xref: /openbmc/linux/net/ipv6/netfilter/Kconfig (revision c2df73de) 
1#
2# IP netfilter configuration
3#
4
5menu "IPv6: Netfilter Configuration"
6	depends on INET && IPV6 && NETFILTER
7
8config NF_CONNTRACK_IPV6
9	tristate "IPv6 connection tracking support"
10	depends on INET && IPV6 && NF_CONNTRACK
11	default m if NETFILTER_ADVANCED=n
12	---help---
13	  Connection tracking keeps a record of what packets have passed
14	  through your machine, in order to figure out how they are related
15	  into connections.
16
17	  This is IPv6 support on Layer 3 independent connection tracking.
18	  Layer 3 independent connection tracking is experimental scheme
19	  which generalize ip_conntrack to support other layer 3 protocols.
20
21	  To compile it as a module, choose M here.  If unsure, say N.
22
23config IP6_NF_QUEUE
24	tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
25	depends on INET && IPV6 && NETFILTER
26	depends on NETFILTER_ADVANCED
27	---help---
28
29	  This option adds a queue handler to the kernel for IPv6
30	  packets which enables users to receive the filtered packets
31	  with QUEUE target using libipq.
32
33	  This option enables the old IPv6-only "ip6_queue" implementation
34	  which has been obsoleted by the new "nfnetlink_queue" code (see
35	  CONFIG_NETFILTER_NETLINK_QUEUE).
36
37	  (C) Fernando Anton 2001
38	  IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
39	  Universidad Carlos III de Madrid
40	  Universidad Politecnica de Alcala de Henares
41	  email: <fanton@it.uc3m.es>.
42
43	  To compile it as a module, choose M here.  If unsure, say N.
44
45config IP6_NF_IPTABLES
46	tristate "IP6 tables support (required for filtering)"
47	depends on INET && IPV6
48	select NETFILTER_XTABLES
49	default m if NETFILTER_ADVANCED=n
50	help
51	  ip6tables is a general, extensible packet identification framework.
52	  Currently only the packet filtering and packet mangling subsystem
53	  for IPv6 use this, but connection tracking is going to follow.
54	  Say 'Y' or 'M' here if you want to use either of those.
55
56	  To compile it as a module, choose M here.  If unsure, say N.
57
58if IP6_NF_IPTABLES
59
60# The simple matches.
61config IP6_NF_MATCH_AH
62	tristate '"ah" match support'
63	depends on NETFILTER_ADVANCED
64	help
65	  This module allows one to match AH packets.
66
67	  To compile it as a module, choose M here.  If unsure, say N.
68
69config IP6_NF_MATCH_EUI64
70	tristate '"eui64" address check'
71	depends on NETFILTER_ADVANCED
72	help
73	  This module performs checking on the IPv6 source address
74	  Compares the last 64 bits with the EUI64 (delivered
75	  from the MAC address) address
76
77	  To compile it as a module, choose M here.  If unsure, say N.
78
79config IP6_NF_MATCH_FRAG
80	tristate '"frag" Fragmentation header match support'
81	depends on NETFILTER_ADVANCED
82	help
83	  frag matching allows you to match packets based on the fragmentation
84	  header of the packet.
85
86	  To compile it as a module, choose M here.  If unsure, say N.
87
88config IP6_NF_MATCH_OPTS
89	tristate '"hbh" hop-by-hop and "dst" opts header match support'
90	depends on NETFILTER_ADVANCED
91	help
92	  This allows one to match packets based on the hop-by-hop
93	  and destination options headers of a packet.
94
95	  To compile it as a module, choose M here.  If unsure, say N.
96
97config IP6_NF_MATCH_HL
98	tristate '"hl" match support'
99	depends on NETFILTER_ADVANCED
100	help
101	  HL matching allows you to match packets based on the hop
102	  limit of the packet.
103
104	  To compile it as a module, choose M here.  If unsure, say N.
105
106config IP6_NF_MATCH_IPV6HEADER
107	tristate '"ipv6header" IPv6 Extension Headers Match'
108	default m if NETFILTER_ADVANCED=n
109	help
110	  This module allows one to match packets based upon
111	  the ipv6 extension headers.
112
113	  To compile it as a module, choose M here.  If unsure, say N.
114
115config IP6_NF_MATCH_MH
116	tristate '"mh" match support'
117	depends on NETFILTER_ADVANCED
118	help
119	  This module allows one to match MH packets.
120
121	  To compile it as a module, choose M here.  If unsure, say N.
122
123config IP6_NF_MATCH_RT
124	tristate '"rt" Routing header match support'
125	depends on NETFILTER_ADVANCED
126	help
127	  rt matching allows you to match packets based on the routing
128	  header of the packet.
129
130	  To compile it as a module, choose M here.  If unsure, say N.
131
132# The targets
133config IP6_NF_TARGET_LOG
134	tristate "LOG target support"
135	default m if NETFILTER_ADVANCED=n
136	help
137	  This option adds a `LOG' target, which allows you to create rules in
138	  any iptables table which records the packet header to the syslog.
139
140	  To compile it as a module, choose M here.  If unsure, say N.
141
142config IP6_NF_FILTER
143	tristate "Packet filtering"
144	default m if NETFILTER_ADVANCED=n
145	help
146	  Packet filtering defines a table `filter', which has a series of
147	  rules for simple packet filtering at local input, forwarding and
148	  local output.  See the man page for iptables(8).
149
150	  To compile it as a module, choose M here.  If unsure, say N.
151
152config IP6_NF_TARGET_REJECT
153	tristate "REJECT target support"
154	depends on IP6_NF_FILTER
155	default m if NETFILTER_ADVANCED=n
156	help
157	  The REJECT target allows a filtering rule to specify that an ICMPv6
158	  error should be issued in response to an incoming packet, rather
159	  than silently being dropped.
160
161	  To compile it as a module, choose M here.  If unsure, say N.
162
163config IP6_NF_MANGLE
164	tristate "Packet mangling"
165	default m if NETFILTER_ADVANCED=n
166	help
167	  This option adds a `mangle' table to iptables: see the man page for
168	  iptables(8).  This table is used for various packet alterations
169	  which can effect how the packet is routed.
170
171	  To compile it as a module, choose M here.  If unsure, say N.
172
173config IP6_NF_TARGET_HL
174	tristate  'HL (hoplimit) target support'
175	depends on IP6_NF_MANGLE
176	depends on NETFILTER_ADVANCED
177	help
178	  This option adds a `HL' target, which enables the user to decrement
179	  the hoplimit value of the IPv6 header or set it to a given (lower)
180	  value.
181
182	  While it is safe to decrement the hoplimit value, this option also
183	  enables functionality to increment and set the hoplimit value of the
184	  IPv6 header to arbitrary values.  This is EXTREMELY DANGEROUS since
185	  you can easily create immortal packets that loop forever on the
186	  network.
187
188	  To compile it as a module, choose M here.  If unsure, say N.
189
190config IP6_NF_RAW
191	tristate  'raw table support (required for TRACE)'
192	depends on NETFILTER_ADVANCED
193	help
194	  This option adds a `raw' table to ip6tables. This table is the very
195	  first in the netfilter framework and hooks in at the PREROUTING
196	  and OUTPUT chains.
197
198	  If you want to compile it as a module, say M here and read
199	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
200
201# security table for MAC policy
202config IP6_NF_SECURITY
203       tristate "Security table"
204       depends on SECURITY
205       depends on NETFILTER_ADVANCED
206       help
207         This option adds a `security' table to iptables, for use
208         with Mandatory Access Control (MAC) policy.
209
210         If unsure, say N.
211
212endif # IP6_NF_IPTABLES
213
214endmenu
215
216