1 # SPDX-License-Identifier: GPL-2.0-only
2 #
3 # IP configuration
4 #
5 config IP_MULTICAST
6 bool "IP: multicasting"
7 help
8 This is code for addressing several
9 enlarging your kernel by about 2 KB.
10 intend to participate in the MBONE,
11 of the Internet which carries audio
12 information about the MBONE is on th
13 <https://www.savetz.com/mbone/>. For
14
15 config IP_ADVANCED_ROUTER
16 bool "IP: advanced router"
17 help
18 If you intend to run your Linux box
19 computer that forwards and redistrib
20 will then be presented with several
21 control about the routing process.
22
23 The answer to this question won't di
24 answering N will just cause the conf
25 questions about advanced routing.
26
27 Note that your box can only act as a
28 forwarding in your kernel; you can d
29 file system support" and "Sysctl sup
30 line
31
32 echo "1" > /proc/sys/net/ipv4/ip_for
33
34 at boot time after the /proc file sy
35
36 If you turn on IP forwarding, you sh
37 automatically rejects incoming packe
38 for their source address doesn't mat
39 arriving on. This has security advan
40 so-called IP spoofing, however it ca
41 asymmetric routing (packets from you
42 than packets from that host to you)
43 host which has several IP addresses
44 rp_filter on use:
45
46 echo 1 > /proc/sys/net/ipv4/conf/<de
47 or
48 echo 1 > /proc/sys/net/ipv4/conf/all
49
50 Note that some distributions enable
51 For details about rp_filter strict a
52 <file:Documentation/networking/ip-sy
53
54 If unsure, say N here.
55
56 config IP_FIB_TRIE_STATS
57 bool "FIB TRIE statistics"
58 depends on IP_ADVANCED_ROUTER
59 help
60 Keep track of statistics on structur
61 Useful for testing and measuring TRI
62
63 config IP_MULTIPLE_TABLES
64 bool "IP: policy routing"
65 depends on IP_ADVANCED_ROUTER
66 select FIB_RULES
67 help
68 Normally, a router decides what to d
69 solely on the packet's final destina
70 the Linux router will also be able t
71 address into account. Furthermore, t
72 of the packet can be used for routin
73
74 If you need more information, see th
75 Routing and Traffic Control document
76 <https://lartc.org/howto/lartc.rpdb.
77
78 If unsure, say N.
79
80 config IP_ROUTE_MULTIPATH
81 bool "IP: equal cost multipath"
82 depends on IP_ADVANCED_ROUTER
83 help
84 Normally, the routing tables specify
85 a deterministic manner for a given p
86 however, it becomes possible to atta
87 pattern, in effect specifying severa
88 for those packets. The router consid
89 equal "cost" and chooses one of them
90 if a matching packet arrives.
91
92 config IP_ROUTE_VERBOSE
93 bool "IP: verbose route monitoring"
94 depends on IP_ADVANCED_ROUTER
95 help
96 If you say Y here, which is recommen
97 verbose messages regarding the routi
98 received packets which look strange
99 attack or a misconfigured system som
100 handled by the klogd daemon which is
101 ("man klogd").
102
103 config IP_ROUTE_CLASSID
104 bool
105
106 config IP_PNP
107 bool "IP: kernel level autoconfigurati
108 help
109 This enables automatic configuration
110 of the routing table during kernel b
111 supplied on the kernel command line
112 You need to say Y only for diskless
113 access to boot (in which case you wa
114 on NFS" as well), because all other
115 in their startup scripts.
116
117 config IP_PNP_DHCP
118 bool "IP: DHCP support"
119 depends on IP_PNP
120 help
121 If you want your Linux box to mount
122 one containing the directory /) from
123 net via NFS and you want the IP addr
124 discovered automatically at boot tim
125 special protocol designed for doing
126 the boot ROM of your network card wa
127 does DHCP itself, providing all nece
128 command line, you can say N here.
129
130 If unsure, say Y. Note that if you w
131 must be operating on your network.
132 <file:Documentation/admin-guide/nfs/
133
134 config IP_PNP_BOOTP
135 bool "IP: BOOTP support"
136 depends on IP_PNP
137 help
138 If you want your Linux box to mount
139 one containing the directory /) from
140 net via NFS and you want the IP addr
141 discovered automatically at boot tim
142 special protocol designed for doing
143 the boot ROM of your network card wa
144 does BOOTP itself, providing all nec
145 command line, you can say N here. If
146 want to use BOOTP, a BOOTP server mu
147 Read <file:Documentation/admin-guide
148
149 config IP_PNP_RARP
150 bool "IP: RARP support"
151 depends on IP_PNP
152 help
153 If you want your Linux box to mount
154 one containing the directory /) from
155 net via NFS and you want the IP addr
156 discovered automatically at boot tim
157 older protocol which is being obsole
158 here. Note that if you want to use R
159 operating on your network. Read
160 <file:Documentation/admin-guide/nfs/
161
162 config NET_IPIP
163 tristate "IP: tunneling"
164 select INET_TUNNEL
165 select NET_IP_TUNNEL
166 help
167 Tunneling means encapsulating data o
168 another protocol and sending it over
169 encapsulating protocol. This particu
170 encapsulation of IP within IP, which
171 can be useful if you want to make yo
172 appear on a different network than i
173 mobile-IP facilities (allowing lapto
174 networks without changing their IP a
175
176 Saying Y to this option will produce
177 be inserted in and removed from the
178 want). Most people won't need this a
179
180 config NET_IPGRE_DEMUX
181 tristate "IP: GRE demultiplexer"
182 help
183 This is helper module to demultiplex
184 Required by ip_gre and pptp modules.
185
186 config NET_IP_TUNNEL
187 tristate
188 select DST_CACHE
189 select GRO_CELLS
190 default n
191
192 config NET_IPGRE
193 tristate "IP: GRE tunnels over IP"
194 depends on (IPV6 || IPV6=n) && NET_IPG
195 select NET_IP_TUNNEL
196 help
197 Tunneling means encapsulating data o
198 another protocol and sending it over
199 encapsulating protocol. This particu
200 GRE (Generic Routing Encapsulation)
201 encapsulating of IPv4 or IPv6 over e
202 This driver is useful if the other e
203 likes GRE much better than the other
204 tunneling" above). In addition, GRE
205 through the tunnel.
206
207 config NET_IPGRE_BROADCAST
208 bool "IP: broadcast GRE over IP"
209 depends on IP_MULTICAST && NET_IPGRE
210 help
211 One application of GRE/IP is to cons
212 Network), which looks like a normal
213 Network), but can be distributed all
214 to do that, say Y here and to "IP mu
215
216 config IP_MROUTE_COMMON
217 bool
218 depends on IP_MROUTE || IPV6_MROUTE
219
220 config IP_MROUTE
221 bool "IP: multicast routing"
222 depends on IP_MULTICAST
223 select IP_MROUTE_COMMON
224 help
225 This is used if you want your machin
226 packets that have several destinatio
227 MBONE, a high bandwidth network on t
228 audio and video broadcasts. In order
229 likely run the program mrouted. If y
230 don't need it.
231
232 config IP_MROUTE_MULTIPLE_TABLES
233 bool "IP: multicast policy routing"
234 depends on IP_MROUTE && IP_ADVANCED_RO
235 select FIB_RULES
236 help
237 Normally, a multicast router runs a
238 what to do with a multicast packet b
239 destination addresses. If you say Y
240 will also be able to take interfaces
241 account and run multiple instances o
242 simultaneously, each one handling a
243
244 If unsure, say N.
245
246 config IP_PIMSM_V1
247 bool "IP: PIM-SM version 1 support"
248 depends on IP_MROUTE
249 help
250 Kernel side support for Sparse Mode
251 Multicast) version 1. This multicast
252 because Cisco supports it. You need
253 (pimd-v1). Please see <http://netweb
254 information about PIM.
255
256 Say Y if you want to use PIM-SM v1.
257 you just want to use Dense Mode PIM.
258
259 config IP_PIMSM_V2
260 bool "IP: PIM-SM version 2 support"
261 depends on IP_MROUTE
262 help
263 Kernel side support for Sparse Mode
264 this, you need an experimental routi
265 gated-5). This routing protocol is n
266 you want to play with it.
267
268 config SYN_COOKIES
269 bool "IP: TCP syncookie support"
270 help
271 Normal TCP/IP networking is open to
272 flooding". This denial-of-service at
273 users from being able to connect to
274 attack and requires very little work
275 operate from anywhere on the Interne
276
277 SYN cookies provide protection again
278 say Y here, the TCP/IP stack will us
279 protocol known as "SYN cookies" to e
280 continue to connect, even when your
281 is no need for the legitimate users
282 SYN cookies work transparently to th
283 about SYN cookies, check out <https:
284
285 If you are SYN flooded, the source a
286 likely to have been forged by the at
287 an aid in tracing the packets to the
288 be taken as absolute truth.
289
290 SYN cookies may prevent correct erro
291 server is really overloaded. If this
292 them off.
293
294 If you say Y here, you can disable S
295 saying Y to "/proc file system suppo
296 "Sysctl support" below and executing
297
298 echo 0 > /proc/sys/net/ipv4/tcp_sync
299
300 after the /proc file system has been
301
302 If unsure, say N.
303
304 config NET_IPVTI
305 tristate "Virtual (secure) IP: tunneli
306 depends on IPV6 || IPV6=n
307 select INET_TUNNEL
308 select NET_IP_TUNNEL
309 select XFRM
310 help
311 Tunneling means encapsulating data o
312 another protocol and sending it over
313 encapsulating protocol. This can be
314 the notion of a secure tunnel for IP
315 on top.
316
317 config NET_UDP_TUNNEL
318 tristate
319 select NET_IP_TUNNEL
320 default n
321
322 config NET_FOU
323 tristate "IP: Foo (IP protocols) over
324 select NET_UDP_TUNNEL
325 help
326 Foo over UDP allows any IP protocol
327 over UDP include tunnels (IPIP, GRE,
328 network mechanisms and optimizations
329 and RSS) can be leveraged to provide
330
331 config NET_FOU_IP_TUNNELS
332 bool "IP: FOU encapsulation of IP tunn
333 depends on NET_IPIP || NET_IPGRE || IP
334 select NET_FOU
335 help
336 Allow configuration of FOU or GUE en
337 When this option is enabled IP tunne
338 FOU or GUE encapsulation.
339
340 config INET_AH
341 tristate "IP: AH transformation"
342 select XFRM_AH
343 help
344 Support for IPsec AH (Authentication
345
346 AH can be used with various authenti
347 enabling AH support itself, this opt
348 implementations of the algorithms th
349 implemented. If you need any other
350 them in the crypto API. You should
351 implementations of any needed algori
352
353 If unsure, say Y.
354
355 config INET_ESP
356 tristate "IP: ESP transformation"
357 select XFRM_ESP
358 help
359 Support for IPsec ESP (Encapsulating
360
361 ESP can be used with various encrypt
362 Besides enabling ESP support itself,
363 implementations of the algorithms th
364 implemented. If you need any other
365 them in the crypto API. You should
366 implementations of any needed algori
367
368 If unsure, say Y.
369
370 config INET_ESP_OFFLOAD
371 tristate "IP: ESP transformation offlo
372 depends on INET_ESP
373 select XFRM_OFFLOAD
374 default n
375 help
376 Support for ESP transformation offlo
377 only if this system really does IPse
378 with high throughput. A typical desk
379 need it, even if it does IPsec.
380
381 If unsure, say N.
382
383 config INET_ESPINTCP
384 bool "IP: ESP in TCP encapsulation (RF
385 depends on XFRM && INET_ESP
386 select STREAM_PARSER
387 select NET_SOCK_MSG
388 select XFRM_ESPINTCP
389 help
390 Support for RFC 8229 encapsulation o
391 TCP/IPv4 sockets.
392
393 If unsure, say N.
394
395 config INET_IPCOMP
396 tristate "IP: IPComp transformation"
397 select INET_XFRM_TUNNEL
398 select XFRM_IPCOMP
399 help
400 Support for IP Payload Compression P
401 typically needed for IPsec.
402
403 If unsure, say Y.
404
405 config INET_TABLE_PERTURB_ORDER
406 int "INET: Source port perturbation ta
407 default 16
408 help
409 Source port perturbation table size
410 RFC 6056 3.3.4. Algorithm 4: Double
411
412 The default is almost always what yo
413 Only change this if you know what yo
414
415 config INET_XFRM_TUNNEL
416 tristate
417 select INET_TUNNEL
418 default n
419
420 config INET_TUNNEL
421 tristate
422 default n
423
424 config INET_DIAG
425 tristate "INET: socket monitoring inte
426 default y
427 help
428 Support for INET (TCP, DCCP, etc) so
429 native Linux tools such as ss. ss is
430 downloadable at:
431
432 http://www.linuxfoundation.org/col
433
434 If unsure, say Y.
435
436 config INET_TCP_DIAG
437 depends on INET_DIAG
438 def_tristate INET_DIAG
439
440 config INET_UDP_DIAG
441 tristate "UDP: socket monitoring inter
442 depends on INET_DIAG && (IPV6 || IPV6=
443 default n
444 help
445 Support for UDP socket monitoring in
446 If unsure, say Y.
447
448 config INET_RAW_DIAG
449 tristate "RAW: socket monitoring inter
450 depends on INET_DIAG && (IPV6 || IPV6=
451 default n
452 help
453 Support for RAW socket monitoring in
454 If unsure, say Y.
455
456 config INET_DIAG_DESTROY
457 bool "INET: allow privileged process t
458 depends on INET_DIAG
459 default n
460 help
461 Provides a SOCK_DESTROY operation th
462 (e.g., a connection manager or a net
463 ss) to close sockets opened by other
464 this way interrupts any blocking rea
465 the socket and causes future socket
466 had been disconnected.
467 If unsure, say N.
468
469 menuconfig TCP_CONG_ADVANCED
470 bool "TCP: advanced congestion control
471 help
472 Support for selection of various TCP
473 modules.
474
475 Nearly all users can safely say no h
476 selection will be made (CUBIC with n
477
478 If unsure, say N.
479
480 if TCP_CONG_ADVANCED
481
482 config TCP_CONG_BIC
483 tristate "Binary Increase Congestion (
484 default m
485 help
486 BIC-TCP is a sender-side only change
487 fairness under large windows while o
488 bounded TCP-friendliness. The protoc
489 called additive increase and binary
490 congestion window is large, additive
491 increment ensures linear RTT fairnes
492 scalability. Under small congestion
493 increase provides TCP friendliness.
494 See http://www.csc.ncsu.edu/faculty/
495
496 config TCP_CONG_CUBIC
497 tristate "CUBIC TCP"
498 default y
499 help
500 This is version 2.0 of BIC-TCP which
501 among other techniques.
502 See http://www.csc.ncsu.edu/faculty/
503
504 config TCP_CONG_WESTWOOD
505 tristate "TCP Westwood+"
506 default m
507 help
508 TCP Westwood+ is a sender-side only
509 protocol stack that optimizes the pe
510 control. It is based on end-to-end b
511 congestion window and slow start thr
512 episode. Using this estimation, TCP
513 slow start threshold and a congestio
514 account the bandwidth used at the t
515 TCP Westwood+ significantly increase
516 wired networks and throughput over w
517
518 config TCP_CONG_HTCP
519 tristate "H-TCP"
520 default m
521 help
522 H-TCP is a send-side only modificati
523 protocol stack that optimizes the pe
524 congestion control for high speed ne
525 modeswitch to change the alpha and b
526 based on network conditions and in a
527 other Reno and H-TCP flows.
528
529 config TCP_CONG_HSTCP
530 tristate "High Speed TCP"
531 default n
532 help
533 Sally Floyd's High Speed TCP (RFC 36
534 A modification to TCP's congestion c
535 with large congestion windows. A tab
536 increase the congestion window by wh
537 For more detail see https://www.icir
538
539 config TCP_CONG_HYBLA
540 tristate "TCP-Hybla congestion control
541 default n
542 help
543 TCP-Hybla is a sender-side only chan
544 long-RTT, large-bandwidth connection
545 involved, especially when sharing a
546 terrestrial connections.
547
548 config TCP_CONG_VEGAS
549 tristate "TCP Vegas"
550 default n
551 help
552 TCP Vegas is a sender-side only chan
553 the onset of congestion by estimatin
554 adjusts the sending rate by modifyin
555 window. TCP Vegas should provide les
556 not as aggressive as TCP Reno.
557
558 config TCP_CONG_NV
559 tristate "TCP NV"
560 default n
561 help
562 TCP NV is a follow up to TCP Vegas.
563 10G networks, measurement noise intr
564 coalescence. In addition, it will de
565 instead of linearly.
566
567 Note that in general congestion avoi
568 queued grows) cannot coexist with co
569 when there is packet loss) due to fa
570 can coexist safely is when the CA fl
571
572 For further details see http://www.b
573
574 config TCP_CONG_SCALABLE
575 tristate "Scalable TCP"
576 default n
577 help
578 Scalable TCP is a sender-side only c
579 MIMD congestion control algorithm wh
580 properties, though is known to have
581 See http://www.deneholme.net/tom/sca
582
583 config TCP_CONG_LP
584 tristate "TCP Low Priority"
585 default n
586 help
587 TCP Low Priority (TCP-LP), a distrib
588 to utilize only the excess network b
589 ``fair share`` of bandwidth as targe
590 See http://www-ece.rice.edu/networks
591
592 config TCP_CONG_VENO
593 tristate "TCP Veno"
594 default n
595 help
596 TCP Veno is a sender-side only enhan
597 throughput over wireless networks. T
598 distinguishing to circumvent the dif
599 type. TCP Veno cuts down less conges
600 loss packets.
601 See <http://ieeexplore.ieee.org/xpl/
602
603 config TCP_CONG_YEAH
604 tristate "YeAH TCP"
605 select TCP_CONG_VEGAS
606 default n
607 help
608 YeAH-TCP is a sender-side high-speed
609 algorithm, which uses a mixed loss/d
610 congestion window. It's design goals
611 internal, RTT and Reno fairness, res
612 keeping network elements load as low
613
614 For further details look here:
615 http://wil.cs.caltech.edu/pfldnet2
616
617 config TCP_CONG_ILLINOIS
618 tristate "TCP Illinois"
619 default n
620 help
621 TCP-Illinois is a sender-side modifi
622 high speed long delay links. It uses
623 adjust the alpha and beta parameters
624 throughput and maintain fairness.
625
626 For further details see:
627 http://www.ews.uiuc.edu/~shaoliu/t
628
629 config TCP_CONG_DCTCP
630 tristate "DataCenter TCP (DCTCP)"
631 default n
632 help
633 DCTCP leverages Explicit Congestion
634 provide multi-bit feedback to the en
635
636 - High burst tolerance (incast due t
637 - Low latency (short flows, queries)
638 - High throughput (continuous data u
639 commodity, shallow-buffered switch
640
641 All switches in the data center netw
642 ECN marking and be configured for ma
643 buffer thresholds. The default ECN m
644 DCTCP on switches is 20 packets (30K
645 (~100KB) at 10Gbps, but might need f
646
647 For further details see:
648 http://simula.stanford.edu/~alizad
649
650 config TCP_CONG_CDG
651 tristate "CAIA Delay-Gradient (CDG)"
652 default n
653 help
654 CAIA Delay-Gradient (CDG) is a TCP c
655 the TCP sender in order to:
656
657 o Use the delay gradient as a conges
658 o Back off with an average probabili
659 o Coexist with flows that use loss-b
660 o Tolerate packet loss unrelated to
661
662 For further details see:
663 D.A. Hayes and G. Armitage. "Revis
664 delay gradients." In Networking 20
665 http://caia.swin.edu.au/cv/dahayes
666
667 config TCP_CONG_BBR
668 tristate "BBR TCP"
669 default n
670 help
671
672 BBR (Bottleneck Bandwidth and RTT) T
673 maximize network utilization and min
674 model of the bottleneck delivery rat
675 delay. It tolerates packet loss and
676 can operate over LAN, WAN, cellular,
677 coexist with flows that use loss-bas
678 operate with shallow buffers, deep b
679 AQM schemes that do not provide a de
680 ("Fair Queue") pacing packet schedul
681
682 choice
683 prompt "Default TCP congestion control
684 default DEFAULT_CUBIC
685 help
686 Select the TCP congestion control th
687 for all connections.
688
689 config DEFAULT_BIC
690 bool "Bic" if TCP_CONG_BIC=y
691
692 config DEFAULT_CUBIC
693 bool "Cubic" if TCP_CONG_CUBIC
694
695 config DEFAULT_HTCP
696 bool "Htcp" if TCP_CONG_HTCP=y
697
698 config DEFAULT_HYBLA
699 bool "Hybla" if TCP_CONG_HYBLA
700
701 config DEFAULT_VEGAS
702 bool "Vegas" if TCP_CONG_VEGAS
703
704 config DEFAULT_VENO
705 bool "Veno" if TCP_CONG_VENO=y
706
707 config DEFAULT_WESTWOOD
708 bool "Westwood" if TCP_CONG_WE
709
710 config DEFAULT_DCTCP
711 bool "DCTCP" if TCP_CONG_DCTCP
712
713 config DEFAULT_CDG
714 bool "CDG" if TCP_CONG_CDG=y
715
716 config DEFAULT_BBR
717 bool "BBR" if TCP_CONG_BBR=y
718
719 config DEFAULT_RENO
720 bool "Reno"
721 endchoice
722
723 endif
724
725 config TCP_CONG_CUBIC
726 tristate
727 depends on !TCP_CONG_ADVANCED
728 default y
729
730 config DEFAULT_TCP_CONG
731 string
732 default "bic" if DEFAULT_BIC
733 default "cubic" if DEFAULT_CUBIC
734 default "htcp" if DEFAULT_HTCP
735 default "hybla" if DEFAULT_HYBLA
736 default "vegas" if DEFAULT_VEGAS
737 default "westwood" if DEFAULT_WESTWOOD
738 default "veno" if DEFAULT_VENO
739 default "reno" if DEFAULT_RENO
740 default "dctcp" if DEFAULT_DCTCP
741 default "cdg" if DEFAULT_CDG
742 default "bbr" if DEFAULT_BBR
743 default "cubic"
744
745 config TCP_SIGPOOL
746 tristate
747
748 config TCP_AO
749 bool "TCP: Authentication Option (RFC5
750 select CRYPTO
751 select TCP_SIGPOOL
752 depends on 64BIT && IPV6 != m # seq-nu
753 help
754 TCP-AO specifies the use of stronger
755 protects against replays for long-li
756 provides more details on the associa
757 connections than TCP MD5 (See RFC592
758
759 If unsure, say N.
760
761 config TCP_MD5SIG
762 bool "TCP: MD5 Signature Option suppor
763 select CRYPTO
764 select CRYPTO_MD5
765 select TCP_SIGPOOL
766 help
767 RFC2385 specifies a method of giving
768 Its main (only?) use is to protect B
769 on the Internet.
770
771 If unsure, say N.
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.