Received-SPF: pass (google.com: domain of linux-kernel+bounces-44062-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Tue, 30 Jan 2024 14:46:00 +0700
From: Bagas Sanjaya <bagasdotme@gmail.com>
To: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Linux Networking <netdev@vger.kernel.org>
Cc: Steffen Klassert <steffen.klassert@secunet.com>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	"David S. Miller" <davem@davemloft.net>,
	David Ahern <dsahern@kernel.org>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Ma Ke <make_ruc2021@163.com>, Deming Wang <wangdeming@inspur.com>,
	Kuniyuki Iwashima <kuniyu@amazon.com>, Wang Ming <machel@vivo.com>,
	Eric Biggers <ebiggers@google.com>,
	Sabrina Dubroca <sd@queasysnail.net>
Subject: CONFIG_INET_{AH,ESP} say y if unsure - rationale?
Message-ID: <ZbipOApntQMw8q0S@archie.me>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="7zL6UcHUWgrAwMc6"
Content-Disposition: inline


--7zL6UcHUWgrAwMc6
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

I stumbled upon CONFIG_INET_AH and CONFIG_INET_ESP every time I configure
my custom kernels. Kconfig description of each options says:

> Support for IPsec AH (Authentication Header).
>=20
> AH can be used with various authentication algorithms.  Besides
> enabling AH support itself, this option enables the generic
> implementations of the algorithms that RFC 8221 lists as MUST be
> implemented.  If you need any other algorithms, you'll need to enable
> them in the crypto API.  You should also enable accelerated
> implementations of any needed algorithms when available.
>=20
> If unsure, say Y.
=20
> Support for IPsec ESP (Encapsulating Security Payload).
>=20
> ESP can be used with various encryption and authentication algorithms.
> Besides enabling ESP support itself, this option enables the generic
> implementations of the algorithms that RFC 8221 lists as MUST be
> implemented.  If you need any other algorithms, you'll need to enable
> them in the crypto API.  You should also enable accelerated
> implementations of any needed algorithms when available.
>=20
> If unsure, say Y.

Yet, distributions like Debian ([1]), Fedora ([2]), and Arch ([3]) instead
enable both options as module, but I followed the Kconfig recommendation
above.

I was wonder the rationale behind "say Y if unsure" for both
options, and whether `default Y` should be justified or not.

Thanks.

[1]: https://salsa.debian.org/kernel-team/linux/-/raw/master/debian/config/=
config?ref_type=3Dheads
[2]: https://src.fedoraproject.org/rpms/kernel/raw/rawhide/f/kernel-x86_64-=
fedora.config
[3]: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/raw/=
main/config?ref_type=3Dheads

--=20
An old man doll... just what I always wanted! - Clara

--7zL6UcHUWgrAwMc6
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQSSYQ6Cy7oyFNCHrUH2uYlJVVFOowUCZbipMwAKCRD2uYlJVVFO
o7bEAP47vu8LywxU4Q4VtItyckJTrKh/VznPmIw0wHdE0SkfcAEA4QZYjIFRSqAt
GLIgnj/wkkYth9LWWHkEe99fb3miXQs=
=S8O9
-----END PGP SIGNATURE-----

--7zL6UcHUWgrAwMc6--