Commit 4654467d authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: arptables: allow xtables-nft only builds 



Allows to build kernel that supports the arptables mangle target
via nftables' compat infra but without the arptables get/setsockopt
interface or the old arptables filter interpreter.

IOW, setting IP_NF_ARPFILTER=n will break arptables-legacy, but
arptables-nft will continue to work as long as nftables compat
support is enabled.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Reviewed-by: default avatarPhil Sutter <phil@nwl.cc>
parent d5f9142f

net/ipv4/netfilter/Kconfig

+13 −15
Original line number Diff line number Diff line
@@ -309,36 +309,34 @@ endif # IP_NF_IPTABLES 


# ARP tables

config IP_NF_ARPTABLES

	tristate "ARP tables support"

	select NETFILTER_XTABLES

	select NETFILTER_FAMILY_ARP

	depends on NETFILTER_ADVANCED

	help

	  arptables is a general, extensible packet identification framework.

	  The ARP packet filtering and mangling (manipulation)subsystems

	  use this: say Y or M here if you want to use either of those.



	  To compile it as a module, choose M here.  If unsure, say N.

	tristate



if IP_NF_ARPTABLES

config NFT_COMPAT_ARP

	tristate

	depends on NF_TABLES_ARP && NFT_COMPAT

	default m if NFT_COMPAT=m

	default y if NFT_COMPAT=y



config IP_NF_ARPFILTER

	tristate "ARP packet filtering"

	tristate "arptables-legacy packet filtering support"

	select IP_NF_ARPTABLES

	help

	  ARP packet filtering defines a table `filter', which has a series of

	  rules for simple ARP packet filtering at local input and

	  local output.  On a bridge, you can also specify filtering rules

	  for forwarded ARP packets. See the man page for arptables(8).

	  local output.  This is only needed for arptables-legacy(8).

	  Neither arptables-nft nor nftables need this to work.



	  To compile it as a module, choose M here.  If unsure, say N.



config IP_NF_ARP_MANGLE

	tristate "ARP payload mangling"

	depends on IP_NF_ARPTABLES || NFT_COMPAT_ARP

	help

	  Allows altering the ARP packet payload: source and destination

	  hardware and network addresses.



endif # IP_NF_ARPTABLES

	  This option is needed by both arptables-legacy and arptables-nft.

	  It is not used by nftables.



endmenu