Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1# SPDX-License-Identifier: GPL-2.0-only
2#
3# Bridge netfilter configuration
4#
5#
6menuconfig NF_TABLES_BRIDGE
7 depends on BRIDGE && NETFILTER && NF_TABLES
8 select NETFILTER_FAMILY_BRIDGE
9 tristate "Ethernet Bridge nf_tables support"
10
11if NF_TABLES_BRIDGE
12
13config NFT_BRIDGE_META
14 tristate "Netfilter nf_table bridge meta support"
15 help
16 Add support for bridge dedicated meta key.
17
18config NFT_BRIDGE_REJECT
19 tristate "Netfilter nf_tables bridge reject support"
20 depends on NFT_REJECT
21 depends on NF_REJECT_IPV4
22 depends on NF_REJECT_IPV6
23 help
24 Add support to reject packets.
25
26endif # NF_TABLES_BRIDGE
27
28config NF_CONNTRACK_BRIDGE
29 tristate "IPv4/IPV6 bridge connection tracking support"
30 depends on NF_CONNTRACK
31 default n
32 help
33 Connection tracking keeps a record of what packets have passed
34 through your machine, in order to figure out how they are related
35 into connections. This is used to enhance packet filtering via
36 stateful policies. Enable this if you want native tracking from
37 the bridge. This provides a replacement for the `br_netfilter'
38 infrastructure.
39
40 To compile it as a module, choose M here. If unsure, say N.
41
42# old sockopt interface and eval loop
43config BRIDGE_NF_EBTABLES_LEGACY
44 tristate "Legacy EBTABLES support"
45 depends on BRIDGE && NETFILTER_XTABLES_LEGACY
46 depends on NETFILTER_XTABLES
47 default n
48 help
49 Legacy ebtables packet/frame classifier.
50 This is not needed if you are using ebtables over nftables
51 (iptables-nft).
52
53menuconfig BRIDGE_NF_EBTABLES
54 tristate "Ethernet Bridge tables (ebtables) support"
55 depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
56 select NETFILTER_FAMILY_BRIDGE
57 help
58 ebtables is a general, extensible frame/packet identification
59 framework. Say 'Y' or 'M' here if you want to do Ethernet
60 filtering/NAT/brouting on the Ethernet bridge.
61
62if BRIDGE_NF_EBTABLES
63
64#
65# tables
66#
67config BRIDGE_EBT_BROUTE
68 tristate "ebt: broute table support"
69 depends on BRIDGE_NF_EBTABLES_LEGACY
70 help
71 The ebtables broute table is used to define rules that decide between
72 bridging and routing frames, giving Linux the functionality of a
73 brouter. See the man page for ebtables(8) and examples on the ebtables
74 website.
75
76 To compile it as a module, choose M here. If unsure, say N.
77
78config BRIDGE_EBT_T_FILTER
79 tristate "ebt: filter table support"
80 depends on BRIDGE_NF_EBTABLES_LEGACY
81 help
82 The ebtables filter table is used to define frame filtering rules at
83 local input, forwarding and local output. See the man page for
84 ebtables(8).
85
86 To compile it as a module, choose M here. If unsure, say N.
87
88config BRIDGE_EBT_T_NAT
89 tristate "ebt: nat table support"
90 depends on BRIDGE_NF_EBTABLES_LEGACY
91 help
92 The ebtables nat table is used to define rules that alter the MAC
93 source address (MAC SNAT) or the MAC destination address (MAC DNAT).
94 See the man page for ebtables(8).
95
96 To compile it as a module, choose M here. If unsure, say N.
97#
98# matches
99#
100config BRIDGE_EBT_802_3
101 tristate "ebt: 802.3 filter support"
102 help
103 This option adds matching support for 802.3 Ethernet frames.
104
105 To compile it as a module, choose M here. If unsure, say N.
106
107config BRIDGE_EBT_AMONG
108 tristate "ebt: among filter support"
109 help
110 This option adds the among match, which allows matching the MAC source
111 and/or destination address on a list of addresses. Optionally,
112 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
113
114 To compile it as a module, choose M here. If unsure, say N.
115
116config BRIDGE_EBT_ARP
117 tristate "ebt: ARP filter support"
118 help
119 This option adds the ARP match, which allows ARP and RARP header field
120 filtering.
121
122 To compile it as a module, choose M here. If unsure, say N.
123
124config BRIDGE_EBT_IP
125 tristate "ebt: IP filter support"
126 help
127 This option adds the IP match, which allows basic IP header field
128 filtering.
129
130 To compile it as a module, choose M here. If unsure, say N.
131
132config BRIDGE_EBT_IP6
133 tristate "ebt: IP6 filter support"
134 depends on BRIDGE_NF_EBTABLES && IPV6
135 help
136 This option adds the IP6 match, which allows basic IPV6 header field
137 filtering.
138
139 To compile it as a module, choose M here. If unsure, say N.
140
141config BRIDGE_EBT_LIMIT
142 tristate "ebt: limit match support"
143 help
144 This option adds the limit match, which allows you to control
145 the rate at which a rule can be matched. This match is the
146 equivalent of the iptables limit match.
147
148 If you want to compile it as a module, say M here and read
149 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
150
151config BRIDGE_EBT_MARK
152 tristate "ebt: mark filter support"
153 help
154 This option adds the mark match, which allows matching frames based on
155 the 'nfmark' value in the frame. This can be set by the mark target.
156 This value is the same as the one used in the iptables mark match and
157 target.
158
159 To compile it as a module, choose M here. If unsure, say N.
160
161config BRIDGE_EBT_PKTTYPE
162 tristate "ebt: packet type filter support"
163 help
164 This option adds the packet type match, which allows matching on the
165 type of packet based on its Ethernet "class" (as determined by
166 the generic networking code): broadcast, multicast,
167 for this host alone or for another host.
168
169 To compile it as a module, choose M here. If unsure, say N.
170
171config BRIDGE_EBT_STP
172 tristate "ebt: STP filter support"
173 help
174 This option adds the Spanning Tree Protocol match, which
175 allows STP header field filtering.
176
177 To compile it as a module, choose M here. If unsure, say N.
178
179config BRIDGE_EBT_VLAN
180 tristate "ebt: 802.1Q VLAN filter support"
181 help
182 This option adds the 802.1Q vlan match, which allows the filtering of
183 802.1Q vlan fields.
184
185 To compile it as a module, choose M here. If unsure, say N.
186#
187# targets
188#
189config BRIDGE_EBT_ARPREPLY
190 tristate "ebt: arp reply target support"
191 depends on BRIDGE_NF_EBTABLES && INET
192 help
193 This option adds the arp reply target, which allows
194 automatically sending arp replies to arp requests.
195
196 To compile it as a module, choose M here. If unsure, say N.
197
198config BRIDGE_EBT_DNAT
199 tristate "ebt: dnat target support"
200 help
201 This option adds the MAC DNAT target, which allows altering the MAC
202 destination address of frames.
203
204 To compile it as a module, choose M here. If unsure, say N.
205
206config BRIDGE_EBT_MARK_T
207 tristate "ebt: mark target support"
208 help
209 This option adds the mark target, which allows marking frames by
210 setting the 'nfmark' value in the frame.
211 This value is the same as the one used in the iptables mark match and
212 target.
213
214 To compile it as a module, choose M here. If unsure, say N.
215
216config BRIDGE_EBT_REDIRECT
217 tristate "ebt: redirect target support"
218 help
219 This option adds the MAC redirect target, which allows altering the MAC
220 destination address of a frame to that of the device it arrived on.
221
222 To compile it as a module, choose M here. If unsure, say N.
223
224config BRIDGE_EBT_SNAT
225 tristate "ebt: snat target support"
226 help
227 This option adds the MAC SNAT target, which allows altering the MAC
228 source address of frames.
229
230 To compile it as a module, choose M here. If unsure, say N.
231#
232# watchers
233#
234config BRIDGE_EBT_LOG
235 tristate "ebt: log support"
236 help
237 This option adds the log watcher, that you can use in any rule
238 in any ebtables table. It records info about the frame header
239 to the syslog.
240
241 To compile it as a module, choose M here. If unsure, say N.
242
243config BRIDGE_EBT_NFLOG
244 tristate "ebt: nflog support"
245 help
246 This option enables the nflog watcher, which allows to LOG
247 messages through the netfilter logging API, which can use
248 either the old LOG target, the old ULOG target or nfnetlink_log
249 as backend.
250
251 This option adds the nflog watcher, that you can use in any rule
252 in any ebtables table.
253
254 To compile it as a module, choose M here. If unsure, say N.
255
256endif # BRIDGE_NF_EBTABLES