]>
Commit | Line | Data |
---|---|---|
1 | # | |
2 | # Network configuration | |
3 | # | |
4 | ||
5 | menuconfig NET | |
6 | bool "Networking support" | |
7 | select NLATTR | |
8 | select GENERIC_NET_UTILS | |
9 | select BPF | |
10 | ---help--- | |
11 | Unless you really know what you are doing, you should say Y here. | |
12 | The reason is that some programs need kernel networking support even | |
13 | when running on a stand-alone machine that isn't connected to any | |
14 | other computer. | |
15 | ||
16 | If you are upgrading from an older kernel, you | |
17 | should consider updating your networking tools too because changes | |
18 | in the kernel and the tools often go hand in hand. The tools are | |
19 | contained in the package net-tools, the location and version number | |
20 | of which are given in <file:Documentation/Changes>. | |
21 | ||
22 | For a general introduction to Linux networking, it is highly | |
23 | recommended to read the NET-HOWTO, available from | |
24 | <http://www.tldp.org/docs.html#howto>. | |
25 | ||
26 | if NET | |
27 | ||
28 | config WANT_COMPAT_NETLINK_MESSAGES | |
29 | bool | |
30 | help | |
31 | This option can be selected by other options that need compat | |
32 | netlink messages. | |
33 | ||
34 | config COMPAT_NETLINK_MESSAGES | |
35 | def_bool y | |
36 | depends on COMPAT | |
37 | depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES | |
38 | help | |
39 | This option makes it possible to send different netlink messages | |
40 | to tasks depending on whether the task is a compat task or not. To | |
41 | achieve this, you need to set skb_shinfo(skb)->frag_list to the | |
42 | compat skb before sending the skb, the netlink code will sort out | |
43 | which message to actually pass to the task. | |
44 | ||
45 | Newly written code should NEVER need this option but do | |
46 | compat-independent messages instead! | |
47 | ||
48 | config NET_INGRESS | |
49 | bool | |
50 | ||
51 | config NET_EGRESS | |
52 | bool | |
53 | ||
54 | menu "Networking options" | |
55 | ||
56 | source "net/packet/Kconfig" | |
57 | source "net/unix/Kconfig" | |
58 | source "net/tls/Kconfig" | |
59 | source "net/xfrm/Kconfig" | |
60 | source "net/iucv/Kconfig" | |
61 | source "net/smc/Kconfig" | |
62 | ||
63 | config INET | |
64 | bool "TCP/IP networking" | |
65 | select CRYPTO | |
66 | select CRYPTO_AES | |
67 | ---help--- | |
68 | These are the protocols used on the Internet and on most local | |
69 | Ethernets. It is highly recommended to say Y here (this will enlarge | |
70 | your kernel by about 400 KB), since some programs (e.g. the X window | |
71 | system) use TCP/IP even if your machine is not connected to any | |
72 | other computer. You will get the so-called loopback device which | |
73 | allows you to ping yourself (great fun, that!). | |
74 | ||
75 | For an excellent introduction to Linux networking, please read the | |
76 | Linux Networking HOWTO, available from | |
77 | <http://www.tldp.org/docs.html#howto>. | |
78 | ||
79 | If you say Y here and also to "/proc file system support" and | |
80 | "Sysctl support" below, you can change various aspects of the | |
81 | behavior of the TCP/IP code by writing to the (virtual) files in | |
82 | /proc/sys/net/ipv4/*; the options are explained in the file | |
83 | <file:Documentation/networking/ip-sysctl.txt>. | |
84 | ||
85 | Short answer: say Y. | |
86 | ||
87 | if INET | |
88 | source "net/ipv4/Kconfig" | |
89 | source "net/ipv6/Kconfig" | |
90 | source "net/netlabel/Kconfig" | |
91 | ||
92 | endif # if INET | |
93 | ||
94 | config NETWORK_SECMARK | |
95 | bool "Security Marking" | |
96 | help | |
97 | This enables security marking of network packets, similar | |
98 | to nfmark, but designated for security purposes. | |
99 | If you are unsure how to answer this question, answer N. | |
100 | ||
101 | config NET_PTP_CLASSIFY | |
102 | def_bool n | |
103 | ||
104 | config NETWORK_PHY_TIMESTAMPING | |
105 | bool "Timestamping in PHY devices" | |
106 | select NET_PTP_CLASSIFY | |
107 | help | |
108 | This allows timestamping of network packets by PHYs with | |
109 | hardware timestamping capabilities. This option adds some | |
110 | overhead in the transmit and receive paths. | |
111 | ||
112 | If you are unsure how to answer this question, answer N. | |
113 | ||
114 | menuconfig NETFILTER | |
115 | bool "Network packet filtering framework (Netfilter)" | |
116 | ---help--- | |
117 | Netfilter is a framework for filtering and mangling network packets | |
118 | that pass through your Linux box. | |
119 | ||
120 | The most common use of packet filtering is to run your Linux box as | |
121 | a firewall protecting a local network from the Internet. The type of | |
122 | firewall provided by this kernel support is called a "packet | |
123 | filter", which means that it can reject individual network packets | |
124 | based on type, source, destination etc. The other kind of firewall, | |
125 | a "proxy-based" one, is more secure but more intrusive and more | |
126 | bothersome to set up; it inspects the network traffic much more | |
127 | closely, modifies it and has knowledge about the higher level | |
128 | protocols, which a packet filter lacks. Moreover, proxy-based | |
129 | firewalls often require changes to the programs running on the local | |
130 | clients. Proxy-based firewalls don't need support by the kernel, but | |
131 | they are often combined with a packet filter, which only works if | |
132 | you say Y here. | |
133 | ||
134 | You should also say Y here if you intend to use your Linux box as | |
135 | the gateway to the Internet for a local network of machines without | |
136 | globally valid IP addresses. This is called "masquerading": if one | |
137 | of the computers on your local network wants to send something to | |
138 | the outside, your box can "masquerade" as that computer, i.e. it | |
139 | forwards the traffic to the intended outside destination, but | |
140 | modifies the packets to make it look like they came from the | |
141 | firewall box itself. It works both ways: if the outside host | |
142 | replies, the Linux box will silently forward the traffic to the | |
143 | correct local computer. This way, the computers on your local net | |
144 | are completely invisible to the outside world, even though they can | |
145 | reach the outside and can receive replies. It is even possible to | |
146 | run globally visible servers from within a masqueraded local network | |
147 | using a mechanism called portforwarding. Masquerading is also often | |
148 | called NAT (Network Address Translation). | |
149 | ||
150 | Another use of Netfilter is in transparent proxying: if a machine on | |
151 | the local network tries to connect to an outside host, your Linux | |
152 | box can transparently forward the traffic to a local server, | |
153 | typically a caching proxy server. | |
154 | ||
155 | Yet another use of Netfilter is building a bridging firewall. Using | |
156 | a bridge with Network packet filtering enabled makes iptables "see" | |
157 | the bridged traffic. For filtering on the lower network and Ethernet | |
158 | protocols over the bridge, use ebtables (under bridge netfilter | |
159 | configuration). | |
160 | ||
161 | Various modules exist for netfilter which replace the previous | |
162 | masquerading (ipmasqadm), packet filtering (ipchains), transparent | |
163 | proxying, and portforwarding mechanisms. Please see | |
164 | <file:Documentation/Changes> under "iptables" for the location of | |
165 | these packages. | |
166 | ||
167 | if NETFILTER | |
168 | ||
169 | config NETFILTER_DEBUG | |
170 | bool "Network packet filtering debugging" | |
171 | depends on NETFILTER | |
172 | help | |
173 | You can say Y here if you want to get additional messages useful in | |
174 | debugging the netfilter code. | |
175 | ||
176 | config NETFILTER_ADVANCED | |
177 | bool "Advanced netfilter configuration" | |
178 | depends on NETFILTER | |
179 | default y | |
180 | help | |
181 | If you say Y here you can select between all the netfilter modules. | |
182 | If you say N the more unusual ones will not be shown and the | |
183 | basic ones needed by most people will default to 'M'. | |
184 | ||
185 | If unsure, say Y. | |
186 | ||
187 | config BRIDGE_NETFILTER | |
188 | tristate "Bridged IP/ARP packets filtering" | |
189 | depends on BRIDGE | |
190 | depends on NETFILTER && INET | |
191 | depends on NETFILTER_ADVANCED | |
192 | default m | |
193 | ---help--- | |
194 | Enabling this option will let arptables resp. iptables see bridged | |
195 | ARP resp. IP traffic. If you want a bridging firewall, you probably | |
196 | want this option enabled. | |
197 | Enabling or disabling this option doesn't enable or disable | |
198 | ebtables. | |
199 | ||
200 | If unsure, say N. | |
201 | ||
202 | source "net/netfilter/Kconfig" | |
203 | source "net/ipv4/netfilter/Kconfig" | |
204 | source "net/ipv6/netfilter/Kconfig" | |
205 | source "net/decnet/netfilter/Kconfig" | |
206 | source "net/bridge/netfilter/Kconfig" | |
207 | ||
208 | endif | |
209 | ||
210 | source "net/dccp/Kconfig" | |
211 | source "net/sctp/Kconfig" | |
212 | source "net/rds/Kconfig" | |
213 | source "net/tipc/Kconfig" | |
214 | source "net/atm/Kconfig" | |
215 | source "net/l2tp/Kconfig" | |
216 | source "net/802/Kconfig" | |
217 | source "net/bridge/Kconfig" | |
218 | source "net/dsa/Kconfig" | |
219 | source "net/8021q/Kconfig" | |
220 | source "net/decnet/Kconfig" | |
221 | source "net/llc/Kconfig" | |
222 | source "net/ipx/Kconfig" | |
223 | source "drivers/net/appletalk/Kconfig" | |
224 | source "net/x25/Kconfig" | |
225 | source "net/lapb/Kconfig" | |
226 | source "net/phonet/Kconfig" | |
227 | source "net/6lowpan/Kconfig" | |
228 | source "net/ieee802154/Kconfig" | |
229 | source "net/mac802154/Kconfig" | |
230 | source "net/sched/Kconfig" | |
231 | source "net/dcb/Kconfig" | |
232 | source "net/dns_resolver/Kconfig" | |
233 | source "net/batman-adv/Kconfig" | |
234 | source "net/openvswitch/Kconfig" | |
235 | source "net/vmw_vsock/Kconfig" | |
236 | source "net/netlink/Kconfig" | |
237 | source "net/mpls/Kconfig" | |
238 | source "net/hsr/Kconfig" | |
239 | source "net/switchdev/Kconfig" | |
240 | source "net/l3mdev/Kconfig" | |
241 | source "net/qrtr/Kconfig" | |
242 | source "net/ncsi/Kconfig" | |
243 | ||
244 | config RPS | |
245 | bool | |
246 | depends on SMP && SYSFS | |
247 | default y | |
248 | ||
249 | config RFS_ACCEL | |
250 | bool | |
251 | depends on RPS | |
252 | select CPU_RMAP | |
253 | default y | |
254 | ||
255 | config XPS | |
256 | bool | |
257 | depends on SMP | |
258 | default y | |
259 | ||
260 | config HWBM | |
261 | bool | |
262 | ||
263 | config CGROUP_NET_PRIO | |
264 | bool "Network priority cgroup" | |
265 | depends on CGROUPS | |
266 | select SOCK_CGROUP_DATA | |
267 | ---help--- | |
268 | Cgroup subsystem for use in assigning processes to network priorities on | |
269 | a per-interface basis. | |
270 | ||
271 | config CGROUP_NET_CLASSID | |
272 | bool "Network classid cgroup" | |
273 | depends on CGROUPS | |
274 | select SOCK_CGROUP_DATA | |
275 | ---help--- | |
276 | Cgroup subsystem for use as general purpose socket classid marker that is | |
277 | being used in cls_cgroup and for netfilter matching. | |
278 | ||
279 | config NET_RX_BUSY_POLL | |
280 | bool | |
281 | default y | |
282 | ||
283 | config BQL | |
284 | bool | |
285 | depends on SYSFS | |
286 | select DQL | |
287 | default y | |
288 | ||
289 | config BPF_JIT | |
290 | bool "enable BPF Just In Time compiler" | |
291 | depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT | |
292 | depends on MODULES | |
293 | ---help--- | |
294 | Berkeley Packet Filter filtering capabilities are normally handled | |
295 | by an interpreter. This option allows kernel to generate a native | |
296 | code when filter is loaded in memory. This should speedup | |
297 | packet sniffing (libpcap/tcpdump). | |
298 | ||
299 | Note, admin should enable this feature changing: | |
300 | /proc/sys/net/core/bpf_jit_enable | |
301 | /proc/sys/net/core/bpf_jit_harden (optional) | |
302 | /proc/sys/net/core/bpf_jit_kallsyms (optional) | |
303 | ||
304 | config NET_FLOW_LIMIT | |
305 | bool | |
306 | depends on RPS | |
307 | default y | |
308 | ---help--- | |
309 | The network stack has to drop packets when a receive processing CPU's | |
310 | backlog reaches netdev_max_backlog. If a few out of many active flows | |
311 | generate the vast majority of load, drop their traffic earlier to | |
312 | maintain capacity for the other flows. This feature provides servers | |
313 | with many clients some protection against DoS by a single (spoofed) | |
314 | flow that greatly exceeds average workload. | |
315 | ||
316 | menu "Network testing" | |
317 | ||
318 | config NET_PKTGEN | |
319 | tristate "Packet Generator (USE WITH CAUTION)" | |
320 | depends on INET && PROC_FS | |
321 | ---help--- | |
322 | This module will inject preconfigured packets, at a configurable | |
323 | rate, out of a given interface. It is used for network interface | |
324 | stress testing and performance analysis. If you don't understand | |
325 | what was just said, you don't need it: say N. | |
326 | ||
327 | Documentation on how to use the packet generator can be found | |
328 | at <file:Documentation/networking/pktgen.txt>. | |
329 | ||
330 | To compile this code as a module, choose M here: the | |
331 | module will be called pktgen. | |
332 | ||
333 | config NET_TCPPROBE | |
334 | tristate "TCP connection probing" | |
335 | depends on INET && PROC_FS && KPROBES | |
336 | ---help--- | |
337 | This module allows for capturing the changes to TCP connection | |
338 | state in response to incoming packets. It is used for debugging | |
339 | TCP congestion avoidance modules. If you don't understand | |
340 | what was just said, you don't need it: say N. | |
341 | ||
342 | Documentation on how to use TCP connection probing can be found | |
343 | at: | |
344 | ||
345 | http://www.linuxfoundation.org/collaborate/workgroups/networking/tcpprobe | |
346 | ||
347 | To compile this code as a module, choose M here: the | |
348 | module will be called tcp_probe. | |
349 | ||
350 | config NET_DROP_MONITOR | |
351 | tristate "Network packet drop alerting service" | |
352 | depends on INET && TRACEPOINTS | |
353 | ---help--- | |
354 | This feature provides an alerting service to userspace in the | |
355 | event that packets are discarded in the network stack. Alerts | |
356 | are broadcast via netlink socket to any listening user space | |
357 | process. If you don't need network drop alerts, or if you are ok | |
358 | just checking the various proc files and other utilities for | |
359 | drop statistics, say N here. | |
360 | ||
361 | endmenu | |
362 | ||
363 | endmenu | |
364 | ||
365 | source "net/ax25/Kconfig" | |
366 | source "net/can/Kconfig" | |
367 | source "net/irda/Kconfig" | |
368 | source "net/bluetooth/Kconfig" | |
369 | source "net/rxrpc/Kconfig" | |
370 | source "net/kcm/Kconfig" | |
371 | source "net/strparser/Kconfig" | |
372 | ||
373 | config FIB_RULES | |
374 | bool | |
375 | ||
376 | menuconfig WIRELESS | |
377 | bool "Wireless" | |
378 | depends on !S390 | |
379 | default y | |
380 | ||
381 | if WIRELESS | |
382 | ||
383 | source "net/wireless/Kconfig" | |
384 | source "net/mac80211/Kconfig" | |
385 | ||
386 | endif # WIRELESS | |
387 | ||
388 | source "net/wimax/Kconfig" | |
389 | ||
390 | source "net/rfkill/Kconfig" | |
391 | source "net/9p/Kconfig" | |
392 | source "net/caif/Kconfig" | |
393 | source "net/ceph/Kconfig" | |
394 | source "net/nfc/Kconfig" | |
395 | source "net/psample/Kconfig" | |
396 | source "net/ife/Kconfig" | |
397 | ||
398 | config LWTUNNEL | |
399 | bool "Network light weight tunnels" | |
400 | ---help--- | |
401 | This feature provides an infrastructure to support light weight | |
402 | tunnels like mpls. There is no netdevice associated with a light | |
403 | weight tunnel endpoint. Tunnel encapsulation parameters are stored | |
404 | with light weight tunnel state associated with fib routes. | |
405 | ||
406 | config LWTUNNEL_BPF | |
407 | bool "Execute BPF program as route nexthop action" | |
408 | depends on LWTUNNEL | |
409 | default y if LWTUNNEL=y | |
410 | ---help--- | |
411 | Allows to run BPF programs as a nexthop action following a route | |
412 | lookup for incoming and outgoing packets. | |
413 | ||
414 | config DST_CACHE | |
415 | bool | |
416 | default n | |
417 | ||
418 | config GRO_CELLS | |
419 | bool | |
420 | default n | |
421 | ||
422 | config NET_DEVLINK | |
423 | tristate "Network physical/parent device Netlink interface" | |
424 | help | |
425 | Network physical/parent device Netlink interface provides | |
426 | infrastructure to support access to physical chip-wide config and | |
427 | monitoring. | |
428 | ||
429 | config MAY_USE_DEVLINK | |
430 | tristate | |
431 | default m if NET_DEVLINK=m | |
432 | default y if NET_DEVLINK=y || NET_DEVLINK=n | |
433 | help | |
434 | Drivers using the devlink infrastructure should have a dependency | |
435 | on MAY_USE_DEVLINK to ensure they do not cause link errors when | |
436 | devlink is a loadable module and the driver using it is built-in. | |
437 | ||
438 | endif # if NET | |
439 | ||
440 | # Used by archs to tell that they support BPF JIT compiler plus which flavour. | |
441 | # Only one of the two can be selected for a specific arch since eBPF JIT supersedes | |
442 | # the cBPF JIT. | |
443 | ||
444 | # Classic BPF JIT (cBPF) | |
445 | config HAVE_CBPF_JIT | |
446 | bool | |
447 | ||
448 | # Extended BPF JIT (eBPF) | |
449 | config HAVE_EBPF_JIT | |
450 | bool |