| .. | .. |
|---|
| 1 | +# SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | # |
|---|
| 2 | 3 | # Network configuration |
|---|
| 3 | 4 | # |
|---|
| .. | .. |
|---|
| 7 | 8 | select NLATTR |
|---|
| 8 | 9 | select GENERIC_NET_UTILS |
|---|
| 9 | 10 | select BPF |
|---|
| 10 | | - ---help--- |
|---|
| 11 | + help |
|---|
| 11 | 12 | Unless you really know what you are doing, you should say Y here. |
|---|
| 12 | 13 | The reason is that some programs need kernel networking support even |
|---|
| 13 | 14 | when running on a stand-alone machine that isn't connected to any |
|---|
| .. | .. |
|---|
| 51 | 52 | config NET_EGRESS |
|---|
| 52 | 53 | bool |
|---|
| 53 | 54 | |
|---|
| 55 | +config NET_REDIRECT |
|---|
| 56 | + bool |
|---|
| 57 | + |
|---|
| 58 | +config SKB_EXTENSIONS |
|---|
| 59 | + bool |
|---|
| 60 | + |
|---|
| 54 | 61 | menu "Networking options" |
|---|
| 55 | 62 | |
|---|
| 56 | 63 | source "net/packet/Kconfig" |
|---|
| .. | .. |
|---|
| 63 | 70 | |
|---|
| 64 | 71 | config INET |
|---|
| 65 | 72 | bool "TCP/IP networking" |
|---|
| 66 | | - select CRYPTO |
|---|
| 67 | | - select CRYPTO_AES |
|---|
| 68 | | - ---help--- |
|---|
| 73 | + help |
|---|
| 69 | 74 | These are the protocols used on the Internet and on most local |
|---|
| 70 | 75 | Ethernets. It is highly recommended to say Y here (this will enlarge |
|---|
| 71 | 76 | your kernel by about 400 KB), since some programs (e.g. the X window |
|---|
| .. | .. |
|---|
| 81 | 86 | "Sysctl support" below, you can change various aspects of the |
|---|
| 82 | 87 | behavior of the TCP/IP code by writing to the (virtual) files in |
|---|
| 83 | 88 | /proc/sys/net/ipv4/*; the options are explained in the file |
|---|
| 84 | | - <file:Documentation/networking/ip-sysctl.txt>. |
|---|
| 89 | + <file:Documentation/networking/ip-sysctl.rst>. |
|---|
| 85 | 90 | |
|---|
| 86 | 91 | Short answer: say Y. |
|---|
| 87 | 92 | |
|---|
| .. | .. |
|---|
| 89 | 94 | source "net/ipv4/Kconfig" |
|---|
| 90 | 95 | source "net/ipv6/Kconfig" |
|---|
| 91 | 96 | source "net/netlabel/Kconfig" |
|---|
| 97 | +source "net/mptcp/Kconfig" |
|---|
| 92 | 98 | |
|---|
| 93 | 99 | endif # if INET |
|---|
| 94 | 100 | |
|---|
| .. | .. |
|---|
| 106 | 112 | bool "Timestamping in PHY devices" |
|---|
| 107 | 113 | select NET_PTP_CLASSIFY |
|---|
| 108 | 114 | help |
|---|
| 109 | | - This allows timestamping of network packets by PHYs with |
|---|
| 110 | | - hardware timestamping capabilities. This option adds some |
|---|
| 111 | | - overhead in the transmit and receive paths. |
|---|
| 115 | + This allows timestamping of network packets by PHYs (or |
|---|
| 116 | + other MII bus snooping devices) with hardware timestamping |
|---|
| 117 | + capabilities. This option adds some overhead in the transmit |
|---|
| 118 | + and receive paths. |
|---|
| 112 | 119 | |
|---|
| 113 | 120 | If you are unsure how to answer this question, answer N. |
|---|
| 114 | 121 | |
|---|
| 115 | 122 | menuconfig NETFILTER |
|---|
| 116 | 123 | bool "Network packet filtering framework (Netfilter)" |
|---|
| 117 | | - ---help--- |
|---|
| 124 | + help |
|---|
| 118 | 125 | Netfilter is a framework for filtering and mangling network packets |
|---|
| 119 | 126 | that pass through your Linux box. |
|---|
| 120 | 127 | |
|---|
| .. | .. |
|---|
| 184 | 191 | depends on NETFILTER && INET |
|---|
| 185 | 192 | depends on NETFILTER_ADVANCED |
|---|
| 186 | 193 | select NETFILTER_FAMILY_BRIDGE |
|---|
| 187 | | - ---help--- |
|---|
| 194 | + select SKB_EXTENSIONS |
|---|
| 195 | + help |
|---|
| 188 | 196 | Enabling this option will let arptables resp. iptables see bridged |
|---|
| 189 | 197 | ARP resp. IP traffic. If you want a bridging firewall, you probably |
|---|
| 190 | 198 | want this option enabled. |
|---|
| .. | .. |
|---|
| 196 | 204 | source "net/netfilter/Kconfig" |
|---|
| 197 | 205 | source "net/ipv4/netfilter/Kconfig" |
|---|
| 198 | 206 | source "net/ipv6/netfilter/Kconfig" |
|---|
| 199 | | -source "net/decnet/netfilter/Kconfig" |
|---|
| 200 | 207 | source "net/bridge/netfilter/Kconfig" |
|---|
| 201 | 208 | |
|---|
| 202 | 209 | endif |
|---|
| .. | .. |
|---|
| 213 | 220 | source "net/bridge/Kconfig" |
|---|
| 214 | 221 | source "net/dsa/Kconfig" |
|---|
| 215 | 222 | source "net/8021q/Kconfig" |
|---|
| 216 | | -source "net/decnet/Kconfig" |
|---|
| 217 | 223 | source "net/llc/Kconfig" |
|---|
| 218 | 224 | source "drivers/net/appletalk/Kconfig" |
|---|
| 219 | 225 | source "net/x25/Kconfig" |
|---|
| .. | .. |
|---|
| 254 | 260 | default y |
|---|
| 255 | 261 | |
|---|
| 256 | 262 | config HWBM |
|---|
| 257 | | - bool |
|---|
| 263 | + bool |
|---|
| 258 | 264 | |
|---|
| 259 | 265 | config CGROUP_NET_PRIO |
|---|
| 260 | 266 | bool "Network priority cgroup" |
|---|
| 261 | 267 | depends on CGROUPS |
|---|
| 262 | 268 | select SOCK_CGROUP_DATA |
|---|
| 263 | | - ---help--- |
|---|
| 269 | + help |
|---|
| 264 | 270 | Cgroup subsystem for use in assigning processes to network priorities on |
|---|
| 265 | 271 | a per-interface basis. |
|---|
| 266 | 272 | |
|---|
| .. | .. |
|---|
| 268 | 274 | bool "Network classid cgroup" |
|---|
| 269 | 275 | depends on CGROUPS |
|---|
| 270 | 276 | select SOCK_CGROUP_DATA |
|---|
| 271 | | - ---help--- |
|---|
| 277 | + help |
|---|
| 272 | 278 | Cgroup subsystem for use as general purpose socket classid marker that is |
|---|
| 273 | 279 | being used in cls_cgroup and for netfilter matching. |
|---|
| 274 | 280 | |
|---|
| 275 | 281 | config NET_RX_BUSY_POLL |
|---|
| 276 | 282 | bool |
|---|
| 277 | | - default y if !PREEMPT_RT_FULL |
|---|
| 283 | + default y |
|---|
| 278 | 284 | |
|---|
| 279 | 285 | config BQL |
|---|
| 280 | 286 | bool |
|---|
| .. | .. |
|---|
| 286 | 292 | bool "enable BPF Just In Time compiler" |
|---|
| 287 | 293 | depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT |
|---|
| 288 | 294 | depends on MODULES |
|---|
| 289 | | - ---help--- |
|---|
| 295 | + help |
|---|
| 290 | 296 | Berkeley Packet Filter filtering capabilities are normally handled |
|---|
| 291 | 297 | by an interpreter. This option allows kernel to generate a native |
|---|
| 292 | 298 | code when filter is loaded in memory. This should speedup |
|---|
| .. | .. |
|---|
| 299 | 305 | |
|---|
| 300 | 306 | config BPF_STREAM_PARSER |
|---|
| 301 | 307 | bool "enable BPF STREAM_PARSER" |
|---|
| 308 | + depends on INET |
|---|
| 302 | 309 | depends on BPF_SYSCALL |
|---|
| 310 | + depends on CGROUP_BPF |
|---|
| 303 | 311 | select STREAM_PARSER |
|---|
| 304 | | - ---help--- |
|---|
| 305 | | - Enabling this allows a stream parser to be used with |
|---|
| 306 | | - BPF_MAP_TYPE_SOCKMAP. |
|---|
| 307 | | - |
|---|
| 308 | | - BPF_MAP_TYPE_SOCKMAP provides a map type to use with network sockets. |
|---|
| 309 | | - It can be used to enforce socket policy, implement socket redirects, |
|---|
| 310 | | - etc. |
|---|
| 311 | | - |
|---|
| 312 | | -config ETHTOOL |
|---|
| 313 | | - bool "enable ethtool" |
|---|
| 314 | | - default y |
|---|
| 312 | + select NET_SOCK_MSG |
|---|
| 315 | 313 | help |
|---|
| 316 | | - This selects ethtool function, default is Y. If say N, ethtool function |
|---|
| 317 | | - is not implemented. |
|---|
| 314 | + Enabling this allows a stream parser to be used with |
|---|
| 315 | + BPF_MAP_TYPE_SOCKMAP. |
|---|
| 318 | 316 | |
|---|
| 319 | | -config FILTER |
|---|
| 320 | | - bool "enable filter" |
|---|
| 321 | | - default y |
|---|
| 322 | | - help |
|---|
| 323 | | - This selects filter function, default is Y. If say N, filter function |
|---|
| 324 | | - is not implemented. |
|---|
| 317 | + BPF_MAP_TYPE_SOCKMAP provides a map type to use with network sockets. |
|---|
| 318 | + It can be used to enforce socket policy, implement socket redirects, |
|---|
| 319 | + etc. |
|---|
| 325 | 320 | |
|---|
| 326 | 321 | config NET_FLOW_LIMIT |
|---|
| 327 | 322 | bool |
|---|
| 328 | 323 | depends on RPS |
|---|
| 329 | 324 | default y |
|---|
| 330 | | - ---help--- |
|---|
| 325 | + help |
|---|
| 331 | 326 | The network stack has to drop packets when a receive processing CPU's |
|---|
| 332 | 327 | backlog reaches netdev_max_backlog. If a few out of many active flows |
|---|
| 333 | 328 | generate the vast majority of load, drop their traffic earlier to |
|---|
| .. | .. |
|---|
| 340 | 335 | config NET_PKTGEN |
|---|
| 341 | 336 | tristate "Packet Generator (USE WITH CAUTION)" |
|---|
| 342 | 337 | depends on INET && PROC_FS |
|---|
| 343 | | - ---help--- |
|---|
| 338 | + help |
|---|
| 344 | 339 | This module will inject preconfigured packets, at a configurable |
|---|
| 345 | 340 | rate, out of a given interface. It is used for network interface |
|---|
| 346 | 341 | stress testing and performance analysis. If you don't understand |
|---|
| 347 | 342 | what was just said, you don't need it: say N. |
|---|
| 348 | 343 | |
|---|
| 349 | 344 | Documentation on how to use the packet generator can be found |
|---|
| 350 | | - at <file:Documentation/networking/pktgen.txt>. |
|---|
| 345 | + at <file:Documentation/networking/pktgen.rst>. |
|---|
| 351 | 346 | |
|---|
| 352 | 347 | To compile this code as a module, choose M here: the |
|---|
| 353 | 348 | module will be called pktgen. |
|---|
| .. | .. |
|---|
| 355 | 350 | config NET_DROP_MONITOR |
|---|
| 356 | 351 | tristate "Network packet drop alerting service" |
|---|
| 357 | 352 | depends on INET && TRACEPOINTS |
|---|
| 358 | | - ---help--- |
|---|
| 359 | | - This feature provides an alerting service to userspace in the |
|---|
| 360 | | - event that packets are discarded in the network stack. Alerts |
|---|
| 361 | | - are broadcast via netlink socket to any listening user space |
|---|
| 362 | | - process. If you don't need network drop alerts, or if you are ok |
|---|
| 363 | | - just checking the various proc files and other utilities for |
|---|
| 364 | | - drop statistics, say N here. |
|---|
| 353 | + help |
|---|
| 354 | + This feature provides an alerting service to userspace in the |
|---|
| 355 | + event that packets are discarded in the network stack. Alerts |
|---|
| 356 | + are broadcast via netlink socket to any listening user space |
|---|
| 357 | + process. If you don't need network drop alerts, or if you are ok |
|---|
| 358 | + just checking the various proc files and other utilities for |
|---|
| 359 | + drop statistics, say N here. |
|---|
| 365 | 360 | |
|---|
| 366 | 361 | endmenu |
|---|
| 367 | 362 | |
|---|
| .. | .. |
|---|
| 401 | 396 | |
|---|
| 402 | 397 | config LWTUNNEL |
|---|
| 403 | 398 | bool "Network light weight tunnels" |
|---|
| 404 | | - ---help--- |
|---|
| 399 | + help |
|---|
| 405 | 400 | This feature provides an infrastructure to support light weight |
|---|
| 406 | 401 | tunnels like mpls. There is no netdevice associated with a light |
|---|
| 407 | 402 | weight tunnel endpoint. Tunnel encapsulation parameters are stored |
|---|
| .. | .. |
|---|
| 409 | 404 | |
|---|
| 410 | 405 | config LWTUNNEL_BPF |
|---|
| 411 | 406 | bool "Execute BPF program as route nexthop action" |
|---|
| 412 | | - depends on LWTUNNEL |
|---|
| 407 | + depends on LWTUNNEL && INET |
|---|
| 413 | 408 | default y if LWTUNNEL=y |
|---|
| 414 | | - ---help--- |
|---|
| 409 | + help |
|---|
| 415 | 410 | Allows to run BPF programs as a nexthop action following a route |
|---|
| 416 | 411 | lookup for incoming and outgoing packets. |
|---|
| 417 | 412 | |
|---|
| .. | .. |
|---|
| 426 | 421 | config SOCK_VALIDATE_XMIT |
|---|
| 427 | 422 | bool |
|---|
| 428 | 423 | |
|---|
| 429 | | -config NET_DEVLINK |
|---|
| 430 | | - tristate "Network physical/parent device Netlink interface" |
|---|
| 424 | +config NET_SOCK_MSG |
|---|
| 425 | + bool |
|---|
| 426 | + default n |
|---|
| 431 | 427 | help |
|---|
| 432 | | - Network physical/parent device Netlink interface provides |
|---|
| 433 | | - infrastructure to support access to physical chip-wide config and |
|---|
| 434 | | - monitoring. |
|---|
| 428 | + The NET_SOCK_MSG provides a framework for plain sockets (e.g. TCP) or |
|---|
| 429 | + ULPs (upper layer modules, e.g. TLS) to process L7 application data |
|---|
| 430 | + with the help of BPF programs. |
|---|
| 435 | 431 | |
|---|
| 436 | | -config MAY_USE_DEVLINK |
|---|
| 437 | | - tristate |
|---|
| 438 | | - default m if NET_DEVLINK=m |
|---|
| 439 | | - default y if NET_DEVLINK=y || NET_DEVLINK=n |
|---|
| 440 | | - help |
|---|
| 441 | | - Drivers using the devlink infrastructure should have a dependency |
|---|
| 442 | | - on MAY_USE_DEVLINK to ensure they do not cause link errors when |
|---|
| 443 | | - devlink is a loadable module and the driver using it is built-in. |
|---|
| 432 | +config NET_DEVLINK |
|---|
| 433 | + bool |
|---|
| 434 | + default n |
|---|
| 444 | 435 | |
|---|
| 445 | 436 | config PAGE_POOL |
|---|
| 446 | | - bool |
|---|
| 437 | + bool |
|---|
| 447 | 438 | |
|---|
| 448 | 439 | config FAILOVER |
|---|
| 449 | 440 | tristate "Generic failover module" |
|---|
| .. | .. |
|---|
| 458 | 449 | migration of VMs with direct attached VFs by failing over to the |
|---|
| 459 | 450 | paravirtual datapath when the VF is unplugged. |
|---|
| 460 | 451 | |
|---|
| 452 | +config ETHTOOL_NETLINK |
|---|
| 453 | + bool "Netlink interface for ethtool" |
|---|
| 454 | + default y |
|---|
| 455 | + help |
|---|
| 456 | + An alternative userspace interface for ethtool based on generic |
|---|
| 457 | + netlink. It provides better extensibility and some new features, |
|---|
| 458 | + e.g. notification messages. |
|---|
| 459 | + |
|---|
| 461 | 460 | endif # if NET |
|---|
| 462 | 461 | |
|---|
| 463 | 462 | # Used by archs to tell that they support BPF JIT compiler plus which flavour. |
|---|