1 # SPDX-License-Identifier: GPL-2.0-only <<
2 # 1 #
3 # XFRM configuration 2 # XFRM configuration
4 # 3 #
5 config XFRM 4 config XFRM
6 bool !! 5 bool
7 depends on INET !! 6 depends on NET
8 select GRO_CELLS !! 7 select GRO_CELLS
9 select SKB_EXTENSIONS !! 8 select SKB_EXTENSIONS
10 9
11 config XFRM_OFFLOAD 10 config XFRM_OFFLOAD
12 bool !! 11 bool
13 12
14 config XFRM_ALGO 13 config XFRM_ALGO
15 tristate 14 tristate
16 select XFRM 15 select XFRM
17 select CRYPTO 16 select CRYPTO
18 select CRYPTO_AEAD <<
19 select CRYPTO_HASH 17 select CRYPTO_HASH
20 select CRYPTO_SKCIPHER !! 18 select CRYPTO_BLKCIPHER
21 19
22 if INET <<
23 config XFRM_USER 20 config XFRM_USER
24 tristate "Transformation user configur 21 tristate "Transformation user configuration interface"
>> 22 depends on INET
25 select XFRM_ALGO 23 select XFRM_ALGO
26 help !! 24 ---help---
27 Support for Transformation(XFRM) use 25 Support for Transformation(XFRM) user configuration interface
28 like IPsec used by native Linux tool 26 like IPsec used by native Linux tools.
29 27
30 If unsure, say Y. 28 If unsure, say Y.
31 29
32 config XFRM_USER_COMPAT <<
33 tristate "Compatible ABI support" <<
34 depends on XFRM_USER && COMPAT_FOR_U64 <<
35 HAVE_EFFICIENT_UNALIGNED_ACCES <<
36 select WANT_COMPAT_NETLINK_MESSAGES <<
37 help <<
38 Transformation(XFRM) user configurat <<
39 used by compatible Linux application <<
40 <<
41 If unsure, say N. <<
42 <<
43 config XFRM_INTERFACE 30 config XFRM_INTERFACE
44 tristate "Transformation virtual inter 31 tristate "Transformation virtual interface"
45 depends on XFRM && IPV6 32 depends on XFRM && IPV6
46 help !! 33 ---help---
47 This provides a virtual interface to 34 This provides a virtual interface to route IPsec traffic.
48 35
49 If unsure, say N. 36 If unsure, say N.
50 37
51 config XFRM_SUB_POLICY 38 config XFRM_SUB_POLICY
52 bool "Transformation sub policy suppor 39 bool "Transformation sub policy support"
53 depends on XFRM 40 depends on XFRM
54 help !! 41 ---help---
55 Support sub policy for developers. B 42 Support sub policy for developers. By using sub policy with main
56 one, two policies can be applied to 43 one, two policies can be applied to the same packet at once.
57 Policy which lives shorter time in k 44 Policy which lives shorter time in kernel should be a sub.
58 45
59 If unsure, say N. 46 If unsure, say N.
60 47
61 config XFRM_MIGRATE 48 config XFRM_MIGRATE
62 bool "Transformation migrate database" 49 bool "Transformation migrate database"
63 depends on XFRM 50 depends on XFRM
64 help !! 51 ---help---
65 A feature to update locator(s) of a 52 A feature to update locator(s) of a given IPsec security
66 association dynamically. This featu 53 association dynamically. This feature is required, for
67 instance, in a Mobile IPv6 environme 54 instance, in a Mobile IPv6 environment with IPsec configuration
68 where mobile nodes change their atta 55 where mobile nodes change their attachment point to the Internet.
69 56
70 If unsure, say N. 57 If unsure, say N.
71 58
72 config XFRM_STATISTICS 59 config XFRM_STATISTICS
73 bool "Transformation statistics" 60 bool "Transformation statistics"
74 depends on XFRM && PROC_FS !! 61 depends on INET && XFRM && PROC_FS
75 help !! 62 ---help---
76 This statistics is not a SNMP/MIB sp 63 This statistics is not a SNMP/MIB specification but shows
77 statistics about transformation erro 64 statistics about transformation error (or almost error) factor
78 at packet processing for developer. 65 at packet processing for developer.
79 66
80 If unsure, say N. 67 If unsure, say N.
81 68
82 # This option selects XFRM_ALGO along with the <<
83 # RFC 8221 lists as MUST be implemented. <<
84 config XFRM_AH <<
85 tristate <<
86 select XFRM_ALGO <<
87 select CRYPTO <<
88 select CRYPTO_HMAC <<
89 select CRYPTO_SHA256 <<
90 <<
91 # This option selects XFRM_ALGO along with the <<
92 # algorithms that RFC 8221 lists as MUST be im <<
93 config XFRM_ESP <<
94 tristate <<
95 select XFRM_ALGO <<
96 select CRYPTO <<
97 select CRYPTO_AES <<
98 select CRYPTO_AUTHENC <<
99 select CRYPTO_CBC <<
100 select CRYPTO_ECHAINIV <<
101 select CRYPTO_GCM <<
102 select CRYPTO_HMAC <<
103 select CRYPTO_SEQIV <<
104 select CRYPTO_SHA256 <<
105 <<
106 config XFRM_IPCOMP 69 config XFRM_IPCOMP
107 tristate 70 tristate
108 select XFRM_ALGO 71 select XFRM_ALGO
109 select CRYPTO 72 select CRYPTO
110 select CRYPTO_DEFLATE 73 select CRYPTO_DEFLATE
111 74
112 config NET_KEY 75 config NET_KEY
113 tristate "PF_KEY sockets" 76 tristate "PF_KEY sockets"
114 select XFRM_ALGO 77 select XFRM_ALGO
115 help !! 78 ---help---
116 PF_KEYv2 socket family, compatible t 79 PF_KEYv2 socket family, compatible to KAME ones.
117 They are required if you are going t 80 They are required if you are going to use IPsec tools ported
118 from KAME. 81 from KAME.
119 82
120 Say Y unless you know what you are d 83 Say Y unless you know what you are doing.
121 84
122 config NET_KEY_MIGRATE 85 config NET_KEY_MIGRATE
123 bool "PF_KEY MIGRATE" 86 bool "PF_KEY MIGRATE"
124 depends on NET_KEY 87 depends on NET_KEY
125 select XFRM_MIGRATE 88 select XFRM_MIGRATE
126 help !! 89 ---help---
127 Add a PF_KEY MIGRATE message to PF_K 90 Add a PF_KEY MIGRATE message to PF_KEYv2 socket family.
128 The PF_KEY MIGRATE message is used t 91 The PF_KEY MIGRATE message is used to dynamically update
129 locator(s) of a given IPsec security 92 locator(s) of a given IPsec security association.
130 This feature is required, for instan 93 This feature is required, for instance, in a Mobile IPv6
131 environment with IPsec configuration 94 environment with IPsec configuration where mobile nodes
132 change their attachment point to the 95 change their attachment point to the Internet. Detail
133 information can be found in the inte 96 information can be found in the internet-draft
134 <draft-sugimoto-mip6-pfkey-migrate>. 97 <draft-sugimoto-mip6-pfkey-migrate>.
135 98
136 If unsure, say N. 99 If unsure, say N.
137 <<
138 config XFRM_ESPINTCP <<
139 bool <<
140 <<
141 endif # INET <<
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.