.. | .. |
---|
| 1 | +# SPDX-License-Identifier: GPL-2.0-only |
---|
1 | 2 | # |
---|
2 | 3 | # XFRM configuration |
---|
3 | 4 | # |
---|
4 | 5 | config XFRM |
---|
5 | | - bool |
---|
6 | | - depends on NET |
---|
7 | | - select GRO_CELLS |
---|
| 6 | + bool |
---|
| 7 | + depends on INET |
---|
| 8 | + select GRO_CELLS |
---|
| 9 | + select SKB_EXTENSIONS |
---|
8 | 10 | |
---|
9 | 11 | config XFRM_OFFLOAD |
---|
10 | | - bool |
---|
11 | | - depends on XFRM |
---|
| 12 | + bool |
---|
12 | 13 | |
---|
13 | 14 | config XFRM_ALGO |
---|
14 | 15 | tristate |
---|
15 | 16 | select XFRM |
---|
16 | 17 | select CRYPTO |
---|
17 | 18 | select CRYPTO_HASH |
---|
18 | | - select CRYPTO_BLKCIPHER |
---|
| 19 | + select CRYPTO_SKCIPHER |
---|
19 | 20 | |
---|
| 21 | +if INET |
---|
20 | 22 | config XFRM_USER |
---|
21 | 23 | tristate "Transformation user configuration interface" |
---|
22 | | - depends on INET |
---|
23 | 24 | select XFRM_ALGO |
---|
24 | | - ---help--- |
---|
| 25 | + help |
---|
25 | 26 | Support for Transformation(XFRM) user configuration interface |
---|
26 | 27 | like IPsec used by native Linux tools. |
---|
27 | 28 | |
---|
.. | .. |
---|
41 | 42 | config XFRM_INTERFACE |
---|
42 | 43 | tristate "Transformation virtual interface" |
---|
43 | 44 | depends on XFRM && IPV6 |
---|
44 | | - ---help--- |
---|
| 45 | + help |
---|
45 | 46 | This provides a virtual interface to route IPsec traffic. |
---|
46 | 47 | |
---|
47 | 48 | If unsure, say N. |
---|
.. | .. |
---|
49 | 50 | config XFRM_SUB_POLICY |
---|
50 | 51 | bool "Transformation sub policy support" |
---|
51 | 52 | depends on XFRM |
---|
52 | | - ---help--- |
---|
| 53 | + help |
---|
53 | 54 | Support sub policy for developers. By using sub policy with main |
---|
54 | 55 | one, two policies can be applied to the same packet at once. |
---|
55 | 56 | Policy which lives shorter time in kernel should be a sub. |
---|
.. | .. |
---|
59 | 60 | config XFRM_MIGRATE |
---|
60 | 61 | bool "Transformation migrate database" |
---|
61 | 62 | depends on XFRM |
---|
62 | | - ---help--- |
---|
| 63 | + help |
---|
63 | 64 | A feature to update locator(s) of a given IPsec security |
---|
64 | 65 | association dynamically. This feature is required, for |
---|
65 | 66 | instance, in a Mobile IPv6 environment with IPsec configuration |
---|
.. | .. |
---|
69 | 70 | |
---|
70 | 71 | config XFRM_STATISTICS |
---|
71 | 72 | bool "Transformation statistics" |
---|
72 | | - depends on INET && XFRM && PROC_FS |
---|
73 | | - ---help--- |
---|
| 73 | + depends on XFRM && PROC_FS |
---|
| 74 | + help |
---|
74 | 75 | This statistics is not a SNMP/MIB specification but shows |
---|
75 | 76 | statistics about transformation error (or almost error) factor |
---|
76 | 77 | at packet processing for developer. |
---|
77 | 78 | |
---|
78 | 79 | If unsure, say N. |
---|
| 80 | + |
---|
| 81 | +# This option selects XFRM_ALGO along with the AH authentication algorithms that |
---|
| 82 | +# RFC 8221 lists as MUST be implemented. |
---|
| 83 | +config XFRM_AH |
---|
| 84 | + tristate |
---|
| 85 | + select XFRM_ALGO |
---|
| 86 | + select CRYPTO |
---|
| 87 | + select CRYPTO_HMAC |
---|
| 88 | + select CRYPTO_SHA256 |
---|
| 89 | + |
---|
| 90 | +# This option selects XFRM_ALGO along with the ESP encryption and authentication |
---|
| 91 | +# algorithms that RFC 8221 lists as MUST be implemented. |
---|
| 92 | +config XFRM_ESP |
---|
| 93 | + tristate |
---|
| 94 | + select XFRM_ALGO |
---|
| 95 | + select CRYPTO |
---|
| 96 | + select CRYPTO_AES |
---|
| 97 | + select CRYPTO_AUTHENC |
---|
| 98 | + select CRYPTO_CBC |
---|
| 99 | + select CRYPTO_ECHAINIV |
---|
| 100 | + select CRYPTO_GCM |
---|
| 101 | + select CRYPTO_HMAC |
---|
| 102 | + select CRYPTO_SEQIV |
---|
| 103 | + select CRYPTO_SHA256 |
---|
79 | 104 | |
---|
80 | 105 | config XFRM_IPCOMP |
---|
81 | 106 | tristate |
---|
.. | .. |
---|
86 | 111 | config NET_KEY |
---|
87 | 112 | tristate "PF_KEY sockets" |
---|
88 | 113 | select XFRM_ALGO |
---|
89 | | - ---help--- |
---|
| 114 | + help |
---|
90 | 115 | PF_KEYv2 socket family, compatible to KAME ones. |
---|
91 | 116 | They are required if you are going to use IPsec tools ported |
---|
92 | 117 | from KAME. |
---|
.. | .. |
---|
97 | 122 | bool "PF_KEY MIGRATE" |
---|
98 | 123 | depends on NET_KEY |
---|
99 | 124 | select XFRM_MIGRATE |
---|
100 | | - ---help--- |
---|
| 125 | + help |
---|
101 | 126 | Add a PF_KEY MIGRATE message to PF_KEYv2 socket family. |
---|
102 | 127 | The PF_KEY MIGRATE message is used to dynamically update |
---|
103 | 128 | locator(s) of a given IPsec security association. |
---|
.. | .. |
---|
108 | 133 | <draft-sugimoto-mip6-pfkey-migrate>. |
---|
109 | 134 | |
---|
110 | 135 | If unsure, say N. |
---|
| 136 | + |
---|
| 137 | +config XFRM_ESPINTCP |
---|
| 138 | + bool |
---|
| 139 | + |
---|
| 140 | +endif # INET |
---|