netdev - Re: CONFIG_NET_KEY defaults to N

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20080722.161848.20826100.davem@davemloft.net>
Date:	Tue, 22 Jul 2008 16:18:48 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	vegard.nossum@...il.com
Cc:	netdev@...r.kernel.org
Subject: Re: CONFIG_NET_KEY defaults to N

From: "Vegard Nossum" <vegard.nossum@...il.com>
Date: Tue, 22 Jul 2008 18:52:14 +0200

> Hi,
> 
> There's one thing I keep wondering about:
> 
> CONFIG_NET_KEY has this help text:
> 
>   │ PF_KEYv2 socket family, compatible to KAME ones.
>   │ They are required if you are going to use IPsec tools ported
>   │ from KAME.
>   │
>   │ Say Y unless you know what you are doing.
> 
> It defaults to N, however.
> 
> Which one is wrong, the help-text or the default? Should it be changed?

We'd like it to default to 'y' but only if the user has turned
on IPSEC via XFRM already.

Unfortunately, we can't do that so easily here because we
always present this option and it simply selects XFRM if you
enable it.

The help text isn't accurate either.  You currently need
NET_KEY even for openswan because we (still) lack a way to
probe the algorithm lists with netlink alone.