xref: /linux/net/Kconfig (revision ef91fd522ba3c88d9c68261c243567bc4c5a8f55)
11da177e4SLinus Torvalds#
21da177e4SLinus Torvalds# Network configuration
31da177e4SLinus Torvalds#
41da177e4SLinus Torvalds
5d5950b43SSam Ravnborgmenu "Networking"
61da177e4SLinus Torvalds
71da177e4SLinus Torvaldsconfig NET
81da177e4SLinus Torvalds	bool "Networking support"
91da177e4SLinus Torvalds	---help---
101da177e4SLinus Torvalds	  Unless you really know what you are doing, you should say Y here.
111da177e4SLinus Torvalds	  The reason is that some programs need kernel networking support even
121da177e4SLinus Torvalds	  when running on a stand-alone machine that isn't connected to any
13d5950b43SSam Ravnborg	  other computer.
14d5950b43SSam Ravnborg
15d5950b43SSam Ravnborg	  If you are upgrading from an older kernel, you
161da177e4SLinus Torvalds	  should consider updating your networking tools too because changes
171da177e4SLinus Torvalds	  in the kernel and the tools often go hand in hand. The tools are
181da177e4SLinus Torvalds	  contained in the package net-tools, the location and version number
191da177e4SLinus Torvalds	  of which are given in <file:Documentation/Changes>.
201da177e4SLinus Torvalds
211da177e4SLinus Torvalds	  For a general introduction to Linux networking, it is highly
221da177e4SLinus Torvalds	  recommended to read the NET-HOWTO, available from
231da177e4SLinus Torvalds	  <http://www.tldp.org/docs.html#howto>.
241da177e4SLinus Torvalds
256a2e9b73SSam Ravnborg# Make sure that all config symbols are dependent on NET
266a2e9b73SSam Ravnborgif NET
276a2e9b73SSam Ravnborg
281da177e4SLinus Torvaldsmenu "Networking options"
291da177e4SLinus Torvalds
300dec456dSStephen Hemmingerconfig NETDEBUG
310dec456dSStephen Hemminger	bool "Network packet debugging"
320dec456dSStephen Hemminger	help
330dec456dSStephen Hemminger	  You can say Y here if you want to get additional messages useful in
340dec456dSStephen Hemminger	  debugging bad packets, but can overwhelm logs under denial of service
350dec456dSStephen Hemminger	  attacks.
360dec456dSStephen Hemminger
376a2e9b73SSam Ravnborgsource "net/packet/Kconfig"
386a2e9b73SSam Ravnborgsource "net/unix/Kconfig"
396a2e9b73SSam Ravnborgsource "net/xfrm/Kconfig"
401da177e4SLinus Torvalds
411da177e4SLinus Torvaldsconfig INET
421da177e4SLinus Torvalds	bool "TCP/IP networking"
431da177e4SLinus Torvalds	---help---
441da177e4SLinus Torvalds	  These are the protocols used on the Internet and on most local
451da177e4SLinus Torvalds	  Ethernets. It is highly recommended to say Y here (this will enlarge
461da177e4SLinus Torvalds	  your kernel by about 144 KB), since some programs (e.g. the X window
471da177e4SLinus Torvalds	  system) use TCP/IP even if your machine is not connected to any
481da177e4SLinus Torvalds	  other computer. You will get the so-called loopback device which
491da177e4SLinus Torvalds	  allows you to ping yourself (great fun, that!).
501da177e4SLinus Torvalds
511da177e4SLinus Torvalds	  For an excellent introduction to Linux networking, please read the
521da177e4SLinus Torvalds	  Linux Networking HOWTO, available from
531da177e4SLinus Torvalds	  <http://www.tldp.org/docs.html#howto>.
541da177e4SLinus Torvalds
551da177e4SLinus Torvalds	  If you say Y here and also to "/proc file system support" and
561da177e4SLinus Torvalds	  "Sysctl support" below, you can change various aspects of the
571da177e4SLinus Torvalds	  behavior of the TCP/IP code by writing to the (virtual) files in
581da177e4SLinus Torvalds	  /proc/sys/net/ipv4/*; the options are explained in the file
591da177e4SLinus Torvalds	  <file:Documentation/networking/ip-sysctl.txt>.
601da177e4SLinus Torvalds
611da177e4SLinus Torvalds	  Short answer: say Y.
621da177e4SLinus Torvalds
636a2e9b73SSam Ravnborgif INET
641da177e4SLinus Torvaldssource "net/ipv4/Kconfig"
651da177e4SLinus Torvaldssource "net/ipv6/Kconfig"
6638c94377SPaul Mooresource "net/netlabel/Kconfig"
671da177e4SLinus Torvalds
686a2e9b73SSam Ravnborgendif # if INET
696a2e9b73SSam Ravnborg
70984bc16cSJames Morrisconfig NETWORK_SECMARK
71984bc16cSJames Morris	bool "Security Marking"
72984bc16cSJames Morris	help
73984bc16cSJames Morris	  This enables security marking of network packets, similar
74984bc16cSJames Morris	  to nfmark, but designated for security purposes.
75984bc16cSJames Morris	  If you are unsure how to answer this question, answer N.
76984bc16cSJames Morris
771da177e4SLinus Torvaldsmenuconfig NETFILTER
78*ef91fd52SPablo Neira Ayuso	bool "Network packet filtering framework (Netfilter)"
791da177e4SLinus Torvalds	---help---
801da177e4SLinus Torvalds	  Netfilter is a framework for filtering and mangling network packets
811da177e4SLinus Torvalds	  that pass through your Linux box.
821da177e4SLinus Torvalds
831da177e4SLinus Torvalds	  The most common use of packet filtering is to run your Linux box as
841da177e4SLinus Torvalds	  a firewall protecting a local network from the Internet. The type of
851da177e4SLinus Torvalds	  firewall provided by this kernel support is called a "packet
861da177e4SLinus Torvalds	  filter", which means that it can reject individual network packets
871da177e4SLinus Torvalds	  based on type, source, destination etc. The other kind of firewall,
881da177e4SLinus Torvalds	  a "proxy-based" one, is more secure but more intrusive and more
891da177e4SLinus Torvalds	  bothersome to set up; it inspects the network traffic much more
901da177e4SLinus Torvalds	  closely, modifies it and has knowledge about the higher level
911da177e4SLinus Torvalds	  protocols, which a packet filter lacks. Moreover, proxy-based
921da177e4SLinus Torvalds	  firewalls often require changes to the programs running on the local
931da177e4SLinus Torvalds	  clients. Proxy-based firewalls don't need support by the kernel, but
941da177e4SLinus Torvalds	  they are often combined with a packet filter, which only works if
951da177e4SLinus Torvalds	  you say Y here.
961da177e4SLinus Torvalds
971da177e4SLinus Torvalds	  You should also say Y here if you intend to use your Linux box as
981da177e4SLinus Torvalds	  the gateway to the Internet for a local network of machines without
991da177e4SLinus Torvalds	  globally valid IP addresses. This is called "masquerading": if one
1001da177e4SLinus Torvalds	  of the computers on your local network wants to send something to
1011da177e4SLinus Torvalds	  the outside, your box can "masquerade" as that computer, i.e. it
1021da177e4SLinus Torvalds	  forwards the traffic to the intended outside destination, but
1031da177e4SLinus Torvalds	  modifies the packets to make it look like they came from the
1041da177e4SLinus Torvalds	  firewall box itself. It works both ways: if the outside host
1051da177e4SLinus Torvalds	  replies, the Linux box will silently forward the traffic to the
1061da177e4SLinus Torvalds	  correct local computer. This way, the computers on your local net
1071da177e4SLinus Torvalds	  are completely invisible to the outside world, even though they can
1081da177e4SLinus Torvalds	  reach the outside and can receive replies. It is even possible to
1091da177e4SLinus Torvalds	  run globally visible servers from within a masqueraded local network
1101da177e4SLinus Torvalds	  using a mechanism called portforwarding. Masquerading is also often
1111da177e4SLinus Torvalds	  called NAT (Network Address Translation).
1121da177e4SLinus Torvalds
1131da177e4SLinus Torvalds	  Another use of Netfilter is in transparent proxying: if a machine on
1141da177e4SLinus Torvalds	  the local network tries to connect to an outside host, your Linux
1151da177e4SLinus Torvalds	  box can transparently forward the traffic to a local server,
1161da177e4SLinus Torvalds	  typically a caching proxy server.
1171da177e4SLinus Torvalds
1181da177e4SLinus Torvalds	  Yet another use of Netfilter is building a bridging firewall. Using
1191da177e4SLinus Torvalds	  a bridge with Network packet filtering enabled makes iptables "see"
1201da177e4SLinus Torvalds	  the bridged traffic. For filtering on the lower network and Ethernet
1211da177e4SLinus Torvalds	  protocols over the bridge, use ebtables (under bridge netfilter
1221da177e4SLinus Torvalds	  configuration).
1231da177e4SLinus Torvalds
1241da177e4SLinus Torvalds	  Various modules exist for netfilter which replace the previous
1251da177e4SLinus Torvalds	  masquerading (ipmasqadm), packet filtering (ipchains), transparent
1261da177e4SLinus Torvalds	  proxying, and portforwarding mechanisms. Please see
1271da177e4SLinus Torvalds	  <file:Documentation/Changes> under "iptables" for the location of
1281da177e4SLinus Torvalds	  these packages.
1291da177e4SLinus Torvalds
1301da177e4SLinus Torvalds	  Make sure to say N to "Fast switching" below if you intend to say Y
1311da177e4SLinus Torvalds	  here, as Fast switching currently bypasses netfilter.
1321da177e4SLinus Torvalds
1331da177e4SLinus Torvalds	  Chances are that you should say Y here if you compile a kernel which
1341da177e4SLinus Torvalds	  will run as a router and N for regular hosts. If unsure, say N.
1351da177e4SLinus Torvalds
1361da177e4SLinus Torvaldsif NETFILTER
1371da177e4SLinus Torvalds
1381da177e4SLinus Torvaldsconfig NETFILTER_DEBUG
1391da177e4SLinus Torvalds	bool "Network packet filtering debugging"
1401da177e4SLinus Torvalds	depends on NETFILTER
1411da177e4SLinus Torvalds	help
1421da177e4SLinus Torvalds	  You can say Y here if you want to get additional messages useful in
1431da177e4SLinus Torvalds	  debugging the netfilter code.
1441da177e4SLinus Torvalds
1451da177e4SLinus Torvaldsconfig BRIDGE_NETFILTER
1461da177e4SLinus Torvalds	bool "Bridged IP/ARP packets filtering"
1471da177e4SLinus Torvalds	depends on BRIDGE && NETFILTER && INET
1481da177e4SLinus Torvalds	default y
1491da177e4SLinus Torvalds	---help---
1501da177e4SLinus Torvalds	  Enabling this option will let arptables resp. iptables see bridged
1511da177e4SLinus Torvalds	  ARP resp. IP traffic. If you want a bridging firewall, you probably
1521da177e4SLinus Torvalds	  want this option enabled.
1531da177e4SLinus Torvalds	  Enabling or disabling this option doesn't enable or disable
1541da177e4SLinus Torvalds	  ebtables.
1551da177e4SLinus Torvalds
1561da177e4SLinus Torvalds	  If unsure, say N.
1571da177e4SLinus Torvalds
1589eb0eec7SHarald Weltesource "net/netfilter/Kconfig"
1591da177e4SLinus Torvaldssource "net/ipv4/netfilter/Kconfig"
1601da177e4SLinus Torvaldssource "net/ipv6/netfilter/Kconfig"
1611da177e4SLinus Torvaldssource "net/decnet/netfilter/Kconfig"
1621da177e4SLinus Torvaldssource "net/bridge/netfilter/Kconfig"
1631da177e4SLinus Torvalds
1641da177e4SLinus Torvaldsendif
1651da177e4SLinus Torvalds
1667c657876SArnaldo Carvalho de Melosource "net/dccp/Kconfig"
1671da177e4SLinus Torvaldssource "net/sctp/Kconfig"
1681e63e681SPer Lidensource "net/tipc/Kconfig"
1696a2e9b73SSam Ravnborgsource "net/atm/Kconfig"
1706a2e9b73SSam Ravnborgsource "net/bridge/Kconfig"
1716a2e9b73SSam Ravnborgsource "net/8021q/Kconfig"
1721da177e4SLinus Torvaldssource "net/decnet/Kconfig"
1731da177e4SLinus Torvaldssource "net/llc/Kconfig"
1741da177e4SLinus Torvaldssource "net/ipx/Kconfig"
1751da177e4SLinus Torvaldssource "drivers/net/appletalk/Kconfig"
1766a2e9b73SSam Ravnborgsource "net/x25/Kconfig"
1776a2e9b73SSam Ravnborgsource "net/lapb/Kconfig"
1786a2e9b73SSam Ravnborgsource "net/econet/Kconfig"
1796a2e9b73SSam Ravnborgsource "net/wanrouter/Kconfig"
1801da177e4SLinus Torvaldssource "net/sched/Kconfig"
1811da177e4SLinus Torvalds
1821da177e4SLinus Torvaldsmenu "Network testing"
1831da177e4SLinus Torvalds
1841da177e4SLinus Torvaldsconfig NET_PKTGEN
1851da177e4SLinus Torvalds	tristate "Packet Generator (USE WITH CAUTION)"
1861da177e4SLinus Torvalds	depends on PROC_FS
1871da177e4SLinus Torvalds	---help---
1881da177e4SLinus Torvalds	  This module will inject preconfigured packets, at a configurable
1891da177e4SLinus Torvalds	  rate, out of a given interface.  It is used for network interface
1901da177e4SLinus Torvalds	  stress testing and performance analysis.  If you don't understand
1911da177e4SLinus Torvalds	  what was just said, you don't need it: say N.
1921da177e4SLinus Torvalds
1931da177e4SLinus Torvalds	  Documentation on how to use the packet generator can be found
1941da177e4SLinus Torvalds	  at <file:Documentation/networking/pktgen.txt>.
1951da177e4SLinus Torvalds
1961da177e4SLinus Torvalds	  To compile this code as a module, choose M here: the
1971da177e4SLinus Torvalds	  module will be called pktgen.
1981da177e4SLinus Torvalds
199a42e9d6cSStephen Hemmingerconfig NET_TCPPROBE
200a42e9d6cSStephen Hemminger	tristate "TCP connection probing"
201a42e9d6cSStephen Hemminger	depends on INET && EXPERIMENTAL && PROC_FS && KPROBES
202a42e9d6cSStephen Hemminger	---help---
203a42e9d6cSStephen Hemminger	This module allows for capturing the changes to TCP connection
2049dadaa19SDave Jones	state in response to incoming packets. It is used for debugging
205a42e9d6cSStephen Hemminger	TCP congestion avoidance modules. If you don't understand
206a42e9d6cSStephen Hemminger	what was just said, you don't need it: say N.
207a42e9d6cSStephen Hemminger
20882fe7c92SGrant Grundler	Documentation on how to use TCP connection probing can be found
209a42e9d6cSStephen Hemminger	at http://linux-net.osdl.org/index.php/TcpProbe
210a42e9d6cSStephen Hemminger
211a42e9d6cSStephen Hemminger	To compile this code as a module, choose M here: the
212a42e9d6cSStephen Hemminger	module will be called tcp_probe.
213a42e9d6cSStephen Hemminger
2141da177e4SLinus Torvaldsendmenu
2151da177e4SLinus Torvalds
2161da177e4SLinus Torvaldsendmenu
2171da177e4SLinus Torvalds
2181da177e4SLinus Torvaldssource "net/ax25/Kconfig"
2191da177e4SLinus Torvaldssource "net/irda/Kconfig"
2201da177e4SLinus Torvaldssource "net/bluetooth/Kconfig"
221b453872cSJeff Garziksource "net/ieee80211/Kconfig"
222b453872cSJeff Garzik
223d86b5e0eSAdrian Bunkconfig WIRELESS_EXT
224d86b5e0eSAdrian Bunk	bool
225d86b5e0eSAdrian Bunk
22614c0b97dSThomas Grafconfig FIB_RULES
22714c0b97dSThomas Graf	bool
22814c0b97dSThomas Graf
2296a2e9b73SSam Ravnborgendif   # if NET
230d5950b43SSam Ravnborgendmenu # Networking
2311da177e4SLinus Torvalds
232