net/ipv6/netfilter/Kconfig

   1 #
   2 # IP netfilter configuration
   3 #
   4
   5 menu "IPv6: Netfilter Configuration"
   6         depends on INET && IPV6 && NETFILTER
   7
   8 config NF_DEFRAG_IPV6
   9         tristate
  10         default n
  11
  12 config NF_CONNTRACK_IPV6
  13         tristate "IPv6 connection tracking support"
  14         depends on INET && IPV6 && NF_CONNTRACK
  15         default m if NETFILTER_ADVANCED=n
  16         select NF_DEFRAG_IPV6
  17         ---help---
  18           Connection tracking keeps a record of what packets have passed
  19           through your machine, in order to figure out how they are related
  20           into connections.
  21
  22           This is IPv6 support on Layer 3 independent connection tracking.
  23           Layer 3 independent connection tracking is experimental scheme
  24           which generalize ip_conntrack to support other layer 3 protocols.
  25
  26           To compile it as a module, choose M here.  If unsure, say N.
  27
  28 if NF_TABLES
  29
  30 config NF_TABLES_IPV6
  31         tristate "IPv6 nf_tables support"
  32         help
  33           This option enables the IPv6 support for nf_tables.
  34
  35 if NF_TABLES_IPV6
  36
  37 config NFT_CHAIN_ROUTE_IPV6
  38         tristate "IPv6 nf_tables route chain support"
  39         help
  40           This option enables the "route" chain for IPv6 in nf_tables. This
  41           chain type is used to force packet re-routing after mangling header
  42           fields such as the source, destination, flowlabel, hop-limit and
  43           the packet mark.
  44
  45 config NFT_REJECT_IPV6
  46         select NF_REJECT_IPV6
  47         default NFT_REJECT
  48         tristate
  49
  50 config NFT_DUP_IPV6
  51         tristate "IPv6 nf_tables packet duplication support"
  52         select NF_DUP_IPV6
  53         help
  54           This module enables IPv6 packet duplication support for nf_tables.
  55
  56 endif # NF_TABLES_IPV6
  57 endif # NF_TABLES
  58
  59 config NF_DUP_IPV6
  60         tristate "Netfilter IPv6 packet duplication to alternate destination"
  61         depends on !NF_CONNTRACK || NF_CONNTRACK
  62         help
  63           This option enables the nf_dup_ipv6 core, which duplicates an IPv6
  64           packet to be rerouted to another destination.
  65
  66 config NF_REJECT_IPV6
  67         tristate "IPv6 packet rejection"
  68         default m if NETFILTER_ADVANCED=n
  69
  70 config NF_LOG_IPV6
  71         tristate "IPv6 packet logging"
  72         default m if NETFILTER_ADVANCED=n
  73         select NF_LOG_COMMON
  74
  75 config NF_NAT_IPV6
  76         tristate "IPv6 NAT"
  77         depends on NF_CONNTRACK_IPV6
  78         depends on NETFILTER_ADVANCED
  79         select NF_NAT
  80         help
  81           The IPv6 NAT option allows masquerading, port forwarding and other
  82           forms of full Network Address Port Translation. This can be
  83           controlled by iptables or nft.
  84
  85 if NF_NAT_IPV6
  86
  87 config NFT_CHAIN_NAT_IPV6
  88         depends on NF_TABLES_IPV6
  89         tristate "IPv6 nf_tables nat chain support"
  90         help
  91           This option enables the "nat" chain for IPv6 in nf_tables. This
  92           chain type is used to perform Network Address Translation (NAT)
  93           packet transformations such as the source, destination address and
  94           source and destination ports.
  95
  96 config NF_NAT_MASQUERADE_IPV6
  97         tristate "IPv6 masquerade support"
  98         help
  99           This is the kernel functionality to provide NAT in the masquerade
 100           flavour (automatic source address selection) for IPv6.
 101
 102 config NFT_MASQ_IPV6
 103         tristate "IPv6 masquerade support for nf_tables"
 104         depends on NF_TABLES_IPV6
 105         depends on NFT_MASQ
 106         select NF_NAT_MASQUERADE_IPV6
 107         help
 108           This is the expression that provides IPv4 masquerading support for
 109           nf_tables.
 110
 111 config NFT_REDIR_IPV6
 112         tristate "IPv6 redirect support for nf_tables"
 113         depends on NF_TABLES_IPV6
 114         depends on NFT_REDIR
 115         select NF_NAT_REDIRECT
 116         help
 117           This is the expression that provides IPv4 redirect support for
 118           nf_tables.
 119
 120 endif # NF_NAT_IPV6
 121
 122 config IP6_NF_IPTABLES
 123         tristate "IP6 tables support (required for filtering)"
 124         depends on INET && IPV6
 125         select NETFILTER_XTABLES
 126         default m if NETFILTER_ADVANCED=n
 127         help
 128           ip6tables is a general, extensible packet identification framework.
 129           Currently only the packet filtering and packet mangling subsystem
 130           for IPv6 use this, but connection tracking is going to follow.
 131           Say 'Y' or 'M' here if you want to use either of those.
 132
 133           To compile it as a module, choose M here.  If unsure, say N.
 134
 135 if IP6_NF_IPTABLES
 136
 137 # The simple matches.
 138 config IP6_NF_MATCH_AH
 139         tristate '"ah" match support'
 140         depends on NETFILTER_ADVANCED
 141         help
 142           This module allows one to match AH packets.
 143
 144           To compile it as a module, choose M here.  If unsure, say N.
 145
 146 config IP6_NF_MATCH_EUI64
 147         tristate '"eui64" address check'
 148         depends on NETFILTER_ADVANCED
 149         help
 150           This module performs checking on the IPv6 source address
 151           Compares the last 64 bits with the EUI64 (delivered
 152           from the MAC address) address
 153
 154           To compile it as a module, choose M here.  If unsure, say N.
 155
 156 config IP6_NF_MATCH_FRAG
 157         tristate '"frag" Fragmentation header match support'
 158         depends on NETFILTER_ADVANCED
 159         help
 160           frag matching allows you to match packets based on the fragmentation
 161           header of the packet.
 162
 163           To compile it as a module, choose M here.  If unsure, say N.
 164
 165 config IP6_NF_MATCH_OPTS
 166         tristate '"hbh" hop-by-hop and "dst" opts header match support'
 167         depends on NETFILTER_ADVANCED
 168         help
 169           This allows one to match packets based on the hop-by-hop
 170           and destination options headers of a packet.
 171
 172           To compile it as a module, choose M here.  If unsure, say N.
 173
 174 config IP6_NF_MATCH_HL
 175         tristate '"hl" hoplimit match support'
 176         depends on NETFILTER_ADVANCED
 177         select NETFILTER_XT_MATCH_HL
 178         ---help---
 179         This is a backwards-compat option for the user's convenience
 180         (e.g. when running oldconfig). It selects
 181         CONFIG_NETFILTER_XT_MATCH_HL.
 182
 183 config IP6_NF_MATCH_IPV6HEADER
 184         tristate '"ipv6header" IPv6 Extension Headers Match'
 185         default m if NETFILTER_ADVANCED=n
 186         help
 187           This module allows one to match packets based upon
 188           the ipv6 extension headers.
 189
 190           To compile it as a module, choose M here.  If unsure, say N.
 191
 192 config IP6_NF_MATCH_MH
 193         tristate '"mh" match support'
 194         depends on NETFILTER_ADVANCED
 195         help
 196           This module allows one to match MH packets.
 197
 198           To compile it as a module, choose M here.  If unsure, say N.
 199
 200 config IP6_NF_MATCH_RPFILTER
 201         tristate '"rpfilter" reverse path filter match support'
 202         depends on NETFILTER_ADVANCED
 203         depends on IP6_NF_MANGLE || IP6_NF_RAW
 204         ---help---
 205           This option allows you to match packets whose replies would
 206           go out via the interface the packet came in.
 207
 208           To compile it as a module, choose M here.  If unsure, say N.
 209           The module will be called ip6t_rpfilter.
 210
 211 config IP6_NF_MATCH_RT
 212         tristate '"rt" Routing header match support'
 213         depends on NETFILTER_ADVANCED
 214         help
 215           rt matching allows you to match packets based on the routing
 216           header of the packet.
 217
 218           To compile it as a module, choose M here.  If unsure, say N.
 219
 220 # The targets
 221 config IP6_NF_TARGET_HL
 222         tristate '"HL" hoplimit target support'
 223         depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
 224         select NETFILTER_XT_TARGET_HL
 225         ---help---
 226         This is a backwards-compatible option for the user's convenience
 227         (e.g. when running oldconfig). It selects
 228         CONFIG_NETFILTER_XT_TARGET_HL.
 229
 230 config IP6_NF_FILTER
 231         tristate "Packet filtering"
 232         default m if NETFILTER_ADVANCED=n
 233         help
 234           Packet filtering defines a table `filter', which has a series of
 235           rules for simple packet filtering at local input, forwarding and
 236           local output.  See the man page for iptables(8).
 237
 238           To compile it as a module, choose M here.  If unsure, say N.
 239
 240 config IP6_NF_TARGET_REJECT
 241         tristate "REJECT target support"
 242         depends on IP6_NF_FILTER
 243         select NF_REJECT_IPV6
 244         default m if NETFILTER_ADVANCED=n
 245         help
 246           The REJECT target allows a filtering rule to specify that an ICMPv6
 247           error should be issued in response to an incoming packet, rather
 248           than silently being dropped.
 249
 250           To compile it as a module, choose M here.  If unsure, say N.
 251
 252 config IP6_NF_TARGET_SYNPROXY
 253         tristate "SYNPROXY target support"
 254         depends on NF_CONNTRACK && NETFILTER_ADVANCED
 255         select NETFILTER_SYNPROXY
 256         select SYN_COOKIES
 257         help
 258           The SYNPROXY target allows you to intercept TCP connections and
 259           establish them using syncookies before they are passed on to the
 260           server. This allows to avoid conntrack and server resource usage
 261           during SYN-flood attacks.
 262
 263           To compile it as a module, choose M here. If unsure, say N.
 264
 265 config IP6_NF_MANGLE
 266         tristate "Packet mangling"
 267         default m if NETFILTER_ADVANCED=n
 268         help
 269           This option adds a `mangle' table to iptables: see the man page for
 270           iptables(8).  This table is used for various packet alterations
 271           which can effect how the packet is routed.
 272
 273           To compile it as a module, choose M here.  If unsure, say N.
 274
 275 config IP6_NF_RAW
 276         tristate  'raw table support (required for TRACE)'
 277         help
 278           This option adds a `raw' table to ip6tables. This table is the very
 279           first in the netfilter framework and hooks in at the PREROUTING
 280           and OUTPUT chains.
 281
 282           If you want to compile it as a module, say M here and read
 283           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 284
 285 # security table for MAC policy
 286 config IP6_NF_SECURITY
 287        tristate "Security table"
 288        depends on SECURITY
 289        depends on NETFILTER_ADVANCED
 290        help
 291          This option adds a `security' table to iptables, for use
 292          with Mandatory Access Control (MAC) policy.
 293
 294          If unsure, say N.
 295
 296 config IP6_NF_NAT
 297         tristate "ip6tables NAT support"
 298         depends on NF_CONNTRACK_IPV6
 299         depends on NETFILTER_ADVANCED
 300         select NF_NAT
 301         select NF_NAT_IPV6
 302         select NETFILTER_XT_NAT
 303         help
 304           This enables the `nat' table in ip6tables. This allows masquerading,
 305           port forwarding and other forms of full Network Address Port
 306           Translation.
 307
 308           To compile it as a module, choose M here.  If unsure, say N.
 309
 310 if IP6_NF_NAT
 311
 312 config IP6_NF_TARGET_MASQUERADE
 313         tristate "MASQUERADE target support"
 314         select NF_NAT_MASQUERADE_IPV6
 315         help
 316           Masquerading is a special case of NAT: all outgoing connections are
 317           changed to seem to come from a particular interface's address, and
 318           if the interface goes down, those connections are lost.  This is
 319           only useful for dialup accounts with dynamic IP address (ie. your IP
 320           address will be different on next dialup).
 321
 322           To compile it as a module, choose M here.  If unsure, say N.
 323
 324 config IP6_NF_TARGET_NPT
 325         tristate "NPT (Network Prefix translation) target support"
 326         help
 327           This option adds the `SNPT' and `DNPT' target, which perform
 328           stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
 329
 330           To compile it as a module, choose M here.  If unsure, say N.
 331
 332 endif # IP6_NF_NAT
 333
 334 endif # IP6_NF_IPTABLES
 335
 336 endmenu
 337