linux-kernel - CONFIG_INET_{AH,ESP} say y if unsure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 30 Jan 2024 14:46:00 +0700
From: Bagas Sanjaya <bagasdotme@...il.com>
To: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Linux Networking <netdev@...r.kernel.org>
Cc: Steffen Klassert <steffen.klassert@...unet.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	"David S. Miller" <davem@...emloft.net>,
	David Ahern <dsahern@...nel.org>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Ma Ke <make_ruc2021@....com>, Deming Wang <wangdeming@...pur.com>,
	Kuniyuki Iwashima <kuniyu@...zon.com>, Wang Ming <machel@...o.com>,
	Eric Biggers <ebiggers@...gle.com>,
	Sabrina Dubroca <sd@...asysnail.net>
Subject: CONFIG_INET_{AH,ESP} say y if unsure - rationale?

Hi,

I stumbled upon CONFIG_INET_AH and CONFIG_INET_ESP every time I configure
my custom kernels. Kconfig description of each options says:

> Support for IPsec AH (Authentication Header).
> 
> AH can be used with various authentication algorithms.  Besides
> enabling AH support itself, this option enables the generic
> implementations of the algorithms that RFC 8221 lists as MUST be
> implemented.  If you need any other algorithms, you'll need to enable
> them in the crypto API.  You should also enable accelerated
> implementations of any needed algorithms when available.
> 
> If unsure, say Y.
 
> Support for IPsec ESP (Encapsulating Security Payload).
> 
> ESP can be used with various encryption and authentication algorithms.
> Besides enabling ESP support itself, this option enables the generic
> implementations of the algorithms that RFC 8221 lists as MUST be
> implemented.  If you need any other algorithms, you'll need to enable
> them in the crypto API.  You should also enable accelerated
> implementations of any needed algorithms when available.
> 
> If unsure, say Y.

Yet, distributions like Debian ([1]), Fedora ([2]), and Arch ([3]) instead
enable both options as module, but I followed the Kconfig recommendation
above.

I was wonder the rationale behind "say Y if unsure" for both
options, and whether `default Y` should be justified or not.

Thanks.

[1]: https://salsa.debian.org/kernel-team/linux/-/raw/master/debian/config/config?ref_type=heads
[2]: https://src.fedoraproject.org/rpms/kernel/raw/rawhide/f/kernel-x86_64-fedora.config
[3]: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/raw/main/config?ref_type=heads

-- 
An old man doll... just what I always wanted! - Clara

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)