1# SPDX-License-Identifier: GPL-2.0-only 2# 3# Network configuration 4# 5 6menuconfig NET 7 bool "Networking support" 8 select NLATTR 9 select GENERIC_NET_UTILS 10 select BPF 11 help 12 Unless you really know what you are doing, you should say Y here. 13 The reason is that some programs need kernel networking support even 14 when running on a stand-alone machine that isn't connected to any 15 other computer. 16 17 If you are upgrading from an older kernel, you 18 should consider updating your networking tools too because changes 19 in the kernel and the tools often go hand in hand. The tools are 20 contained in the package net-tools, the location and version number 21 of which are given in <file:Documentation/Changes>. 22 23 For a general introduction to Linux networking, it is highly 24 recommended to read the NET-HOWTO, available from 25 <http://www.tldp.org/docs.html#howto>. 26 27if NET 28 29config WANT_COMPAT_NETLINK_MESSAGES 30 bool 31 help 32 This option can be selected by other options that need compat 33 netlink messages. 34 35config COMPAT_NETLINK_MESSAGES 36 def_bool y 37 depends on COMPAT 38 depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES 39 help 40 This option makes it possible to send different netlink messages 41 to tasks depending on whether the task is a compat task or not. To 42 achieve this, you need to set skb_shinfo(skb)->frag_list to the 43 compat skb before sending the skb, the netlink code will sort out 44 which message to actually pass to the task. 45 46 Newly written code should NEVER need this option but do 47 compat-independent messages instead! 48 49config NET_INGRESS 50 bool 51 52config NET_EGRESS 53 bool 54 55config NET_XGRESS 56 select NET_INGRESS 57 select NET_EGRESS 58 bool 59 60config NET_REDIRECT 61 bool 62 63config SKB_DECRYPTED 64 bool 65 66config SKB_EXTENSIONS 67 bool 68 69menu "Networking options" 70 71source "net/packet/Kconfig" 72source "net/unix/Kconfig" 73source "net/tls/Kconfig" 74source "net/xfrm/Kconfig" 75source "net/iucv/Kconfig" 76source "net/smc/Kconfig" 77source "net/xdp/Kconfig" 78 79config NET_HANDSHAKE 80 bool 81 depends on SUNRPC || NVME_TARGET_TCP || NVME_TCP 82 default y 83 84config NET_HANDSHAKE_KUNIT_TEST 85 tristate "KUnit tests for the handshake upcall mechanism" if !KUNIT_ALL_TESTS 86 default KUNIT_ALL_TESTS 87 depends on KUNIT 88 help 89 This builds the KUnit tests for the handshake upcall mechanism. 90 91 KUnit tests run during boot and output the results to the debug 92 log in TAP format (https://testanything.org/). Only useful for 93 kernel devs running KUnit test harness and are not for inclusion 94 into a production build. 95 96 For more information on KUnit and unit tests in general, refer 97 to the KUnit documentation in Documentation/dev-tools/kunit/. 98 99config INET 100 bool "TCP/IP networking" 101 help 102 These are the protocols used on the Internet and on most local 103 Ethernets. It is highly recommended to say Y here (this will enlarge 104 your kernel by about 400 KB), since some programs (e.g. the X window 105 system) use TCP/IP even if your machine is not connected to any 106 other computer. You will get the so-called loopback device which 107 allows you to ping yourself (great fun, that!). 108 109 For an excellent introduction to Linux networking, please read the 110 Linux Networking HOWTO, available from 111 <http://www.tldp.org/docs.html#howto>. 112 113 If you say Y here and also to "/proc file system support" and 114 "Sysctl support" below, you can change various aspects of the 115 behavior of the TCP/IP code by writing to the (virtual) files in 116 /proc/sys/net/ipv4/*; the options are explained in the file 117 <file:Documentation/networking/ip-sysctl.rst>. 118 119 Short answer: say Y. 120 121if INET 122source "net/ipv4/Kconfig" 123source "net/ipv6/Kconfig" 124source "net/netlabel/Kconfig" 125source "net/mptcp/Kconfig" 126 127endif # if INET 128 129config NETWORK_SECMARK 130 bool "Security Marking" 131 help 132 This enables security marking of network packets, similar 133 to nfmark, but designated for security purposes. 134 If you are unsure how to answer this question, answer N. 135 136config NET_PTP_CLASSIFY 137 def_bool n 138 139config NETWORK_PHY_TIMESTAMPING 140 bool "Timestamping in PHY devices" 141 select NET_PTP_CLASSIFY 142 help 143 This allows timestamping of network packets by PHYs (or 144 other MII bus snooping devices) with hardware timestamping 145 capabilities. This option adds some overhead in the transmit 146 and receive paths. 147 148 If you are unsure how to answer this question, answer N. 149 150menuconfig NETFILTER 151 bool "Network packet filtering framework (Netfilter)" 152 help 153 Netfilter is a framework for filtering and mangling network packets 154 that pass through your Linux box. 155 156 The most common use of packet filtering is to run your Linux box as 157 a firewall protecting a local network from the Internet. The type of 158 firewall provided by this kernel support is called a "packet 159 filter", which means that it can reject individual network packets 160 based on type, source, destination etc. The other kind of firewall, 161 a "proxy-based" one, is more secure but more intrusive and more 162 bothersome to set up; it inspects the network traffic much more 163 closely, modifies it and has knowledge about the higher level 164 protocols, which a packet filter lacks. Moreover, proxy-based 165 firewalls often require changes to the programs running on the local 166 clients. Proxy-based firewalls don't need support by the kernel, but 167 they are often combined with a packet filter, which only works if 168 you say Y here. 169 170 You should also say Y here if you intend to use your Linux box as 171 the gateway to the Internet for a local network of machines without 172 globally valid IP addresses. This is called "masquerading": if one 173 of the computers on your local network wants to send something to 174 the outside, your box can "masquerade" as that computer, i.e. it 175 forwards the traffic to the intended outside destination, but 176 modifies the packets to make it look like they came from the 177 firewall box itself. It works both ways: if the outside host 178 replies, the Linux box will silently forward the traffic to the 179 correct local computer. This way, the computers on your local net 180 are completely invisible to the outside world, even though they can 181 reach the outside and can receive replies. It is even possible to 182 run globally visible servers from within a masqueraded local network 183 using a mechanism called portforwarding. Masquerading is also often 184 called NAT (Network Address Translation). 185 186 Another use of Netfilter is in transparent proxying: if a machine on 187 the local network tries to connect to an outside host, your Linux 188 box can transparently forward the traffic to a local server, 189 typically a caching proxy server. 190 191 Yet another use of Netfilter is building a bridging firewall. Using 192 a bridge with Network packet filtering enabled makes iptables "see" 193 the bridged traffic. For filtering on the lower network and Ethernet 194 protocols over the bridge, use ebtables (under bridge netfilter 195 configuration). 196 197 Various modules exist for netfilter which replace the previous 198 masquerading (ipmasqadm), packet filtering (ipchains), transparent 199 proxying, and portforwarding mechanisms. Please see 200 <file:Documentation/Changes> under "iptables" for the location of 201 these packages. 202 203if NETFILTER 204 205config NETFILTER_ADVANCED 206 bool "Advanced netfilter configuration" 207 depends on NETFILTER 208 default y 209 help 210 If you say Y here you can select between all the netfilter modules. 211 If you say N the more unusual ones will not be shown and the 212 basic ones needed by most people will default to 'M'. 213 214 If unsure, say Y. 215 216config BRIDGE_NETFILTER 217 tristate "Bridged IP/ARP packets filtering" 218 depends on BRIDGE 219 depends on NETFILTER && INET 220 depends on NETFILTER_ADVANCED 221 select NETFILTER_FAMILY_BRIDGE 222 select SKB_EXTENSIONS 223 help 224 Enabling this option will let arptables resp. iptables see bridged 225 ARP resp. IP traffic. If you want a bridging firewall, you probably 226 want this option enabled. 227 Enabling or disabling this option doesn't enable or disable 228 ebtables. 229 230 If unsure, say N. 231 232source "net/netfilter/Kconfig" 233source "net/ipv4/netfilter/Kconfig" 234source "net/ipv6/netfilter/Kconfig" 235source "net/bridge/netfilter/Kconfig" 236 237endif 238 239source "net/dccp/Kconfig" 240source "net/sctp/Kconfig" 241source "net/rds/Kconfig" 242source "net/tipc/Kconfig" 243source "net/atm/Kconfig" 244source "net/l2tp/Kconfig" 245source "net/802/Kconfig" 246source "net/bridge/Kconfig" 247source "net/dsa/Kconfig" 248source "net/8021q/Kconfig" 249source "net/llc/Kconfig" 250source "net/appletalk/Kconfig" 251source "net/x25/Kconfig" 252source "net/lapb/Kconfig" 253source "net/phonet/Kconfig" 254source "net/6lowpan/Kconfig" 255source "net/ieee802154/Kconfig" 256source "net/mac802154/Kconfig" 257source "net/sched/Kconfig" 258source "net/dcb/Kconfig" 259source "net/dns_resolver/Kconfig" 260source "net/batman-adv/Kconfig" 261source "net/openvswitch/Kconfig" 262source "net/vmw_vsock/Kconfig" 263source "net/netlink/Kconfig" 264source "net/mpls/Kconfig" 265source "net/nsh/Kconfig" 266source "net/hsr/Kconfig" 267source "net/switchdev/Kconfig" 268source "net/l3mdev/Kconfig" 269source "net/qrtr/Kconfig" 270source "net/ncsi/Kconfig" 271 272config PCPU_DEV_REFCNT 273 bool "Use percpu variables to maintain network device refcount" 274 depends on SMP 275 default y 276 help 277 network device refcount are using per cpu variables if this option is set. 278 This can be forced to N to detect underflows (with a performance drop). 279 280config MAX_SKB_FRAGS 281 int "Maximum number of fragments per skb_shared_info" 282 range 17 45 283 default 17 284 help 285 Having more fragments per skb_shared_info can help GRO efficiency. 286 This helps BIG TCP workloads, but might expose bugs in some 287 legacy drivers. 288 This also increases memory overhead of small packets, 289 and in drivers using build_skb(). 290 If unsure, say 17. 291 292config RPS 293 bool 294 depends on SMP && SYSFS 295 default y 296 297config RFS_ACCEL 298 bool 299 depends on RPS 300 select CPU_RMAP 301 default y 302 303config SOCK_RX_QUEUE_MAPPING 304 bool 305 306config XPS 307 bool 308 depends on SMP 309 select SOCK_RX_QUEUE_MAPPING 310 default y 311 312config HWBM 313 bool 314 315config CGROUP_NET_PRIO 316 bool "Network priority cgroup" 317 depends on CGROUPS 318 select SOCK_CGROUP_DATA 319 help 320 Cgroup subsystem for use in assigning processes to network priorities on 321 a per-interface basis. 322 323config CGROUP_NET_CLASSID 324 bool "Network classid cgroup" 325 depends on CGROUPS 326 select SOCK_CGROUP_DATA 327 help 328 Cgroup subsystem for use as general purpose socket classid marker that is 329 being used in cls_cgroup and for netfilter matching. 330 331config NET_RX_BUSY_POLL 332 bool 333 default y if !PREEMPT_RT || (PREEMPT_RT && !NETCONSOLE) 334 335config BQL 336 bool 337 prompt "Enable Byte Queue Limits" 338 depends on SYSFS 339 select DQL 340 default y 341 342config BPF_STREAM_PARSER 343 bool "enable BPF STREAM_PARSER" 344 depends on INET 345 depends on BPF_SYSCALL 346 depends on CGROUP_BPF 347 select STREAM_PARSER 348 select NET_SOCK_MSG 349 help 350 Enabling this allows a TCP stream parser to be used with 351 BPF_MAP_TYPE_SOCKMAP. 352 353config NET_FLOW_LIMIT 354 bool 355 depends on RPS 356 default y 357 help 358 The network stack has to drop packets when a receive processing CPU's 359 backlog reaches netdev_max_backlog. If a few out of many active flows 360 generate the vast majority of load, drop their traffic earlier to 361 maintain capacity for the other flows. This feature provides servers 362 with many clients some protection against DoS by a single (spoofed) 363 flow that greatly exceeds average workload. 364 365menu "Network testing" 366 367config NET_PKTGEN 368 tristate "Packet Generator (USE WITH CAUTION)" 369 depends on INET && PROC_FS 370 help 371 This module will inject preconfigured packets, at a configurable 372 rate, out of a given interface. It is used for network interface 373 stress testing and performance analysis. If you don't understand 374 what was just said, you don't need it: say N. 375 376 Documentation on how to use the packet generator can be found 377 at <file:Documentation/networking/pktgen.rst>. 378 379 To compile this code as a module, choose M here: the 380 module will be called pktgen. 381 382config NET_DROP_MONITOR 383 tristate "Network packet drop alerting service" 384 depends on INET && TRACEPOINTS 385 help 386 This feature provides an alerting service to userspace in the 387 event that packets are discarded in the network stack. Alerts 388 are broadcast via netlink socket to any listening user space 389 process. If you don't need network drop alerts, or if you are ok 390 just checking the various proc files and other utilities for 391 drop statistics, say N here. 392 393endmenu 394 395endmenu 396 397source "net/ax25/Kconfig" 398source "net/can/Kconfig" 399source "net/bluetooth/Kconfig" 400source "net/rxrpc/Kconfig" 401source "net/kcm/Kconfig" 402source "net/strparser/Kconfig" 403source "net/mctp/Kconfig" 404 405config FIB_RULES 406 bool 407 408menuconfig WIRELESS 409 bool "Wireless" 410 depends on !S390 411 default y 412 413if WIRELESS 414 415source "net/wireless/Kconfig" 416source "net/mac80211/Kconfig" 417 418endif # WIRELESS 419 420source "net/rfkill/Kconfig" 421source "net/9p/Kconfig" 422source "net/caif/Kconfig" 423source "net/ceph/Kconfig" 424source "net/nfc/Kconfig" 425source "net/psample/Kconfig" 426source "net/ife/Kconfig" 427 428config LWTUNNEL 429 bool "Network light weight tunnels" 430 help 431 This feature provides an infrastructure to support light weight 432 tunnels like mpls. There is no netdevice associated with a light 433 weight tunnel endpoint. Tunnel encapsulation parameters are stored 434 with light weight tunnel state associated with fib routes. 435 436config LWTUNNEL_BPF 437 bool "Execute BPF program as route nexthop action" 438 depends on LWTUNNEL && INET 439 default y if LWTUNNEL=y 440 help 441 Allows to run BPF programs as a nexthop action following a route 442 lookup for incoming and outgoing packets. 443 444config DST_CACHE 445 bool 446 default n 447 448config GRO_CELLS 449 bool 450 default n 451 452config SOCK_VALIDATE_XMIT 453 bool 454 455config NET_IEEE8021Q_HELPERS 456 bool 457 458config NET_SELFTESTS 459 def_tristate PHYLIB 460 depends on PHYLIB && INET 461 462config NET_SOCK_MSG 463 bool 464 default n 465 help 466 The NET_SOCK_MSG provides a framework for plain sockets (e.g. TCP) or 467 ULPs (upper layer modules, e.g. TLS) to process L7 application data 468 with the help of BPF programs. 469 470config NET_DEVLINK 471 bool 472 default n 473 474config PAGE_POOL 475 bool 476 477config PAGE_POOL_STATS 478 default n 479 bool "Page pool stats" 480 depends on PAGE_POOL 481 help 482 Enable page pool statistics to track page allocation and recycling 483 in page pools. This option incurs additional CPU cost in allocation 484 and recycle paths and additional memory cost to store the statistics. 485 These statistics are only available if this option is enabled and if 486 the driver using the page pool supports exporting this data. 487 488 If unsure, say N. 489 490config FAILOVER 491 tristate "Generic failover module" 492 help 493 The failover module provides a generic interface for paravirtual 494 drivers to register a netdev and a set of ops with a failover 495 instance. The ops are used as event handlers that get called to 496 handle netdev register/unregister/link change/name change events 497 on slave pci ethernet devices with the same mac address as the 498 failover netdev. This enables paravirtual drivers to use a 499 VF as an accelerated low latency datapath. It also allows live 500 migration of VMs with direct attached VFs by failing over to the 501 paravirtual datapath when the VF is unplugged. 502 503config ETHTOOL_NETLINK 504 bool "Netlink interface for ethtool" 505 default y 506 help 507 An alternative userspace interface for ethtool based on generic 508 netlink. It provides better extensibility and some new features, 509 e.g. notification messages. 510 511config NETDEV_ADDR_LIST_TEST 512 tristate "Unit tests for device address list" 513 default KUNIT_ALL_TESTS 514 depends on KUNIT 515 516config NET_TEST 517 tristate "KUnit tests for networking" if !KUNIT_ALL_TESTS 518 depends on KUNIT 519 default KUNIT_ALL_TESTS 520 help 521 KUnit tests covering core networking infra, such as sk_buff. 522 523 If unsure, say N. 524 525endif # if NET 526