# SPDX-License-Identifier: GPL-2.0-only
|
#
|
# XFRM configuration
|
#
|
config XFRM
|
bool
|
depends on INET
|
select GRO_CELLS
|
select SKB_EXTENSIONS
|
|
config XFRM_OFFLOAD
|
bool
|
|
config XFRM_ALGO
|
tristate
|
select XFRM
|
select CRYPTO
|
select CRYPTO_HASH
|
select CRYPTO_SKCIPHER
|
|
if INET
|
config XFRM_USER
|
tristate "Transformation user configuration interface"
|
select XFRM_ALGO
|
help
|
Support for Transformation(XFRM) user configuration interface
|
like IPsec used by native Linux tools.
|
|
If unsure, say Y.
|
|
config XFRM_USER_COMPAT
|
tristate "Compatible ABI support"
|
depends on XFRM_USER && COMPAT_FOR_U64_ALIGNMENT && \
|
HAVE_EFFICIENT_UNALIGNED_ACCESS
|
select WANT_COMPAT_NETLINK_MESSAGES
|
help
|
Transformation(XFRM) user configuration interface like IPsec
|
used by compatible Linux applications.
|
|
If unsure, say N.
|
|
config XFRM_INTERFACE
|
tristate "Transformation virtual interface"
|
depends on XFRM && IPV6
|
help
|
This provides a virtual interface to route IPsec traffic.
|
|
If unsure, say N.
|
|
config XFRM_SUB_POLICY
|
bool "Transformation sub policy support"
|
depends on XFRM
|
help
|
Support sub policy for developers. By using sub policy with main
|
one, two policies can be applied to the same packet at once.
|
Policy which lives shorter time in kernel should be a sub.
|
|
If unsure, say N.
|
|
config XFRM_MIGRATE
|
bool "Transformation migrate database"
|
depends on XFRM
|
help
|
A feature to update locator(s) of a given IPsec security
|
association dynamically. This feature is required, for
|
instance, in a Mobile IPv6 environment with IPsec configuration
|
where mobile nodes change their attachment point to the Internet.
|
|
If unsure, say N.
|
|
config XFRM_STATISTICS
|
bool "Transformation statistics"
|
depends on XFRM && PROC_FS
|
help
|
This statistics is not a SNMP/MIB specification but shows
|
statistics about transformation error (or almost error) factor
|
at packet processing for developer.
|
|
If unsure, say N.
|
|
# This option selects XFRM_ALGO along with the AH authentication algorithms that
|
# RFC 8221 lists as MUST be implemented.
|
config XFRM_AH
|
tristate
|
select XFRM_ALGO
|
select CRYPTO
|
select CRYPTO_HMAC
|
select CRYPTO_SHA256
|
|
# This option selects XFRM_ALGO along with the ESP encryption and authentication
|
# algorithms that RFC 8221 lists as MUST be implemented.
|
config XFRM_ESP
|
tristate
|
select XFRM_ALGO
|
select CRYPTO
|
select CRYPTO_AES
|
select CRYPTO_AUTHENC
|
select CRYPTO_CBC
|
select CRYPTO_ECHAINIV
|
select CRYPTO_GCM
|
select CRYPTO_HMAC
|
select CRYPTO_SEQIV
|
select CRYPTO_SHA256
|
|
config XFRM_IPCOMP
|
tristate
|
select XFRM_ALGO
|
select CRYPTO
|
select CRYPTO_DEFLATE
|
|
config NET_KEY
|
tristate "PF_KEY sockets"
|
select XFRM_ALGO
|
help
|
PF_KEYv2 socket family, compatible to KAME ones.
|
They are required if you are going to use IPsec tools ported
|
from KAME.
|
|
Say Y unless you know what you are doing.
|
|
config NET_KEY_MIGRATE
|
bool "PF_KEY MIGRATE"
|
depends on NET_KEY
|
select XFRM_MIGRATE
|
help
|
Add a PF_KEY MIGRATE message to PF_KEYv2 socket family.
|
The PF_KEY MIGRATE message is used to dynamically update
|
locator(s) of a given IPsec security association.
|
This feature is required, for instance, in a Mobile IPv6
|
environment with IPsec configuration where mobile nodes
|
change their attachment point to the Internet. Detail
|
information can be found in the internet-draft
|
<draft-sugimoto-mip6-pfkey-migrate>.
|
|
If unsure, say N.
|
|
config XFRM_ESPINTCP
|
bool
|
|
endif # INET
|
