1#
2# IP netfilter configuration
3#
4
5menu "IPv6: Netfilter Configuration"
6	depends on INET && IPV6 && NETFILTER
7
8config NF_DEFRAG_IPV6
9	tristate
10	default n
11
12config NF_CONNTRACK_IPV6
13	tristate "IPv6 connection tracking support"
14	depends on INET && IPV6 && NF_CONNTRACK
15	default m if NETFILTER_ADVANCED=n
16	select NF_DEFRAG_IPV6
17	---help---
18	  Connection tracking keeps a record of what packets have passed
19	  through your machine, in order to figure out how they are related
20	  into connections.
21
22	  This is IPv6 support on Layer 3 independent connection tracking.
23	  Layer 3 independent connection tracking is experimental scheme
24	  which generalize ip_conntrack to support other layer 3 protocols.
25
26	  To compile it as a module, choose M here.  If unsure, say N.
27
28config IP6_NF_QUEUE
29	tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
30	depends on INET && IPV6 && NETFILTER
31	depends on NETFILTER_ADVANCED
32	---help---
33
34	  This option adds a queue handler to the kernel for IPv6
35	  packets which enables users to receive the filtered packets
36	  with QUEUE target using libipq.
37
38	  This option enables the old IPv6-only "ip6_queue" implementation
39	  which has been obsoleted by the new "nfnetlink_queue" code (see
40	  CONFIG_NETFILTER_NETLINK_QUEUE).
41
42	  (C) Fernando Anton 2001
43	  IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
44	  Universidad Carlos III de Madrid
45	  Universidad Politecnica de Alcala de Henares
46	  email: <fanton@it.uc3m.es>.
47
48	  To compile it as a module, choose M here.  If unsure, say N.
49
50config IP6_NF_IPTABLES
51	tristate "IP6 tables support (required for filtering)"
52	depends on INET && IPV6
53	select NETFILTER_XTABLES
54	default m if NETFILTER_ADVANCED=n
55	help
56	  ip6tables is a general, extensible packet identification framework.
57	  Currently only the packet filtering and packet mangling subsystem
58	  for IPv6 use this, but connection tracking is going to follow.
59	  Say 'Y' or 'M' here if you want to use either of those.
60
61	  To compile it as a module, choose M here.  If unsure, say N.
62
63if IP6_NF_IPTABLES
64
65# The simple matches.
66config IP6_NF_MATCH_AH
67	tristate '"ah" match support'
68	depends on NETFILTER_ADVANCED
69	help
70	  This module allows one to match AH packets.
71
72	  To compile it as a module, choose M here.  If unsure, say N.
73
74config IP6_NF_MATCH_EUI64
75	tristate '"eui64" address check'
76	depends on NETFILTER_ADVANCED
77	help
78	  This module performs checking on the IPv6 source address
79	  Compares the last 64 bits with the EUI64 (delivered
80	  from the MAC address) address
81
82	  To compile it as a module, choose M here.  If unsure, say N.
83
84config IP6_NF_MATCH_FRAG
85	tristate '"frag" Fragmentation header match support'
86	depends on NETFILTER_ADVANCED
87	help
88	  frag matching allows you to match packets based on the fragmentation
89	  header of the packet.
90
91	  To compile it as a module, choose M here.  If unsure, say N.
92
93config IP6_NF_MATCH_OPTS
94	tristate '"hbh" hop-by-hop and "dst" opts header match support'
95	depends on NETFILTER_ADVANCED
96	help
97	  This allows one to match packets based on the hop-by-hop
98	  and destination options headers of a packet.
99
100	  To compile it as a module, choose M here.  If unsure, say N.
101
102config IP6_NF_MATCH_HL
103	tristate '"hl" hoplimit match support'
104	depends on NETFILTER_ADVANCED
105	select NETFILTER_XT_MATCH_HL
106	---help---
107	This is a backwards-compat option for the user's convenience
108	(e.g. when running oldconfig). It selects
109	CONFIG_NETFILTER_XT_MATCH_HL.
110
111config IP6_NF_MATCH_IPV6HEADER
112	tristate '"ipv6header" IPv6 Extension Headers Match'
113	default m if NETFILTER_ADVANCED=n
114	help
115	  This module allows one to match packets based upon
116	  the ipv6 extension headers.
117
118	  To compile it as a module, choose M here.  If unsure, say N.
119
120config IP6_NF_MATCH_MH
121	tristate '"mh" match support'
122	depends on NETFILTER_ADVANCED
123	help
124	  This module allows one to match MH packets.
125
126	  To compile it as a module, choose M here.  If unsure, say N.
127
128config IP6_NF_MATCH_RT
129	tristate '"rt" Routing header match support'
130	depends on NETFILTER_ADVANCED
131	help
132	  rt matching allows you to match packets based on the routing
133	  header of the packet.
134
135	  To compile it as a module, choose M here.  If unsure, say N.
136
137# The targets
138config IP6_NF_TARGET_HL
139	tristate '"HL" hoplimit target support'
140	depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
141	select NETFILTER_XT_TARGET_HL
142	---help---
143	This is a backwards-compatible option for the user's convenience
144	(e.g. when running oldconfig). It selects
145	CONFIG_NETFILTER_XT_TARGET_HL.
146
147config IP6_NF_TARGET_LOG
148	tristate "LOG target support"
149	default m if NETFILTER_ADVANCED=n
150	help
151	  This option adds a `LOG' target, which allows you to create rules in
152	  any iptables table which records the packet header to the syslog.
153
154	  To compile it as a module, choose M here.  If unsure, say N.
155
156config IP6_NF_FILTER
157	tristate "Packet filtering"
158	default m if NETFILTER_ADVANCED=n
159	help
160	  Packet filtering defines a table `filter', which has a series of
161	  rules for simple packet filtering at local input, forwarding and
162	  local output.  See the man page for iptables(8).
163
164	  To compile it as a module, choose M here.  If unsure, say N.
165
166config IP6_NF_TARGET_REJECT
167	tristate "REJECT target support"
168	depends on IP6_NF_FILTER
169	default m if NETFILTER_ADVANCED=n
170	help
171	  The REJECT target allows a filtering rule to specify that an ICMPv6
172	  error should be issued in response to an incoming packet, rather
173	  than silently being dropped.
174
175	  To compile it as a module, choose M here.  If unsure, say N.
176
177config IP6_NF_MANGLE
178	tristate "Packet mangling"
179	default m if NETFILTER_ADVANCED=n
180	help
181	  This option adds a `mangle' table to iptables: see the man page for
182	  iptables(8).  This table is used for various packet alterations
183	  which can effect how the packet is routed.
184
185	  To compile it as a module, choose M here.  If unsure, say N.
186
187config IP6_NF_RAW
188	tristate  'raw table support (required for TRACE)'
189	depends on NETFILTER_ADVANCED
190	help
191	  This option adds a `raw' table to ip6tables. This table is the very
192	  first in the netfilter framework and hooks in at the PREROUTING
193	  and OUTPUT chains.
194
195	  If you want to compile it as a module, say M here and read
196	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
197
198# security table for MAC policy
199config IP6_NF_SECURITY
200       tristate "Security table"
201       depends on SECURITY
202       depends on NETFILTER_ADVANCED
203       help
204         This option adds a `security' table to iptables, for use
205         with Mandatory Access Control (MAC) policy.
206
207         If unsure, say N.
208
209endif # IP6_NF_IPTABLES
210
211endmenu
212
213