aboutsummaryrefslogtreecommitdiff
path: root/net/ipv6
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2007-12-17 22:47:05 -0800
committerDavid S. Miller <davem@davemloft.net>2008-01-28 14:59:12 -0800
commit33b8e776056202aceaf4c90f465d0f4ee53432ac (patch)
tree24f6bc7b89a81d95b1b9c0f16254ad8423aed9cb /net/ipv6
parent34498825cb9062192b77fa02dae672a4fe6eec70 (diff)
[NETFILTER]: Add CONFIG_NETFILTER_ADVANCED option
The NETFILTER_ADVANCED option hides lots of the rather obscure netfilter options when disabled and provides defaults (M) that should allow to run a distribution firewall without further thinking. Defaults to 'y' to avoid breaking current configurations. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/netfilter/Kconfig23
1 files changed, 20 insertions, 3 deletions
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 5374c665f8d..a6b4a9a1053 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -8,6 +8,7 @@ menu "IPv6: Netfilter Configuration (EXPERIMENTAL)"
config NF_CONNTRACK_IPV6
tristate "IPv6 connection tracking support (EXPERIMENTAL)"
depends on INET && IPV6 && EXPERIMENTAL && NF_CONNTRACK
+ default m if NETFILTER_ADVANCED=n
---help---
Connection tracking keeps a record of what packets have passed
through your machine, in order to figure out how they are related
@@ -22,6 +23,7 @@ config NF_CONNTRACK_IPV6
config IP6_NF_QUEUE
tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
depends on INET && IPV6 && NETFILTER && EXPERIMENTAL
+ depends on NETFILTER_ADVANCED
---help---
This option adds a queue handler to the kernel for IPv6
@@ -44,6 +46,7 @@ config IP6_NF_IPTABLES
tristate "IP6 tables support (required for filtering)"
depends on INET && IPV6 && EXPERIMENTAL
select NETFILTER_XTABLES
+ default m if NETFILTER_ADVANCED=n
help
ip6tables is a general, extensible packet identification framework.
Currently only the packet filtering and packet mangling subsystem
@@ -56,6 +59,7 @@ config IP6_NF_IPTABLES
config IP6_NF_MATCH_RT
tristate '"rt" Routing header match support'
depends on IP6_NF_IPTABLES
+ depends on NETFILTER_ADVANCED
help
rt matching allows you to match packets based on the routing
header of the packet.
@@ -65,6 +69,7 @@ config IP6_NF_MATCH_RT
config IP6_NF_MATCH_OPTS
tristate '"hopbyhop" and "dst" opts header match support'
depends on IP6_NF_IPTABLES
+ depends on NETFILTER_ADVANCED
help
This allows one to match packets based on the hop-by-hop
and destination options headers of a packet.
@@ -74,6 +79,7 @@ config IP6_NF_MATCH_OPTS
config IP6_NF_MATCH_FRAG
tristate '"frag" Fragmentation header match support'
depends on IP6_NF_IPTABLES
+ depends on NETFILTER_ADVANCED
help
frag matching allows you to match packets based on the fragmentation
header of the packet.
@@ -83,6 +89,7 @@ config IP6_NF_MATCH_FRAG
config IP6_NF_MATCH_HL
tristate '"hl" match support'
depends on IP6_NF_IPTABLES
+ depends on NETFILTER_ADVANCED
help
HL matching allows you to match packets based on the hop
limit of the packet.
@@ -92,6 +99,7 @@ config IP6_NF_MATCH_HL
config IP6_NF_MATCH_IPV6HEADER
tristate '"ipv6header" IPv6 Extension Headers Match'
depends on IP6_NF_IPTABLES
+ depends on NETFILTER_ADVANCED
help
This module allows one to match packets based upon
the ipv6 extension headers.
@@ -101,6 +109,7 @@ config IP6_NF_MATCH_IPV6HEADER
config IP6_NF_MATCH_AH
tristate '"ah" match support'
depends on IP6_NF_IPTABLES
+ depends on NETFILTER_ADVANCED
help
This module allows one to match AH packets.
@@ -109,6 +118,7 @@ config IP6_NF_MATCH_AH
config IP6_NF_MATCH_MH
tristate '"mh" match support'
depends on IP6_NF_IPTABLES
+ depends on NETFILTER_ADVANCED
help
This module allows one to match MH packets.
@@ -117,6 +127,7 @@ config IP6_NF_MATCH_MH
config IP6_NF_MATCH_EUI64
tristate '"eui64" address check'
depends on IP6_NF_IPTABLES
+ depends on NETFILTER_ADVANCED
help
This module performs checking on the IPv6 source address
Compares the last 64 bits with the EUI64 (delivered
@@ -128,6 +139,7 @@ config IP6_NF_MATCH_EUI64
config IP6_NF_FILTER
tristate "Packet filtering"
depends on IP6_NF_IPTABLES
+ default m if NETFILTER_ADVANCED=n
help
Packet filtering defines a table `filter', which has a series of
rules for simple packet filtering at local input, forwarding and
@@ -138,6 +150,7 @@ config IP6_NF_FILTER
config IP6_NF_TARGET_LOG
tristate "LOG target support"
depends on IP6_NF_FILTER
+ default m if NETFILTER_ADVANCED=n
help
This option adds a `LOG' target, which allows you to create rules in
any iptables table which records the packet header to the syslog.
@@ -147,6 +160,7 @@ config IP6_NF_TARGET_LOG
config IP6_NF_TARGET_REJECT
tristate "REJECT target support"
depends on IP6_NF_FILTER
+ default m if NETFILTER_ADVANCED=n
help
The REJECT target allows a filtering rule to specify that an ICMPv6
error should be issued in response to an incoming packet, rather
@@ -157,6 +171,7 @@ config IP6_NF_TARGET_REJECT
config IP6_NF_MANGLE
tristate "Packet mangling"
depends on IP6_NF_IPTABLES
+ default m if NETFILTER_ADVANCED=n
help
This option adds a `mangle' table to iptables: see the man page for
iptables(8). This table is used for various packet alterations
@@ -167,27 +182,29 @@ config IP6_NF_MANGLE
config IP6_NF_TARGET_HL
tristate 'HL (hoplimit) target support'
depends on IP6_NF_MANGLE
+ depends on NETFILTER_ADVANCED
help
This option adds a `HL' target, which enables the user to decrement
the hoplimit value of the IPv6 header or set it to a given (lower)
value.
-
+
While it is safe to decrement the hoplimit value, this option also
enables functionality to increment and set the hoplimit value of the
IPv6 header to arbitrary values. This is EXTREMELY DANGEROUS since
you can easily create immortal packets that loop forever on the
- network.
+ network.
To compile it as a module, choose M here. If unsure, say N.
config IP6_NF_RAW
tristate 'raw table support (required for TRACE)'
depends on IP6_NF_IPTABLES
+ depends on NETFILTER_ADVANCED
help
This option adds a `raw' table to ip6tables. This table is the very
first in the netfilter framework and hooks in at the PREROUTING
and OUTPUT chains.
-
+
If you want to compile it as a module, say M here and read
<file:Documentation/kbuild/modules.txt>. If unsure, say `N'.