1# 2# Network configuration 3# 4 5menuconfig NET 6 bool "Networking support" 7 select NLATTR 8 select GENERIC_NET_UTILS 9 select BPF 10 ---help--- 11 Unless you really know what you are doing, you should say Y here. 12 The reason is that some programs need kernel networking support even 13 when running on a stand-alone machine that isn't connected to any 14 other computer. 15 16 If you are upgrading from an older kernel, you 17 should consider updating your networking tools too because changes 18 in the kernel and the tools often go hand in hand. The tools are 19 contained in the package net-tools, the location and version number 20 of which are given in <file:Documentation/Changes>. 21 22 For a general introduction to Linux networking, it is highly 23 recommended to read the NET-HOWTO, available from 24 <http://www.tldp.org/docs.html#howto>. 25 26if NET 27 28config WANT_COMPAT_NETLINK_MESSAGES 29 bool 30 help 31 This option can be selected by other options that need compat 32 netlink messages. 33 34config COMPAT_NETLINK_MESSAGES 35 def_bool y 36 depends on COMPAT 37 depends on WEXT_CORE || WANT_COMPAT_NETLINK_MESSAGES 38 help 39 This option makes it possible to send different netlink messages 40 to tasks depending on whether the task is a compat task or not. To 41 achieve this, you need to set skb_shinfo(skb)->frag_list to the 42 compat skb before sending the skb, the netlink code will sort out 43 which message to actually pass to the task. 44 45 Newly written code should NEVER need this option but do 46 compat-independent messages instead! 47 48menu "Networking options" 49 50source "net/packet/Kconfig" 51source "net/unix/Kconfig" 52source "net/xfrm/Kconfig" 53source "net/iucv/Kconfig" 54 55config INET 56 bool "TCP/IP networking" 57 select CRYPTO 58 select CRYPTO_AES 59 ---help--- 60 These are the protocols used on the Internet and on most local 61 Ethernets. It is highly recommended to say Y here (this will enlarge 62 your kernel by about 400 KB), since some programs (e.g. the X window 63 system) use TCP/IP even if your machine is not connected to any 64 other computer. You will get the so-called loopback device which 65 allows you to ping yourself (great fun, that!). 66 67 For an excellent introduction to Linux networking, please read the 68 Linux Networking HOWTO, available from 69 <http://www.tldp.org/docs.html#howto>. 70 71 If you say Y here and also to "/proc file system support" and 72 "Sysctl support" below, you can change various aspects of the 73 behavior of the TCP/IP code by writing to the (virtual) files in 74 /proc/sys/net/ipv4/*; the options are explained in the file 75 <file:Documentation/networking/ip-sysctl.txt>. 76 77 Short answer: say Y. 78 79if INET 80source "net/ipv4/Kconfig" 81source "net/ipv6/Kconfig" 82source "net/netlabel/Kconfig" 83 84endif # if INET 85 86config ANDROID_PARANOID_NETWORK 87 bool "Only allow certain groups to create sockets" 88 default y 89 help 90 none 91 92config NET_ACTIVITY_STATS 93 bool "Network activity statistics tracking" 94 default y 95 help 96 Network activity statistics are useful for tracking wireless 97 modem activity on 2G, 3G, 4G wireless networks. Counts number of 98 transmissions and groups them in specified time buckets. 99 100config NETWORK_SECMARK 101 bool "Security Marking" 102 help 103 This enables security marking of network packets, similar 104 to nfmark, but designated for security purposes. 105 If you are unsure how to answer this question, answer N. 106 107config NET_PTP_CLASSIFY 108 def_bool n 109 110config NETWORK_PHY_TIMESTAMPING 111 bool "Timestamping in PHY devices" 112 select NET_PTP_CLASSIFY 113 help 114 This allows timestamping of network packets by PHYs with 115 hardware timestamping capabilities. This option adds some 116 overhead in the transmit and receive paths. 117 118 If you are unsure how to answer this question, answer N. 119 120menuconfig NETFILTER 121 bool "Network packet filtering framework (Netfilter)" 122 ---help--- 123 Netfilter is a framework for filtering and mangling network packets 124 that pass through your Linux box. 125 126 The most common use of packet filtering is to run your Linux box as 127 a firewall protecting a local network from the Internet. The type of 128 firewall provided by this kernel support is called a "packet 129 filter", which means that it can reject individual network packets 130 based on type, source, destination etc. The other kind of firewall, 131 a "proxy-based" one, is more secure but more intrusive and more 132 bothersome to set up; it inspects the network traffic much more 133 closely, modifies it and has knowledge about the higher level 134 protocols, which a packet filter lacks. Moreover, proxy-based 135 firewalls often require changes to the programs running on the local 136 clients. Proxy-based firewalls don't need support by the kernel, but 137 they are often combined with a packet filter, which only works if 138 you say Y here. 139 140 You should also say Y here if you intend to use your Linux box as 141 the gateway to the Internet for a local network of machines without 142 globally valid IP addresses. This is called "masquerading": if one 143 of the computers on your local network wants to send something to 144 the outside, your box can "masquerade" as that computer, i.e. it 145 forwards the traffic to the intended outside destination, but 146 modifies the packets to make it look like they came from the 147 firewall box itself. It works both ways: if the outside host 148 replies, the Linux box will silently forward the traffic to the 149 correct local computer. This way, the computers on your local net 150 are completely invisible to the outside world, even though they can 151 reach the outside and can receive replies. It is even possible to 152 run globally visible servers from within a masqueraded local network 153 using a mechanism called portforwarding. Masquerading is also often 154 called NAT (Network Address Translation). 155 156 Another use of Netfilter is in transparent proxying: if a machine on 157 the local network tries to connect to an outside host, your Linux 158 box can transparently forward the traffic to a local server, 159 typically a caching proxy server. 160 161 Yet another use of Netfilter is building a bridging firewall. Using 162 a bridge with Network packet filtering enabled makes iptables "see" 163 the bridged traffic. For filtering on the lower network and Ethernet 164 protocols over the bridge, use ebtables (under bridge netfilter 165 configuration). 166 167 Various modules exist for netfilter which replace the previous 168 masquerading (ipmasqadm), packet filtering (ipchains), transparent 169 proxying, and portforwarding mechanisms. Please see 170 <file:Documentation/Changes> under "iptables" for the location of 171 these packages. 172 173if NETFILTER 174 175config NETFILTER_DEBUG 176 bool "Network packet filtering debugging" 177 depends on NETFILTER 178 help 179 You can say Y here if you want to get additional messages useful in 180 debugging the netfilter code. 181 182config NETFILTER_ADVANCED 183 bool "Advanced netfilter configuration" 184 depends on NETFILTER 185 default y 186 help 187 If you say Y here you can select between all the netfilter modules. 188 If you say N the more unusual ones will not be shown and the 189 basic ones needed by most people will default to 'M'. 190 191 If unsure, say Y. 192 193config BRIDGE_NETFILTER 194 tristate "Bridged IP/ARP packets filtering" 195 depends on BRIDGE 196 depends on NETFILTER && INET 197 depends on NETFILTER_ADVANCED 198 default m 199 ---help--- 200 Enabling this option will let arptables resp. iptables see bridged 201 ARP resp. IP traffic. If you want a bridging firewall, you probably 202 want this option enabled. 203 Enabling or disabling this option doesn't enable or disable 204 ebtables. 205 206 If unsure, say N. 207 208source "net/netfilter/Kconfig" 209source "net/ipv4/netfilter/Kconfig" 210source "net/ipv6/netfilter/Kconfig" 211source "net/decnet/netfilter/Kconfig" 212source "net/bridge/netfilter/Kconfig" 213 214endif 215 216source "net/dccp/Kconfig" 217source "net/sctp/Kconfig" 218source "net/rds/Kconfig" 219source "net/tipc/Kconfig" 220source "net/atm/Kconfig" 221source "net/l2tp/Kconfig" 222source "net/802/Kconfig" 223source "net/bridge/Kconfig" 224source "net/dsa/Kconfig" 225source "net/8021q/Kconfig" 226source "net/decnet/Kconfig" 227source "net/llc/Kconfig" 228source "net/ipx/Kconfig" 229source "drivers/net/appletalk/Kconfig" 230source "net/x25/Kconfig" 231source "net/lapb/Kconfig" 232source "net/phonet/Kconfig" 233source "net/6lowpan/Kconfig" 234source "net/ieee802154/Kconfig" 235source "net/mac802154/Kconfig" 236source "net/sched/Kconfig" 237source "net/dcb/Kconfig" 238source "net/dns_resolver/Kconfig" 239source "net/batman-adv/Kconfig" 240source "net/openvswitch/Kconfig" 241source "net/vmw_vsock/Kconfig" 242source "net/netlink/Kconfig" 243source "net/mpls/Kconfig" 244source "net/hsr/Kconfig" 245 246config RPS 247 boolean "RPS" 248 depends on SMP && SYSFS 249 default y 250 251config RFS_ACCEL 252 boolean 253 depends on RPS 254 select CPU_RMAP 255 default y 256 257config XPS 258 boolean 259 depends on SMP 260 default y 261 262config CGROUP_NET_PRIO 263 bool "Network priority cgroup" 264 depends on CGROUPS 265 ---help--- 266 Cgroup subsystem for use in assigning processes to network priorities on 267 a per-interface basis. 268 269config CGROUP_NET_CLASSID 270 boolean "Network classid cgroup" 271 depends on CGROUPS 272 ---help--- 273 Cgroup subsystem for use as general purpose socket classid marker that is 274 being used in cls_cgroup and for netfilter matching. 275 276config NET_RX_BUSY_POLL 277 boolean 278 default y 279 280config BQL 281 boolean 282 depends on SYSFS 283 select DQL 284 default y 285 286config BPF_JIT 287 bool "enable BPF Just In Time compiler" 288 depends on HAVE_BPF_JIT 289 depends on MODULES 290 ---help--- 291 Berkeley Packet Filter filtering capabilities are normally handled 292 by an interpreter. This option allows kernel to generate a native 293 code when filter is loaded in memory. This should speedup 294 packet sniffing (libpcap/tcpdump). Note : Admin should enable 295 this feature changing /proc/sys/net/core/bpf_jit_enable 296 297config NET_FLOW_LIMIT 298 boolean 299 depends on RPS 300 default y 301 ---help--- 302 The network stack has to drop packets when a receive processing CPU's 303 backlog reaches netdev_max_backlog. If a few out of many active flows 304 generate the vast majority of load, drop their traffic earlier to 305 maintain capacity for the other flows. This feature provides servers 306 with many clients some protection against DoS by a single (spoofed) 307 flow that greatly exceeds average workload. 308 309menu "Network testing" 310 311config NET_PKTGEN 312 tristate "Packet Generator (USE WITH CAUTION)" 313 depends on INET && PROC_FS 314 ---help--- 315 This module will inject preconfigured packets, at a configurable 316 rate, out of a given interface. It is used for network interface 317 stress testing and performance analysis. If you don't understand 318 what was just said, you don't need it: say N. 319 320 Documentation on how to use the packet generator can be found 321 at <file:Documentation/networking/pktgen.txt>. 322 323 To compile this code as a module, choose M here: the 324 module will be called pktgen. 325 326config NET_TCPPROBE 327 tristate "TCP connection probing" 328 depends on INET && PROC_FS && KPROBES 329 ---help--- 330 This module allows for capturing the changes to TCP connection 331 state in response to incoming packets. It is used for debugging 332 TCP congestion avoidance modules. If you don't understand 333 what was just said, you don't need it: say N. 334 335 Documentation on how to use TCP connection probing can be found 336 at: 337 338 http://www.linuxfoundation.org/collaborate/workgroups/networking/tcpprobe 339 340 To compile this code as a module, choose M here: the 341 module will be called tcp_probe. 342 343config NET_DROP_MONITOR 344 tristate "Network packet drop alerting service" 345 depends on INET && TRACEPOINTS 346 ---help--- 347 This feature provides an alerting service to userspace in the 348 event that packets are discarded in the network stack. Alerts 349 are broadcast via netlink socket to any listening user space 350 process. If you don't need network drop alerts, or if you are ok 351 just checking the various proc files and other utilities for 352 drop statistics, say N here. 353 354endmenu 355 356endmenu 357 358source "net/ax25/Kconfig" 359source "net/can/Kconfig" 360source "net/irda/Kconfig" 361source "net/bluetooth/Kconfig" 362source "net/rxrpc/Kconfig" 363 364config FIB_RULES 365 bool 366 367menuconfig WIRELESS 368 bool "Wireless" 369 depends on !S390 370 default y 371 372if WIRELESS 373 374source "net/wireless/Kconfig" 375source "net/mac80211/Kconfig" 376 377endif # WIRELESS 378 379source "net/wimax/Kconfig" 380 381source "net/rfkill/Kconfig" 382source "net/9p/Kconfig" 383source "net/caif/Kconfig" 384source "net/ceph/Kconfig" 385source "net/nfc/Kconfig" 386 387 388endif # if NET 389 390# Used by archs to tell that they support BPF_JIT 391config HAVE_BPF_JIT 392 bool 393