1#
2# Bridge netfilter configuration
3#
4#
5menuconfig NF_TABLES_BRIDGE
6	depends on BRIDGE && NETFILTER && NF_TABLES
7	select NETFILTER_FAMILY_BRIDGE
8	bool "Ethernet Bridge nf_tables support"
9
10if NF_TABLES_BRIDGE
11config NFT_BRIDGE_REJECT
12	tristate "Netfilter nf_tables bridge reject support"
13	depends on NFT_REJECT && NFT_REJECT_IPV4 && NFT_REJECT_IPV6
14	help
15	  Add support to reject packets.
16
17config NF_LOG_BRIDGE
18	tristate "Bridge packet logging"
19	select NF_LOG_COMMON
20
21endif # NF_TABLES_BRIDGE
22
23menuconfig BRIDGE_NF_EBTABLES
24	tristate "Ethernet Bridge tables (ebtables) support"
25	depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
26	select NETFILTER_FAMILY_BRIDGE
27	help
28	  ebtables is a general, extensible frame/packet identification
29	  framework. Say 'Y' or 'M' here if you want to do Ethernet
30	  filtering/NAT/brouting on the Ethernet bridge.
31
32if BRIDGE_NF_EBTABLES
33
34#
35# tables
36#
37config BRIDGE_EBT_BROUTE
38	tristate "ebt: broute table support"
39	help
40	  The ebtables broute table is used to define rules that decide between
41	  bridging and routing frames, giving Linux the functionality of a
42	  brouter. See the man page for ebtables(8) and examples on the ebtables
43	  website.
44
45	  To compile it as a module, choose M here.  If unsure, say N.
46
47config BRIDGE_EBT_T_FILTER
48	tristate "ebt: filter table support"
49	help
50	  The ebtables filter table is used to define frame filtering rules at
51	  local input, forwarding and local output. See the man page for
52	  ebtables(8).
53
54	  To compile it as a module, choose M here.  If unsure, say N.
55
56config BRIDGE_EBT_T_NAT
57	tristate "ebt: nat table support"
58	help
59	  The ebtables nat table is used to define rules that alter the MAC
60	  source address (MAC SNAT) or the MAC destination address (MAC DNAT).
61	  See the man page for ebtables(8).
62
63	  To compile it as a module, choose M here.  If unsure, say N.
64#
65# matches
66#
67config BRIDGE_EBT_802_3
68	tristate "ebt: 802.3 filter support"
69	help
70	  This option adds matching support for 802.3 Ethernet frames.
71
72	  To compile it as a module, choose M here.  If unsure, say N.
73
74config BRIDGE_EBT_AMONG
75	tristate "ebt: among filter support"
76	help
77	  This option adds the among match, which allows matching the MAC source
78	  and/or destination address on a list of addresses. Optionally,
79	  MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
80
81	  To compile it as a module, choose M here.  If unsure, say N.
82
83config BRIDGE_EBT_ARP
84	tristate "ebt: ARP filter support"
85	help
86	  This option adds the ARP match, which allows ARP and RARP header field
87	  filtering.
88
89	  To compile it as a module, choose M here.  If unsure, say N.
90
91config BRIDGE_EBT_IP
92	tristate "ebt: IP filter support"
93	help
94	  This option adds the IP match, which allows basic IP header field
95	  filtering.
96
97	  To compile it as a module, choose M here.  If unsure, say N.
98
99config BRIDGE_EBT_IP6
100	tristate "ebt: IP6 filter support"
101	depends on BRIDGE_NF_EBTABLES && IPV6
102	help
103	  This option adds the IP6 match, which allows basic IPV6 header field
104	  filtering.
105
106	  To compile it as a module, choose M here.  If unsure, say N.
107
108config BRIDGE_EBT_LIMIT
109	tristate "ebt: limit match support"
110	help
111	  This option adds the limit match, which allows you to control
112	  the rate at which a rule can be matched. This match is the
113	  equivalent of the iptables limit match.
114
115	  If you want to compile it as a module, say M here and read
116	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
117
118config BRIDGE_EBT_MARK
119	tristate "ebt: mark filter support"
120	help
121	  This option adds the mark match, which allows matching frames based on
122	  the 'nfmark' value in the frame. This can be set by the mark target.
123	  This value is the same as the one used in the iptables mark match and
124	  target.
125
126	  To compile it as a module, choose M here.  If unsure, say N.
127
128config BRIDGE_EBT_PKTTYPE
129	tristate "ebt: packet type filter support"
130	help
131	  This option adds the packet type match, which allows matching on the
132	  type of packet based on its Ethernet "class" (as determined by
133	  the generic networking code): broadcast, multicast,
134	  for this host alone or for another host.
135
136	  To compile it as a module, choose M here.  If unsure, say N.
137
138config BRIDGE_EBT_STP
139	tristate "ebt: STP filter support"
140	help
141	  This option adds the Spanning Tree Protocol match, which
142	  allows STP header field filtering.
143
144	  To compile it as a module, choose M here.  If unsure, say N.
145
146config BRIDGE_EBT_VLAN
147	tristate "ebt: 802.1Q VLAN filter support"
148	help
149	  This option adds the 802.1Q vlan match, which allows the filtering of
150	  802.1Q vlan fields.
151
152	  To compile it as a module, choose M here.  If unsure, say N.
153#
154# targets
155#
156config BRIDGE_EBT_ARPREPLY
157	tristate "ebt: arp reply target support"
158	depends on BRIDGE_NF_EBTABLES && INET
159	help
160	  This option adds the arp reply target, which allows
161	  automatically sending arp replies to arp requests.
162
163	  To compile it as a module, choose M here.  If unsure, say N.
164
165config BRIDGE_EBT_DNAT
166	tristate "ebt: dnat target support"
167	help
168	  This option adds the MAC DNAT target, which allows altering the MAC
169	  destination address of frames.
170
171	  To compile it as a module, choose M here.  If unsure, say N.
172
173config BRIDGE_EBT_MARK_T
174	tristate "ebt: mark target support"
175	help
176	  This option adds the mark target, which allows marking frames by
177	  setting the 'nfmark' value in the frame.
178	  This value is the same as the one used in the iptables mark match and
179	  target.
180
181	  To compile it as a module, choose M here.  If unsure, say N.
182
183config BRIDGE_EBT_REDIRECT
184	tristate "ebt: redirect target support"
185	help
186	  This option adds the MAC redirect target, which allows altering the MAC
187	  destination address of a frame to that of the device it arrived on.
188
189	  To compile it as a module, choose M here.  If unsure, say N.
190
191config BRIDGE_EBT_SNAT
192	tristate "ebt: snat target support"
193	help
194	  This option adds the MAC SNAT target, which allows altering the MAC
195	  source address of frames.
196
197	  To compile it as a module, choose M here.  If unsure, say N.
198#
199# watchers
200#
201config BRIDGE_EBT_LOG
202	tristate "ebt: log support"
203	help
204	  This option adds the log watcher, that you can use in any rule
205	  in any ebtables table. It records info about the frame header
206	  to the syslog.
207
208	  To compile it as a module, choose M here.  If unsure, say N.
209
210config BRIDGE_EBT_NFLOG
211	tristate "ebt: nflog support"
212	help
213	  This option enables the nflog watcher, which allows to LOG
214	  messages through the netfilter logging API, which can use
215	  either the old LOG target, the old ULOG target or nfnetlink_log
216	  as backend.
217
218	  This option adds the nflog watcher, that you can use in any rule
219	  in any ebtables table.
220
221	  To compile it as a module, choose M here.  If unsure, say N.
222
223endif # BRIDGE_NF_EBTABLES
224