[NETFILTER]: Add CONFIG_NETFILTER_ADVANCED option

The NETFILTER_ADVANCED option hides lots of the rather obscure netfilter
options when disabled and provides defaults (M) that should allow to
run a distribution firewall without further thinking.

Defaults to 'y' to avoid breaking current configurations.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 25 insertions, 1 deletions

diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index ad26f66b53e9..cface714edf3 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -8,6 +8,7 @@ menu "IP: Netfilter Configuration"
 config NF_CONNTRACK_IPV4
         tristate "IPv4 connection tracking support (required for NAT)"
         depends on NF_CONNTRACK
+        default m if NETFILTER_ADVANCED=n
         ---help---
           Connection tracking keeps a record of what packets have passed
           through your machine, in order to figure out how they are related
@@ -32,6 +33,7 @@ config NF_CONNTRACK_PROC_COMPAT
 
 config IP_NF_QUEUE
         tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
+        depends on NETFILTER_ADVANCED
         help
           Netfilter has the ability to queue packets to user space: the
           netlink device can be used to access them using this driver.
@@ -44,6 +46,7 @@ config IP_NF_QUEUE
 
 config IP_NF_IPTABLES
         tristate "IP tables support (required for filtering/masq/NAT)"
+        default m if NETFILTER_ADVANCED=n
         select NETFILTER_XTABLES
         help
           iptables is a general, extensible packet identification framework.
@@ -57,6 +60,7 @@ config IP_NF_IPTABLES
 config IP_NF_MATCH_IPRANGE
         tristate '"iprange" match support'
         depends on IP_NF_IPTABLES
+        depends on NETFILTER_ADVANCED
         help
           This option makes possible to match IP addresses against IP address
           ranges.
@@ -66,6 +70,7 @@ config IP_NF_MATCH_IPRANGE
 config IP_NF_MATCH_RECENT
         tristate '"recent" match support'
         depends on IP_NF_IPTABLES
+        depends on NETFILTER_ADVANCED
         help
           This match is used for creating one or many lists of recently
           used addresses and then matching against that/those list(s).
@@ -78,6 +83,7 @@ config IP_NF_MATCH_RECENT
 config IP_NF_MATCH_ECN
         tristate '"ecn" match support'
         depends on IP_NF_IPTABLES
+        depends on NETFILTER_ADVANCED
         help
           This option adds a `ECN' match, which allows you to match against
           the IPv4 and TCP header ECN fields.
@@ -87,6 +93,7 @@ config IP_NF_MATCH_ECN
 config IP_NF_MATCH_AH
         tristate '"ah" match support'
         depends on IP_NF_IPTABLES
+        depends on NETFILTER_ADVANCED
         help
           This match extension allows you to match a range of SPIs
           inside AH header of IPSec packets.
@@ -96,6 +103,7 @@ config IP_NF_MATCH_AH
 config IP_NF_MATCH_TTL
         tristate '"ttl" match support'
         depends on IP_NF_IPTABLES
+        depends on NETFILTER_ADVANCED
         help
           This adds CONFIG_IP_NF_MATCH_TTL option, which enabled the user
           to match packets by their TTL value.
@@ -105,10 +113,11 @@ config IP_NF_MATCH_TTL
 config IP_NF_MATCH_ADDRTYPE
         tristate '"addrtype" address type match support'
         depends on IP_NF_IPTABLES
+        depends on NETFILTER_ADVANCED
         help
           This option allows you to match what routing thinks of an address,
           eg. UNICAST, LOCAL, BROADCAST, ...
-        
+
           If you want to compile it as a module, say M here and read
           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
@@ -116,6 +125,7 @@ config IP_NF_MATCH_ADDRTYPE
 config IP_NF_FILTER
         tristate "Packet filtering"
         depends on IP_NF_IPTABLES
+        default m if NETFILTER_ADVANCED=n
         help
           Packet filtering defines a table `filter', which has a series of
           rules for simple packet filtering at local input, forwarding and
@@ -126,6 +136,7 @@ config IP_NF_FILTER
 config IP_NF_TARGET_REJECT
         tristate "REJECT target support"
         depends on IP_NF_FILTER
+        default m if NETFILTER_ADVANCED=n
         help
           The REJECT target allows a filtering rule to specify that an ICMP
           error should be issued in response to an incoming packet, rather
@@ -136,6 +147,7 @@ config IP_NF_TARGET_REJECT
 config IP_NF_TARGET_LOG
         tristate "LOG target support"
         depends on IP_NF_IPTABLES
+        default m if NETFILTER_ADVANCED=n
         help
           This option adds a `LOG' target, which allows you to create rules in
           any iptables table which records the packet header to the syslog.
@@ -145,6 +157,7 @@ config IP_NF_TARGET_LOG
 config IP_NF_TARGET_ULOG
         tristate "ULOG target support"
         depends on IP_NF_IPTABLES
+        default m if NETFILTER_ADVANCED=n
         ---help---
 
           This option enables the old IPv4-only "ipt_ULOG" implementation
@@ -165,6 +178,7 @@ config IP_NF_TARGET_ULOG
 config NF_NAT
         tristate "Full NAT"
         depends on IP_NF_IPTABLES && NF_CONNTRACK_IPV4
+        default m if NETFILTER_ADVANCED=n
         help
           The Full NAT option allows masquerading, port forwarding and other
           forms of full Network Address Port Translation.  It is controlled by
@@ -180,6 +194,7 @@ config NF_NAT_NEEDED
 config IP_NF_TARGET_MASQUERADE
         tristate "MASQUERADE target support"
         depends on NF_NAT
+        default m if NETFILTER_ADVANCED=n
         help
           Masquerading is a special case of NAT: all outgoing connections are
           changed to seem to come from a particular interface's address, and
@@ -192,6 +207,7 @@ config IP_NF_TARGET_MASQUERADE
 config IP_NF_TARGET_REDIRECT
         tristate "REDIRECT target support"
         depends on NF_NAT
+        depends on NETFILTER_ADVANCED
         help
           REDIRECT is a special case of NAT: all incoming connections are
           mapped onto the incoming interface's address, causing the packets to
@@ -203,6 +219,7 @@ config IP_NF_TARGET_REDIRECT
 config IP_NF_TARGET_NETMAP
         tristate "NETMAP target support"
         depends on NF_NAT
+        depends on NETFILTER_ADVANCED
         help
           NETMAP is an implementation of static 1:1 NAT mapping of network
           addresses. It maps the network address part, while keeping the host
@@ -214,6 +231,7 @@ config IP_NF_TARGET_NETMAP
 config NF_NAT_SNMP_BASIC
         tristate "Basic SNMP-ALG support (EXPERIMENTAL)"
         depends on EXPERIMENTAL && NF_NAT
+        depends on NETFILTER_ADVANCED
         ---help---
 
           This module implements an Application Layer Gateway (ALG) for
@@ -277,6 +295,7 @@ config NF_NAT_SIP
 config IP_NF_MANGLE
         tristate "Packet mangling"
         depends on IP_NF_IPTABLES
+        default m if NETFILTER_ADVANCED=n
         help
           This option adds a `mangle' table to iptables: see the man page for
           iptables(8).  This table is used for various packet alterations
@@ -287,6 +306,7 @@ config IP_NF_MANGLE
 config IP_NF_TARGET_ECN
         tristate "ECN target support"
         depends on IP_NF_MANGLE
+        depends on NETFILTER_ADVANCED
         ---help---
           This option adds a `ECN' target, which can be used in the iptables mangle
           table.  
@@ -301,6 +321,7 @@ config IP_NF_TARGET_ECN
 config IP_NF_TARGET_TTL
         tristate  'TTL target support'
         depends on IP_NF_MANGLE
+        depends on NETFILTER_ADVANCED
         help
           This option adds a `TTL' target, which enables the user to modify
           the TTL value of the IP header.
@@ -316,6 +337,7 @@ config IP_NF_TARGET_CLUSTERIP
         tristate "CLUSTERIP target support (EXPERIMENTAL)"
         depends on IP_NF_MANGLE && EXPERIMENTAL
         depends on NF_CONNTRACK_IPV4
+        depends on NETFILTER_ADVANCED
         select NF_CONNTRACK_MARK
         help
           The CLUSTERIP target allows you to build load-balancing clusters of
@@ -328,6 +350,7 @@ config IP_NF_TARGET_CLUSTERIP
 config IP_NF_RAW
         tristate  'raw table support (required for NOTRACK/TRACE)'
         depends on IP_NF_IPTABLES
+        depends on NETFILTER_ADVANCED
         help
           This option adds a `raw' table to iptables. This table is the very
           first in the netfilter framework and hooks in at the PREROUTING
@@ -340,6 +363,7 @@ config IP_NF_RAW
 config IP_NF_ARPTABLES
         tristate "ARP tables support"
         select NETFILTER_XTABLES
+        depends on NETFILTER_ADVANCED
         help
           arptables is a general, extensible packet identification framework.
           The ARP packet filtering and mangling (manipulation)subsystems