1 # SPDX-License-Identifier: GPL-2.0-only 1 # SPDX-License-Identifier: GPL-2.0-only
2 # 2 #
3 # XFRM configuration 3 # XFRM configuration
4 # 4 #
5 config XFRM 5 config XFRM
6 bool 6 bool
7 depends on INET 7 depends on INET
8 select GRO_CELLS 8 select GRO_CELLS
9 select SKB_EXTENSIONS 9 select SKB_EXTENSIONS
10 10
11 config XFRM_OFFLOAD 11 config XFRM_OFFLOAD
12 bool 12 bool
13 13
14 config XFRM_ALGO 14 config XFRM_ALGO
15 tristate 15 tristate
16 select XFRM 16 select XFRM
17 select CRYPTO 17 select CRYPTO
18 select CRYPTO_AEAD 18 select CRYPTO_AEAD
19 select CRYPTO_HASH 19 select CRYPTO_HASH
20 select CRYPTO_SKCIPHER 20 select CRYPTO_SKCIPHER
21 21
22 if INET 22 if INET
23 config XFRM_USER 23 config XFRM_USER
24 tristate "Transformation user configur 24 tristate "Transformation user configuration interface"
25 select XFRM_ALGO 25 select XFRM_ALGO
26 help 26 help
27 Support for Transformation(XFRM) use 27 Support for Transformation(XFRM) user configuration interface
28 like IPsec used by native Linux tool 28 like IPsec used by native Linux tools.
29 29
30 If unsure, say Y. 30 If unsure, say Y.
31 31
32 config XFRM_USER_COMPAT 32 config XFRM_USER_COMPAT
33 tristate "Compatible ABI support" 33 tristate "Compatible ABI support"
34 depends on XFRM_USER && COMPAT_FOR_U64 34 depends on XFRM_USER && COMPAT_FOR_U64_ALIGNMENT && \
35 HAVE_EFFICIENT_UNALIGNED_ACCES 35 HAVE_EFFICIENT_UNALIGNED_ACCESS
36 select WANT_COMPAT_NETLINK_MESSAGES 36 select WANT_COMPAT_NETLINK_MESSAGES
37 help 37 help
38 Transformation(XFRM) user configurat 38 Transformation(XFRM) user configuration interface like IPsec
39 used by compatible Linux application 39 used by compatible Linux applications.
40 40
41 If unsure, say N. 41 If unsure, say N.
42 42
43 config XFRM_INTERFACE 43 config XFRM_INTERFACE
44 tristate "Transformation virtual inter 44 tristate "Transformation virtual interface"
45 depends on XFRM && IPV6 45 depends on XFRM && IPV6
46 help 46 help
47 This provides a virtual interface to 47 This provides a virtual interface to route IPsec traffic.
48 48
49 If unsure, say N. 49 If unsure, say N.
50 50
51 config XFRM_SUB_POLICY 51 config XFRM_SUB_POLICY
52 bool "Transformation sub policy suppor 52 bool "Transformation sub policy support"
53 depends on XFRM 53 depends on XFRM
54 help 54 help
55 Support sub policy for developers. B 55 Support sub policy for developers. By using sub policy with main
56 one, two policies can be applied to 56 one, two policies can be applied to the same packet at once.
57 Policy which lives shorter time in k 57 Policy which lives shorter time in kernel should be a sub.
58 58
59 If unsure, say N. 59 If unsure, say N.
60 60
61 config XFRM_MIGRATE 61 config XFRM_MIGRATE
62 bool "Transformation migrate database" 62 bool "Transformation migrate database"
63 depends on XFRM 63 depends on XFRM
64 help 64 help
65 A feature to update locator(s) of a 65 A feature to update locator(s) of a given IPsec security
66 association dynamically. This featu 66 association dynamically. This feature is required, for
67 instance, in a Mobile IPv6 environme 67 instance, in a Mobile IPv6 environment with IPsec configuration
68 where mobile nodes change their atta 68 where mobile nodes change their attachment point to the Internet.
69 69
70 If unsure, say N. 70 If unsure, say N.
71 71
72 config XFRM_STATISTICS 72 config XFRM_STATISTICS
73 bool "Transformation statistics" 73 bool "Transformation statistics"
74 depends on XFRM && PROC_FS 74 depends on XFRM && PROC_FS
75 help 75 help
76 This statistics is not a SNMP/MIB sp 76 This statistics is not a SNMP/MIB specification but shows
77 statistics about transformation erro 77 statistics about transformation error (or almost error) factor
78 at packet processing for developer. 78 at packet processing for developer.
79 79
80 If unsure, say N. 80 If unsure, say N.
81 81
82 # This option selects XFRM_ALGO along with the 82 # This option selects XFRM_ALGO along with the AH authentication algorithms that
83 # RFC 8221 lists as MUST be implemented. 83 # RFC 8221 lists as MUST be implemented.
84 config XFRM_AH 84 config XFRM_AH
85 tristate 85 tristate
86 select XFRM_ALGO 86 select XFRM_ALGO
87 select CRYPTO 87 select CRYPTO
88 select CRYPTO_HMAC 88 select CRYPTO_HMAC
89 select CRYPTO_SHA256 89 select CRYPTO_SHA256
90 90
91 # This option selects XFRM_ALGO along with the 91 # This option selects XFRM_ALGO along with the ESP encryption and authentication
92 # algorithms that RFC 8221 lists as MUST be im 92 # algorithms that RFC 8221 lists as MUST be implemented.
93 config XFRM_ESP 93 config XFRM_ESP
94 tristate 94 tristate
95 select XFRM_ALGO 95 select XFRM_ALGO
96 select CRYPTO 96 select CRYPTO
97 select CRYPTO_AES 97 select CRYPTO_AES
98 select CRYPTO_AUTHENC 98 select CRYPTO_AUTHENC
99 select CRYPTO_CBC 99 select CRYPTO_CBC
100 select CRYPTO_ECHAINIV 100 select CRYPTO_ECHAINIV
101 select CRYPTO_GCM 101 select CRYPTO_GCM
102 select CRYPTO_HMAC 102 select CRYPTO_HMAC
103 select CRYPTO_SEQIV 103 select CRYPTO_SEQIV
104 select CRYPTO_SHA256 104 select CRYPTO_SHA256
105 105
106 config XFRM_IPCOMP 106 config XFRM_IPCOMP
107 tristate 107 tristate
108 select XFRM_ALGO 108 select XFRM_ALGO
109 select CRYPTO 109 select CRYPTO
110 select CRYPTO_DEFLATE 110 select CRYPTO_DEFLATE
111 111
112 config NET_KEY 112 config NET_KEY
113 tristate "PF_KEY sockets" 113 tristate "PF_KEY sockets"
114 select XFRM_ALGO 114 select XFRM_ALGO
115 help 115 help
116 PF_KEYv2 socket family, compatible t 116 PF_KEYv2 socket family, compatible to KAME ones.
117 They are required if you are going t 117 They are required if you are going to use IPsec tools ported
118 from KAME. 118 from KAME.
119 119
120 Say Y unless you know what you are d 120 Say Y unless you know what you are doing.
121 121
122 config NET_KEY_MIGRATE 122 config NET_KEY_MIGRATE
123 bool "PF_KEY MIGRATE" 123 bool "PF_KEY MIGRATE"
124 depends on NET_KEY 124 depends on NET_KEY
125 select XFRM_MIGRATE 125 select XFRM_MIGRATE
126 help 126 help
127 Add a PF_KEY MIGRATE message to PF_K 127 Add a PF_KEY MIGRATE message to PF_KEYv2 socket family.
128 The PF_KEY MIGRATE message is used t 128 The PF_KEY MIGRATE message is used to dynamically update
129 locator(s) of a given IPsec security 129 locator(s) of a given IPsec security association.
130 This feature is required, for instan 130 This feature is required, for instance, in a Mobile IPv6
131 environment with IPsec configuration 131 environment with IPsec configuration where mobile nodes
132 change their attachment point to the 132 change their attachment point to the Internet. Detail
133 information can be found in the inte 133 information can be found in the internet-draft
134 <draft-sugimoto-mip6-pfkey-migrate>. 134 <draft-sugimoto-mip6-pfkey-migrate>.
135 135
136 If unsure, say N. 136 If unsure, say N.
137 137
138 config XFRM_ESPINTCP 138 config XFRM_ESPINTCP
139 bool 139 bool
140 140
141 endif # INET 141 endif # INET
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.