1# SPDX-License-Identifier: GPL-2.0-only
  2#
  3# Network configuration
  4#
  5
  6menuconfig NET
  7	bool "Networking support"
  8	select NLATTR
  9	select GENERIC_NET_UTILS
 10	select BPF
 11	help
 12	  Unless you really know what you are doing, you should say Y here.
 13	  The reason is that some programs need kernel networking support even
 14	  when running on a stand-alone machine that isn't connected to any
 15	  other computer.
 16
 17	  If you are upgrading from an older kernel, you
 18	  should consider updating your networking tools too because changes
 19	  in the kernel and the tools often go hand in hand. The tools are
 20	  contained in the package net-tools, the location and version number
 21	  of which are given in <file:Documentation/Changes>.
 22
 23	  For a general introduction to Linux networking, it is highly
 24	  recommended to read the NET-HOWTO, available from
 25	  <http://www.tldp.org/docs.html#howto>.
 26
 27if NET
 28
 29config WANT_COMPAT_NETLINK_MESSAGES
 30	bool
 31	help
 32	  This option can be selected by other options that need compat
 33	  netlink messages.
 34
 35config COMPAT_NETLINK_MESSAGES
 36	def_bool y
 37	depends on COMPAT
 38	depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES
 39	help
 40	  This option makes it possible to send different netlink messages
 41	  to tasks depending on whether the task is a compat task or not. To
 42	  achieve this, you need to set skb_shinfo(skb)->frag_list to the
 43	  compat skb before sending the skb, the netlink code will sort out
 44	  which message to actually pass to the task.
 45
 46	  Newly written code should NEVER need this option but do
 47	  compat-independent messages instead!
 48
 49config NET_INGRESS
 50	bool
 51
 52config NET_EGRESS
 53	bool
 54
 55config NET_XGRESS
 56	select NET_INGRESS
 57	select NET_EGRESS
 58	bool
 59
 60config NET_REDIRECT
 61	bool
 62
 63config SKB_DECRYPTED
 64	bool
 65
 66config SKB_EXTENSIONS
 67	bool
 68
 69config NET_DEVMEM
 70	def_bool y
 71	depends on DMA_SHARED_BUFFER
 72	depends on GENERIC_ALLOCATOR
 73	depends on PAGE_POOL
 74
 75config NET_SHAPER
 76	bool
 77
 78menu "Networking options"
 79
 80source "net/packet/Kconfig"
 81source "net/unix/Kconfig"
 82source "net/tls/Kconfig"
 83source "net/xfrm/Kconfig"
 84source "net/iucv/Kconfig"
 85source "net/smc/Kconfig"
 86source "net/xdp/Kconfig"
 87
 88config NET_HANDSHAKE
 89	bool
 90	depends on SUNRPC || NVME_TARGET_TCP || NVME_TCP
 91	default y
 92
 93config NET_HANDSHAKE_KUNIT_TEST
 94	tristate "KUnit tests for the handshake upcall mechanism" if !KUNIT_ALL_TESTS
 95	default KUNIT_ALL_TESTS
 96	depends on KUNIT
 97	help
 98	  This builds the KUnit tests for the handshake upcall mechanism.
 99
100	  KUnit tests run during boot and output the results to the debug
101	  log in TAP format (https://testanything.org/). Only useful for
102	  kernel devs running KUnit test harness and are not for inclusion
103	  into a production build.
104
105	  For more information on KUnit and unit tests in general, refer
106	  to the KUnit documentation in Documentation/dev-tools/kunit/.
107
108config INET
109	bool "TCP/IP networking"
110	help
111	  These are the protocols used on the Internet and on most local
112	  Ethernets. It is highly recommended to say Y here (this will enlarge
113	  your kernel by about 400 KB), since some programs (e.g. the X window
114	  system) use TCP/IP even if your machine is not connected to any
115	  other computer. You will get the so-called loopback device which
116	  allows you to ping yourself (great fun, that!).
117
118	  For an excellent introduction to Linux networking, please read the
119	  Linux Networking HOWTO, available from
120	  <http://www.tldp.org/docs.html#howto>.
121
122	  If you say Y here and also to "/proc file system support" and
123	  "Sysctl support" below, you can change various aspects of the
124	  behavior of the TCP/IP code by writing to the (virtual) files in
125	  /proc/sys/net/ipv4/*; the options are explained in the file
126	  <file:Documentation/networking/ip-sysctl.rst>.
127
128	  Short answer: say Y.
129
130if INET
131source "net/ipv4/Kconfig"
132source "net/ipv6/Kconfig"
133source "net/netlabel/Kconfig"
134source "net/mptcp/Kconfig"
135
136endif # if INET
137
138config NETWORK_SECMARK
139	bool "Security Marking"
140	help
141	  This enables security marking of network packets, similar
142	  to nfmark, but designated for security purposes.
143	  If you are unsure how to answer this question, answer N.
144
145config NET_PTP_CLASSIFY
146	def_bool n
147
148config NETWORK_PHY_TIMESTAMPING
149	bool "Timestamping in PHY devices"
150	select NET_PTP_CLASSIFY
151	help
152	  This allows timestamping of network packets by PHYs (or
153	  other MII bus snooping devices) with hardware timestamping
154	  capabilities. This option adds some overhead in the transmit
155	  and receive paths.
156
157	  If you are unsure how to answer this question, answer N.
158
159menuconfig NETFILTER
160	bool "Network packet filtering framework (Netfilter)"
161	help
162	  Netfilter is a framework for filtering and mangling network packets
163	  that pass through your Linux box.
164
165	  The most common use of packet filtering is to run your Linux box as
166	  a firewall protecting a local network from the Internet. The type of
167	  firewall provided by this kernel support is called a "packet
168	  filter", which means that it can reject individual network packets
169	  based on type, source, destination etc. The other kind of firewall,
170	  a "proxy-based" one, is more secure but more intrusive and more
171	  bothersome to set up; it inspects the network traffic much more
172	  closely, modifies it and has knowledge about the higher level
173	  protocols, which a packet filter lacks. Moreover, proxy-based
174	  firewalls often require changes to the programs running on the local
175	  clients. Proxy-based firewalls don't need support by the kernel, but
176	  they are often combined with a packet filter, which only works if
177	  you say Y here.
178
179	  You should also say Y here if you intend to use your Linux box as
180	  the gateway to the Internet for a local network of machines without
181	  globally valid IP addresses. This is called "masquerading": if one
182	  of the computers on your local network wants to send something to
183	  the outside, your box can "masquerade" as that computer, i.e. it
184	  forwards the traffic to the intended outside destination, but
185	  modifies the packets to make it look like they came from the
186	  firewall box itself. It works both ways: if the outside host
187	  replies, the Linux box will silently forward the traffic to the
188	  correct local computer. This way, the computers on your local net
189	  are completely invisible to the outside world, even though they can
190	  reach the outside and can receive replies. It is even possible to
191	  run globally visible servers from within a masqueraded local network
192	  using a mechanism called portforwarding. Masquerading is also often
193	  called NAT (Network Address Translation).
194
195	  Another use of Netfilter is in transparent proxying: if a machine on
196	  the local network tries to connect to an outside host, your Linux
197	  box can transparently forward the traffic to a local server,
198	  typically a caching proxy server.
199
200	  Yet another use of Netfilter is building a bridging firewall. Using
201	  a bridge with Network packet filtering enabled makes iptables "see"
202	  the bridged traffic. For filtering on the lower network and Ethernet
203	  protocols over the bridge, use ebtables (under bridge netfilter
204	  configuration).
205
206	  Various modules exist for netfilter which replace the previous
207	  masquerading (ipmasqadm), packet filtering (ipchains), transparent
208	  proxying, and portforwarding mechanisms. Please see
209	  <file:Documentation/Changes> under "iptables" for the location of
210	  these packages.
211
212if NETFILTER
213
214config NETFILTER_ADVANCED
215	bool "Advanced netfilter configuration"
216	depends on NETFILTER
217	default y
218	help
219	  If you say Y here you can select between all the netfilter modules.
220	  If you say N the more unusual ones will not be shown and the
221	  basic ones needed by most people will default to 'M'.
222
223	  If unsure, say Y.
224
225config BRIDGE_NETFILTER
226	tristate "Bridged IP/ARP packets filtering"
227	depends on BRIDGE
228	depends on NETFILTER && INET
229	depends on NETFILTER_ADVANCED
230	select NETFILTER_FAMILY_BRIDGE
231	select SKB_EXTENSIONS
232	help
233	  Enabling this option will let arptables resp. iptables see bridged
234	  ARP resp. IP traffic. If you want a bridging firewall, you probably
235	  want this option enabled.
236	  Enabling or disabling this option doesn't enable or disable
237	  ebtables.
238
239	  If unsure, say N.
240
241source "net/netfilter/Kconfig"
242source "net/ipv4/netfilter/Kconfig"
243source "net/ipv6/netfilter/Kconfig"
244source "net/bridge/netfilter/Kconfig"
245
246endif
247
248source "net/dccp/Kconfig"
249source "net/sctp/Kconfig"
250source "net/rds/Kconfig"
251source "net/tipc/Kconfig"
252source "net/atm/Kconfig"
253source "net/l2tp/Kconfig"
254source "net/802/Kconfig"
255source "net/bridge/Kconfig"
256source "net/dsa/Kconfig"
257source "net/8021q/Kconfig"
258source "net/llc/Kconfig"
259source "net/appletalk/Kconfig"
260source "net/x25/Kconfig"
261source "net/lapb/Kconfig"
262source "net/phonet/Kconfig"
263source "net/6lowpan/Kconfig"
264source "net/ieee802154/Kconfig"
265source "net/mac802154/Kconfig"
266source "net/sched/Kconfig"
267source "net/dcb/Kconfig"
268source "net/dns_resolver/Kconfig"
269source "net/batman-adv/Kconfig"
270source "net/openvswitch/Kconfig"
271source "net/vmw_vsock/Kconfig"
272source "net/netlink/Kconfig"
273source "net/mpls/Kconfig"
274source "net/nsh/Kconfig"
275source "net/hsr/Kconfig"
276source "net/switchdev/Kconfig"
277source "net/l3mdev/Kconfig"
278source "net/qrtr/Kconfig"
279source "net/ncsi/Kconfig"
280
281config PCPU_DEV_REFCNT
282	bool "Use percpu variables to maintain network device refcount"
283	depends on SMP
284	default y
285	help
286	  network device refcount are using per cpu variables if this option is set.
287	  This can be forced to N to detect underflows (with a performance drop).
288
289config MAX_SKB_FRAGS
290	int "Maximum number of fragments per skb_shared_info"
291	range 17 45
292	default 17
293	help
294	  Having more fragments per skb_shared_info can help GRO efficiency.
295	  This helps BIG TCP workloads, but might expose bugs in some
296	  legacy drivers.
297	  This also increases memory overhead of small packets,
298	  and in drivers using build_skb().
299	  If unsure, say 17.
300
301config RPS
302	bool "Receive packet steering"
303	depends on SMP && SYSFS
304	default y
305	help
306	  Software receive side packet steering (RPS) distributes the
307	  load of received packet processing across multiple CPUs.
308
309config RFS_ACCEL
310	bool "Hardware acceleration of RFS"
311	depends on RPS
312	select CPU_RMAP
313	default y
314	help
315	  Allowing drivers for multiqueue hardware with flow filter tables to
316	  accelerate RFS.
317
318config SOCK_RX_QUEUE_MAPPING
319	bool
320
321config XPS
322	bool
323	depends on SMP
324	select SOCK_RX_QUEUE_MAPPING
325	default y
326
327config HWBM
328	bool
329
330config CGROUP_NET_PRIO
331	bool "Network priority cgroup"
332	depends on CGROUPS
333	select SOCK_CGROUP_DATA
334	help
335	  Cgroup subsystem for use in assigning processes to network priorities on
336	  a per-interface basis.
337
338config CGROUP_NET_CLASSID
339	bool "Network classid cgroup"
340	depends on CGROUPS
341	select SOCK_CGROUP_DATA
342	help
343	  Cgroup subsystem for use as general purpose socket classid marker that is
344	  being used in cls_cgroup and for netfilter matching.
345
346config NET_RX_BUSY_POLL
347	bool
348	default y if !PREEMPT_RT || (PREEMPT_RT && !NETCONSOLE)
349
350config BQL
351	bool
352	prompt "Enable Byte Queue Limits"
353	depends on SYSFS
354	select DQL
355	default y
356
357config BPF_STREAM_PARSER
358	bool "enable BPF STREAM_PARSER"
359	depends on INET
360	depends on BPF_SYSCALL
361	depends on CGROUP_BPF
362	select STREAM_PARSER
363	select NET_SOCK_MSG
364	help
365	  Enabling this allows a TCP stream parser to be used with
366	  BPF_MAP_TYPE_SOCKMAP.
367
368config NET_FLOW_LIMIT
369	bool "Net flow limit"
370	depends on RPS
371	default y
372	help
373	  The network stack has to drop packets when a receive processing CPU's
374	  backlog reaches netdev_max_backlog. If a few out of many active flows
375	  generate the vast majority of load, drop their traffic earlier to
376	  maintain capacity for the other flows. This feature provides servers
377	  with many clients some protection against DoS by a single (spoofed)
378	  flow that greatly exceeds average workload.
379
380menu "Network testing"
381
382config NET_PKTGEN
383	tristate "Packet Generator (USE WITH CAUTION)"
384	depends on INET && PROC_FS
385	help
386	  This module will inject preconfigured packets, at a configurable
387	  rate, out of a given interface.  It is used for network interface
388	  stress testing and performance analysis.  If you don't understand
389	  what was just said, you don't need it: say N.
390
391	  Documentation on how to use the packet generator can be found
392	  at <file:Documentation/networking/pktgen.rst>.
393
394	  To compile this code as a module, choose M here: the
395	  module will be called pktgen.
396
397config NET_DROP_MONITOR
398	tristate "Network packet drop alerting service"
399	depends on INET && TRACEPOINTS
400	help
401	  This feature provides an alerting service to userspace in the
402	  event that packets are discarded in the network stack.  Alerts
403	  are broadcast via netlink socket to any listening user space
404	  process.  If you don't need network drop alerts, or if you are ok
405	  just checking the various proc files and other utilities for
406	  drop statistics, say N here.
407
408endmenu
409
410endmenu
411
412source "net/ax25/Kconfig"
413source "net/can/Kconfig"
414source "net/bluetooth/Kconfig"
415source "net/rxrpc/Kconfig"
416source "net/kcm/Kconfig"
417source "net/strparser/Kconfig"
418source "net/mctp/Kconfig"
419
420config FIB_RULES
421	bool
422
423menuconfig WIRELESS
424	bool "Wireless"
425	depends on !S390
426	default y
427
428if WIRELESS
429
430source "net/wireless/Kconfig"
431source "net/mac80211/Kconfig"
432
433endif # WIRELESS
434
435source "net/rfkill/Kconfig"
436source "net/9p/Kconfig"
437source "net/caif/Kconfig"
438source "net/ceph/Kconfig"
439source "net/nfc/Kconfig"
440source "net/psample/Kconfig"
441source "net/ife/Kconfig"
442
443config LWTUNNEL
444	bool "Network light weight tunnels"
445	help
446	  This feature provides an infrastructure to support light weight
447	  tunnels like mpls. There is no netdevice associated with a light
448	  weight tunnel endpoint. Tunnel encapsulation parameters are stored
449	  with light weight tunnel state associated with fib routes.
450
451config LWTUNNEL_BPF
452	bool "Execute BPF program as route nexthop action"
453	depends on LWTUNNEL && INET
454	default y if LWTUNNEL=y
455	help
456	  Allows to run BPF programs as a nexthop action following a route
457	  lookup for incoming and outgoing packets.
458
459config DST_CACHE
460	bool
461	default n
462
463config GRO_CELLS
464	bool
465	default n
466
467config SOCK_VALIDATE_XMIT
468	bool
469
470config NET_IEEE8021Q_HELPERS
471	bool
472
473config NET_SELFTESTS
474	def_tristate PHYLIB
475	depends on PHYLIB && INET
476
477config NET_SOCK_MSG
478	bool
479	default n
480	help
481	  The NET_SOCK_MSG provides a framework for plain sockets (e.g. TCP) or
482	  ULPs (upper layer modules, e.g. TLS) to process L7 application data
483	  with the help of BPF programs.
484
485config NET_DEVLINK
486	bool
487	default n
488
489config PAGE_POOL
490	bool
491
492config PAGE_POOL_STATS
493	default n
494	bool "Page pool stats"
495	depends on PAGE_POOL
496	help
497	  Enable page pool statistics to track page allocation and recycling
498	  in page pools. This option incurs additional CPU cost in allocation
499	  and recycle paths and additional memory cost to store the statistics.
500	  These statistics are only available if this option is enabled and if
501	  the driver using the page pool supports exporting this data.
502
503	  If unsure, say N.
504
505config FAILOVER
506	tristate "Generic failover module"
507	help
508	  The failover module provides a generic interface for paravirtual
509	  drivers to register a netdev and a set of ops with a failover
510	  instance. The ops are used as event handlers that get called to
511	  handle netdev register/unregister/link change/name change events
512	  on slave pci ethernet devices with the same mac address as the
513	  failover netdev. This enables paravirtual drivers to use a
514	  VF as an accelerated low latency datapath. It also allows live
515	  migration of VMs with direct attached VFs by failing over to the
516	  paravirtual datapath when the VF is unplugged.
517
518config ETHTOOL_NETLINK
519	bool "Netlink interface for ethtool"
520	select DIMLIB
521	default y
522	help
523	  An alternative userspace interface for ethtool based on generic
524	  netlink. It provides better extensibility and some new features,
525	  e.g. notification messages.
526
527config NETDEV_ADDR_LIST_TEST
528	tristate "Unit tests for device address list"
529	default KUNIT_ALL_TESTS
530	depends on KUNIT
531
532config NET_TEST
533	tristate "KUnit tests for networking" if !KUNIT_ALL_TESTS
534	depends on KUNIT
535	default KUNIT_ALL_TESTS
536	help
537	  KUnit tests covering core networking infra, such as sk_buff.
538
539	  If unsure, say N.
540
541endif   # if NET