1ec8f24b7SThomas Gleixner# SPDX-License-Identifier: GPL-2.0-only 21da177e4SLinus Torvalds# 31da177e4SLinus Torvalds# XFRM configuration 41da177e4SLinus Torvalds# 56a2e9b73SSam Ravnborgconfig XFRM 66a2e9b73SSam Ravnborg bool 7e54d1527SFlorian Westphal depends on INET 897e219b7SEric Dumazet select GRO_CELLS 9a84e3f53SFlorian Westphal select SKB_EXTENSIONS 106a2e9b73SSam Ravnborg 1125393d3fSSteffen Klassertconfig XFRM_OFFLOAD 1225393d3fSSteffen Klassert bool 1325393d3fSSteffen Klassert 147e152524SJan Beulichconfig XFRM_ALGO 157e152524SJan Beulich tristate 167e152524SJan Beulich select XFRM 177e152524SJan Beulich select CRYPTO 18*29b49013SHerbert Xu select CRYPTO_AEAD 19597179b0SArnd Bergmann select CRYPTO_HASH 20b95bba5dSEric Biggers select CRYPTO_SKCIPHER 217e152524SJan Beulich 22e54d1527SFlorian Westphalif INET 231da177e4SLinus Torvaldsconfig XFRM_USER 24654b32c6SMasahide NAKAMURA tristate "Transformation user configuration interface" 257e152524SJan Beulich select XFRM_ALGO 26a7f7f624SMasahiro Yamada help 27654b32c6SMasahide NAKAMURA Support for Transformation(XFRM) user configuration interface 28654b32c6SMasahide NAKAMURA like IPsec used by native Linux tools. 291da177e4SLinus Torvalds 301da177e4SLinus Torvalds If unsure, say Y. 311da177e4SLinus Torvalds 32c9e7c76dSDmitry Safonovconfig XFRM_USER_COMPAT 33c9e7c76dSDmitry Safonov tristate "Compatible ABI support" 345106f4a8SDmitry Safonov depends on XFRM_USER && COMPAT_FOR_U64_ALIGNMENT && \ 355106f4a8SDmitry Safonov HAVE_EFFICIENT_UNALIGNED_ACCESS 36c9e7c76dSDmitry Safonov select WANT_COMPAT_NETLINK_MESSAGES 37c9e7c76dSDmitry Safonov help 38c9e7c76dSDmitry Safonov Transformation(XFRM) user configuration interface like IPsec 39c9e7c76dSDmitry Safonov used by compatible Linux applications. 40c9e7c76dSDmitry Safonov 41c9e7c76dSDmitry Safonov If unsure, say N. 42c9e7c76dSDmitry Safonov 43f203b76dSSteffen Klassertconfig XFRM_INTERFACE 44f203b76dSSteffen Klassert tristate "Transformation virtual interface" 45f203b76dSSteffen Klassert depends on XFRM && IPV6 46a7f7f624SMasahiro Yamada help 47f203b76dSSteffen Klassert This provides a virtual interface to route IPsec traffic. 48f203b76dSSteffen Klassert 49f203b76dSSteffen Klassert If unsure, say N. 50f203b76dSSteffen Klassert 51c11f1a15SMasahide NAKAMURAconfig XFRM_SUB_POLICY 52f215bf48SKees Cook bool "Transformation sub policy support" 53f215bf48SKees Cook depends on XFRM 54a7f7f624SMasahiro Yamada help 55c11f1a15SMasahide NAKAMURA Support sub policy for developers. By using sub policy with main 56c11f1a15SMasahide NAKAMURA one, two policies can be applied to the same packet at once. 57c11f1a15SMasahide NAKAMURA Policy which lives shorter time in kernel should be a sub. 58c11f1a15SMasahide NAKAMURA 59c11f1a15SMasahide NAKAMURA If unsure, say N. 60c11f1a15SMasahide NAKAMURA 61d0473655SShinta Sugimotoconfig XFRM_MIGRATE 62f215bf48SKees Cook bool "Transformation migrate database" 63f215bf48SKees Cook depends on XFRM 64a7f7f624SMasahiro Yamada help 65d0473655SShinta Sugimoto A feature to update locator(s) of a given IPsec security 66d0473655SShinta Sugimoto association dynamically. This feature is required, for 67d0473655SShinta Sugimoto instance, in a Mobile IPv6 environment with IPsec configuration 68d0473655SShinta Sugimoto where mobile nodes change their attachment point to the Internet. 69d0473655SShinta Sugimoto 70d0473655SShinta Sugimoto If unsure, say N. 71d0473655SShinta Sugimoto 728ea84349SMasahide NAKAMURAconfig XFRM_STATISTICS 73f215bf48SKees Cook bool "Transformation statistics" 74e54d1527SFlorian Westphal depends on XFRM && PROC_FS 75a7f7f624SMasahiro Yamada help 768ea84349SMasahide NAKAMURA This statistics is not a SNMP/MIB specification but shows 778ea84349SMasahide NAKAMURA statistics about transformation error (or almost error) factor 788ea84349SMasahide NAKAMURA at packet processing for developer. 798ea84349SMasahide NAKAMURA 808ea84349SMasahide NAKAMURA If unsure, say N. 818ea84349SMasahide NAKAMURA 82be013698SEric Biggers# This option selects XFRM_ALGO along with the AH authentication algorithms that 83be013698SEric Biggers# RFC 8221 lists as MUST be implemented. 847d4e3919SEric Biggersconfig XFRM_AH 857d4e3919SEric Biggers tristate 867d4e3919SEric Biggers select XFRM_ALGO 877d4e3919SEric Biggers select CRYPTO 887d4e3919SEric Biggers select CRYPTO_HMAC 89be013698SEric Biggers select CRYPTO_SHA256 907d4e3919SEric Biggers 91be013698SEric Biggers# This option selects XFRM_ALGO along with the ESP encryption and authentication 92be013698SEric Biggers# algorithms that RFC 8221 lists as MUST be implemented. 937d4e3919SEric Biggersconfig XFRM_ESP 947d4e3919SEric Biggers tristate 957d4e3919SEric Biggers select XFRM_ALGO 967d4e3919SEric Biggers select CRYPTO 97be013698SEric Biggers select CRYPTO_AES 987d4e3919SEric Biggers select CRYPTO_AUTHENC 997d4e3919SEric Biggers select CRYPTO_CBC 1007d4e3919SEric Biggers select CRYPTO_ECHAINIV 101be013698SEric Biggers select CRYPTO_GCM 102be013698SEric Biggers select CRYPTO_HMAC 10337ea0f18SEric Biggers select CRYPTO_SEQIV 104be013698SEric Biggers select CRYPTO_SHA256 1057d4e3919SEric Biggers 1066fccab67SHerbert Xuconfig XFRM_IPCOMP 1076fccab67SHerbert Xu tristate 1087e152524SJan Beulich select XFRM_ALGO 1096fccab67SHerbert Xu select CRYPTO 1106fccab67SHerbert Xu select CRYPTO_DEFLATE 1116fccab67SHerbert Xu 1126a2e9b73SSam Ravnborgconfig NET_KEY 1136a2e9b73SSam Ravnborg tristate "PF_KEY sockets" 1147e152524SJan Beulich select XFRM_ALGO 115a7f7f624SMasahiro Yamada help 1166a2e9b73SSam Ravnborg PF_KEYv2 socket family, compatible to KAME ones. 1176a2e9b73SSam Ravnborg They are required if you are going to use IPsec tools ported 1186a2e9b73SSam Ravnborg from KAME. 1196a2e9b73SSam Ravnborg 1206a2e9b73SSam Ravnborg Say Y unless you know what you are doing. 1216a2e9b73SSam Ravnborg 122f6ed0ec0SShinta Sugimotoconfig NET_KEY_MIGRATE 123f215bf48SKees Cook bool "PF_KEY MIGRATE" 124f215bf48SKees Cook depends on NET_KEY 125f6ed0ec0SShinta Sugimoto select XFRM_MIGRATE 126a7f7f624SMasahiro Yamada help 127f6ed0ec0SShinta Sugimoto Add a PF_KEY MIGRATE message to PF_KEYv2 socket family. 128f6ed0ec0SShinta Sugimoto The PF_KEY MIGRATE message is used to dynamically update 129f6ed0ec0SShinta Sugimoto locator(s) of a given IPsec security association. 130f6ed0ec0SShinta Sugimoto This feature is required, for instance, in a Mobile IPv6 131f6ed0ec0SShinta Sugimoto environment with IPsec configuration where mobile nodes 132f6ed0ec0SShinta Sugimoto change their attachment point to the Internet. Detail 133f6ed0ec0SShinta Sugimoto information can be found in the internet-draft 134f6ed0ec0SShinta Sugimoto <draft-sugimoto-mip6-pfkey-migrate>. 135f6ed0ec0SShinta Sugimoto 136f6ed0ec0SShinta Sugimoto If unsure, say N. 137e54d1527SFlorian Westphal 13826333c37SSabrina Dubrocaconfig XFRM_ESPINTCP 13926333c37SSabrina Dubroca bool 14026333c37SSabrina Dubroca 141e54d1527SFlorian Westphalendif # INET 142