tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1#
2# Bridge netfilter configuration
3#
4#
5menuconfig NF_TABLES_BRIDGE
6 depends on BRIDGE && NETFILTER && NF_TABLES
7 select NETFILTER_FAMILY_BRIDGE
8 bool "Ethernet Bridge nf_tables support"
9
10if NF_TABLES_BRIDGE
11config NFT_BRIDGE_REJECT
12 tristate "Netfilter nf_tables bridge reject support"
13 depends on NFT_REJECT && NFT_REJECT_IPV4 && NFT_REJECT_IPV6
14 help
15 Add support to reject packets.
16
17config NF_LOG_BRIDGE
18 tristate "Bridge packet logging"
19 select NF_LOG_COMMON
20
21endif # NF_TABLES_BRIDGE
22
23menuconfig BRIDGE_NF_EBTABLES
24 tristate "Ethernet Bridge tables (ebtables) support"
25 depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
26 select NETFILTER_FAMILY_BRIDGE
27 help
28 ebtables is a general, extensible frame/packet identification
29 framework. Say 'Y' or 'M' here if you want to do Ethernet
30 filtering/NAT/brouting on the Ethernet bridge.
31
32if BRIDGE_NF_EBTABLES
33
34#
35# tables
36#
37config BRIDGE_EBT_BROUTE
38 tristate "ebt: broute table support"
39 help
40 The ebtables broute table is used to define rules that decide between
41 bridging and routing frames, giving Linux the functionality of a
42 brouter. See the man page for ebtables(8) and examples on the ebtables
43 website.
44
45 To compile it as a module, choose M here. If unsure, say N.
46
47config BRIDGE_EBT_T_FILTER
48 tristate "ebt: filter table support"
49 help
50 The ebtables filter table is used to define frame filtering rules at
51 local input, forwarding and local output. See the man page for
52 ebtables(8).
53
54 To compile it as a module, choose M here. If unsure, say N.
55
56config BRIDGE_EBT_T_NAT
57 tristate "ebt: nat table support"
58 help
59 The ebtables nat table is used to define rules that alter the MAC
60 source address (MAC SNAT) or the MAC destination address (MAC DNAT).
61 See the man page for ebtables(8).
62
63 To compile it as a module, choose M here. If unsure, say N.
64#
65# matches
66#
67config BRIDGE_EBT_802_3
68 tristate "ebt: 802.3 filter support"
69 help
70 This option adds matching support for 802.3 Ethernet frames.
71
72 To compile it as a module, choose M here. If unsure, say N.
73
74config BRIDGE_EBT_AMONG
75 tristate "ebt: among filter support"
76 help
77 This option adds the among match, which allows matching the MAC source
78 and/or destination address on a list of addresses. Optionally,
79 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
80
81 To compile it as a module, choose M here. If unsure, say N.
82
83config BRIDGE_EBT_ARP
84 tristate "ebt: ARP filter support"
85 help
86 This option adds the ARP match, which allows ARP and RARP header field
87 filtering.
88
89 To compile it as a module, choose M here. If unsure, say N.
90
91config BRIDGE_EBT_IP
92 tristate "ebt: IP filter support"
93 help
94 This option adds the IP match, which allows basic IP header field
95 filtering.
96
97 To compile it as a module, choose M here. If unsure, say N.
98
99config BRIDGE_EBT_IP6
100 tristate "ebt: IP6 filter support"
101 depends on BRIDGE_NF_EBTABLES && IPV6
102 help
103 This option adds the IP6 match, which allows basic IPV6 header field
104 filtering.
105
106 To compile it as a module, choose M here. If unsure, say N.
107
108config BRIDGE_EBT_LIMIT
109 tristate "ebt: limit match support"
110 help
111 This option adds the limit match, which allows you to control
112 the rate at which a rule can be matched. This match is the
113 equivalent of the iptables limit match.
114
115 If you want to compile it as a module, say M here and read
116 <file:Documentation/kbuild/modules.txt>. If unsure, say `N'.
117
118config BRIDGE_EBT_MARK
119 tristate "ebt: mark filter support"
120 help
121 This option adds the mark match, which allows matching frames based on
122 the 'nfmark' value in the frame. This can be set by the mark target.
123 This value is the same as the one used in the iptables mark match and
124 target.
125
126 To compile it as a module, choose M here. If unsure, say N.
127
128config BRIDGE_EBT_PKTTYPE
129 tristate "ebt: packet type filter support"
130 help
131 This option adds the packet type match, which allows matching on the
132 type of packet based on its Ethernet "class" (as determined by
133 the generic networking code): broadcast, multicast,
134 for this host alone or for another host.
135
136 To compile it as a module, choose M here. If unsure, say N.
137
138config BRIDGE_EBT_STP
139 tristate "ebt: STP filter support"
140 help
141 This option adds the Spanning Tree Protocol match, which
142 allows STP header field filtering.
143
144 To compile it as a module, choose M here. If unsure, say N.
145
146config BRIDGE_EBT_VLAN
147 tristate "ebt: 802.1Q VLAN filter support"
148 help
149 This option adds the 802.1Q vlan match, which allows the filtering of
150 802.1Q vlan fields.
151
152 To compile it as a module, choose M here. If unsure, say N.
153#
154# targets
155#
156config BRIDGE_EBT_ARPREPLY
157 tristate "ebt: arp reply target support"
158 depends on BRIDGE_NF_EBTABLES && INET
159 help
160 This option adds the arp reply target, which allows
161 automatically sending arp replies to arp requests.
162
163 To compile it as a module, choose M here. If unsure, say N.
164
165config BRIDGE_EBT_DNAT
166 tristate "ebt: dnat target support"
167 help
168 This option adds the MAC DNAT target, which allows altering the MAC
169 destination address of frames.
170
171 To compile it as a module, choose M here. If unsure, say N.
172
173config BRIDGE_EBT_MARK_T
174 tristate "ebt: mark target support"
175 help
176 This option adds the mark target, which allows marking frames by
177 setting the 'nfmark' value in the frame.
178 This value is the same as the one used in the iptables mark match and
179 target.
180
181 To compile it as a module, choose M here. If unsure, say N.
182
183config BRIDGE_EBT_REDIRECT
184 tristate "ebt: redirect target support"
185 help
186 This option adds the MAC redirect target, which allows altering the MAC
187 destination address of a frame to that of the device it arrived on.
188
189 To compile it as a module, choose M here. If unsure, say N.
190
191config BRIDGE_EBT_SNAT
192 tristate "ebt: snat target support"
193 help
194 This option adds the MAC SNAT target, which allows altering the MAC
195 source address of frames.
196
197 To compile it as a module, choose M here. If unsure, say N.
198#
199# watchers
200#
201config BRIDGE_EBT_LOG
202 tristate "ebt: log support"
203 help
204 This option adds the log watcher, that you can use in any rule
205 in any ebtables table. It records info about the frame header
206 to the syslog.
207
208 To compile it as a module, choose M here. If unsure, say N.
209
210config BRIDGE_EBT_NFLOG
211 tristate "ebt: nflog support"
212 help
213 This option enables the nflog watcher, which allows to LOG
214 messages through the netfilter logging API, which can use
215 either the old LOG target, the old ULOG target or nfnetlink_log
216 as backend.
217
218 This option adds the nflog watcher, that you can use in any rule
219 in any ebtables table.
220
221 To compile it as a module, choose M here. If unsure, say N.
222
223endif # BRIDGE_NF_EBTABLES