| .. | .. |
|---|
| 1 | +# SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | # |
|---|
| 2 | 3 | # Network configuration |
|---|
| 3 | 4 | # |
|---|
| .. | .. |
|---|
| 7 | 8 | select NLATTR |
|---|
| 8 | 9 | select GENERIC_NET_UTILS |
|---|
| 9 | 10 | select BPF |
|---|
| 10 | | - ---help--- |
|---|
| 11 | + help |
|---|
| 11 | 12 | Unless you really know what you are doing, you should say Y here. |
|---|
| 12 | 13 | The reason is that some programs need kernel networking support even |
|---|
| 13 | 14 | when running on a stand-alone machine that isn't connected to any |
|---|
| .. | .. |
|---|
| 51 | 52 | config NET_EGRESS |
|---|
| 52 | 53 | bool |
|---|
| 53 | 54 | |
|---|
| 55 | +config NET_REDIRECT |
|---|
| 56 | + bool |
|---|
| 57 | + |
|---|
| 58 | +config SKB_EXTENSIONS |
|---|
| 59 | + bool |
|---|
| 60 | + |
|---|
| 54 | 61 | menu "Networking options" |
|---|
| 55 | 62 | |
|---|
| 56 | 63 | source "net/packet/Kconfig" |
|---|
| .. | .. |
|---|
| 63 | 70 | |
|---|
| 64 | 71 | config INET |
|---|
| 65 | 72 | bool "TCP/IP networking" |
|---|
| 66 | | - select CRYPTO |
|---|
| 67 | | - select CRYPTO_AES |
|---|
| 68 | | - ---help--- |
|---|
| 73 | + help |
|---|
| 69 | 74 | These are the protocols used on the Internet and on most local |
|---|
| 70 | 75 | Ethernets. It is highly recommended to say Y here (this will enlarge |
|---|
| 71 | 76 | your kernel by about 400 KB), since some programs (e.g. the X window |
|---|
| .. | .. |
|---|
| 81 | 86 | "Sysctl support" below, you can change various aspects of the |
|---|
| 82 | 87 | behavior of the TCP/IP code by writing to the (virtual) files in |
|---|
| 83 | 88 | /proc/sys/net/ipv4/*; the options are explained in the file |
|---|
| 84 | | - <file:Documentation/networking/ip-sysctl.txt>. |
|---|
| 89 | + <file:Documentation/networking/ip-sysctl.rst>. |
|---|
| 85 | 90 | |
|---|
| 86 | 91 | Short answer: say Y. |
|---|
| 87 | 92 | |
|---|
| .. | .. |
|---|
| 89 | 94 | source "net/ipv4/Kconfig" |
|---|
| 90 | 95 | source "net/ipv6/Kconfig" |
|---|
| 91 | 96 | source "net/netlabel/Kconfig" |
|---|
| 97 | +source "net/mptcp/Kconfig" |
|---|
| 92 | 98 | |
|---|
| 93 | 99 | endif # if INET |
|---|
| 94 | 100 | |
|---|
| .. | .. |
|---|
| 106 | 112 | bool "Timestamping in PHY devices" |
|---|
| 107 | 113 | select NET_PTP_CLASSIFY |
|---|
| 108 | 114 | help |
|---|
| 109 | | - This allows timestamping of network packets by PHYs with |
|---|
| 110 | | - hardware timestamping capabilities. This option adds some |
|---|
| 111 | | - overhead in the transmit and receive paths. |
|---|
| 115 | + This allows timestamping of network packets by PHYs (or |
|---|
| 116 | + other MII bus snooping devices) with hardware timestamping |
|---|
| 117 | + capabilities. This option adds some overhead in the transmit |
|---|
| 118 | + and receive paths. |
|---|
| 112 | 119 | |
|---|
| 113 | 120 | If you are unsure how to answer this question, answer N. |
|---|
| 114 | 121 | |
|---|
| 115 | 122 | menuconfig NETFILTER |
|---|
| 116 | 123 | bool "Network packet filtering framework (Netfilter)" |
|---|
| 117 | | - ---help--- |
|---|
| 124 | + help |
|---|
| 118 | 125 | Netfilter is a framework for filtering and mangling network packets |
|---|
| 119 | 126 | that pass through your Linux box. |
|---|
| 120 | 127 | |
|---|
| .. | .. |
|---|
| 184 | 191 | depends on NETFILTER && INET |
|---|
| 185 | 192 | depends on NETFILTER_ADVANCED |
|---|
| 186 | 193 | select NETFILTER_FAMILY_BRIDGE |
|---|
| 187 | | - ---help--- |
|---|
| 194 | + select SKB_EXTENSIONS |
|---|
| 195 | + help |
|---|
| 188 | 196 | Enabling this option will let arptables resp. iptables see bridged |
|---|
| 189 | 197 | ARP resp. IP traffic. If you want a bridging firewall, you probably |
|---|
| 190 | 198 | want this option enabled. |
|---|
| .. | .. |
|---|
| 254 | 262 | default y |
|---|
| 255 | 263 | |
|---|
| 256 | 264 | config HWBM |
|---|
| 257 | | - bool |
|---|
| 265 | + bool |
|---|
| 258 | 266 | |
|---|
| 259 | 267 | config CGROUP_NET_PRIO |
|---|
| 260 | 268 | bool "Network priority cgroup" |
|---|
| 261 | 269 | depends on CGROUPS |
|---|
| 262 | 270 | select SOCK_CGROUP_DATA |
|---|
| 263 | | - ---help--- |
|---|
| 271 | + help |
|---|
| 264 | 272 | Cgroup subsystem for use in assigning processes to network priorities on |
|---|
| 265 | 273 | a per-interface basis. |
|---|
| 266 | 274 | |
|---|
| .. | .. |
|---|
| 268 | 276 | bool "Network classid cgroup" |
|---|
| 269 | 277 | depends on CGROUPS |
|---|
| 270 | 278 | select SOCK_CGROUP_DATA |
|---|
| 271 | | - ---help--- |
|---|
| 279 | + help |
|---|
| 272 | 280 | Cgroup subsystem for use as general purpose socket classid marker that is |
|---|
| 273 | 281 | being used in cls_cgroup and for netfilter matching. |
|---|
| 274 | 282 | |
|---|
| 275 | 283 | config NET_RX_BUSY_POLL |
|---|
| 276 | 284 | bool |
|---|
| 277 | | - default y if !PREEMPT_RT_FULL |
|---|
| 285 | + default y |
|---|
| 278 | 286 | |
|---|
| 279 | 287 | config BQL |
|---|
| 280 | 288 | bool |
|---|
| .. | .. |
|---|
| 286 | 294 | bool "enable BPF Just In Time compiler" |
|---|
| 287 | 295 | depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT |
|---|
| 288 | 296 | depends on MODULES |
|---|
| 289 | | - ---help--- |
|---|
| 297 | + help |
|---|
| 290 | 298 | Berkeley Packet Filter filtering capabilities are normally handled |
|---|
| 291 | 299 | by an interpreter. This option allows kernel to generate a native |
|---|
| 292 | 300 | code when filter is loaded in memory. This should speedup |
|---|
| .. | .. |
|---|
| 299 | 307 | |
|---|
| 300 | 308 | config BPF_STREAM_PARSER |
|---|
| 301 | 309 | bool "enable BPF STREAM_PARSER" |
|---|
| 310 | + depends on INET |
|---|
| 302 | 311 | depends on BPF_SYSCALL |
|---|
| 312 | + depends on CGROUP_BPF |
|---|
| 303 | 313 | select STREAM_PARSER |
|---|
| 304 | | - ---help--- |
|---|
| 305 | | - Enabling this allows a stream parser to be used with |
|---|
| 306 | | - BPF_MAP_TYPE_SOCKMAP. |
|---|
| 307 | | - |
|---|
| 308 | | - BPF_MAP_TYPE_SOCKMAP provides a map type to use with network sockets. |
|---|
| 309 | | - It can be used to enforce socket policy, implement socket redirects, |
|---|
| 310 | | - etc. |
|---|
| 311 | | - |
|---|
| 312 | | -config ETHTOOL |
|---|
| 313 | | - bool "enable ethtool" |
|---|
| 314 | | - default y |
|---|
| 314 | + select NET_SOCK_MSG |
|---|
| 315 | 315 | help |
|---|
| 316 | | - This selects ethtool function, default is Y. If say N, ethtool function |
|---|
| 317 | | - is not implemented. |
|---|
| 316 | + Enabling this allows a stream parser to be used with |
|---|
| 317 | + BPF_MAP_TYPE_SOCKMAP. |
|---|
| 318 | 318 | |
|---|
| 319 | | -config FILTER |
|---|
| 320 | | - bool "enable filter" |
|---|
| 321 | | - default y |
|---|
| 322 | | - help |
|---|
| 323 | | - This selects filter function, default is Y. If say N, filter function |
|---|
| 324 | | - is not implemented. |
|---|
| 319 | + BPF_MAP_TYPE_SOCKMAP provides a map type to use with network sockets. |
|---|
| 320 | + It can be used to enforce socket policy, implement socket redirects, |
|---|
| 321 | + etc. |
|---|
| 325 | 322 | |
|---|
| 326 | 323 | config NET_FLOW_LIMIT |
|---|
| 327 | 324 | bool |
|---|
| 328 | 325 | depends on RPS |
|---|
| 329 | 326 | default y |
|---|
| 330 | | - ---help--- |
|---|
| 327 | + help |
|---|
| 331 | 328 | The network stack has to drop packets when a receive processing CPU's |
|---|
| 332 | 329 | backlog reaches netdev_max_backlog. If a few out of many active flows |
|---|
| 333 | 330 | generate the vast majority of load, drop their traffic earlier to |
|---|
| .. | .. |
|---|
| 340 | 337 | config NET_PKTGEN |
|---|
| 341 | 338 | tristate "Packet Generator (USE WITH CAUTION)" |
|---|
| 342 | 339 | depends on INET && PROC_FS |
|---|
| 343 | | - ---help--- |
|---|
| 340 | + help |
|---|
| 344 | 341 | This module will inject preconfigured packets, at a configurable |
|---|
| 345 | 342 | rate, out of a given interface. It is used for network interface |
|---|
| 346 | 343 | stress testing and performance analysis. If you don't understand |
|---|
| 347 | 344 | what was just said, you don't need it: say N. |
|---|
| 348 | 345 | |
|---|
| 349 | 346 | Documentation on how to use the packet generator can be found |
|---|
| 350 | | - at <file:Documentation/networking/pktgen.txt>. |
|---|
| 347 | + at <file:Documentation/networking/pktgen.rst>. |
|---|
| 351 | 348 | |
|---|
| 352 | 349 | To compile this code as a module, choose M here: the |
|---|
| 353 | 350 | module will be called pktgen. |
|---|
| .. | .. |
|---|
| 355 | 352 | config NET_DROP_MONITOR |
|---|
| 356 | 353 | tristate "Network packet drop alerting service" |
|---|
| 357 | 354 | depends on INET && TRACEPOINTS |
|---|
| 358 | | - ---help--- |
|---|
| 359 | | - This feature provides an alerting service to userspace in the |
|---|
| 360 | | - event that packets are discarded in the network stack. Alerts |
|---|
| 361 | | - are broadcast via netlink socket to any listening user space |
|---|
| 362 | | - process. If you don't need network drop alerts, or if you are ok |
|---|
| 363 | | - just checking the various proc files and other utilities for |
|---|
| 364 | | - drop statistics, say N here. |
|---|
| 355 | + help |
|---|
| 356 | + This feature provides an alerting service to userspace in the |
|---|
| 357 | + event that packets are discarded in the network stack. Alerts |
|---|
| 358 | + are broadcast via netlink socket to any listening user space |
|---|
| 359 | + process. If you don't need network drop alerts, or if you are ok |
|---|
| 360 | + just checking the various proc files and other utilities for |
|---|
| 361 | + drop statistics, say N here. |
|---|
| 365 | 362 | |
|---|
| 366 | 363 | endmenu |
|---|
| 367 | 364 | |
|---|
| .. | .. |
|---|
| 401 | 398 | |
|---|
| 402 | 399 | config LWTUNNEL |
|---|
| 403 | 400 | bool "Network light weight tunnels" |
|---|
| 404 | | - ---help--- |
|---|
| 401 | + help |
|---|
| 405 | 402 | This feature provides an infrastructure to support light weight |
|---|
| 406 | 403 | tunnels like mpls. There is no netdevice associated with a light |
|---|
| 407 | 404 | weight tunnel endpoint. Tunnel encapsulation parameters are stored |
|---|
| .. | .. |
|---|
| 409 | 406 | |
|---|
| 410 | 407 | config LWTUNNEL_BPF |
|---|
| 411 | 408 | bool "Execute BPF program as route nexthop action" |
|---|
| 412 | | - depends on LWTUNNEL |
|---|
| 409 | + depends on LWTUNNEL && INET |
|---|
| 413 | 410 | default y if LWTUNNEL=y |
|---|
| 414 | | - ---help--- |
|---|
| 411 | + help |
|---|
| 415 | 412 | Allows to run BPF programs as a nexthop action following a route |
|---|
| 416 | 413 | lookup for incoming and outgoing packets. |
|---|
| 417 | 414 | |
|---|
| .. | .. |
|---|
| 426 | 423 | config SOCK_VALIDATE_XMIT |
|---|
| 427 | 424 | bool |
|---|
| 428 | 425 | |
|---|
| 429 | | -config NET_DEVLINK |
|---|
| 430 | | - tristate "Network physical/parent device Netlink interface" |
|---|
| 426 | +config NET_SOCK_MSG |
|---|
| 427 | + bool |
|---|
| 428 | + default n |
|---|
| 431 | 429 | help |
|---|
| 432 | | - Network physical/parent device Netlink interface provides |
|---|
| 433 | | - infrastructure to support access to physical chip-wide config and |
|---|
| 434 | | - monitoring. |
|---|
| 430 | + The NET_SOCK_MSG provides a framework for plain sockets (e.g. TCP) or |
|---|
| 431 | + ULPs (upper layer modules, e.g. TLS) to process L7 application data |
|---|
| 432 | + with the help of BPF programs. |
|---|
| 435 | 433 | |
|---|
| 436 | | -config MAY_USE_DEVLINK |
|---|
| 437 | | - tristate |
|---|
| 438 | | - default m if NET_DEVLINK=m |
|---|
| 439 | | - default y if NET_DEVLINK=y || NET_DEVLINK=n |
|---|
| 440 | | - help |
|---|
| 441 | | - Drivers using the devlink infrastructure should have a dependency |
|---|
| 442 | | - on MAY_USE_DEVLINK to ensure they do not cause link errors when |
|---|
| 443 | | - devlink is a loadable module and the driver using it is built-in. |
|---|
| 434 | +config NET_DEVLINK |
|---|
| 435 | + bool |
|---|
| 436 | + default n |
|---|
| 444 | 437 | |
|---|
| 445 | 438 | config PAGE_POOL |
|---|
| 446 | | - bool |
|---|
| 439 | + bool |
|---|
| 447 | 440 | |
|---|
| 448 | 441 | config FAILOVER |
|---|
| 449 | 442 | tristate "Generic failover module" |
|---|
| .. | .. |
|---|
| 458 | 451 | migration of VMs with direct attached VFs by failing over to the |
|---|
| 459 | 452 | paravirtual datapath when the VF is unplugged. |
|---|
| 460 | 453 | |
|---|
| 454 | +config ETHTOOL_NETLINK |
|---|
| 455 | + bool "Netlink interface for ethtool" |
|---|
| 456 | + default y |
|---|
| 457 | + help |
|---|
| 458 | + An alternative userspace interface for ethtool based on generic |
|---|
| 459 | + netlink. It provides better extensibility and some new features, |
|---|
| 460 | + e.g. notification messages. |
|---|
| 461 | + |
|---|
| 461 | 462 | endif # if NET |
|---|
| 462 | 463 | |
|---|
| 463 | 464 | # Used by archs to tell that they support BPF JIT compiler plus which flavour. |
|---|