tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1#
2# IP netfilter configuration
3#
4
5menu "IPv6: Netfilter Configuration"
6 depends on INET && IPV6 && NETFILTER
7
8config NF_DEFRAG_IPV6
9 tristate
10 default n
11
12config NF_CONNTRACK_IPV6
13 tristate "IPv6 connection tracking support"
14 depends on INET && IPV6 && NF_CONNTRACK
15 default m if NETFILTER_ADVANCED=n
16 select NF_DEFRAG_IPV6
17 ---help---
18 Connection tracking keeps a record of what packets have passed
19 through your machine, in order to figure out how they are related
20 into connections.
21
22 This is IPv6 support on Layer 3 independent connection tracking.
23 Layer 3 independent connection tracking is experimental scheme
24 which generalize ip_conntrack to support other layer 3 protocols.
25
26 To compile it as a module, choose M here. If unsure, say N.
27
28config IP6_NF_QUEUE
29 tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
30 depends on INET && IPV6 && NETFILTER
31 depends on NETFILTER_ADVANCED
32 ---help---
33
34 This option adds a queue handler to the kernel for IPv6
35 packets which enables users to receive the filtered packets
36 with QUEUE target using libipq.
37
38 This option enables the old IPv6-only "ip6_queue" implementation
39 which has been obsoleted by the new "nfnetlink_queue" code (see
40 CONFIG_NETFILTER_NETLINK_QUEUE).
41
42 (C) Fernando Anton 2001
43 IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
44 Universidad Carlos III de Madrid
45 Universidad Politecnica de Alcala de Henares
46 email: <fanton@it.uc3m.es>.
47
48 To compile it as a module, choose M here. If unsure, say N.
49
50config IP6_NF_IPTABLES
51 tristate "IP6 tables support (required for filtering)"
52 depends on INET && IPV6
53 select NETFILTER_XTABLES
54 default m if NETFILTER_ADVANCED=n
55 help
56 ip6tables is a general, extensible packet identification framework.
57 Currently only the packet filtering and packet mangling subsystem
58 for IPv6 use this, but connection tracking is going to follow.
59 Say 'Y' or 'M' here if you want to use either of those.
60
61 To compile it as a module, choose M here. If unsure, say N.
62
63if IP6_NF_IPTABLES
64
65# The simple matches.
66config IP6_NF_MATCH_AH
67 tristate '"ah" match support'
68 depends on NETFILTER_ADVANCED
69 help
70 This module allows one to match AH packets.
71
72 To compile it as a module, choose M here. If unsure, say N.
73
74config IP6_NF_MATCH_EUI64
75 tristate '"eui64" address check'
76 depends on NETFILTER_ADVANCED
77 help
78 This module performs checking on the IPv6 source address
79 Compares the last 64 bits with the EUI64 (delivered
80 from the MAC address) address
81
82 To compile it as a module, choose M here. If unsure, say N.
83
84config IP6_NF_MATCH_FRAG
85 tristate '"frag" Fragmentation header match support'
86 depends on NETFILTER_ADVANCED
87 help
88 frag matching allows you to match packets based on the fragmentation
89 header of the packet.
90
91 To compile it as a module, choose M here. If unsure, say N.
92
93config IP6_NF_MATCH_OPTS
94 tristate '"hbh" hop-by-hop and "dst" opts header match support'
95 depends on NETFILTER_ADVANCED
96 help
97 This allows one to match packets based on the hop-by-hop
98 and destination options headers of a packet.
99
100 To compile it as a module, choose M here. If unsure, say N.
101
102config IP6_NF_MATCH_HL
103 tristate '"hl" hoplimit match support'
104 depends on NETFILTER_ADVANCED
105 select NETFILTER_XT_MATCH_HL
106 ---help---
107 This is a backwards-compat option for the user's convenience
108 (e.g. when running oldconfig). It selects
109 CONFIG_NETFILTER_XT_MATCH_HL.
110
111config IP6_NF_MATCH_IPV6HEADER
112 tristate '"ipv6header" IPv6 Extension Headers Match'
113 default m if NETFILTER_ADVANCED=n
114 help
115 This module allows one to match packets based upon
116 the ipv6 extension headers.
117
118 To compile it as a module, choose M here. If unsure, say N.
119
120config IP6_NF_MATCH_MH
121 tristate '"mh" match support'
122 depends on NETFILTER_ADVANCED
123 help
124 This module allows one to match MH packets.
125
126 To compile it as a module, choose M here. If unsure, say N.
127
128config IP6_NF_MATCH_RPFILTER
129 tristate '"rpfilter" reverse path filter match support'
130 depends on NETFILTER_ADVANCED
131 ---help---
132 This option allows you to match packets whose replies would
133 go out via the interface the packet came in.
134
135 To compile it as a module, choose M here. If unsure, say N.
136 The module will be called ip6t_rpfilter.
137
138config IP6_NF_MATCH_RT
139 tristate '"rt" Routing header match support'
140 depends on NETFILTER_ADVANCED
141 help
142 rt matching allows you to match packets based on the routing
143 header of the packet.
144
145 To compile it as a module, choose M here. If unsure, say N.
146
147# The targets
148config IP6_NF_TARGET_HL
149 tristate '"HL" hoplimit target support'
150 depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
151 select NETFILTER_XT_TARGET_HL
152 ---help---
153 This is a backwards-compatible option for the user's convenience
154 (e.g. when running oldconfig). It selects
155 CONFIG_NETFILTER_XT_TARGET_HL.
156
157config IP6_NF_TARGET_LOG
158 tristate "LOG target support"
159 default m if NETFILTER_ADVANCED=n
160 help
161 This option adds a `LOG' target, which allows you to create rules in
162 any iptables table which records the packet header to the syslog.
163
164 To compile it as a module, choose M here. If unsure, say N.
165
166config IP6_NF_FILTER
167 tristate "Packet filtering"
168 default m if NETFILTER_ADVANCED=n
169 help
170 Packet filtering defines a table `filter', which has a series of
171 rules for simple packet filtering at local input, forwarding and
172 local output. See the man page for iptables(8).
173
174 To compile it as a module, choose M here. If unsure, say N.
175
176config IP6_NF_TARGET_REJECT
177 tristate "REJECT target support"
178 depends on IP6_NF_FILTER
179 default m if NETFILTER_ADVANCED=n
180 help
181 The REJECT target allows a filtering rule to specify that an ICMPv6
182 error should be issued in response to an incoming packet, rather
183 than silently being dropped.
184
185 To compile it as a module, choose M here. If unsure, say N.
186
187config IP6_NF_MANGLE
188 tristate "Packet mangling"
189 default m if NETFILTER_ADVANCED=n
190 help
191 This option adds a `mangle' table to iptables: see the man page for
192 iptables(8). This table is used for various packet alterations
193 which can effect how the packet is routed.
194
195 To compile it as a module, choose M here. If unsure, say N.
196
197config IP6_NF_RAW
198 tristate 'raw table support (required for TRACE)'
199 help
200 This option adds a `raw' table to ip6tables. This table is the very
201 first in the netfilter framework and hooks in at the PREROUTING
202 and OUTPUT chains.
203
204 If you want to compile it as a module, say M here and read
205 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
206
207# security table for MAC policy
208config IP6_NF_SECURITY
209 tristate "Security table"
210 depends on SECURITY
211 depends on NETFILTER_ADVANCED
212 help
213 This option adds a `security' table to iptables, for use
214 with Mandatory Access Control (MAC) policy.
215
216 If unsure, say N.
217
218endif # IP6_NF_IPTABLES
219
220endmenu
221