile it as a module, choose M here.  If unsure, say N.
41
42# old sockopt interface and eval loop
43config BRIDGE_NF_EBTABLES_LEGACY
44	tristate "Legacy EBTABLES support"
45	depends on BRIDGE && NETFILTER_XTABLES
46	default n
47	help
48	 Legacy ebtables packet/frame classifier.
49	 This is not needed if you are using ebtables over nftables
50	 (iptables-nft).
51
52menuconfig BRIDGE_NF_EBTABLES
53	tristate "Ethernet Bridge tables (ebtables) support"
54	depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
55	select NETFILTER_FAMILY_BRIDGE
56	help
57	  ebtables is a general, extensible frame/packet identification
58	  framework. Say 'Y' or 'M' here if you want to do Ethernet
59	  filtering/NAT/brouting on the Ethernet bridge.
60
61if BRIDGE_NF_EBTABLES
62
63#
64# tables
65#
66config BRIDGE_EBT_BROUTE
67	tristate "ebt: broute table support"
68	select BRIDGE_NF_EBTABLES_LEGACY
69	help
70	  The ebtables broute table is used to define rules that decide between
71	  bridging and routing frames, giving Linux the functionality of a
72	  brouter. See the man page for ebtables(8) and examples on the ebtables
73	  website.
74
75	  To compile it as a module, choose M here.  If unsure, say N.
76
77config BRIDGE_EBT_T_FILTER
78	tristate "ebt: filter table support"
79	select BRIDGE_NF_EBTABLES_LEGACY
80	help
81	  The ebtables filter table is used to define frame filtering rules at
82	  local input, forwarding and local output. See the man page for
83	  ebtables(8).
84
85	  To compile it as a module, choose M here.  If unsure, say N.
86
87config BRIDGE_EBT_T_NAT
88	tristate "ebt: nat table support"
89	select BRIDGE_NF_EBTABLES_LEGACY
90	help
91	  The ebtables nat table is used to define rules that alter the MAC
92	  source address (MAC SNAT) or the MAC destination address (MAC DNAT).
93	  See the man page for ebtables(8).
94
95	  To compile it as a module, choose M here.  If unsure, say N.
96#
97# matches
98#
99config BRIDGE_EBT_802_3
100	tristate "ebt: 802.3 filter support"
101	help
102	  This option adds matching support for 802.3 Ethernet frames.
103
104	  To compile it as a module, choose M here.  If unsure, say N.
105
106config BRIDGE_EBT_AMONG
107	tristate "ebt: among filter support"
108	help
109	  This option adds the among match, which allows matching the MAC source
110	  and/or destination address on a list of addresses. Optionally,
111	  MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
112
113	  To compile it as a module, choose M here.  If unsure, say N.
114
115config BRIDGE_EBT_ARP
116	tristate "ebt: ARP filter support"
117	help
118	  This option adds the ARP match, which allows ARP and RARP header field
119	  filtering.
120
121	  To compile it as a module, choose M here.  If unsure, say N.
122
123config BRIDGE_EBT_IP
124	tristate "ebt: IP filter support"
125	help
126	  This option adds the IP match, which allows basic IP header field
127	  filtering.
128
129	  To compile it as a module, choose M here.  If unsure, say N.
130
131config BRIDGE_EBT_IP6
132	tristate "ebt: IP6 filter support"
133	depends on BRIDGE_NF_EBTABLES && IPV6
134	help
135	  This option adds the IP6 match, which allows basic IPV6 header field
136	  filtering.
137
138	  To compile it as a module, choose M here.  If unsure, say N.
139
140config BRIDGE_EBT_LIMIT
141	tristate "ebt: limit match support"
142	help
143	  This option adds the limit match, which allows you to control
144	  the rate at which a rule can be matched. This match is the
145	  equivalent of the iptables limit match.
146
147	  If you want to compile it as a module, say M here and read
148	  <file:Documentation/kbuild/modules.rst>.  If unsure, say `N'.
149
150config BRIDGE_EBT_MARK
151	tristate "ebt: mark filter support"
152	help
153	  This option adds the mark match, which allows matching frames based on
154	  the 'nfmark' value in the frame. This can be set by the mark target.
155	  This value is the same as the one used in the iptables mark match and
156	  target.
157
158	  To compile it as a module, choose M here.  If unsure, say N.
159
160config BRIDGE_EBT_PKTTYPE
161	tristate "ebt: packet type filter support"
162	help
163	  This option adds the packet type match, which allows matching on the
164	  type of packet based on its Ethernet "class" (as determined by
165	  the generic networking code): broadcast, multicast,
166	  for this host alone or for another host.
167
168	  To compile it as a module, choose M here.  If unsure, say N.
169
170config BRIDGE_EBT_STP
171	tristate "ebt: STP filter support"
172	help
173	  This option adds the Spanning Tree Protocol match, which
174	  allows STP header field filtering.
175
176	  To compile it as a module, choose M here.  If unsure, say N.
177
178config BRIDGE_EBT_VLAN
179	tristate "ebt: 802.1Q VLAN filter support"
180	help
181	  This option adds the 802.1Q vlan match, which allows the filtering of
182	  802.1Q vlan fields.
183
184	  To compile it as a module, choose M here.  If unsure, say N.
185#
186# targets
187#
188config BRIDGE_EBT_ARPREPLY
189	tristate "ebt: arp reply target support"
190	depends on BRIDGE_NF_EBTABLES && INET
191	help
192	  This option adds the arp reply target, which allows
193	  automatically sending arp replies to arp requests.
194
195	  To compile it as a module, choose M here.  If unsure, say N.
196
197config BRIDGE_EBT_DNAT
198	tristate "ebt: dnat target support"
199	help
200	  This option adds the MAC DNAT target, which allows altering the MAC
201	  destination address of frames.
202
203	  To compile it as a module, choose M here.  If unsure, say N.
204
205config BRIDGE_EBT_MARK_T
206	tristate "ebt: mark target support"
207	help
208	  This option adds the mark target, which allows marking frames by
209	  setting the 'nfmark' value in the frame.
210	  This value is the same as the one used in the iptables mark match and
211	  target.
212
213	  To compile it as a module, choose M here.  If unsure, say N.
214
215config BRIDGE_EBT_REDIRECT
216	tristate "ebt: redirect target support"
217	help
218	  This option adds the MAC redirect target, which allows altering the MAC
219	  destination address of a frame to that of the device it arrived on.
220
221	  To compile it as a module, choose M here.  If unsure, say N.
222
223config BRIDGE_EBT_SNAT
224	tristate "ebt: snat target support"
225	help
226	  This option adds the MAC SNAT target, which allows altering the MAC
227	  source address of frames.
228
229	  To compile it as a module, choose M here.  If unsure, say N.
230#
231# watchers
232#
233config BRIDGE_EBT_LOG
234	tristate "ebt: log support"
235	help
236	  This option adds the log watcher, that you can use in any rule
237	  in any ebtables table. It records info about the frame header
238	  to the syslog.
239
240	  To compile it as a module, choose M here.  If unsure, say N.
241
242config BRIDGE_EBT_NFLOG
243	tristate "ebt: nflog support"
244	help
245	  This option enables the nflog watcher, which allows to LOG
246	  messages through the netfilter logging API, which can use
247	  either the old LOG target, the old ULOG target or nfnetlink_log
248	  as backend.
249
250	  This option adds the nflog watcher, that you can use in any rule
251	  in any ebtables table.
252
253	  To compile it as a module, choose M here.  If unsure, say N.
254
255endif # BRIDGE_NF_EBTABLES
256