77d2c7b99a
Provide the user-to-kernel translator under XFRM_USER_COMPAT, that creates for 32-bit xfrm-user message a 64-bit translation. The translation is afterwards reused by xfrm_user code just as if userspace had sent 64-bit message. Signed-off-by: Dmitry Safonov <dima@arista.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> (cherry picked from commit 5106f4a8acff480e244300bc5097c0ad7048c3a2) [adelva: nlmsg_parse_deprecated -> nlmsg_parse] Bug: 163141236 Signed-off-by: Alistair Delva <adelva@google.com> Change-Id: If15999b86e4704b75307fbcc3d7f0c8d8bc89e7a
110 lines
2.8 KiB
Text
110 lines
2.8 KiB
Text
#
|
|
# XFRM configuration
|
|
#
|
|
config XFRM
|
|
bool
|
|
depends on NET
|
|
select GRO_CELLS
|
|
|
|
config XFRM_OFFLOAD
|
|
bool
|
|
depends on XFRM
|
|
|
|
config XFRM_ALGO
|
|
tristate
|
|
select XFRM
|
|
select CRYPTO
|
|
select CRYPTO_HASH
|
|
select CRYPTO_BLKCIPHER
|
|
|
|
config XFRM_USER
|
|
tristate "Transformation user configuration interface"
|
|
depends on INET
|
|
select XFRM_ALGO
|
|
---help---
|
|
Support for Transformation(XFRM) user configuration interface
|
|
like IPsec used by native Linux tools.
|
|
|
|
If unsure, say Y.
|
|
|
|
config XFRM_USER_COMPAT
|
|
tristate "Compatible ABI support"
|
|
depends on XFRM_USER && COMPAT_FOR_U64_ALIGNMENT && \
|
|
HAVE_EFFICIENT_UNALIGNED_ACCESS
|
|
select WANT_COMPAT_NETLINK_MESSAGES
|
|
help
|
|
Transformation(XFRM) user configuration interface like IPsec
|
|
used by compatible Linux applications.
|
|
|
|
If unsure, say N.
|
|
|
|
config XFRM_INTERFACE
|
|
tristate "Transformation virtual interface"
|
|
depends on XFRM && IPV6
|
|
---help---
|
|
This provides a virtual interface to route IPsec traffic.
|
|
|
|
If unsure, say N.
|
|
|
|
config XFRM_SUB_POLICY
|
|
bool "Transformation sub policy support"
|
|
depends on XFRM
|
|
---help---
|
|
Support sub policy for developers. By using sub policy with main
|
|
one, two policies can be applied to the same packet at once.
|
|
Policy which lives shorter time in kernel should be a sub.
|
|
|
|
If unsure, say N.
|
|
|
|
config XFRM_MIGRATE
|
|
bool "Transformation migrate database"
|
|
depends on XFRM
|
|
---help---
|
|
A feature to update locator(s) of a given IPsec security
|
|
association dynamically. This feature is required, for
|
|
instance, in a Mobile IPv6 environment with IPsec configuration
|
|
where mobile nodes change their attachment point to the Internet.
|
|
|
|
If unsure, say N.
|
|
|
|
config XFRM_STATISTICS
|
|
bool "Transformation statistics"
|
|
depends on INET && XFRM && PROC_FS
|
|
---help---
|
|
This statistics is not a SNMP/MIB specification but shows
|
|
statistics about transformation error (or almost error) factor
|
|
at packet processing for developer.
|
|
|
|
If unsure, say N.
|
|
|
|
config XFRM_IPCOMP
|
|
tristate
|
|
select XFRM_ALGO
|
|
select CRYPTO
|
|
select CRYPTO_DEFLATE
|
|
|
|
config NET_KEY
|
|
tristate "PF_KEY sockets"
|
|
select XFRM_ALGO
|
|
---help---
|
|
PF_KEYv2 socket family, compatible to KAME ones.
|
|
They are required if you are going to use IPsec tools ported
|
|
from KAME.
|
|
|
|
Say Y unless you know what you are doing.
|
|
|
|
config NET_KEY_MIGRATE
|
|
bool "PF_KEY MIGRATE"
|
|
depends on NET_KEY
|
|
select XFRM_MIGRATE
|
|
---help---
|
|
Add a PF_KEY MIGRATE message to PF_KEYv2 socket family.
|
|
The PF_KEY MIGRATE message is used to dynamically update
|
|
locator(s) of a given IPsec security association.
|
|
This feature is required, for instance, in a Mobile IPv6
|
|
environment with IPsec configuration where mobile nodes
|
|
change their attachment point to the Internet. Detail
|
|
information can be found in the internet-draft
|
|
<draft-sugimoto-mip6-pfkey-migrate>.
|
|
|
|
If unsure, say N.
|