net/ipv6/netfilter/Kconfig

   1 #
   2 # IP netfilter configuration
   3 #
   4
   5 menu "IPv6: Netfilter Configuration"
   6         depends on INET && IPV6 && NETFILTER
   7
   8 config NF_DEFRAG_IPV6
   9         tristate
  10         default n
  11
  12 config NF_CONNTRACK_IPV6
  13         tristate "IPv6 connection tracking support"
  14         depends on INET && IPV6 && NF_CONNTRACK
  15         default m if NETFILTER_ADVANCED=n
  16         select NF_DEFRAG_IPV6
  17         ---help---
  18           Connection tracking keeps a record of what packets have passed
  19           through your machine, in order to figure out how they are related
  20           into connections.
  21
  22           This is IPv6 support on Layer 3 independent connection tracking.
  23           Layer 3 independent connection tracking is experimental scheme
  24           which generalize ip_conntrack to support other layer 3 protocols.
  25
  26           To compile it as a module, choose M here.  If unsure, say N.
  27
  28 if NF_TABLES
  29
  30 config NF_TABLES_IPV6
  31         tristate "IPv6 nf_tables support"
  32         help
  33           This option enables the IPv6 support for nf_tables.
  34
  35 if NF_TABLES_IPV6
  36
  37 config NFT_CHAIN_ROUTE_IPV6
  38         tristate "IPv6 nf_tables route chain support"
  39         help
  40           This option enables the "route" chain for IPv6 in nf_tables. This
  41           chain type is used to force packet re-routing after mangling header
  42           fields such as the source, destination, flowlabel, hop-limit and
  43           the packet mark.
  44
  45 config NFT_REJECT_IPV6
  46         select NF_REJECT_IPV6
  47         default NFT_REJECT
  48         tristate
  49
  50 endif # NF_TABLES_IPV6
  51 endif # NF_TABLES
  52
  53 config NF_DUP_IPV6
  54         tristate "Netfilter IPv6 packet duplication to alternate destination"
  55         help
  56           This option enables the nf_dup_ipv6 core, which duplicates an IPv6
  57           packet to be rerouted to another destination.
  58
  59 config NF_REJECT_IPV6
  60         tristate "IPv6 packet rejection"
  61         default m if NETFILTER_ADVANCED=n
  62
  63 config NF_LOG_IPV6
  64         tristate "IPv6 packet logging"
  65         default m if NETFILTER_ADVANCED=n
  66         select NF_LOG_COMMON
  67
  68 config NF_NAT_IPV6
  69         tristate "IPv6 NAT"
  70         depends on NF_CONNTRACK_IPV6
  71         depends on NETFILTER_ADVANCED
  72         select NF_NAT
  73         help
  74           The IPv6 NAT option allows masquerading, port forwarding and other
  75           forms of full Network Address Port Translation. This can be
  76           controlled by iptables or nft.
  77
  78 if NF_NAT_IPV6
  79
  80 config NFT_CHAIN_NAT_IPV6
  81         depends on NF_TABLES_IPV6
  82         tristate "IPv6 nf_tables nat chain support"
  83         help
  84           This option enables the "nat" chain for IPv6 in nf_tables. This
  85           chain type is used to perform Network Address Translation (NAT)
  86           packet transformations such as the source, destination address and
  87           source and destination ports.
  88
  89 config NF_NAT_MASQUERADE_IPV6
  90         tristate "IPv6 masquerade support"
  91         help
  92           This is the kernel functionality to provide NAT in the masquerade
  93           flavour (automatic source address selection) for IPv6.
  94
  95 config NFT_MASQ_IPV6
  96         tristate "IPv6 masquerade support for nf_tables"
  97         depends on NF_TABLES_IPV6
  98         depends on NFT_MASQ
  99         select NF_NAT_MASQUERADE_IPV6
 100         help
 101           This is the expression that provides IPv4 masquerading support for
 102           nf_tables.
 103
 104 config NFT_REDIR_IPV6
 105         tristate "IPv6 redirect support for nf_tables"
 106         depends on NF_TABLES_IPV6
 107         depends on NFT_REDIR
 108         select NF_NAT_REDIRECT
 109         help
 110           This is the expression that provides IPv4 redirect support for
 111           nf_tables.
 112
 113 endif # NF_NAT_IPV6
 114
 115 config IP6_NF_IPTABLES
 116         tristate "IP6 tables support (required for filtering)"
 117         depends on INET && IPV6
 118         select NETFILTER_XTABLES
 119         default m if NETFILTER_ADVANCED=n
 120         help
 121           ip6tables is a general, extensible packet identification framework.
 122           Currently only the packet filtering and packet mangling subsystem
 123           for IPv6 use this, but connection tracking is going to follow.
 124           Say 'Y' or 'M' here if you want to use either of those.
 125
 126           To compile it as a module, choose M here.  If unsure, say N.
 127
 128 if IP6_NF_IPTABLES
 129
 130 # The simple matches.
 131 config IP6_NF_MATCH_AH
 132         tristate '"ah" match support'
 133         depends on NETFILTER_ADVANCED
 134         help
 135           This module allows one to match AH packets.
 136
 137           To compile it as a module, choose M here.  If unsure, say N.
 138
 139 config IP6_NF_MATCH_EUI64
 140         tristate '"eui64" address check'
 141         depends on NETFILTER_ADVANCED
 142         help
 143           This module performs checking on the IPv6 source address
 144           Compares the last 64 bits with the EUI64 (delivered
 145           from the MAC address) address
 146
 147           To compile it as a module, choose M here.  If unsure, say N.
 148
 149 config IP6_NF_MATCH_FRAG
 150         tristate '"frag" Fragmentation header match support'
 151         depends on NETFILTER_ADVANCED
 152         help
 153           frag matching allows you to match packets based on the fragmentation
 154           header of the packet.
 155
 156           To compile it as a module, choose M here.  If unsure, say N.
 157
 158 config IP6_NF_MATCH_OPTS
 159         tristate '"hbh" hop-by-hop and "dst" opts header match support'
 160         depends on NETFILTER_ADVANCED
 161         help
 162           This allows one to match packets based on the hop-by-hop
 163           and destination options headers of a packet.
 164
 165           To compile it as a module, choose M here.  If unsure, say N.
 166
 167 config IP6_NF_MATCH_HL
 168         tristate '"hl" hoplimit match support'
 169         depends on NETFILTER_ADVANCED
 170         select NETFILTER_XT_MATCH_HL
 171         ---help---
 172         This is a backwards-compat option for the user's convenience
 173         (e.g. when running oldconfig). It selects
 174         CONFIG_NETFILTER_XT_MATCH_HL.
 175
 176 config IP6_NF_MATCH_IPV6HEADER
 177         tristate '"ipv6header" IPv6 Extension Headers Match'
 178         default m if NETFILTER_ADVANCED=n
 179         help
 180           This module allows one to match packets based upon
 181           the ipv6 extension headers.
 182
 183           To compile it as a module, choose M here.  If unsure, say N.
 184
 185 config IP6_NF_MATCH_MH
 186         tristate '"mh" match support'
 187         depends on NETFILTER_ADVANCED
 188         help
 189           This module allows one to match MH packets.
 190
 191           To compile it as a module, choose M here.  If unsure, say N.
 192
 193 config IP6_NF_MATCH_RPFILTER
 194         tristate '"rpfilter" reverse path filter match support'
 195         depends on NETFILTER_ADVANCED
 196         depends on IP6_NF_MANGLE || IP6_NF_RAW
 197         ---help---
 198           This option allows you to match packets whose replies would
 199           go out via the interface the packet came in.
 200
 201           To compile it as a module, choose M here.  If unsure, say N.
 202           The module will be called ip6t_rpfilter.
 203
 204 config IP6_NF_MATCH_RT
 205         tristate '"rt" Routing header match support'
 206         depends on NETFILTER_ADVANCED
 207         help
 208           rt matching allows you to match packets based on the routing
 209           header of the packet.
 210
 211           To compile it as a module, choose M here.  If unsure, say N.
 212
 213 # The targets
 214 config IP6_NF_TARGET_HL
 215         tristate '"HL" hoplimit target support'
 216         depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
 217         select NETFILTER_XT_TARGET_HL
 218         ---help---
 219         This is a backwards-compatible option for the user's convenience
 220         (e.g. when running oldconfig). It selects
 221         CONFIG_NETFILTER_XT_TARGET_HL.
 222
 223 config IP6_NF_FILTER
 224         tristate "Packet filtering"
 225         default m if NETFILTER_ADVANCED=n
 226         help
 227           Packet filtering defines a table `filter', which has a series of
 228           rules for simple packet filtering at local input, forwarding and
 229           local output.  See the man page for iptables(8).
 230
 231           To compile it as a module, choose M here.  If unsure, say N.
 232
 233 config IP6_NF_TARGET_REJECT
 234         tristate "REJECT target support"
 235         depends on IP6_NF_FILTER
 236         select NF_REJECT_IPV6
 237         default m if NETFILTER_ADVANCED=n
 238         help
 239           The REJECT target allows a filtering rule to specify that an ICMPv6
 240           error should be issued in response to an incoming packet, rather
 241           than silently being dropped.
 242
 243           To compile it as a module, choose M here.  If unsure, say N.
 244
 245 config IP6_NF_TARGET_SYNPROXY
 246         tristate "SYNPROXY target support"
 247         depends on NF_CONNTRACK && NETFILTER_ADVANCED
 248         select NETFILTER_SYNPROXY
 249         select SYN_COOKIES
 250         help
 251           The SYNPROXY target allows you to intercept TCP connections and
 252           establish them using syncookies before they are passed on to the
 253           server. This allows to avoid conntrack and server resource usage
 254           during SYN-flood attacks.
 255
 256           To compile it as a module, choose M here. If unsure, say N.
 257
 258 config IP6_NF_MANGLE
 259         tristate "Packet mangling"
 260         default m if NETFILTER_ADVANCED=n
 261         help
 262           This option adds a `mangle' table to iptables: see the man page for
 263           iptables(8).  This table is used for various packet alterations
 264           which can effect how the packet is routed.
 265
 266           To compile it as a module, choose M here.  If unsure, say N.
 267
 268 config IP6_NF_RAW
 269         tristate  'raw table support (required for TRACE)'
 270         help
 271           This option adds a `raw' table to ip6tables. This table is the very
 272           first in the netfilter framework and hooks in at the PREROUTING
 273           and OUTPUT chains.
 274
 275           If you want to compile it as a module, say M here and read
 276           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 277
 278 # security table for MAC policy
 279 config IP6_NF_SECURITY
 280        tristate "Security table"
 281        depends on SECURITY
 282        depends on NETFILTER_ADVANCED
 283        help
 284          This option adds a `security' table to iptables, for use
 285          with Mandatory Access Control (MAC) policy.
 286
 287          If unsure, say N.
 288
 289 config IP6_NF_NAT
 290         tristate "ip6tables NAT support"
 291         depends on NF_CONNTRACK_IPV6
 292         depends on NETFILTER_ADVANCED
 293         select NF_NAT
 294         select NF_NAT_IPV6
 295         select NETFILTER_XT_NAT
 296         help
 297           This enables the `nat' table in ip6tables. This allows masquerading,
 298           port forwarding and other forms of full Network Address Port
 299           Translation.
 300
 301           To compile it as a module, choose M here.  If unsure, say N.
 302
 303 if IP6_NF_NAT
 304
 305 config IP6_NF_TARGET_MASQUERADE
 306         tristate "MASQUERADE target support"
 307         select NF_NAT_MASQUERADE_IPV6
 308         help
 309           Masquerading is a special case of NAT: all outgoing connections are
 310           changed to seem to come from a particular interface's address, and
 311           if the interface goes down, those connections are lost.  This is
 312           only useful for dialup accounts with dynamic IP address (ie. your IP
 313           address will be different on next dialup).
 314
 315           To compile it as a module, choose M here.  If unsure, say N.
 316
 317 config IP6_NF_TARGET_NPT
 318         tristate "NPT (Network Prefix translation) target support"
 319         help
 320           This option adds the `SNPT' and `DNPT' target, which perform
 321           stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
 322
 323           To compile it as a module, choose M here.  If unsure, say N.
 324
 325 endif # IP6_NF_NAT
 326
 327 endif # IP6_NF_IPTABLES
 328
 329 endmenu
 330