path: root/net/Kconfig (plain)
blob: 37757600171aaf0f0855bc1d97df89cabf5e7358

1	#
2	# Network configuration
3	#
4
5	menuconfig NET
6	bool "Networking support"
7	select NLATTR
8	select GENERIC_NET_UTILS
9	select BPF
10	---help---
11	Unless you really know what you are doing, you should say Y here.
12	The reason is that some programs need kernel networking support even
13	when running on a stand-alone machine that isn't connected to any
14	other computer.
15
16	If you are upgrading from an older kernel, you
17	should consider updating your networking tools too because changes
18	in the kernel and the tools often go hand in hand. The tools are
19	contained in the package net-tools, the location and version number
20	of which are given in <file:Documentation/Changes>.
21
22	For a general introduction to Linux networking, it is highly
23	recommended to read the NET-HOWTO, available from
24	<http://www.tldp.org/docs.html#howto>.
25
26	if NET
27
28	config WANT_COMPAT_NETLINK_MESSAGES
29	bool
30	help
31	This option can be selected by other options that need compat
32	netlink messages.
33
34	config COMPAT_NETLINK_MESSAGES
35	def_bool y
36	depends on COMPAT
37	depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES
38	help
39	This option makes it possible to send different netlink messages
40	to tasks depending on whether the task is a compat task or not. To
41	achieve this, you need to set skb_shinfo(skb)->frag_list to the
42	compat skb before sending the skb, the netlink code will sort out
43	which message to actually pass to the task.
44
45	Newly written code should NEVER need this option but do
46	compat-independent messages instead!
47
48	config NET_INGRESS
49	bool
50
51	config NET_EGRESS
52	bool
53
54	menu "Networking options"
55
56	source "net/packet/Kconfig"
57	source "net/unix/Kconfig"
58	source "net/xfrm/Kconfig"
59	source "net/iucv/Kconfig"
60
61	config INET
62	bool "TCP/IP networking"
63	select CRYPTO
64	select CRYPTO_AES
65	---help---
66	These are the protocols used on the Internet and on most local
67	Ethernets. It is highly recommended to say Y here (this will enlarge
68	your kernel by about 400 KB), since some programs (e.g. the X window
69	system) use TCP/IP even if your machine is not connected to any
70	other computer. You will get the so-called loopback device which
71	allows you to ping yourself (great fun, that!).
72
73	For an excellent introduction to Linux networking, please read the
74	Linux Networking HOWTO, available from
75	<http://www.tldp.org/docs.html#howto>.
76
77	If you say Y here and also to "/proc file system support" and
78	"Sysctl support" below, you can change various aspects of the
79	behavior of the TCP/IP code by writing to the (virtual) files in
80	/proc/sys/net/ipv4/*; the options are explained in the file
81	<file:Documentation/networking/ip-sysctl.txt>.
82
83	Short answer: say Y.
84
85	if INET
86	source "net/ipv4/Kconfig"
87	source "net/ipv6/Kconfig"
88	source "net/netlabel/Kconfig"
89
90	endif # if INET
91
92	config ANDROID_PARANOID_NETWORK
93	bool "Only allow certain groups to create sockets"
94	default y
95	help
96	none
97
98	config NETWORK_SECMARK
99	bool "Security Marking"
100	help
101	This enables security marking of network packets, similar
102	to nfmark, but designated for security purposes.
103	If you are unsure how to answer this question, answer N.
104
105	config NET_PTP_CLASSIFY
106	def_bool n
107
108	config NETWORK_PHY_TIMESTAMPING
109	bool "Timestamping in PHY devices"
110	select NET_PTP_CLASSIFY
111	help
112	This allows timestamping of network packets by PHYs with
113	hardware timestamping capabilities. This option adds some
114	overhead in the transmit and receive paths.
115
116	If you are unsure how to answer this question, answer N.
117
118	menuconfig NETFILTER
119	bool "Network packet filtering framework (Netfilter)"
120	---help---
121	Netfilter is a framework for filtering and mangling network packets
122	that pass through your Linux box.
123
124	The most common use of packet filtering is to run your Linux box as
125	a firewall protecting a local network from the Internet. The type of
126	firewall provided by this kernel support is called a "packet
127	filter", which means that it can reject individual network packets
128	based on type, source, destination etc. The other kind of firewall,
129	a "proxy-based" one, is more secure but more intrusive and more
130	bothersome to set up; it inspects the network traffic much more
131	closely, modifies it and has knowledge about the higher level
132	protocols, which a packet filter lacks. Moreover, proxy-based
133	firewalls often require changes to the programs running on the local
134	clients. Proxy-based firewalls don't need support by the kernel, but
135	they are often combined with a packet filter, which only works if
136	you say Y here.
137
138	You should also say Y here if you intend to use your Linux box as
139	the gateway to the Internet for a local network of machines without
140	globally valid IP addresses. This is called "masquerading": if one
141	of the computers on your local network wants to send something to
142	the outside, your box can "masquerade" as that computer, i.e. it
143	forwards the traffic to the intended outside destination, but
144	modifies the packets to make it look like they came from the
145	firewall box itself. It works both ways: if the outside host
146	replies, the Linux box will silently forward the traffic to the
147	correct local computer. This way, the computers on your local net
148	are completely invisible to the outside world, even though they can
149	reach the outside and can receive replies. It is even possible to
150	run globally visible servers from within a masqueraded local network
151	using a mechanism called portforwarding. Masquerading is also often
152	called NAT (Network Address Translation).
153
154	Another use of Netfilter is in transparent proxying: if a machine on
155	the local network tries to connect to an outside host, your Linux
156	box can transparently forward the traffic to a local server,
157	typically a caching proxy server.
158
159	Yet another use of Netfilter is building a bridging firewall. Using
160	a bridge with Network packet filtering enabled makes iptables "see"
161	the bridged traffic. For filtering on the lower network and Ethernet
162	protocols over the bridge, use ebtables (under bridge netfilter
163	configuration).
164
165	Various modules exist for netfilter which replace the previous
166	masquerading (ipmasqadm), packet filtering (ipchains), transparent
167	proxying, and portforwarding mechanisms. Please see
168	<file:Documentation/Changes> under "iptables" for the location of
169	these packages.
170
171	if NETFILTER
172
173	config NETFILTER_DEBUG
174	bool "Network packet filtering debugging"
175	depends on NETFILTER
176	help
177	You can say Y here if you want to get additional messages useful in
178	debugging the netfilter code.
179
180	config NETFILTER_ADVANCED
181	bool "Advanced netfilter configuration"
182	depends on NETFILTER
183	default y
184	help
185	If you say Y here you can select between all the netfilter modules.
186	If you say N the more unusual ones will not be shown and the
187	basic ones needed by most people will default to 'M'.
188
189	If unsure, say Y.
190
191	config BRIDGE_NETFILTER
192	tristate "Bridged IP/ARP packets filtering"
193	depends on BRIDGE
194	depends on NETFILTER && INET
195	depends on NETFILTER_ADVANCED
196	default m
197	---help---
198	Enabling this option will let arptables resp. iptables see bridged
199	ARP resp. IP traffic. If you want a bridging firewall, you probably
200	want this option enabled.
201	Enabling or disabling this option doesn't enable or disable
202	ebtables.
203
204	If unsure, say N.
205
206	source "net/netfilter/Kconfig"
207	source "net/ipv4/netfilter/Kconfig"
208	source "net/ipv6/netfilter/Kconfig"
209	source "net/decnet/netfilter/Kconfig"
210	source "net/bridge/netfilter/Kconfig"
211
212	endif
213
214	source "net/dccp/Kconfig"
215	source "net/sctp/Kconfig"
216	source "net/rds/Kconfig"
217	source "net/tipc/Kconfig"
218	source "net/atm/Kconfig"
219	source "net/l2tp/Kconfig"
220	source "net/802/Kconfig"
221	source "net/bridge/Kconfig"
222	source "net/dsa/Kconfig"
223	source "net/8021q/Kconfig"
224	source "net/decnet/Kconfig"
225	source "net/llc/Kconfig"
226	source "net/ipx/Kconfig"
227	source "drivers/net/appletalk/Kconfig"
228	source "net/x25/Kconfig"
229	source "net/lapb/Kconfig"
230	source "net/phonet/Kconfig"
231	source "net/6lowpan/Kconfig"
232	source "net/ieee802154/Kconfig"
233	source "net/mac802154/Kconfig"
234	source "net/sched/Kconfig"
235	source "net/dcb/Kconfig"
236	source "net/dns_resolver/Kconfig"
237	source "net/batman-adv/Kconfig"
238	source "net/openvswitch/Kconfig"
239	source "net/vmw_vsock/Kconfig"
240	source "net/netlink/Kconfig"
241	source "net/mpls/Kconfig"
242	source "net/hsr/Kconfig"
243	source "net/switchdev/Kconfig"
244	source "net/l3mdev/Kconfig"
245	source "net/qrtr/Kconfig"
246	source "net/ncsi/Kconfig"
247
248	config RPS
249	bool
250	depends on SMP && SYSFS
251	default y
252
253	config RFS_ACCEL
254	bool
255	depends on RPS
256	select CPU_RMAP
257	default y
258
259	config XPS
260	bool
261	depends on SMP
262	default y
263
264	config HWBM
265	bool
266
267	config CGROUP_NET_PRIO
268	bool "Network priority cgroup"
269	depends on CGROUPS
270	select SOCK_CGROUP_DATA
271	---help---
272	Cgroup subsystem for use in assigning processes to network priorities on
273	a per-interface basis.
274
275	config CGROUP_NET_CLASSID
276	bool "Network classid cgroup"
277	depends on CGROUPS
278	select SOCK_CGROUP_DATA
279	---help---
280	Cgroup subsystem for use as general purpose socket classid marker that is
281	being used in cls_cgroup and for netfilter matching.
282
283	config NET_RX_BUSY_POLL
284	bool
285	default y
286
287	config BQL
288	bool
289	depends on SYSFS
290	select DQL
291	default y
292
293	config BPF_JIT
294	bool "enable BPF Just In Time compiler"
295	depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
296	depends on MODULES
297	depends on !CFI
298	---help---
299	Berkeley Packet Filter filtering capabilities are normally handled
300	by an interpreter. This option allows kernel to generate a native
301	code when filter is loaded in memory. This should speedup
302	packet sniffing (libpcap/tcpdump).
303
304	Note, admin should enable this feature changing:
305	/proc/sys/net/core/bpf_jit_enable
306	/proc/sys/net/core/bpf_jit_harden (optional)
307
308	config NET_FLOW_LIMIT
309	bool
310	depends on RPS
311	default y
312	---help---
313	The network stack has to drop packets when a receive processing CPU's
314	backlog reaches netdev_max_backlog. If a few out of many active flows
315	generate the vast majority of load, drop their traffic earlier to
316	maintain capacity for the other flows. This feature provides servers
317	with many clients some protection against DoS by a single (spoofed)
318	flow that greatly exceeds average workload.
319
320	menu "Network testing"
321
322	config NET_PKTGEN
323	tristate "Packet Generator (USE WITH CAUTION)"
324	depends on INET && PROC_FS
325	---help---
326	This module will inject preconfigured packets, at a configurable
327	rate, out of a given interface. It is used for network interface
328	stress testing and performance analysis. If you don't understand
329	what was just said, you don't need it: say N.
330
331	Documentation on how to use the packet generator can be found
332	at <file:Documentation/networking/pktgen.txt>.
333
334	To compile this code as a module, choose M here: the
335	module will be called pktgen.
336
337	config NET_TCPPROBE
338	tristate "TCP connection probing"
339	depends on INET && PROC_FS && KPROBES
340	---help---
341	This module allows for capturing the changes to TCP connection
342	state in response to incoming packets. It is used for debugging
343	TCP congestion avoidance modules. If you don't understand
344	what was just said, you don't need it: say N.
345
346	Documentation on how to use TCP connection probing can be found
347	at:
348
349	http://www.linuxfoundation.org/collaborate/workgroups/networking/tcpprobe
350
351	To compile this code as a module, choose M here: the
352	module will be called tcp_probe.
353
354	config NET_DROP_MONITOR
355	tristate "Network packet drop alerting service"
356	depends on INET && TRACEPOINTS
357	---help---
358	This feature provides an alerting service to userspace in the
359	event that packets are discarded in the network stack. Alerts
360	are broadcast via netlink socket to any listening user space
361	process. If you don't need network drop alerts, or if you are ok
362	just checking the various proc files and other utilities for
363	drop statistics, say N here.
364
365	endmenu
366
367	endmenu
368
369	source "net/ax25/Kconfig"
370	source "net/can/Kconfig"
371	source "net/irda/Kconfig"
372	source "net/bluetooth/Kconfig"
373	source "net/rxrpc/Kconfig"
374	source "net/kcm/Kconfig"
375	source "net/strparser/Kconfig"
376
377	config FIB_RULES
378	bool
379
380	menuconfig WIRELESS
381	bool "Wireless"
382	depends on !S390
383	default y
384
385	if WIRELESS
386
387	source "net/wireless/Kconfig"
388	source "net/mac80211/Kconfig"
389
390	endif # WIRELESS
391
392	source "net/wimax/Kconfig"
393
394	source "net/rfkill/Kconfig"
395	source "net/9p/Kconfig"
396	source "net/caif/Kconfig"
397	source "net/ceph/Kconfig"
398	source "net/nfc/Kconfig"
399
400	config LWTUNNEL
401	bool "Network light weight tunnels"
402	---help---
403	This feature provides an infrastructure to support light weight
404	tunnels like mpls. There is no netdevice associated with a light
405	weight tunnel endpoint. Tunnel encapsulation parameters are stored
406	with light weight tunnel state associated with fib routes.
407
408	config DST_CACHE
409	bool
410	default n
411
412	config NET_DEVLINK
413	tristate "Network physical/parent device Netlink interface"
414	help
415	Network physical/parent device Netlink interface provides
416	infrastructure to support access to physical chip-wide config and
417	monitoring.
418
419	config MAY_USE_DEVLINK
420	tristate
421	default m if NET_DEVLINK=m
422	default y if NET_DEVLINK=y || NET_DEVLINK=n
423	help
424	Drivers using the devlink infrastructure should have a dependency
425	on MAY_USE_DEVLINK to ensure they do not cause link errors when
426	devlink is a loadable module and the driver using it is built-in.
427
428	endif # if NET
429
430	# Used by archs to tell that they support BPF JIT compiler plus which flavour.
431	# Only one of the two can be selected for a specific arch since eBPF JIT supersedes
432	# the cBPF JIT.
433
434	# Classic BPF JIT (cBPF)
435	config HAVE_CBPF_JIT
436	bool
437
438	# Extended BPF JIT (eBPF)
439	config HAVE_EBPF_JIT
440	bool
441