[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ZbipOApntQMw8q0S@archie.me>
Date: Tue, 30 Jan 2024 14:46:00 +0700
From: Bagas Sanjaya <bagasdotme@...il.com>
To: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Linux Networking <netdev@...r.kernel.org>
Cc: Steffen Klassert <steffen.klassert@...unet.com>,
Herbert Xu <herbert@...dor.apana.org.au>,
"David S. Miller" <davem@...emloft.net>,
David Ahern <dsahern@...nel.org>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Ma Ke <make_ruc2021@....com>, Deming Wang <wangdeming@...pur.com>,
Kuniyuki Iwashima <kuniyu@...zon.com>, Wang Ming <machel@...o.com>,
Eric Biggers <ebiggers@...gle.com>,
Sabrina Dubroca <sd@...asysnail.net>
Subject: CONFIG_INET_{AH,ESP} say y if unsure - rationale?
Hi,
I stumbled upon CONFIG_INET_AH and CONFIG_INET_ESP every time I configure
my custom kernels. Kconfig description of each options says:
> Support for IPsec AH (Authentication Header).
>
> AH can be used with various authentication algorithms. Besides
> enabling AH support itself, this option enables the generic
> implementations of the algorithms that RFC 8221 lists as MUST be
> implemented. If you need any other algorithms, you'll need to enable
> them in the crypto API. You should also enable accelerated
> implementations of any needed algorithms when available.
>
> If unsure, say Y.
> Support for IPsec ESP (Encapsulating Security Payload).
>
> ESP can be used with various encryption and authentication algorithms.
> Besides enabling ESP support itself, this option enables the generic
> implementations of the algorithms that RFC 8221 lists as MUST be
> implemented. If you need any other algorithms, you'll need to enable
> them in the crypto API. You should also enable accelerated
> implementations of any needed algorithms when available.
>
> If unsure, say Y.
Yet, distributions like Debian ([1]), Fedora ([2]), and Arch ([3]) instead
enable both options as module, but I followed the Kconfig recommendation
above.
I was wonder the rationale behind "say Y if unsure" for both
options, and whether `default Y` should be justified or not.
Thanks.
[1]: https://salsa.debian.org/kernel-team/linux/-/raw/master/debian/config/config?ref_type=heads
[2]: https://src.fedoraproject.org/rpms/kernel/raw/rawhide/f/kernel-x86_64-fedora.config
[3]: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/raw/main/config?ref_type=heads
--
An old man doll... just what I always wanted! - Clara
Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)
Powered by blists - more mailing lists