xref: /openbmc/linux/net/Kconfig (revision 3d40aed8)
1# SPDX-License-Identifier: GPL-2.0-only
2#
3# Network configuration
4#
5
6menuconfig NET
7	bool "Networking support"
8	select NLATTR
9	select GENERIC_NET_UTILS
10	select BPF
11	help
12	  Unless you really know what you are doing, you should say Y here.
13	  The reason is that some programs need kernel networking support even
14	  when running on a stand-alone machine that isn't connected to any
15	  other computer.
16
17	  If you are upgrading from an older kernel, you
18	  should consider updating your networking tools too because changes
19	  in the kernel and the tools often go hand in hand. The tools are
20	  contained in the package net-tools, the location and version number
21	  of which are given in <file:Documentation/Changes>.
22
23	  For a general introduction to Linux networking, it is highly
24	  recommended to read the NET-HOWTO, available from
25	  <http://www.tldp.org/docs.html#howto>.
26
27if NET
28
29config WANT_COMPAT_NETLINK_MESSAGES
30	bool
31	help
32	  This option can be selected by other options that need compat
33	  netlink messages.
34
35config COMPAT_NETLINK_MESSAGES
36	def_bool y
37	depends on COMPAT
38	depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES
39	help
40	  This option makes it possible to send different netlink messages
41	  to tasks depending on whether the task is a compat task or not. To
42	  achieve this, you need to set skb_shinfo(skb)->frag_list to the
43	  compat skb before sending the skb, the netlink code will sort out
44	  which message to actually pass to the task.
45
46	  Newly written code should NEVER need this option but do
47	  compat-independent messages instead!
48
49config NET_INGRESS
50	bool
51
52config NET_EGRESS
53	bool
54
55config NET_XGRESS
56	select NET_INGRESS
57	select NET_EGRESS
58	bool
59
60config NET_REDIRECT
61	bool
62
63config SKB_EXTENSIONS
64	bool
65
66menu "Networking options"
67
68source "net/packet/Kconfig"
69source "net/unix/Kconfig"
70source "net/tls/Kconfig"
71source "net/xfrm/Kconfig"
72source "net/iucv/Kconfig"
73source "net/smc/Kconfig"
74source "net/xdp/Kconfig"
75
76config NET_HANDSHAKE
77	bool
78	depends on SUNRPC || NVME_TARGET_TCP || NVME_TCP
79	default y
80
81config NET_HANDSHAKE_KUNIT_TEST
82	tristate "KUnit tests for the handshake upcall mechanism" if !KUNIT_ALL_TESTS
83	default KUNIT_ALL_TESTS
84	depends on KUNIT
85	help
86	  This builds the KUnit tests for the handshake upcall mechanism.
87
88	  KUnit tests run during boot and output the results to the debug
89	  log in TAP format (https://testanything.org/). Only useful for
90	  kernel devs running KUnit test harness and are not for inclusion
91	  into a production build.
92
93	  For more information on KUnit and unit tests in general, refer
94	  to the KUnit documentation in Documentation/dev-tools/kunit/.
95
96config INET
97	bool "TCP/IP networking"
98	help
99	  These are the protocols used on the Internet and on most local
100	  Ethernets. It is highly recommended to say Y here (this will enlarge
101	  your kernel by about 400 KB), since some programs (e.g. the X window
102	  system) use TCP/IP even if your machine is not connected to any
103	  other computer. You will get the so-called loopback device which
104	  allows you to ping yourself (great fun, that!).
105
106	  For an excellent introduction to Linux networking, please read the
107	  Linux Networking HOWTO, available from
108	  <http://www.tldp.org/docs.html#howto>.
109
110	  If you say Y here and also to "/proc file system support" and
111	  "Sysctl support" below, you can change various aspects of the
112	  behavior of the TCP/IP code by writing to the (virtual) files in
113	  /proc/sys/net/ipv4/*; the options are explained in the file
114	  <file:Documentation/networking/ip-sysctl.rst>.
115
116	  Short answer: say Y.
117
118if INET
119source "net/ipv4/Kconfig"
120source "net/ipv6/Kconfig"
121source "net/netlabel/Kconfig"
122source "net/mptcp/Kconfig"
123
124endif # if INET
125
126config NETWORK_SECMARK
127	bool "Security Marking"
128	help
129	  This enables security marking of network packets, similar
130	  to nfmark, but designated for security purposes.
131	  If you are unsure how to answer this question, answer N.
132
133config NET_PTP_CLASSIFY
134	def_bool n
135
136config NETWORK_PHY_TIMESTAMPING
137	bool "Timestamping in PHY devices"
138	select NET_PTP_CLASSIFY
139	help
140	  This allows timestamping of network packets by PHYs (or
141	  other MII bus snooping devices) with hardware timestamping
142	  capabilities. This option adds some overhead in the transmit
143	  and receive paths.
144
145	  If you are unsure how to answer this question, answer N.
146
147menuconfig NETFILTER
148	bool "Network packet filtering framework (Netfilter)"
149	help
150	  Netfilter is a framework for filtering and mangling network packets
151	  that pass through your Linux box.
152
153	  The most common use of packet filtering is to run your Linux box as
154	  a firewall protecting a local network from the Internet. The type of
155	  firewall provided by this kernel support is called a "packet
156	  filter", which means that it can reject individual network packets
157	  based on type, source, destination etc. The other kind of firewall,
158	  a "proxy-based" one, is more secure but more intrusive and more
159	  bothersome to set up; it inspects the network traffic much more
160	  closely, modifies it and has knowledge about the higher level
161	  protocols, which a packet filter lacks. Moreover, proxy-based
162	  firewalls often require changes to the programs running on the local
163	  clients. Proxy-based firewalls don't need support by the kernel, but
164	  they are often combined with a packet filter, which only works if
165	  you say Y here.
166
167	  You should also say Y here if you intend to use your Linux box as
168	  the gateway to the Internet for a local network of machines without
169	  globally valid IP addresses. This is called "masquerading": if one
170	  of the computers on your local network wants to send something to
171	  the outside, your box can "masquerade" as that computer, i.e. it
172	  forwards the traffic to the intended outside destination, but
173	  modifies the packets to make it look like they came from the
174	  firewall box itself. It works both ways: if the outside host
175	  replies, the Linux box will silently forward the traffic to the
176	  correct local computer. This way, the computers on your local net
177	  are completely invisible to the outside world, even though they can
178	  reach the outside and can receive replies. It is even possible to
179	  run globally visible servers from within a masqueraded local network
180	  using a mechanism called portforwarding. Masquerading is also often
181	  called NAT (Network Address Translation).
182
183	  Another use of Netfilter is in transparent proxying: if a machine on
184	  the local network tries to connect to an outside host, your Linux
185	  box can transparently forward the traffic to a local server,
186	  typically a caching proxy server.
187
188	  Yet another use of Netfilter is building a bridging firewall. Using
189	  a bridge with Network packet filtering enabled makes iptables "see"
190	  the bridged traffic. For filtering on the lower network and Ethernet
191	  protocols over the bridge, use ebtables (under bridge netfilter
192	  configuration).
193
194	  Various modules exist for netfilter which replace the previous
195	  masquerading (ipmasqadm), packet filtering (ipchains), transparent
196	  proxying, and portforwarding mechanisms. Please see
197	  <file:Documentation/Changes> under "iptables" for the location of
198	  these packages.
199
200if NETFILTER
201
202config NETFILTER_ADVANCED
203	bool "Advanced netfilter configuration"
204	depends on NETFILTER
205	default y
206	help
207	  If you say Y here you can select between all the netfilter modules.
208	  If you say N the more unusual ones will not be shown and the
209	  basic ones needed by most people will default to 'M'.
210
211	  If unsure, say Y.
212
213config BRIDGE_NETFILTER
214	tristate "Bridged IP/ARP packets filtering"
215	depends on BRIDGE
216	depends on NETFILTER && INET
217	depends on NETFILTER_ADVANCED
218	select NETFILTER_FAMILY_BRIDGE
219	select SKB_EXTENSIONS
220	help
221	  Enabling this option will let arptables resp. iptables see bridged
222	  ARP resp. IP traffic. If you want a bridging firewall, you probably
223	  want this option enabled.
224	  Enabling or disabling this option doesn't enable or disable
225	  ebtables.
226
227	  If unsure, say N.
228
229source "net/netfilter/Kconfig"
230source "net/ipv4/netfilter/Kconfig"
231source "net/ipv6/netfilter/Kconfig"
232source "net/bridge/netfilter/Kconfig"
233
234endif
235
236source "net/bpfilter/Kconfig"
237
238source "net/dccp/Kconfig"
239source "net/sctp/Kconfig"
240source "net/rds/Kconfig"
241source "net/tipc/Kconfig"
242source "net/atm/Kconfig"
243source "net/l2tp/Kconfig"
244source "net/802/Kconfig"
245source "net/bridge/Kconfig"
246source "net/dsa/Kconfig"
247source "net/8021q/Kconfig"
248source "net/llc/Kconfig"
249source "drivers/net/appletalk/Kconfig"
250source "net/x25/Kconfig"
251source "net/lapb/Kconfig"
252source "net/phonet/Kconfig"
253source "net/6lowpan/Kconfig"
254source "net/ieee802154/Kconfig"
255source "net/mac802154/Kconfig"
256source "net/sched/Kconfig"
257source "net/dcb/Kconfig"
258source "net/dns_resolver/Kconfig"
259source "net/batman-adv/Kconfig"
260source "net/openvswitch/Kconfig"
261source "net/vmw_vsock/Kconfig"
262source "net/netlink/Kconfig"
263source "net/mpls/Kconfig"
264source "net/nsh/Kconfig"
265source "net/hsr/Kconfig"
266source "net/switchdev/Kconfig"
267source "net/l3mdev/Kconfig"
268source "net/qrtr/Kconfig"
269source "net/ncsi/Kconfig"
270
271config PCPU_DEV_REFCNT
272	bool "Use percpu variables to maintain network device refcount"
273	depends on SMP
274	default y
275	help
276	  network device refcount are using per cpu variables if this option is set.
277	  This can be forced to N to detect underflows (with a performance drop).
278
279config MAX_SKB_FRAGS
280	int "Maximum number of fragments per skb_shared_info"
281	range 17 45
282	default 17
283	help
284	  Having more fragments per skb_shared_info can help GRO efficiency.
285	  This helps BIG TCP workloads, but might expose bugs in some
286	  legacy drivers.
287	  This also increases memory overhead of small packets,
288	  and in drivers using build_skb().
289	  If unsure, say 17.
290
291config RPS
292	bool
293	depends on SMP && SYSFS
294	default y
295
296config RFS_ACCEL
297	bool
298	depends on RPS
299	select CPU_RMAP
300	default y
301
302config SOCK_RX_QUEUE_MAPPING
303	bool
304
305config XPS
306	bool
307	depends on SMP
308	select SOCK_RX_QUEUE_MAPPING
309	default y
310
311config HWBM
312	bool
313
314config CGROUP_NET_PRIO
315	bool "Network priority cgroup"
316	depends on CGROUPS
317	select SOCK_CGROUP_DATA
318	help
319	  Cgroup subsystem for use in assigning processes to network priorities on
320	  a per-interface basis.
321
322config CGROUP_NET_CLASSID
323	bool "Network classid cgroup"
324	depends on CGROUPS
325	select SOCK_CGROUP_DATA
326	help
327	  Cgroup subsystem for use as general purpose socket classid marker that is
328	  being used in cls_cgroup and for netfilter matching.
329
330config NET_RX_BUSY_POLL
331	bool
332	default y if !PREEMPT_RT || (PREEMPT_RT && !NETCONSOLE)
333
334config BQL
335	bool
336	depends on SYSFS
337	select DQL
338	default y
339
340config BPF_STREAM_PARSER
341	bool "enable BPF STREAM_PARSER"
342	depends on INET
343	depends on BPF_SYSCALL
344	depends on CGROUP_BPF
345	select STREAM_PARSER
346	select NET_SOCK_MSG
347	help
348	  Enabling this allows a TCP stream parser to be used with
349	  BPF_MAP_TYPE_SOCKMAP.
350
351config NET_FLOW_LIMIT
352	bool
353	depends on RPS
354	default y
355	help
356	  The network stack has to drop packets when a receive processing CPU's
357	  backlog reaches netdev_max_backlog. If a few out of many active flows
358	  generate the vast majority of load, drop their traffic earlier to
359	  maintain capacity for the other flows. This feature provides servers
360	  with many clients some protection against DoS by a single (spoofed)
361	  flow that greatly exceeds average workload.
362
363menu "Network testing"
364
365config NET_PKTGEN
366	tristate "Packet Generator (USE WITH CAUTION)"
367	depends on INET && PROC_FS
368	help
369	  This module will inject preconfigured packets, at a configurable
370	  rate, out of a given interface.  It is used for network interface
371	  stress testing and performance analysis.  If you don't understand
372	  what was just said, you don't need it: say N.
373
374	  Documentation on how to use the packet generator can be found
375	  at <file:Documentation/networking/pktgen.rst>.
376
377	  To compile this code as a module, choose M here: the
378	  module will be called pktgen.
379
380config NET_DROP_MONITOR
381	tristate "Network packet drop alerting service"
382	depends on INET && TRACEPOINTS
383	help
384	  This feature provides an alerting service to userspace in the
385	  event that packets are discarded in the network stack.  Alerts
386	  are broadcast via netlink socket to any listening user space
387	  process.  If you don't need network drop alerts, or if you are ok
388	  just checking the various proc files and other utilities for
389	  drop statistics, say N here.
390
391endmenu
392
393endmenu
394
395source "net/ax25/Kconfig"
396source "net/can/Kconfig"
397source "net/bluetooth/Kconfig"
398source "net/rxrpc/Kconfig"
399source "net/kcm/Kconfig"
400source "net/strparser/Kconfig"
401source "net/mctp/Kconfig"
402
403config FIB_RULES
404	bool
405
406menuconfig WIRELESS
407	bool "Wireless"
408	depends on !S390
409	default y
410
411if WIRELESS
412
413source "net/wireless/Kconfig"
414source "net/mac80211/Kconfig"
415
416endif # WIRELESS
417
418source "net/rfkill/Kconfig"
419source "net/9p/Kconfig"
420source "net/caif/Kconfig"
421source "net/ceph/Kconfig"
422source "net/nfc/Kconfig"
423source "net/psample/Kconfig"
424source "net/ife/Kconfig"
425
426config LWTUNNEL
427	bool "Network light weight tunnels"
428	help
429	  This feature provides an infrastructure to support light weight
430	  tunnels like mpls. There is no netdevice associated with a light
431	  weight tunnel endpoint. Tunnel encapsulation parameters are stored
432	  with light weight tunnel state associated with fib routes.
433
434config LWTUNNEL_BPF
435	bool "Execute BPF program as route nexthop action"
436	depends on LWTUNNEL && INET
437	default y if LWTUNNEL=y
438	help
439	  Allows to run BPF programs as a nexthop action following a route
440	  lookup for incoming and outgoing packets.
441
442config DST_CACHE
443	bool
444	default n
445
446config GRO_CELLS
447	bool
448	default n
449
450config SOCK_VALIDATE_XMIT
451	bool
452
453config NET_SELFTESTS
454	def_tristate PHYLIB
455	depends on PHYLIB && INET
456
457config NET_SOCK_MSG
458	bool
459	default n
460	help
461	  The NET_SOCK_MSG provides a framework for plain sockets (e.g. TCP) or
462	  ULPs (upper layer modules, e.g. TLS) to process L7 application data
463	  with the help of BPF programs.
464
465config NET_DEVLINK
466	bool
467	default n
468
469config PAGE_POOL
470	bool
471
472config PAGE_POOL_STATS
473	default n
474	bool "Page pool stats"
475	depends on PAGE_POOL
476	help
477	  Enable page pool statistics to track page allocation and recycling
478	  in page pools. This option incurs additional CPU cost in allocation
479	  and recycle paths and additional memory cost to store the statistics.
480	  These statistics are only available if this option is enabled and if
481	  the driver using the page pool supports exporting this data.
482
483	  If unsure, say N.
484
485config FAILOVER
486	tristate "Generic failover module"
487	help
488	  The failover module provides a generic interface for paravirtual
489	  drivers to register a netdev and a set of ops with a failover
490	  instance. The ops are used as event handlers that get called to
491	  handle netdev register/unregister/link change/name change events
492	  on slave pci ethernet devices with the same mac address as the
493	  failover netdev. This enables paravirtual drivers to use a
494	  VF as an accelerated low latency datapath. It also allows live
495	  migration of VMs with direct attached VFs by failing over to the
496	  paravirtual datapath when the VF is unplugged.
497
498config ETHTOOL_NETLINK
499	bool "Netlink interface for ethtool"
500	default y
501	help
502	  An alternative userspace interface for ethtool based on generic
503	  netlink. It provides better extensibility and some new features,
504	  e.g. notification messages.
505
506config NETDEV_ADDR_LIST_TEST
507	tristate "Unit tests for device address list"
508	default KUNIT_ALL_TESTS
509	depends on KUNIT
510
511endif   # if NET
512