Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | # |
2 | # Network configuration | |
3 | # | |
4 | ||
031cf19e | 5 | menuconfig NET |
1da177e4 | 6 | bool "Networking support" |
e9cc8bdd | 7 | select NLATTR |
4cd5773a | 8 | select GENERIC_NET_UTILS |
f89b7755 | 9 | select BPF |
1da177e4 LT |
10 | ---help--- |
11 | Unless you really know what you are doing, you should say Y here. | |
12 | The reason is that some programs need kernel networking support even | |
13 | when running on a stand-alone machine that isn't connected to any | |
d5950b43 | 14 | other computer. |
e446a276 | 15 | |
d5950b43 | 16 | If you are upgrading from an older kernel, you |
1da177e4 LT |
17 | should consider updating your networking tools too because changes |
18 | in the kernel and the tools often go hand in hand. The tools are | |
19 | contained in the package net-tools, the location and version number | |
20 | of which are given in <file:Documentation/Changes>. | |
21 | ||
22 | For a general introduction to Linux networking, it is highly | |
23 | recommended to read the NET-HOWTO, available from | |
24 | <http://www.tldp.org/docs.html#howto>. | |
25 | ||
6a2e9b73 | 26 | if NET |
1da177e4 | 27 | |
1dacc76d JB |
28 | config WANT_COMPAT_NETLINK_MESSAGES |
29 | bool | |
30 | help | |
31 | This option can be selected by other options that need compat | |
32 | netlink messages. | |
33 | ||
34 | config COMPAT_NETLINK_MESSAGES | |
35 | def_bool y | |
36 | depends on COMPAT | |
40b53d8a | 37 | depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES |
1dacc76d JB |
38 | help |
39 | This option makes it possible to send different netlink messages | |
40 | to tasks depending on whether the task is a compat task or not. To | |
41 | achieve this, you need to set skb_shinfo(skb)->frag_list to the | |
42 | compat skb before sending the skb, the netlink code will sort out | |
43 | which message to actually pass to the task. | |
44 | ||
45 | Newly written code should NEVER need this option but do | |
46 | compat-independent messages instead! | |
47 | ||
1cf51900 PN |
48 | config NET_INGRESS |
49 | bool | |
50 | ||
1f211a1b DB |
51 | config NET_EGRESS |
52 | bool | |
53 | ||
df5042f4 FW |
54 | config SKB_EXTENSIONS |
55 | bool | |
56 | ||
6a2e9b73 | 57 | menu "Networking options" |
1da177e4 | 58 | |
6a2e9b73 SR |
59 | source "net/packet/Kconfig" |
60 | source "net/unix/Kconfig" | |
3c4d7559 | 61 | source "net/tls/Kconfig" |
6a2e9b73 | 62 | source "net/xfrm/Kconfig" |
2356f4cb | 63 | source "net/iucv/Kconfig" |
ac713874 | 64 | source "net/smc/Kconfig" |
68e8b849 | 65 | source "net/xdp/Kconfig" |
1da177e4 LT |
66 | |
67 | config INET | |
68 | bool "TCP/IP networking" | |
798b2cbf DM |
69 | select CRYPTO |
70 | select CRYPTO_AES | |
1da177e4 LT |
71 | ---help--- |
72 | These are the protocols used on the Internet and on most local | |
73 | Ethernets. It is highly recommended to say Y here (this will enlarge | |
cf80efc2 | 74 | your kernel by about 400 KB), since some programs (e.g. the X window |
1da177e4 LT |
75 | system) use TCP/IP even if your machine is not connected to any |
76 | other computer. You will get the so-called loopback device which | |
77 | allows you to ping yourself (great fun, that!). | |
78 | ||
79 | For an excellent introduction to Linux networking, please read the | |
80 | Linux Networking HOWTO, available from | |
81 | <http://www.tldp.org/docs.html#howto>. | |
82 | ||
83 | If you say Y here and also to "/proc file system support" and | |
84 | "Sysctl support" below, you can change various aspects of the | |
85 | behavior of the TCP/IP code by writing to the (virtual) files in | |
86 | /proc/sys/net/ipv4/*; the options are explained in the file | |
87 | <file:Documentation/networking/ip-sysctl.txt>. | |
88 | ||
89 | Short answer: say Y. | |
90 | ||
6a2e9b73 | 91 | if INET |
1da177e4 | 92 | source "net/ipv4/Kconfig" |
1da177e4 | 93 | source "net/ipv6/Kconfig" |
38c94377 | 94 | source "net/netlabel/Kconfig" |
1da177e4 | 95 | |
6a2e9b73 SR |
96 | endif # if INET |
97 | ||
984bc16c JM |
98 | config NETWORK_SECMARK |
99 | bool "Security Marking" | |
100 | help | |
101 | This enables security marking of network packets, similar | |
102 | to nfmark, but designated for security purposes. | |
103 | If you are unsure how to answer this question, answer N. | |
104 | ||
408eccce DB |
105 | config NET_PTP_CLASSIFY |
106 | def_bool n | |
107 | ||
c1f19b51 RC |
108 | config NETWORK_PHY_TIMESTAMPING |
109 | bool "Timestamping in PHY devices" | |
408eccce | 110 | select NET_PTP_CLASSIFY |
c1f19b51 RC |
111 | help |
112 | This allows timestamping of network packets by PHYs with | |
113 | hardware timestamping capabilities. This option adds some | |
114 | overhead in the transmit and receive paths. | |
115 | ||
116 | If you are unsure how to answer this question, answer N. | |
117 | ||
1da177e4 | 118 | menuconfig NETFILTER |
ef91fd52 | 119 | bool "Network packet filtering framework (Netfilter)" |
1da177e4 LT |
120 | ---help--- |
121 | Netfilter is a framework for filtering and mangling network packets | |
122 | that pass through your Linux box. | |
123 | ||
124 | The most common use of packet filtering is to run your Linux box as | |
125 | a firewall protecting a local network from the Internet. The type of | |
126 | firewall provided by this kernel support is called a "packet | |
127 | filter", which means that it can reject individual network packets | |
128 | based on type, source, destination etc. The other kind of firewall, | |
129 | a "proxy-based" one, is more secure but more intrusive and more | |
130 | bothersome to set up; it inspects the network traffic much more | |
131 | closely, modifies it and has knowledge about the higher level | |
132 | protocols, which a packet filter lacks. Moreover, proxy-based | |
133 | firewalls often require changes to the programs running on the local | |
134 | clients. Proxy-based firewalls don't need support by the kernel, but | |
135 | they are often combined with a packet filter, which only works if | |
136 | you say Y here. | |
137 | ||
138 | You should also say Y here if you intend to use your Linux box as | |
139 | the gateway to the Internet for a local network of machines without | |
140 | globally valid IP addresses. This is called "masquerading": if one | |
141 | of the computers on your local network wants to send something to | |
142 | the outside, your box can "masquerade" as that computer, i.e. it | |
143 | forwards the traffic to the intended outside destination, but | |
144 | modifies the packets to make it look like they came from the | |
145 | firewall box itself. It works both ways: if the outside host | |
146 | replies, the Linux box will silently forward the traffic to the | |
147 | correct local computer. This way, the computers on your local net | |
148 | are completely invisible to the outside world, even though they can | |
149 | reach the outside and can receive replies. It is even possible to | |
150 | run globally visible servers from within a masqueraded local network | |
151 | using a mechanism called portforwarding. Masquerading is also often | |
152 | called NAT (Network Address Translation). | |
153 | ||
154 | Another use of Netfilter is in transparent proxying: if a machine on | |
155 | the local network tries to connect to an outside host, your Linux | |
156 | box can transparently forward the traffic to a local server, | |
157 | typically a caching proxy server. | |
158 | ||
159 | Yet another use of Netfilter is building a bridging firewall. Using | |
160 | a bridge with Network packet filtering enabled makes iptables "see" | |
161 | the bridged traffic. For filtering on the lower network and Ethernet | |
162 | protocols over the bridge, use ebtables (under bridge netfilter | |
163 | configuration). | |
164 | ||
165 | Various modules exist for netfilter which replace the previous | |
166 | masquerading (ipmasqadm), packet filtering (ipchains), transparent | |
167 | proxying, and portforwarding mechanisms. Please see | |
168 | <file:Documentation/Changes> under "iptables" for the location of | |
169 | these packages. | |
170 | ||
1da177e4 LT |
171 | if NETFILTER |
172 | ||
33b8e776 PM |
173 | config NETFILTER_ADVANCED |
174 | bool "Advanced netfilter configuration" | |
175 | depends on NETFILTER | |
176 | default y | |
177 | help | |
178 | If you say Y here you can select between all the netfilter modules. | |
692105b8 | 179 | If you say N the more unusual ones will not be shown and the |
33b8e776 PM |
180 | basic ones needed by most people will default to 'M'. |
181 | ||
182 | If unsure, say Y. | |
183 | ||
1da177e4 | 184 | config BRIDGE_NETFILTER |
34666d46 | 185 | tristate "Bridged IP/ARP packets filtering" |
57f5877c | 186 | depends on BRIDGE |
34666d46 | 187 | depends on NETFILTER && INET |
33b8e776 | 188 | depends on NETFILTER_ADVANCED |
2a95183a | 189 | select NETFILTER_FAMILY_BRIDGE |
de8bda1d | 190 | select SKB_EXTENSIONS |
34666d46 | 191 | default m |
1da177e4 LT |
192 | ---help--- |
193 | Enabling this option will let arptables resp. iptables see bridged | |
194 | ARP resp. IP traffic. If you want a bridging firewall, you probably | |
195 | want this option enabled. | |
196 | Enabling or disabling this option doesn't enable or disable | |
197 | ebtables. | |
198 | ||
199 | If unsure, say N. | |
200 | ||
9eb0eec7 | 201 | source "net/netfilter/Kconfig" |
1da177e4 LT |
202 | source "net/ipv4/netfilter/Kconfig" |
203 | source "net/ipv6/netfilter/Kconfig" | |
204 | source "net/decnet/netfilter/Kconfig" | |
205 | source "net/bridge/netfilter/Kconfig" | |
206 | ||
207 | endif | |
208 | ||
d2ba09c1 AS |
209 | source "net/bpfilter/Kconfig" |
210 | ||
7c657876 | 211 | source "net/dccp/Kconfig" |
1da177e4 | 212 | source "net/sctp/Kconfig" |
fe17f84f | 213 | source "net/rds/Kconfig" |
1e63e681 | 214 | source "net/tipc/Kconfig" |
6a2e9b73 | 215 | source "net/atm/Kconfig" |
fd558d18 | 216 | source "net/l2tp/Kconfig" |
a19800d7 | 217 | source "net/802/Kconfig" |
6a2e9b73 | 218 | source "net/bridge/Kconfig" |
91da11f8 | 219 | source "net/dsa/Kconfig" |
6a2e9b73 | 220 | source "net/8021q/Kconfig" |
1da177e4 | 221 | source "net/decnet/Kconfig" |
1da177e4 | 222 | source "net/llc/Kconfig" |
1da177e4 | 223 | source "drivers/net/appletalk/Kconfig" |
6a2e9b73 SR |
224 | source "net/x25/Kconfig" |
225 | source "net/lapb/Kconfig" | |
5075138d | 226 | source "net/phonet/Kconfig" |
2c6bed7c | 227 | source "net/6lowpan/Kconfig" |
9ec76716 | 228 | source "net/ieee802154/Kconfig" |
1010f540 | 229 | source "net/mac802154/Kconfig" |
1da177e4 | 230 | source "net/sched/Kconfig" |
2f90b865 | 231 | source "net/dcb/Kconfig" |
1a4240f4 | 232 | source "net/dns_resolver/Kconfig" |
c6c8fea2 | 233 | source "net/batman-adv/Kconfig" |
ccb1352e | 234 | source "net/openvswitch/Kconfig" |
d021c344 | 235 | source "net/vmw_vsock/Kconfig" |
eaaa3139 | 236 | source "net/netlink/Kconfig" |
0d89d203 | 237 | source "net/mpls/Kconfig" |
c411ed85 | 238 | source "net/nsh/Kconfig" |
f421436a | 239 | source "net/hsr/Kconfig" |
007f790c | 240 | source "net/switchdev/Kconfig" |
1b69c6d0 | 241 | source "net/l3mdev/Kconfig" |
bdabad3e | 242 | source "net/qrtr/Kconfig" |
2d283bdd | 243 | source "net/ncsi/Kconfig" |
1da177e4 | 244 | |
df334545 | 245 | config RPS |
6341e62b | 246 | bool |
044c8d4b | 247 | depends on SMP && SYSFS |
df334545 ED |
248 | default y |
249 | ||
c445477d | 250 | config RFS_ACCEL |
6341e62b | 251 | bool |
0244ad00 | 252 | depends on RPS |
c445477d BH |
253 | select CPU_RMAP |
254 | default y | |
255 | ||
bf264145 | 256 | config XPS |
6341e62b | 257 | bool |
044c8d4b | 258 | depends on SMP |
bf264145 TH |
259 | default y |
260 | ||
8cb2d8bf GC |
261 | config HWBM |
262 | bool | |
263 | ||
86f8515f | 264 | config CGROUP_NET_PRIO |
af636337 | 265 | bool "Network priority cgroup" |
5bc1421e | 266 | depends on CGROUPS |
2a56a1fe | 267 | select SOCK_CGROUP_DATA |
5bc1421e NH |
268 | ---help--- |
269 | Cgroup subsystem for use in assigning processes to network priorities on | |
86f8515f | 270 | a per-interface basis. |
5bc1421e | 271 | |
fe1217c4 | 272 | config CGROUP_NET_CLASSID |
6341e62b | 273 | bool "Network classid cgroup" |
fe1217c4 | 274 | depends on CGROUPS |
2a56a1fe | 275 | select SOCK_CGROUP_DATA |
fe1217c4 DB |
276 | ---help--- |
277 | Cgroup subsystem for use as general purpose socket classid marker that is | |
278 | being used in cls_cgroup and for netfilter matching. | |
279 | ||
e0d1095a | 280 | config NET_RX_BUSY_POLL |
6341e62b | 281 | bool |
89bf1b5a | 282 | default y |
06021292 | 283 | |
114cf580 | 284 | config BQL |
6341e62b | 285 | bool |
114cf580 TH |
286 | depends on SYSFS |
287 | select DQL | |
288 | default y | |
289 | ||
0a14842f ED |
290 | config BPF_JIT |
291 | bool "enable BPF Just In Time compiler" | |
6077776b | 292 | depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT |
b6202f97 | 293 | depends on MODULES |
0a14842f ED |
294 | ---help--- |
295 | Berkeley Packet Filter filtering capabilities are normally handled | |
296 | by an interpreter. This option allows kernel to generate a native | |
297 | code when filter is loaded in memory. This should speedup | |
4f3446bb DB |
298 | packet sniffing (libpcap/tcpdump). |
299 | ||
300 | Note, admin should enable this feature changing: | |
301 | /proc/sys/net/core/bpf_jit_enable | |
74451e66 DB |
302 | /proc/sys/net/core/bpf_jit_harden (optional) |
303 | /proc/sys/net/core/bpf_jit_kallsyms (optional) | |
0a14842f | 304 | |
08848246 JF |
305 | config BPF_STREAM_PARSER |
306 | bool "enable BPF STREAM_PARSER" | |
604326b4 | 307 | depends on INET |
08848246 | 308 | depends on BPF_SYSCALL |
604326b4 | 309 | depends on CGROUP_BPF |
08848246 | 310 | select STREAM_PARSER |
604326b4 | 311 | select NET_SOCK_MSG |
08848246 JF |
312 | ---help--- |
313 | Enabling this allows a stream parser to be used with | |
314 | BPF_MAP_TYPE_SOCKMAP. | |
315 | ||
316 | BPF_MAP_TYPE_SOCKMAP provides a map type to use with network sockets. | |
317 | It can be used to enforce socket policy, implement socket redirects, | |
318 | etc. | |
319 | ||
99bbc707 | 320 | config NET_FLOW_LIMIT |
6341e62b | 321 | bool |
99bbc707 WB |
322 | depends on RPS |
323 | default y | |
324 | ---help--- | |
325 | The network stack has to drop packets when a receive processing CPU's | |
326 | backlog reaches netdev_max_backlog. If a few out of many active flows | |
327 | generate the vast majority of load, drop their traffic earlier to | |
328 | maintain capacity for the other flows. This feature provides servers | |
329 | with many clients some protection against DoS by a single (spoofed) | |
330 | flow that greatly exceeds average workload. | |
331 | ||
1da177e4 LT |
332 | menu "Network testing" |
333 | ||
334 | config NET_PKTGEN | |
335 | tristate "Packet Generator (USE WITH CAUTION)" | |
ffd756b3 | 336 | depends on INET && PROC_FS |
1da177e4 LT |
337 | ---help--- |
338 | This module will inject preconfigured packets, at a configurable | |
339 | rate, out of a given interface. It is used for network interface | |
340 | stress testing and performance analysis. If you don't understand | |
341 | what was just said, you don't need it: say N. | |
342 | ||
343 | Documentation on how to use the packet generator can be found | |
344 | at <file:Documentation/networking/pktgen.txt>. | |
345 | ||
346 | To compile this code as a module, choose M here: the | |
347 | module will be called pktgen. | |
348 | ||
273ae44b | 349 | config NET_DROP_MONITOR |
cad456d5 | 350 | tristate "Network packet drop alerting service" |
911f8635 | 351 | depends on INET && TRACEPOINTS |
273ae44b NH |
352 | ---help--- |
353 | This feature provides an alerting service to userspace in the | |
354 | event that packets are discarded in the network stack. Alerts | |
355 | are broadcast via netlink socket to any listening user space | |
356 | process. If you don't need network drop alerts, or if you are ok | |
357 | just checking the various proc files and other utilities for | |
358 | drop statistics, say N here. | |
359 | ||
1da177e4 LT |
360 | endmenu |
361 | ||
362 | endmenu | |
363 | ||
1da177e4 | 364 | source "net/ax25/Kconfig" |
0d66548a | 365 | source "net/can/Kconfig" |
1da177e4 | 366 | source "net/bluetooth/Kconfig" |
17926a79 | 367 | source "net/rxrpc/Kconfig" |
ab7ac4eb | 368 | source "net/kcm/Kconfig" |
43a0c675 | 369 | source "net/strparser/Kconfig" |
d86b5e0e | 370 | |
14c0b97d TG |
371 | config FIB_RULES |
372 | bool | |
373 | ||
5442060c RD |
374 | menuconfig WIRELESS |
375 | bool "Wireless" | |
f54bfc0e | 376 | depends on !S390 |
5442060c RD |
377 | default y |
378 | ||
379 | if WIRELESS | |
2a5e1c0e JB |
380 | |
381 | source "net/wireless/Kconfig" | |
f0706e82 | 382 | source "net/mac80211/Kconfig" |
2a5e1c0e | 383 | |
5442060c | 384 | endif # WIRELESS |
2a5e1c0e | 385 | |
b0c83ae1 IPG |
386 | source "net/wimax/Kconfig" |
387 | ||
cf4328cd | 388 | source "net/rfkill/Kconfig" |
bd238fb4 | 389 | source "net/9p/Kconfig" |
3908c690 | 390 | source "net/caif/Kconfig" |
3d14c5d2 | 391 | source "net/ceph/Kconfig" |
3e256b8f | 392 | source "net/nfc/Kconfig" |
6ae0a628 | 393 | source "net/psample/Kconfig" |
1ce84604 | 394 | source "net/ife/Kconfig" |
3908c690 | 395 | |
499a2425 RP |
396 | config LWTUNNEL |
397 | bool "Network light weight tunnels" | |
398 | ---help--- | |
399 | This feature provides an infrastructure to support light weight | |
400 | tunnels like mpls. There is no netdevice associated with a light | |
401 | weight tunnel endpoint. Tunnel encapsulation parameters are stored | |
402 | with light weight tunnel state associated with fib routes. | |
cf4328cd | 403 | |
3a0af8fd TG |
404 | config LWTUNNEL_BPF |
405 | bool "Execute BPF program as route nexthop action" | |
b251f9f6 | 406 | depends on LWTUNNEL && INET |
3a0af8fd TG |
407 | default y if LWTUNNEL=y |
408 | ---help--- | |
409 | Allows to run BPF programs as a nexthop action following a route | |
410 | lookup for incoming and outgoing packets. | |
411 | ||
911362c7 | 412 | config DST_CACHE |
9b246841 | 413 | bool |
911362c7 PA |
414 | default n |
415 | ||
97e219b7 ED |
416 | config GRO_CELLS |
417 | bool | |
418 | default n | |
419 | ||
ebf4e808 IL |
420 | config SOCK_VALIDATE_XMIT |
421 | bool | |
422 | ||
604326b4 DB |
423 | config NET_SOCK_MSG |
424 | bool | |
425 | default n | |
426 | help | |
427 | The NET_SOCK_MSG provides a framework for plain sockets (e.g. TCP) or | |
428 | ULPs (upper layer modules, e.g. TLS) to process L7 application data | |
429 | with the help of BPF programs. | |
430 | ||
bfcd3a46 | 431 | config NET_DEVLINK |
f6b19b35 JP |
432 | bool |
433 | default n | |
bfcd3a46 | 434 | |
ff7d6b27 JDB |
435 | config PAGE_POOL |
436 | bool | |
437 | ||
30c8bd5a SS |
438 | config FAILOVER |
439 | tristate "Generic failover module" | |
440 | help | |
441 | The failover module provides a generic interface for paravirtual | |
442 | drivers to register a netdev and a set of ops with a failover | |
443 | instance. The ops are used as event handlers that get called to | |
444 | handle netdev register/unregister/link change/name change events | |
445 | on slave pci ethernet devices with the same mac address as the | |
446 | failover netdev. This enables paravirtual drivers to use a | |
447 | VF as an accelerated low latency datapath. It also allows live | |
448 | migration of VMs with direct attached VFs by failing over to the | |
449 | paravirtual datapath when the VF is unplugged. | |
450 | ||
6a2e9b73 | 451 | endif # if NET |
e47b65b0 | 452 | |
6077776b DB |
453 | # Used by archs to tell that they support BPF JIT compiler plus which flavour. |
454 | # Only one of the two can be selected for a specific arch since eBPF JIT supersedes | |
455 | # the cBPF JIT. | |
456 | ||
457 | # Classic BPF JIT (cBPF) | |
458 | config HAVE_CBPF_JIT | |
459 | bool | |
460 | ||
461 | # Extended BPF JIT (eBPF) | |
462 | config HAVE_EBPF_JIT | |
e47b65b0 | 463 | bool |