netfilter: arptables: allow xtables-nft only builds

Allows to build kernel that supports the arptables mangle target
via nftables' compat infra but without the arptables get/setsockopt
interface or the old arptables filter interpreter.

IOW, setting IP_NF_ARPFILTER=n will break arptables-legacy, but
arptables-nft will continue to work as long as nftables compat
support is enabled.

Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Phil Sutter <phil@nwl.cc>

diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index f71a7e9a7de6d8c474f2fe01e67049a4eb2ca85a..070475392236f135ad052cc15e045d3a9de6d9c3 100644 (file)
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -309,36 +309,34 @@ endif # IP_NF_IPTABLES
 
 # ARP tables
 config IP_NF_ARPTABLES
-       tristate "ARP tables support"
-       select NETFILTER_XTABLES
-       select NETFILTER_FAMILY_ARP
-       depends on NETFILTER_ADVANCED
-       help
-         arptables is a general, extensible packet identification framework.
-         The ARP packet filtering and mangling (manipulation)subsystems
-         use this: say Y or M here if you want to use either of those.
-
-         To compile it as a module, choose M here.  If unsure, say N.
+       tristate
 
-if IP_NF_ARPTABLES
+config NFT_COMPAT_ARP
+       tristate
+       depends on NF_TABLES_ARP && NFT_COMPAT
+       default m if NFT_COMPAT=m
+       default y if NFT_COMPAT=y
 
 config IP_NF_ARPFILTER
-       tristate "ARP packet filtering"
+       tristate "arptables-legacy packet filtering support"
+       select IP_NF_ARPTABLES
        help
          ARP packet filtering defines a table `filter', which has a series of
          rules for simple ARP packet filtering at local input and
-         local output.  On a bridge, you can also specify filtering rules
-         for forwarded ARP packets. See the man page for arptables(8).
+         local output.  This is only needed for arptables-legacy(8).
+         Neither arptables-nft nor nftables need this to work.
 
          To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_ARP_MANGLE
        tristate "ARP payload mangling"
+       depends on IP_NF_ARPTABLES || NFT_COMPAT_ARP
        help
          Allows altering the ARP packet payload: source and destination
          hardware and network addresses.
 
-endif # IP_NF_ARPTABLES
+         This option is needed by both arptables-legacy and arptables-nft.
+         It is not used by nftables.
 
 endmenu