Loading...
1# SPDX-License-Identifier: GPL-2.0-only
2#
3# Bridge netfilter configuration
4#
5#
6menuconfig NF_TABLES_BRIDGE
7 depends on BRIDGE && NETFILTER && NF_TABLES
8 select NETFILTER_FAMILY_BRIDGE
9 tristate "Ethernet Bridge nf_tables support"
10
11if NF_TABLES_BRIDGE
12
13config NFT_BRIDGE_META
14 tristate "Netfilter nf_table bridge meta support"
15 help
16 Add support for bridge dedicated meta key.
17
18config NFT_BRIDGE_REJECT
19 tristate "Netfilter nf_tables bridge reject support"
20 depends on NFT_REJECT && NFT_REJECT_IPV4 && NFT_REJECT_IPV6
21 help
22 Add support to reject packets.
23
24config NF_LOG_BRIDGE
25 tristate "Bridge packet logging"
26 select NF_LOG_COMMON
27
28endif # NF_TABLES_BRIDGE
29
30config NF_CONNTRACK_BRIDGE
31 tristate "IPv4/IPV6 bridge connection tracking support"
32 depends on NF_CONNTRACK
33 default n
34 help
35 Connection tracking keeps a record of what packets have passed
36 through your machine, in order to figure out how they are related
37 into connections. This is used to enhance packet filtering via
38 stateful policies. Enable this if you want native tracking from
39 the bridge. This provides a replacement for the `br_netfilter'
40 infrastructure.
41
42 To compile it as a module, choose M here. If unsure, say N.
43
44menuconfig BRIDGE_NF_EBTABLES
45 tristate "Ethernet Bridge tables (ebtables) support"
46 depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
47 select NETFILTER_FAMILY_BRIDGE
48 help
49 ebtables is a general, extensible frame/packet identification
50 framework. Say 'Y' or 'M' here if you want to do Ethernet
51 filtering/NAT/brouting on the Ethernet bridge.
52
53if BRIDGE_NF_EBTABLES
54
55#
56# tables
57#
58config BRIDGE_EBT_BROUTE
59 tristate "ebt: broute table support"
60 help
61 The ebtables broute table is used to define rules that decide between
62 bridging and routing frames, giving Linux the functionality of a
63 brouter. See the man page for ebtables(8) and examples on the ebtables
64 website.
65
66 To compile it as a module, choose M here. If unsure, say N.
67
68config BRIDGE_EBT_T_FILTER
69 tristate "ebt: filter table support"
70 help
71 The ebtables filter table is used to define frame filtering rules at
72 local input, forwarding and local output. See the man page for
73 ebtables(8).
74
75 To compile it as a module, choose M here. If unsure, say N.
76
77config BRIDGE_EBT_T_NAT
78 tristate "ebt: nat table support"
79 help
80 The ebtables nat table is used to define rules that alter the MAC
81 source address (MAC SNAT) or the MAC destination address (MAC DNAT).
82 See the man page for ebtables(8).
83
84 To compile it as a module, choose M here. If unsure, say N.
85#
86# matches
87#
88config BRIDGE_EBT_802_3
89 tristate "ebt: 802.3 filter support"
90 help
91 This option adds matching support for 802.3 Ethernet frames.
92
93 To compile it as a module, choose M here. If unsure, say N.
94
95config BRIDGE_EBT_AMONG
96 tristate "ebt: among filter support"
97 help
98 This option adds the among match, which allows matching the MAC source
99 and/or destination address on a list of addresses. Optionally,
100 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
101
102 To compile it as a module, choose M here. If unsure, say N.
103
104config BRIDGE_EBT_ARP
105 tristate "ebt: ARP filter support"
106 help
107 This option adds the ARP match, which allows ARP and RARP header field
108 filtering.
109
110 To compile it as a module, choose M here. If unsure, say N.
111
112config BRIDGE_EBT_IP
113 tristate "ebt: IP filter support"
114 help
115 This option adds the IP match, which allows basic IP header field
116 filtering.
117
118 To compile it as a module, choose M here. If unsure, say N.
119
120config BRIDGE_EBT_IP6
121 tristate "ebt: IP6 filter support"
122 depends on BRIDGE_NF_EBTABLES && IPV6
123 help
124 This option adds the IP6 match, which allows basic IPV6 header field
125 filtering.
126
127 To compile it as a module, choose M here. If unsure, say N.
128
129config BRIDGE_EBT_LIMIT
130 tristate "ebt: limit match support"
131 help
132 This option adds the limit match, which allows you to control
133 the rate at which a rule can be matched. This match is the
134 equivalent of the iptables limit match.
135
136 If you want to compile it as a module, say M here and read
137 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
138
139config BRIDGE_EBT_MARK
140 tristate "ebt: mark filter support"
141 help
142 This option adds the mark match, which allows matching frames based on
143 the 'nfmark' value in the frame. This can be set by the mark target.
144 This value is the same as the one used in the iptables mark match and
145 target.
146
147 To compile it as a module, choose M here. If unsure, say N.
148
149config BRIDGE_EBT_PKTTYPE
150 tristate "ebt: packet type filter support"
151 help
152 This option adds the packet type match, which allows matching on the
153 type of packet based on its Ethernet "class" (as determined by
154 the generic networking code): broadcast, multicast,
155 for this host alone or for another host.
156
157 To compile it as a module, choose M here. If unsure, say N.
158
159config BRIDGE_EBT_STP
160 tristate "ebt: STP filter support"
161 help
162 This option adds the Spanning Tree Protocol match, which
163 allows STP header field filtering.
164
165 To compile it as a module, choose M here. If unsure, say N.
166
167config BRIDGE_EBT_VLAN
168 tristate "ebt: 802.1Q VLAN filter support"
169 help
170 This option adds the 802.1Q vlan match, which allows the filtering of
171 802.1Q vlan fields.
172
173 To compile it as a module, choose M here. If unsure, say N.
174#
175# targets
176#
177config BRIDGE_EBT_ARPREPLY
178 tristate "ebt: arp reply target support"
179 depends on BRIDGE_NF_EBTABLES && INET
180 help
181 This option adds the arp reply target, which allows
182 automatically sending arp replies to arp requests.
183
184 To compile it as a module, choose M here. If unsure, say N.
185
186config BRIDGE_EBT_DNAT
187 tristate "ebt: dnat target support"
188 help
189 This option adds the MAC DNAT target, which allows altering the MAC
190 destination address of frames.
191
192 To compile it as a module, choose M here. If unsure, say N.
193
194config BRIDGE_EBT_MARK_T
195 tristate "ebt: mark target support"
196 help
197 This option adds the mark target, which allows marking frames by
198 setting the 'nfmark' value in the frame.
199 This value is the same as the one used in the iptables mark match and
200 target.
201
202 To compile it as a module, choose M here. If unsure, say N.
203
204config BRIDGE_EBT_REDIRECT
205 tristate "ebt: redirect target support"
206 help
207 This option adds the MAC redirect target, which allows altering the MAC
208 destination address of a frame to that of the device it arrived on.
209
210 To compile it as a module, choose M here. If unsure, say N.
211
212config BRIDGE_EBT_SNAT
213 tristate "ebt: snat target support"
214 help
215 This option adds the MAC SNAT target, which allows altering the MAC
216 source address of frames.
217
218 To compile it as a module, choose M here. If unsure, say N.
219#
220# watchers
221#
222config BRIDGE_EBT_LOG
223 tristate "ebt: log support"
224 help
225 This option adds the log watcher, that you can use in any rule
226 in any ebtables table. It records info about the frame header
227 to the syslog.
228
229 To compile it as a module, choose M here. If unsure, say N.
230
231config BRIDGE_EBT_NFLOG
232 tristate "ebt: nflog support"
233 help
234 This option enables the nflog watcher, which allows to LOG
235 messages through the netfilter logging API, which can use
236 either the old LOG target, the old ULOG target or nfnetlink_log
237 as backend.
238
239 This option adds the nflog watcher, that you can use in any rule
240 in any ebtables table.
241
242 To compile it as a module, choose M here. If unsure, say N.
243
244endif # BRIDGE_NF_EBTABLES
1# SPDX-License-Identifier: GPL-2.0-only
2#
3# Bridge netfilter configuration
4#
5#
6menuconfig NF_TABLES_BRIDGE
7 depends on BRIDGE && NETFILTER && NF_TABLES
8 select NETFILTER_FAMILY_BRIDGE
9 tristate "Ethernet Bridge nf_tables support"
10
11if NF_TABLES_BRIDGE
12
13config NFT_BRIDGE_META
14 tristate "Netfilter nf_table bridge meta support"
15 help
16 Add support for bridge dedicated meta key.
17
18config NFT_BRIDGE_REJECT
19 tristate "Netfilter nf_tables bridge reject support"
20 depends on NFT_REJECT
21 depends on NF_REJECT_IPV4
22 depends on NF_REJECT_IPV6
23 help
24 Add support to reject packets.
25
26endif # NF_TABLES_BRIDGE
27
28config NF_CONNTRACK_BRIDGE
29 tristate "IPv4/IPV6 bridge connection tracking support"
30 depends on NF_CONNTRACK
31 default n
32 help
33 Connection tracking keeps a record of what packets have passed
34 through your machine, in order to figure out how they are related
35 into connections. This is used to enhance packet filtering via
36 stateful policies. Enable this if you want native tracking from
37 the bridge. This provides a replacement for the `br_netfilter'
38 infrastructure.
39
40 To compile it as a module, choose M here. If unsure, say N.
41
42# old sockopt interface and eval loop
43config BRIDGE_NF_EBTABLES_LEGACY
44 tristate
45
46menuconfig BRIDGE_NF_EBTABLES
47 tristate "Ethernet Bridge tables (ebtables) support"
48 depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
49 select NETFILTER_FAMILY_BRIDGE
50 help
51 ebtables is a general, extensible frame/packet identification
52 framework. Say 'Y' or 'M' here if you want to do Ethernet
53 filtering/NAT/brouting on the Ethernet bridge.
54
55if BRIDGE_NF_EBTABLES
56
57#
58# tables
59#
60config BRIDGE_EBT_BROUTE
61 tristate "ebt: broute table support"
62 select BRIDGE_NF_EBTABLES_LEGACY
63 help
64 The ebtables broute table is used to define rules that decide between
65 bridging and routing frames, giving Linux the functionality of a
66 brouter. See the man page for ebtables(8) and examples on the ebtables
67 website.
68
69 To compile it as a module, choose M here. If unsure, say N.
70
71config BRIDGE_EBT_T_FILTER
72 tristate "ebt: filter table support"
73 select BRIDGE_NF_EBTABLES_LEGACY
74 help
75 The ebtables filter table is used to define frame filtering rules at
76 local input, forwarding and local output. See the man page for
77 ebtables(8).
78
79 To compile it as a module, choose M here. If unsure, say N.
80
81config BRIDGE_EBT_T_NAT
82 tristate "ebt: nat table support"
83 select BRIDGE_NF_EBTABLES_LEGACY
84 help
85 The ebtables nat table is used to define rules that alter the MAC
86 source address (MAC SNAT) or the MAC destination address (MAC DNAT).
87 See the man page for ebtables(8).
88
89 To compile it as a module, choose M here. If unsure, say N.
90#
91# matches
92#
93config BRIDGE_EBT_802_3
94 tristate "ebt: 802.3 filter support"
95 help
96 This option adds matching support for 802.3 Ethernet frames.
97
98 To compile it as a module, choose M here. If unsure, say N.
99
100config BRIDGE_EBT_AMONG
101 tristate "ebt: among filter support"
102 help
103 This option adds the among match, which allows matching the MAC source
104 and/or destination address on a list of addresses. Optionally,
105 MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
106
107 To compile it as a module, choose M here. If unsure, say N.
108
109config BRIDGE_EBT_ARP
110 tristate "ebt: ARP filter support"
111 help
112 This option adds the ARP match, which allows ARP and RARP header field
113 filtering.
114
115 To compile it as a module, choose M here. If unsure, say N.
116
117config BRIDGE_EBT_IP
118 tristate "ebt: IP filter support"
119 help
120 This option adds the IP match, which allows basic IP header field
121 filtering.
122
123 To compile it as a module, choose M here. If unsure, say N.
124
125config BRIDGE_EBT_IP6
126 tristate "ebt: IP6 filter support"
127 depends on BRIDGE_NF_EBTABLES && IPV6
128 help
129 This option adds the IP6 match, which allows basic IPV6 header field
130 filtering.
131
132 To compile it as a module, choose M here. If unsure, say N.
133
134config BRIDGE_EBT_LIMIT
135 tristate "ebt: limit match support"
136 help
137 This option adds the limit match, which allows you to control
138 the rate at which a rule can be matched. This match is the
139 equivalent of the iptables limit match.
140
141 If you want to compile it as a module, say M here and read
142 <file:Documentation/kbuild/modules.rst>. If unsure, say `N'.
143
144config BRIDGE_EBT_MARK
145 tristate "ebt: mark filter support"
146 help
147 This option adds the mark match, which allows matching frames based on
148 the 'nfmark' value in the frame. This can be set by the mark target.
149 This value is the same as the one used in the iptables mark match and
150 target.
151
152 To compile it as a module, choose M here. If unsure, say N.
153
154config BRIDGE_EBT_PKTTYPE
155 tristate "ebt: packet type filter support"
156 help
157 This option adds the packet type match, which allows matching on the
158 type of packet based on its Ethernet "class" (as determined by
159 the generic networking code): broadcast, multicast,
160 for this host alone or for another host.
161
162 To compile it as a module, choose M here. If unsure, say N.
163
164config BRIDGE_EBT_STP
165 tristate "ebt: STP filter support"
166 help
167 This option adds the Spanning Tree Protocol match, which
168 allows STP header field filtering.
169
170 To compile it as a module, choose M here. If unsure, say N.
171
172config BRIDGE_EBT_VLAN
173 tristate "ebt: 802.1Q VLAN filter support"
174 help
175 This option adds the 802.1Q vlan match, which allows the filtering of
176 802.1Q vlan fields.
177
178 To compile it as a module, choose M here. If unsure, say N.
179#
180# targets
181#
182config BRIDGE_EBT_ARPREPLY
183 tristate "ebt: arp reply target support"
184 depends on BRIDGE_NF_EBTABLES && INET
185 help
186 This option adds the arp reply target, which allows
187 automatically sending arp replies to arp requests.
188
189 To compile it as a module, choose M here. If unsure, say N.
190
191config BRIDGE_EBT_DNAT
192 tristate "ebt: dnat target support"
193 help
194 This option adds the MAC DNAT target, which allows altering the MAC
195 destination address of frames.
196
197 To compile it as a module, choose M here. If unsure, say N.
198
199config BRIDGE_EBT_MARK_T
200 tristate "ebt: mark target support"
201 help
202 This option adds the mark target, which allows marking frames by
203 setting the 'nfmark' value in the frame.
204 This value is the same as the one used in the iptables mark match and
205 target.
206
207 To compile it as a module, choose M here. If unsure, say N.
208
209config BRIDGE_EBT_REDIRECT
210 tristate "ebt: redirect target support"
211 help
212 This option adds the MAC redirect target, which allows altering the MAC
213 destination address of a frame to that of the device it arrived on.
214
215 To compile it as a module, choose M here. If unsure, say N.
216
217config BRIDGE_EBT_SNAT
218 tristate "ebt: snat target support"
219 help
220 This option adds the MAC SNAT target, which allows altering the MAC
221 source address of frames.
222
223 To compile it as a module, choose M here. If unsure, say N.
224#
225# watchers
226#
227config BRIDGE_EBT_LOG
228 tristate "ebt: log support"
229 help
230 This option adds the log watcher, that you can use in any rule
231 in any ebtables table. It records info about the frame header
232 to the syslog.
233
234 To compile it as a module, choose M here. If unsure, say N.
235
236config BRIDGE_EBT_NFLOG
237 tristate "ebt: nflog support"
238 help
239 This option enables the nflog watcher, which allows to LOG
240 messages through the netfilter logging API, which can use
241 either the old LOG target, the old ULOG target or nfnetlink_log
242 as backend.
243
244 This option adds the nflog watcher, that you can use in any rule
245 in any ebtables table.
246
247 To compile it as a module, choose M here. If unsure, say N.
248
249endif # BRIDGE_NF_EBTABLES