hc
2024-10-22 8ac6c7a54ed1b98d142dce24b11c6de6a1e239a5
kernel/net/xfrm/Kconfig
....@@ -1,27 +1,28 @@
1
+# SPDX-License-Identifier: GPL-2.0-only
12 #
23 # XFRM configuration
34 #
45 config XFRM
5
- bool
6
- depends on NET
7
- select GRO_CELLS
6
+ bool
7
+ depends on INET
8
+ select GRO_CELLS
9
+ select SKB_EXTENSIONS
810
911 config XFRM_OFFLOAD
10
- bool
11
- depends on XFRM
12
+ bool
1213
1314 config XFRM_ALGO
1415 tristate
1516 select XFRM
1617 select CRYPTO
1718 select CRYPTO_HASH
18
- select CRYPTO_BLKCIPHER
19
+ select CRYPTO_SKCIPHER
1920
21
+if INET
2022 config XFRM_USER
2123 tristate "Transformation user configuration interface"
22
- depends on INET
2324 select XFRM_ALGO
24
- ---help---
25
+ help
2526 Support for Transformation(XFRM) user configuration interface
2627 like IPsec used by native Linux tools.
2728
....@@ -41,7 +42,7 @@
4142 config XFRM_INTERFACE
4243 tristate "Transformation virtual interface"
4344 depends on XFRM && IPV6
44
- ---help---
45
+ help
4546 This provides a virtual interface to route IPsec traffic.
4647
4748 If unsure, say N.
....@@ -49,7 +50,7 @@
4950 config XFRM_SUB_POLICY
5051 bool "Transformation sub policy support"
5152 depends on XFRM
52
- ---help---
53
+ help
5354 Support sub policy for developers. By using sub policy with main
5455 one, two policies can be applied to the same packet at once.
5556 Policy which lives shorter time in kernel should be a sub.
....@@ -59,7 +60,7 @@
5960 config XFRM_MIGRATE
6061 bool "Transformation migrate database"
6162 depends on XFRM
62
- ---help---
63
+ help
6364 A feature to update locator(s) of a given IPsec security
6465 association dynamically. This feature is required, for
6566 instance, in a Mobile IPv6 environment with IPsec configuration
....@@ -69,13 +70,37 @@
6970
7071 config XFRM_STATISTICS
7172 bool "Transformation statistics"
72
- depends on INET && XFRM && PROC_FS
73
- ---help---
73
+ depends on XFRM && PROC_FS
74
+ help
7475 This statistics is not a SNMP/MIB specification but shows
7576 statistics about transformation error (or almost error) factor
7677 at packet processing for developer.
7778
7879 If unsure, say N.
80
+
81
+# This option selects XFRM_ALGO along with the AH authentication algorithms that
82
+# RFC 8221 lists as MUST be implemented.
83
+config XFRM_AH
84
+ tristate
85
+ select XFRM_ALGO
86
+ select CRYPTO
87
+ select CRYPTO_HMAC
88
+ select CRYPTO_SHA256
89
+
90
+# This option selects XFRM_ALGO along with the ESP encryption and authentication
91
+# algorithms that RFC 8221 lists as MUST be implemented.
92
+config XFRM_ESP
93
+ tristate
94
+ select XFRM_ALGO
95
+ select CRYPTO
96
+ select CRYPTO_AES
97
+ select CRYPTO_AUTHENC
98
+ select CRYPTO_CBC
99
+ select CRYPTO_ECHAINIV
100
+ select CRYPTO_GCM
101
+ select CRYPTO_HMAC
102
+ select CRYPTO_SEQIV
103
+ select CRYPTO_SHA256
79104
80105 config XFRM_IPCOMP
81106 tristate
....@@ -86,7 +111,7 @@
86111 config NET_KEY
87112 tristate "PF_KEY sockets"
88113 select XFRM_ALGO
89
- ---help---
114
+ help
90115 PF_KEYv2 socket family, compatible to KAME ones.
91116 They are required if you are going to use IPsec tools ported
92117 from KAME.
....@@ -97,7 +122,7 @@
97122 bool "PF_KEY MIGRATE"
98123 depends on NET_KEY
99124 select XFRM_MIGRATE
100
- ---help---
125
+ help
101126 Add a PF_KEY MIGRATE message to PF_KEYv2 socket family.
102127 The PF_KEY MIGRATE message is used to dynamically update
103128 locator(s) of a given IPsec security association.
....@@ -108,3 +133,8 @@
108133 <draft-sugimoto-mip6-pfkey-migrate>.
109134
110135 If unsure, say N.
136
+
137
+config XFRM_ESPINTCP
138
+ bool
139
+
140
+endif # INET