Linux Audio

Check our new training course

Loading...
v6.13.7
  1# SPDX-License-Identifier: GPL-2.0-only
  2#
  3# Network configuration
  4#
  5
  6menuconfig NET
  7	bool "Networking support"
  8	select NLATTR
  9	select GENERIC_NET_UTILS
 10	select BPF
 11	help
 12	  Unless you really know what you are doing, you should say Y here.
 13	  The reason is that some programs need kernel networking support even
 14	  when running on a stand-alone machine that isn't connected to any
 15	  other computer.
 16
 17	  If you are upgrading from an older kernel, you
 18	  should consider updating your networking tools too because changes
 19	  in the kernel and the tools often go hand in hand. The tools are
 20	  contained in the package net-tools, the location and version number
 21	  of which are given in <file:Documentation/Changes>.
 22
 23	  For a general introduction to Linux networking, it is highly
 24	  recommended to read the NET-HOWTO, available from
 25	  <http://www.tldp.org/docs.html#howto>.
 26
 27if NET
 28
 29config WANT_COMPAT_NETLINK_MESSAGES
 30	bool
 31	help
 32	  This option can be selected by other options that need compat
 33	  netlink messages.
 34
 35config COMPAT_NETLINK_MESSAGES
 36	def_bool y
 37	depends on COMPAT
 38	depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES
 39	help
 40	  This option makes it possible to send different netlink messages
 41	  to tasks depending on whether the task is a compat task or not. To
 42	  achieve this, you need to set skb_shinfo(skb)->frag_list to the
 43	  compat skb before sending the skb, the netlink code will sort out
 44	  which message to actually pass to the task.
 45
 46	  Newly written code should NEVER need this option but do
 47	  compat-independent messages instead!
 48
 49config NET_INGRESS
 50	bool
 51
 52config NET_EGRESS
 53	bool
 54
 55config NET_XGRESS
 56	select NET_INGRESS
 57	select NET_EGRESS
 58	bool
 59
 60config NET_REDIRECT
 61	bool
 62
 63config SKB_DECRYPTED
 64	bool
 65
 66config SKB_EXTENSIONS
 67	bool
 68
 69config NET_DEVMEM
 70	def_bool y
 71	depends on DMA_SHARED_BUFFER
 72	depends on GENERIC_ALLOCATOR
 73	depends on PAGE_POOL
 74
 75config NET_SHAPER
 76	bool
 77
 78menu "Networking options"
 79
 80source "net/packet/Kconfig"
 81source "net/unix/Kconfig"
 82source "net/tls/Kconfig"
 83source "net/xfrm/Kconfig"
 84source "net/iucv/Kconfig"
 85source "net/smc/Kconfig"
 86source "net/xdp/Kconfig"
 87
 88config NET_HANDSHAKE
 89	bool
 90	depends on SUNRPC || NVME_TARGET_TCP || NVME_TCP
 91	default y
 92
 93config NET_HANDSHAKE_KUNIT_TEST
 94	tristate "KUnit tests for the handshake upcall mechanism" if !KUNIT_ALL_TESTS
 95	default KUNIT_ALL_TESTS
 96	depends on KUNIT
 97	help
 98	  This builds the KUnit tests for the handshake upcall mechanism.
 99
100	  KUnit tests run during boot and output the results to the debug
101	  log in TAP format (https://testanything.org/). Only useful for
102	  kernel devs running KUnit test harness and are not for inclusion
103	  into a production build.
104
105	  For more information on KUnit and unit tests in general, refer
106	  to the KUnit documentation in Documentation/dev-tools/kunit/.
107
108config INET
109	bool "TCP/IP networking"
110	help
111	  These are the protocols used on the Internet and on most local
112	  Ethernets. It is highly recommended to say Y here (this will enlarge
113	  your kernel by about 400 KB), since some programs (e.g. the X window
114	  system) use TCP/IP even if your machine is not connected to any
115	  other computer. You will get the so-called loopback device which
116	  allows you to ping yourself (great fun, that!).
117
118	  For an excellent introduction to Linux networking, please read the
119	  Linux Networking HOWTO, available from
120	  <http://www.tldp.org/docs.html#howto>.
121
122	  If you say Y here and also to "/proc file system support" and
123	  "Sysctl support" below, you can change various aspects of the
124	  behavior of the TCP/IP code by writing to the (virtual) files in
125	  /proc/sys/net/ipv4/*; the options are explained in the file
126	  <file:Documentation/networking/ip-sysctl.rst>.
127
128	  Short answer: say Y.
129
130if INET
131source "net/ipv4/Kconfig"
132source "net/ipv6/Kconfig"
133source "net/netlabel/Kconfig"
134source "net/mptcp/Kconfig"
135
136endif # if INET
137
138config NETWORK_SECMARK
139	bool "Security Marking"
140	help
141	  This enables security marking of network packets, similar
142	  to nfmark, but designated for security purposes.
143	  If you are unsure how to answer this question, answer N.
144
145config NET_PTP_CLASSIFY
146	def_bool n
147
148config NETWORK_PHY_TIMESTAMPING
149	bool "Timestamping in PHY devices"
150	select NET_PTP_CLASSIFY
151	help
152	  This allows timestamping of network packets by PHYs (or
153	  other MII bus snooping devices) with hardware timestamping
154	  capabilities. This option adds some overhead in the transmit
155	  and receive paths.
156
157	  If you are unsure how to answer this question, answer N.
158
159menuconfig NETFILTER
160	bool "Network packet filtering framework (Netfilter)"
161	help
162	  Netfilter is a framework for filtering and mangling network packets
163	  that pass through your Linux box.
164
165	  The most common use of packet filtering is to run your Linux box as
166	  a firewall protecting a local network from the Internet. The type of
167	  firewall provided by this kernel support is called a "packet
168	  filter", which means that it can reject individual network packets
169	  based on type, source, destination etc. The other kind of firewall,
170	  a "proxy-based" one, is more secure but more intrusive and more
171	  bothersome to set up; it inspects the network traffic much more
172	  closely, modifies it and has knowledge about the higher level
173	  protocols, which a packet filter lacks. Moreover, proxy-based
174	  firewalls often require changes to the programs running on the local
175	  clients. Proxy-based firewalls don't need support by the kernel, but
176	  they are often combined with a packet filter, which only works if
177	  you say Y here.
178
179	  You should also say Y here if you intend to use your Linux box as
180	  the gateway to the Internet for a local network of machines without
181	  globally valid IP addresses. This is called "masquerading": if one
182	  of the computers on your local network wants to send something to
183	  the outside, your box can "masquerade" as that computer, i.e. it
184	  forwards the traffic to the intended outside destination, but
185	  modifies the packets to make it look like they came from the
186	  firewall box itself. It works both ways: if the outside host
187	  replies, the Linux box will silently forward the traffic to the
188	  correct local computer. This way, the computers on your local net
189	  are completely invisible to the outside world, even though they can
190	  reach the outside and can receive replies. It is even possible to
191	  run globally visible servers from within a masqueraded local network
192	  using a mechanism called portforwarding. Masquerading is also often
193	  called NAT (Network Address Translation).
194
195	  Another use of Netfilter is in transparent proxying: if a machine on
196	  the local network tries to connect to an outside host, your Linux
197	  box can transparently forward the traffic to a local server,
198	  typically a caching proxy server.
199
200	  Yet another use of Netfilter is building a bridging firewall. Using
201	  a bridge with Network packet filtering enabled makes iptables "see"
202	  the bridged traffic. For filtering on the lower network and Ethernet
203	  protocols over the bridge, use ebtables (under bridge netfilter
204	  configuration).
205
206	  Various modules exist for netfilter which replace the previous
207	  masquerading (ipmasqadm), packet filtering (ipchains), transparent
208	  proxying, and portforwarding mechanisms. Please see
209	  <file:Documentation/Changes> under "iptables" for the location of
210	  these packages.
211
212if NETFILTER
213
214config NETFILTER_ADVANCED
215	bool "Advanced netfilter configuration"
216	depends on NETFILTER
217	default y
218	help
219	  If you say Y here you can select between all the netfilter modules.
220	  If you say N the more unusual ones will not be shown and the
221	  basic ones needed by most people will default to 'M'.
222
223	  If unsure, say Y.
224
225config BRIDGE_NETFILTER
226	tristate "Bridged IP/ARP packets filtering"
227	depends on BRIDGE
228	depends on NETFILTER && INET
229	depends on NETFILTER_ADVANCED
230	select NETFILTER_FAMILY_BRIDGE
231	select SKB_EXTENSIONS
232	help
233	  Enabling this option will let arptables resp. iptables see bridged
234	  ARP resp. IP traffic. If you want a bridging firewall, you probably
235	  want this option enabled.
236	  Enabling or disabling this option doesn't enable or disable
237	  ebtables.
238
239	  If unsure, say N.
240
241source "net/netfilter/Kconfig"
242source "net/ipv4/netfilter/Kconfig"
243source "net/ipv6/netfilter/Kconfig"
 
244source "net/bridge/netfilter/Kconfig"
245
246endif
247
 
 
248source "net/dccp/Kconfig"
249source "net/sctp/Kconfig"
250source "net/rds/Kconfig"
251source "net/tipc/Kconfig"
252source "net/atm/Kconfig"
253source "net/l2tp/Kconfig"
254source "net/802/Kconfig"
255source "net/bridge/Kconfig"
256source "net/dsa/Kconfig"
257source "net/8021q/Kconfig"
 
258source "net/llc/Kconfig"
259source "net/appletalk/Kconfig"
260source "net/x25/Kconfig"
261source "net/lapb/Kconfig"
262source "net/phonet/Kconfig"
263source "net/6lowpan/Kconfig"
264source "net/ieee802154/Kconfig"
265source "net/mac802154/Kconfig"
266source "net/sched/Kconfig"
267source "net/dcb/Kconfig"
268source "net/dns_resolver/Kconfig"
269source "net/batman-adv/Kconfig"
270source "net/openvswitch/Kconfig"
271source "net/vmw_vsock/Kconfig"
272source "net/netlink/Kconfig"
273source "net/mpls/Kconfig"
274source "net/nsh/Kconfig"
275source "net/hsr/Kconfig"
276source "net/switchdev/Kconfig"
277source "net/l3mdev/Kconfig"
278source "net/qrtr/Kconfig"
279source "net/ncsi/Kconfig"
280
281config PCPU_DEV_REFCNT
282	bool "Use percpu variables to maintain network device refcount"
283	depends on SMP
284	default y
285	help
286	  network device refcount are using per cpu variables if this option is set.
287	  This can be forced to N to detect underflows (with a performance drop).
288
289config MAX_SKB_FRAGS
290	int "Maximum number of fragments per skb_shared_info"
291	range 17 45
292	default 17
293	help
294	  Having more fragments per skb_shared_info can help GRO efficiency.
295	  This helps BIG TCP workloads, but might expose bugs in some
296	  legacy drivers.
297	  This also increases memory overhead of small packets,
298	  and in drivers using build_skb().
299	  If unsure, say 17.
300
301config RPS
302	bool "Receive packet steering"
303	depends on SMP && SYSFS
304	default y
305	help
306	  Software receive side packet steering (RPS) distributes the
307	  load of received packet processing across multiple CPUs.
308
309config RFS_ACCEL
310	bool "Hardware acceleration of RFS"
311	depends on RPS
312	select CPU_RMAP
313	default y
314	help
315	  Allowing drivers for multiqueue hardware with flow filter tables to
316	  accelerate RFS.
317
318config SOCK_RX_QUEUE_MAPPING
319	bool
320
321config XPS
322	bool
323	depends on SMP
324	select SOCK_RX_QUEUE_MAPPING
325	default y
326
327config HWBM
328	bool
329
330config CGROUP_NET_PRIO
331	bool "Network priority cgroup"
332	depends on CGROUPS
333	select SOCK_CGROUP_DATA
334	help
335	  Cgroup subsystem for use in assigning processes to network priorities on
336	  a per-interface basis.
337
338config CGROUP_NET_CLASSID
339	bool "Network classid cgroup"
340	depends on CGROUPS
341	select SOCK_CGROUP_DATA
342	help
343	  Cgroup subsystem for use as general purpose socket classid marker that is
344	  being used in cls_cgroup and for netfilter matching.
345
346config NET_RX_BUSY_POLL
347	bool
348	default y if !PREEMPT_RT || (PREEMPT_RT && !NETCONSOLE)
349
350config BQL
351	bool
352	prompt "Enable Byte Queue Limits"
353	depends on SYSFS
354	select DQL
355	default y
356
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
357config BPF_STREAM_PARSER
358	bool "enable BPF STREAM_PARSER"
359	depends on INET
360	depends on BPF_SYSCALL
361	depends on CGROUP_BPF
362	select STREAM_PARSER
363	select NET_SOCK_MSG
364	help
365	  Enabling this allows a TCP stream parser to be used with
366	  BPF_MAP_TYPE_SOCKMAP.
367
 
 
 
 
368config NET_FLOW_LIMIT
369	bool "Net flow limit"
370	depends on RPS
371	default y
372	help
373	  The network stack has to drop packets when a receive processing CPU's
374	  backlog reaches netdev_max_backlog. If a few out of many active flows
375	  generate the vast majority of load, drop their traffic earlier to
376	  maintain capacity for the other flows. This feature provides servers
377	  with many clients some protection against DoS by a single (spoofed)
378	  flow that greatly exceeds average workload.
379
380menu "Network testing"
381
382config NET_PKTGEN
383	tristate "Packet Generator (USE WITH CAUTION)"
384	depends on INET && PROC_FS
385	help
386	  This module will inject preconfigured packets, at a configurable
387	  rate, out of a given interface.  It is used for network interface
388	  stress testing and performance analysis.  If you don't understand
389	  what was just said, you don't need it: say N.
390
391	  Documentation on how to use the packet generator can be found
392	  at <file:Documentation/networking/pktgen.rst>.
393
394	  To compile this code as a module, choose M here: the
395	  module will be called pktgen.
396
397config NET_DROP_MONITOR
398	tristate "Network packet drop alerting service"
399	depends on INET && TRACEPOINTS
400	help
401	  This feature provides an alerting service to userspace in the
402	  event that packets are discarded in the network stack.  Alerts
403	  are broadcast via netlink socket to any listening user space
404	  process.  If you don't need network drop alerts, or if you are ok
405	  just checking the various proc files and other utilities for
406	  drop statistics, say N here.
407
408endmenu
409
410endmenu
411
412source "net/ax25/Kconfig"
413source "net/can/Kconfig"
414source "net/bluetooth/Kconfig"
415source "net/rxrpc/Kconfig"
416source "net/kcm/Kconfig"
417source "net/strparser/Kconfig"
418source "net/mctp/Kconfig"
419
420config FIB_RULES
421	bool
422
423menuconfig WIRELESS
424	bool "Wireless"
425	depends on !S390
426	default y
427
428if WIRELESS
429
430source "net/wireless/Kconfig"
431source "net/mac80211/Kconfig"
432
433endif # WIRELESS
434
 
 
435source "net/rfkill/Kconfig"
436source "net/9p/Kconfig"
437source "net/caif/Kconfig"
438source "net/ceph/Kconfig"
439source "net/nfc/Kconfig"
440source "net/psample/Kconfig"
441source "net/ife/Kconfig"
442
443config LWTUNNEL
444	bool "Network light weight tunnels"
445	help
446	  This feature provides an infrastructure to support light weight
447	  tunnels like mpls. There is no netdevice associated with a light
448	  weight tunnel endpoint. Tunnel encapsulation parameters are stored
449	  with light weight tunnel state associated with fib routes.
450
451config LWTUNNEL_BPF
452	bool "Execute BPF program as route nexthop action"
453	depends on LWTUNNEL && INET
454	default y if LWTUNNEL=y
455	help
456	  Allows to run BPF programs as a nexthop action following a route
457	  lookup for incoming and outgoing packets.
458
459config DST_CACHE
460	bool
461	default n
462
463config GRO_CELLS
464	bool
465	default n
466
467config SOCK_VALIDATE_XMIT
468	bool
469
470config NET_IEEE8021Q_HELPERS
471	bool
472
473config NET_SELFTESTS
474	def_tristate PHYLIB
475	depends on PHYLIB && INET
476
477config NET_SOCK_MSG
478	bool
479	default n
480	help
481	  The NET_SOCK_MSG provides a framework for plain sockets (e.g. TCP) or
482	  ULPs (upper layer modules, e.g. TLS) to process L7 application data
483	  with the help of BPF programs.
484
485config NET_DEVLINK
486	bool
487	default n
 
488
489config PAGE_POOL
490	bool
491
492config PAGE_POOL_STATS
493	default n
494	bool "Page pool stats"
495	depends on PAGE_POOL
496	help
497	  Enable page pool statistics to track page allocation and recycling
498	  in page pools. This option incurs additional CPU cost in allocation
499	  and recycle paths and additional memory cost to store the statistics.
500	  These statistics are only available if this option is enabled and if
501	  the driver using the page pool supports exporting this data.
502
503	  If unsure, say N.
504
505config FAILOVER
506	tristate "Generic failover module"
507	help
508	  The failover module provides a generic interface for paravirtual
509	  drivers to register a netdev and a set of ops with a failover
510	  instance. The ops are used as event handlers that get called to
511	  handle netdev register/unregister/link change/name change events
512	  on slave pci ethernet devices with the same mac address as the
513	  failover netdev. This enables paravirtual drivers to use a
514	  VF as an accelerated low latency datapath. It also allows live
515	  migration of VMs with direct attached VFs by failing over to the
516	  paravirtual datapath when the VF is unplugged.
517
518config ETHTOOL_NETLINK
519	bool "Netlink interface for ethtool"
520	select DIMLIB
521	default y
522	help
523	  An alternative userspace interface for ethtool based on generic
524	  netlink. It provides better extensibility and some new features,
525	  e.g. notification messages.
526
527config NETDEV_ADDR_LIST_TEST
528	tristate "Unit tests for device address list"
529	default KUNIT_ALL_TESTS
530	depends on KUNIT
531
532config NET_TEST
533	tristate "KUnit tests for networking" if !KUNIT_ALL_TESTS
534	depends on KUNIT
535	default KUNIT_ALL_TESTS
536	help
537	  KUnit tests covering core networking infra, such as sk_buff.
538
539	  If unsure, say N.
 
 
540
541endif   # if NET
 
 
 
 
 
 
v5.9
  1# SPDX-License-Identifier: GPL-2.0-only
  2#
  3# Network configuration
  4#
  5
  6menuconfig NET
  7	bool "Networking support"
  8	select NLATTR
  9	select GENERIC_NET_UTILS
 10	select BPF
 11	help
 12	  Unless you really know what you are doing, you should say Y here.
 13	  The reason is that some programs need kernel networking support even
 14	  when running on a stand-alone machine that isn't connected to any
 15	  other computer.
 16
 17	  If you are upgrading from an older kernel, you
 18	  should consider updating your networking tools too because changes
 19	  in the kernel and the tools often go hand in hand. The tools are
 20	  contained in the package net-tools, the location and version number
 21	  of which are given in <file:Documentation/Changes>.
 22
 23	  For a general introduction to Linux networking, it is highly
 24	  recommended to read the NET-HOWTO, available from
 25	  <http://www.tldp.org/docs.html#howto>.
 26
 27if NET
 28
 29config WANT_COMPAT_NETLINK_MESSAGES
 30	bool
 31	help
 32	  This option can be selected by other options that need compat
 33	  netlink messages.
 34
 35config COMPAT_NETLINK_MESSAGES
 36	def_bool y
 37	depends on COMPAT
 38	depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES
 39	help
 40	  This option makes it possible to send different netlink messages
 41	  to tasks depending on whether the task is a compat task or not. To
 42	  achieve this, you need to set skb_shinfo(skb)->frag_list to the
 43	  compat skb before sending the skb, the netlink code will sort out
 44	  which message to actually pass to the task.
 45
 46	  Newly written code should NEVER need this option but do
 47	  compat-independent messages instead!
 48
 49config NET_INGRESS
 50	bool
 51
 52config NET_EGRESS
 53	bool
 54
 
 
 
 
 
 55config NET_REDIRECT
 56	bool
 57
 
 
 
 58config SKB_EXTENSIONS
 59	bool
 60
 
 
 
 
 
 
 
 
 
 61menu "Networking options"
 62
 63source "net/packet/Kconfig"
 64source "net/unix/Kconfig"
 65source "net/tls/Kconfig"
 66source "net/xfrm/Kconfig"
 67source "net/iucv/Kconfig"
 68source "net/smc/Kconfig"
 69source "net/xdp/Kconfig"
 70
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 71config INET
 72	bool "TCP/IP networking"
 73	help
 74	  These are the protocols used on the Internet and on most local
 75	  Ethernets. It is highly recommended to say Y here (this will enlarge
 76	  your kernel by about 400 KB), since some programs (e.g. the X window
 77	  system) use TCP/IP even if your machine is not connected to any
 78	  other computer. You will get the so-called loopback device which
 79	  allows you to ping yourself (great fun, that!).
 80
 81	  For an excellent introduction to Linux networking, please read the
 82	  Linux Networking HOWTO, available from
 83	  <http://www.tldp.org/docs.html#howto>.
 84
 85	  If you say Y here and also to "/proc file system support" and
 86	  "Sysctl support" below, you can change various aspects of the
 87	  behavior of the TCP/IP code by writing to the (virtual) files in
 88	  /proc/sys/net/ipv4/*; the options are explained in the file
 89	  <file:Documentation/networking/ip-sysctl.rst>.
 90
 91	  Short answer: say Y.
 92
 93if INET
 94source "net/ipv4/Kconfig"
 95source "net/ipv6/Kconfig"
 96source "net/netlabel/Kconfig"
 97source "net/mptcp/Kconfig"
 98
 99endif # if INET
100
101config NETWORK_SECMARK
102	bool "Security Marking"
103	help
104	  This enables security marking of network packets, similar
105	  to nfmark, but designated for security purposes.
106	  If you are unsure how to answer this question, answer N.
107
108config NET_PTP_CLASSIFY
109	def_bool n
110
111config NETWORK_PHY_TIMESTAMPING
112	bool "Timestamping in PHY devices"
113	select NET_PTP_CLASSIFY
114	help
115	  This allows timestamping of network packets by PHYs (or
116	  other MII bus snooping devices) with hardware timestamping
117	  capabilities. This option adds some overhead in the transmit
118	  and receive paths.
119
120	  If you are unsure how to answer this question, answer N.
121
122menuconfig NETFILTER
123	bool "Network packet filtering framework (Netfilter)"
124	help
125	  Netfilter is a framework for filtering and mangling network packets
126	  that pass through your Linux box.
127
128	  The most common use of packet filtering is to run your Linux box as
129	  a firewall protecting a local network from the Internet. The type of
130	  firewall provided by this kernel support is called a "packet
131	  filter", which means that it can reject individual network packets
132	  based on type, source, destination etc. The other kind of firewall,
133	  a "proxy-based" one, is more secure but more intrusive and more
134	  bothersome to set up; it inspects the network traffic much more
135	  closely, modifies it and has knowledge about the higher level
136	  protocols, which a packet filter lacks. Moreover, proxy-based
137	  firewalls often require changes to the programs running on the local
138	  clients. Proxy-based firewalls don't need support by the kernel, but
139	  they are often combined with a packet filter, which only works if
140	  you say Y here.
141
142	  You should also say Y here if you intend to use your Linux box as
143	  the gateway to the Internet for a local network of machines without
144	  globally valid IP addresses. This is called "masquerading": if one
145	  of the computers on your local network wants to send something to
146	  the outside, your box can "masquerade" as that computer, i.e. it
147	  forwards the traffic to the intended outside destination, but
148	  modifies the packets to make it look like they came from the
149	  firewall box itself. It works both ways: if the outside host
150	  replies, the Linux box will silently forward the traffic to the
151	  correct local computer. This way, the computers on your local net
152	  are completely invisible to the outside world, even though they can
153	  reach the outside and can receive replies. It is even possible to
154	  run globally visible servers from within a masqueraded local network
155	  using a mechanism called portforwarding. Masquerading is also often
156	  called NAT (Network Address Translation).
157
158	  Another use of Netfilter is in transparent proxying: if a machine on
159	  the local network tries to connect to an outside host, your Linux
160	  box can transparently forward the traffic to a local server,
161	  typically a caching proxy server.
162
163	  Yet another use of Netfilter is building a bridging firewall. Using
164	  a bridge with Network packet filtering enabled makes iptables "see"
165	  the bridged traffic. For filtering on the lower network and Ethernet
166	  protocols over the bridge, use ebtables (under bridge netfilter
167	  configuration).
168
169	  Various modules exist for netfilter which replace the previous
170	  masquerading (ipmasqadm), packet filtering (ipchains), transparent
171	  proxying, and portforwarding mechanisms. Please see
172	  <file:Documentation/Changes> under "iptables" for the location of
173	  these packages.
174
175if NETFILTER
176
177config NETFILTER_ADVANCED
178	bool "Advanced netfilter configuration"
179	depends on NETFILTER
180	default y
181	help
182	  If you say Y here you can select between all the netfilter modules.
183	  If you say N the more unusual ones will not be shown and the
184	  basic ones needed by most people will default to 'M'.
185
186	  If unsure, say Y.
187
188config BRIDGE_NETFILTER
189	tristate "Bridged IP/ARP packets filtering"
190	depends on BRIDGE
191	depends on NETFILTER && INET
192	depends on NETFILTER_ADVANCED
193	select NETFILTER_FAMILY_BRIDGE
194	select SKB_EXTENSIONS
195	help
196	  Enabling this option will let arptables resp. iptables see bridged
197	  ARP resp. IP traffic. If you want a bridging firewall, you probably
198	  want this option enabled.
199	  Enabling or disabling this option doesn't enable or disable
200	  ebtables.
201
202	  If unsure, say N.
203
204source "net/netfilter/Kconfig"
205source "net/ipv4/netfilter/Kconfig"
206source "net/ipv6/netfilter/Kconfig"
207source "net/decnet/netfilter/Kconfig"
208source "net/bridge/netfilter/Kconfig"
209
210endif
211
212source "net/bpfilter/Kconfig"
213
214source "net/dccp/Kconfig"
215source "net/sctp/Kconfig"
216source "net/rds/Kconfig"
217source "net/tipc/Kconfig"
218source "net/atm/Kconfig"
219source "net/l2tp/Kconfig"
220source "net/802/Kconfig"
221source "net/bridge/Kconfig"
222source "net/dsa/Kconfig"
223source "net/8021q/Kconfig"
224source "net/decnet/Kconfig"
225source "net/llc/Kconfig"
226source "drivers/net/appletalk/Kconfig"
227source "net/x25/Kconfig"
228source "net/lapb/Kconfig"
229source "net/phonet/Kconfig"
230source "net/6lowpan/Kconfig"
231source "net/ieee802154/Kconfig"
232source "net/mac802154/Kconfig"
233source "net/sched/Kconfig"
234source "net/dcb/Kconfig"
235source "net/dns_resolver/Kconfig"
236source "net/batman-adv/Kconfig"
237source "net/openvswitch/Kconfig"
238source "net/vmw_vsock/Kconfig"
239source "net/netlink/Kconfig"
240source "net/mpls/Kconfig"
241source "net/nsh/Kconfig"
242source "net/hsr/Kconfig"
243source "net/switchdev/Kconfig"
244source "net/l3mdev/Kconfig"
245source "net/qrtr/Kconfig"
246source "net/ncsi/Kconfig"
247
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
248config RPS
249	bool
250	depends on SMP && SYSFS
251	default y
 
 
 
252
253config RFS_ACCEL
254	bool
255	depends on RPS
256	select CPU_RMAP
257	default y
 
 
 
 
 
 
258
259config XPS
260	bool
261	depends on SMP
 
262	default y
263
264config HWBM
265	bool
266
267config CGROUP_NET_PRIO
268	bool "Network priority cgroup"
269	depends on CGROUPS
270	select SOCK_CGROUP_DATA
271	help
272	  Cgroup subsystem for use in assigning processes to network priorities on
273	  a per-interface basis.
274
275config CGROUP_NET_CLASSID
276	bool "Network classid cgroup"
277	depends on CGROUPS
278	select SOCK_CGROUP_DATA
279	help
280	  Cgroup subsystem for use as general purpose socket classid marker that is
281	  being used in cls_cgroup and for netfilter matching.
282
283config NET_RX_BUSY_POLL
284	bool
285	default y
286
287config BQL
288	bool
 
289	depends on SYSFS
290	select DQL
291	default y
292
293config BPF_JIT
294	bool "enable BPF Just In Time compiler"
295	depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
296	depends on MODULES
297	help
298	  Berkeley Packet Filter filtering capabilities are normally handled
299	  by an interpreter. This option allows kernel to generate a native
300	  code when filter is loaded in memory. This should speedup
301	  packet sniffing (libpcap/tcpdump).
302
303	  Note, admin should enable this feature changing:
304	  /proc/sys/net/core/bpf_jit_enable
305	  /proc/sys/net/core/bpf_jit_harden   (optional)
306	  /proc/sys/net/core/bpf_jit_kallsyms (optional)
307
308config BPF_STREAM_PARSER
309	bool "enable BPF STREAM_PARSER"
310	depends on INET
311	depends on BPF_SYSCALL
312	depends on CGROUP_BPF
313	select STREAM_PARSER
314	select NET_SOCK_MSG
315	help
316	  Enabling this allows a stream parser to be used with
317	  BPF_MAP_TYPE_SOCKMAP.
318
319	  BPF_MAP_TYPE_SOCKMAP provides a map type to use with network sockets.
320	  It can be used to enforce socket policy, implement socket redirects,
321	  etc.
322
323config NET_FLOW_LIMIT
324	bool
325	depends on RPS
326	default y
327	help
328	  The network stack has to drop packets when a receive processing CPU's
329	  backlog reaches netdev_max_backlog. If a few out of many active flows
330	  generate the vast majority of load, drop their traffic earlier to
331	  maintain capacity for the other flows. This feature provides servers
332	  with many clients some protection against DoS by a single (spoofed)
333	  flow that greatly exceeds average workload.
334
335menu "Network testing"
336
337config NET_PKTGEN
338	tristate "Packet Generator (USE WITH CAUTION)"
339	depends on INET && PROC_FS
340	help
341	  This module will inject preconfigured packets, at a configurable
342	  rate, out of a given interface.  It is used for network interface
343	  stress testing and performance analysis.  If you don't understand
344	  what was just said, you don't need it: say N.
345
346	  Documentation on how to use the packet generator can be found
347	  at <file:Documentation/networking/pktgen.rst>.
348
349	  To compile this code as a module, choose M here: the
350	  module will be called pktgen.
351
352config NET_DROP_MONITOR
353	tristate "Network packet drop alerting service"
354	depends on INET && TRACEPOINTS
355	help
356	  This feature provides an alerting service to userspace in the
357	  event that packets are discarded in the network stack.  Alerts
358	  are broadcast via netlink socket to any listening user space
359	  process.  If you don't need network drop alerts, or if you are ok
360	  just checking the various proc files and other utilities for
361	  drop statistics, say N here.
362
363endmenu
364
365endmenu
366
367source "net/ax25/Kconfig"
368source "net/can/Kconfig"
369source "net/bluetooth/Kconfig"
370source "net/rxrpc/Kconfig"
371source "net/kcm/Kconfig"
372source "net/strparser/Kconfig"
 
373
374config FIB_RULES
375	bool
376
377menuconfig WIRELESS
378	bool "Wireless"
379	depends on !S390
380	default y
381
382if WIRELESS
383
384source "net/wireless/Kconfig"
385source "net/mac80211/Kconfig"
386
387endif # WIRELESS
388
389source "net/wimax/Kconfig"
390
391source "net/rfkill/Kconfig"
392source "net/9p/Kconfig"
393source "net/caif/Kconfig"
394source "net/ceph/Kconfig"
395source "net/nfc/Kconfig"
396source "net/psample/Kconfig"
397source "net/ife/Kconfig"
398
399config LWTUNNEL
400	bool "Network light weight tunnels"
401	help
402	  This feature provides an infrastructure to support light weight
403	  tunnels like mpls. There is no netdevice associated with a light
404	  weight tunnel endpoint. Tunnel encapsulation parameters are stored
405	  with light weight tunnel state associated with fib routes.
406
407config LWTUNNEL_BPF
408	bool "Execute BPF program as route nexthop action"
409	depends on LWTUNNEL && INET
410	default y if LWTUNNEL=y
411	help
412	  Allows to run BPF programs as a nexthop action following a route
413	  lookup for incoming and outgoing packets.
414
415config DST_CACHE
416	bool
417	default n
418
419config GRO_CELLS
420	bool
421	default n
422
423config SOCK_VALIDATE_XMIT
424	bool
425
 
 
 
 
 
 
 
426config NET_SOCK_MSG
427	bool
428	default n
429	help
430	  The NET_SOCK_MSG provides a framework for plain sockets (e.g. TCP) or
431	  ULPs (upper layer modules, e.g. TLS) to process L7 application data
432	  with the help of BPF programs.
433
434config NET_DEVLINK
435	bool
436	default n
437	imply NET_DROP_MONITOR
438
439config PAGE_POOL
440	bool
441
 
 
 
 
 
 
 
 
 
 
 
 
 
442config FAILOVER
443	tristate "Generic failover module"
444	help
445	  The failover module provides a generic interface for paravirtual
446	  drivers to register a netdev and a set of ops with a failover
447	  instance. The ops are used as event handlers that get called to
448	  handle netdev register/unregister/link change/name change events
449	  on slave pci ethernet devices with the same mac address as the
450	  failover netdev. This enables paravirtual drivers to use a
451	  VF as an accelerated low latency datapath. It also allows live
452	  migration of VMs with direct attached VFs by failing over to the
453	  paravirtual datapath when the VF is unplugged.
454
455config ETHTOOL_NETLINK
456	bool "Netlink interface for ethtool"
 
457	default y
458	help
459	  An alternative userspace interface for ethtool based on generic
460	  netlink. It provides better extensibility and some new features,
461	  e.g. notification messages.
462
463endif   # if NET
 
 
 
 
 
 
 
 
 
 
464
465# Used by archs to tell that they support BPF JIT compiler plus which flavour.
466# Only one of the two can be selected for a specific arch since eBPF JIT supersedes
467# the cBPF JIT.
468
469# Classic BPF JIT (cBPF)
470config HAVE_CBPF_JIT
471	bool
472
473# Extended BPF JIT (eBPF)
474config HAVE_EBPF_JIT
475	bool