AH transformation broken since 2.5.56
Quoted 6 lines
From: David S. Miller ([email protected])
Date: Thu Jan 23 2003 - 21:21:14 ESTFrom: Brice Goglin <[email protected]>
Date: Wed, 22 Jan 2003 14:31:07 +0100
Quoted 7 lines
Support for IPsec AH in
net/ipv4/ah.cis broken since 2.5.56(still broken in 2.5.59).
I tried withCONFIG_INET_AH=yand m, I got the same error :You have to enable
CONFIG_CRYPTO_HMACif you want to enableCONFIG_INET_AH
Ok, thanks.
I just saw that net/ipv4/Kconfig make CONFIG_INET_AH depend on CONFIG_CRYPTO_HMAC.
My problem was based on the fact that you can disable CONFIG_CRYPTO_HMAC by disabling CONFIG_CRYPTO. But this will not disable CONFIG_INET_AH.
Shouldn't there be a fix in dependencies between CONFIG_CRYPTO and CONFIG_CRYPTO_HMAC, or between CONFIG_INET_AH and CONFIG_CRYPTO ?
Regards
Brice Goglin
============
Ph.D Student
Laboratoire de l'Informatique du Parallélisme
ENS Lyon
France
From: Brice Goglin <[email protected]>
Date: Fri, 24 Jan 2003 11:05:30 +0100
My problem was based on the fact that you can disable CONFIG_CRYPTO_HMAC by disabling CONFIG_CRYPTO. But this will not disable CONFIG_INET_AH.
Shouldn't there be a fix in dependencies between CONFIG_CRYPTO and CONFIG_CRYPTO_HMAC, or between CONFIG_INET_AH and CONFIG_CRYPTO ?
If you override the defaults, the responsibility lands in your hands to do the right thing.
The only facility we have right now is to choose the defaults sensibly for you, and if you look at crypto/Kconfig we are doing exactly that. It checks there fore whether AH or ESP have been enabled, and chooses a default based upon that.
Also, CRYPTO selection comes after the ipsec choices. So the only thing we can do is make decisions based upon whether you've enabled AH or ESP not the other way around.
Whether there should be a way to FORCE config options on or off (instead of controlling the default) to avoid situations like this is a seperate topic.