1# SPDX-License-Identifier: GPL-2.0-only 2# 3# XFRM configuration 4# 5config XFRM 6 bool 7 depends on INET 8 select GRO_CELLS 9 select SKB_EXTENSIONS 10 11config XFRM_OFFLOAD 12 bool 13 14config XFRM_ALGO 15 tristate 16 select XFRM 17 select CRYPTO 18 select CRYPTO_AEAD 19 select CRYPTO_HASH 20 select CRYPTO_SKCIPHER 21 22if INET 23config XFRM_USER 24 tristate "Transformation user configuration interface" 25 select XFRM_ALGO 26 help 27 Support for Transformation(XFRM) user configuration interface 28 like IPsec used by native Linux tools. 29 30 If unsure, say Y. 31 32config XFRM_USER_COMPAT 33 tristate "Compatible ABI support" 34 depends on XFRM_USER && COMPAT_FOR_U64_ALIGNMENT && \ 35 HAVE_EFFICIENT_UNALIGNED_ACCESS 36 select WANT_COMPAT_NETLINK_MESSAGES 37 help 38 Transformation(XFRM) user configuration interface like IPsec 39 used by compatible Linux applications. 40 41 If unsure, say N. 42 43config XFRM_INTERFACE 44 tristate "Transformation virtual interface" 45 depends on XFRM && IPV6 46 help 47 This provides a virtual interface to route IPsec traffic. 48 49 If unsure, say N. 50 51config XFRM_SUB_POLICY 52 bool "Transformation sub policy support" 53 depends on XFRM 54 help 55 Support sub policy for developers. By using sub policy with main 56 one, two policies can be applied to the same packet at once. 57 Policy which lives shorter time in kernel should be a sub. 58 59 If unsure, say N. 60 61config XFRM_MIGRATE 62 bool "Transformation migrate database" 63 depends on XFRM 64 help 65 A feature to update locator(s) of a given IPsec security 66 association dynamically. This feature is required, for 67 instance, in a Mobile IPv6 environment with IPsec configuration 68 where mobile nodes change their attachment point to the Internet. 69 70 If unsure, say N. 71 72config XFRM_STATISTICS 73 bool "Transformation statistics" 74 depends on XFRM && PROC_FS 75 help 76 This statistics is not a SNMP/MIB specification but shows 77 statistics about transformation error (or almost error) factor 78 at packet processing for developer. 79 80 If unsure, say N. 81 82# This option selects XFRM_ALGO along with the AH authentication algorithms that 83# RFC 8221 lists as MUST be implemented. 84config XFRM_AH 85 tristate 86 select XFRM_ALGO 87 select CRYPTO 88 select CRYPTO_HMAC 89 select CRYPTO_SHA256 90 91# This option selects XFRM_ALGO along with the ESP encryption and authentication 92# algorithms that RFC 8221 lists as MUST be implemented. 93config XFRM_ESP 94 tristate 95 select XFRM_ALGO 96 select CRYPTO 97 select CRYPTO_AES 98 select CRYPTO_AUTHENC 99 select CRYPTO_CBC 100 select CRYPTO_ECHAINIV 101 select CRYPTO_GCM 102 select CRYPTO_HMAC 103 select CRYPTO_SEQIV 104 select CRYPTO_SHA256 105 106config XFRM_IPCOMP 107 tristate 108 select XFRM_ALGO 109 select CRYPTO 110 select CRYPTO_DEFLATE 111 112config NET_KEY 113 tristate "PF_KEY sockets (deprecated)" 114 select XFRM_ALGO 115 help 116 PF_KEYv2 socket family, compatible to KAME ones. 117 118 The PF_KEYv2 socket interface is deprecated and 119 scheduled for removal. All maintained IKE daemons 120 no longer need PF_KEY sockets. Please use the netlink 121 interface (XFRM_USER) to configure IPsec. 122 123 If unsure, say N. 124 125config NET_KEY_MIGRATE 126 bool "PF_KEY MIGRATE" 127 depends on NET_KEY 128 select XFRM_MIGRATE 129 help 130 Add a PF_KEY MIGRATE message to PF_KEYv2 socket family. 131 The PF_KEY MIGRATE message is used to dynamically update 132 locator(s) of a given IPsec security association. 133 This feature is required, for instance, in a Mobile IPv6 134 environment with IPsec configuration where mobile nodes 135 change their attachment point to the Internet. Detail 136 information can be found in the internet-draft 137 <draft-sugimoto-mip6-pfkey-migrate>. 138 139 If unsure, say N. 140 141config XFRM_IPTFS 142 tristate "IPsec IP-TFS/AGGFRAG (RFC 9347) encapsulation support" 143 depends on XFRM 144 help 145 Information on the IP-TFS/AGGFRAG encapsulation can be found 146 in RFC 9347. This feature supports demand driven (i.e., 147 non-constant send rate) IP-TFS to take advantage of the 148 AGGFRAG ESP payload encapsulation. This payload type 149 supports aggregation and fragmentation of the inner IP 150 packet stream which in turn yields higher small-packet 151 bandwidth as well as reducing MTU/PMTU issues. Congestion 152 control is unimplementated as the send rate is demand driven 153 rather than constant. 154 155 If unsure, say N. 156 157config XFRM_ESPINTCP 158 bool 159 160endif # INET 161