mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-12-27 10:01:39 -05:00
Code Issues Packages Projects Releases Wiki Activity

pfkey: Deprecate pfkey

Browse Source 
The pfkey user configuration interface was replaced by the netlink
user configuration interface more than a decade ago. In between
all maintained IKE implementations moved to the netlink interface.
So let config NET_KEY default to no in Kconfig. The pfkey code
will be removed in a second step.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Antony Antony <antony.antony@secunet.com>
Acked-by: Tobias Brunner <tobias@strongswan.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Tuomo Soini <tis@foobar.fi>
Acked-by: Paul Wouters <paul@nohats.ca>
This commit is contained in:
Steffen Klassert
2025-10-28 07:29:09 +01:00
parent 7197e080de
commit 6b3b6e59c4
2 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
net/key/af_key.c
View File

@@ -3903,6 +3903,8 @@ static int __init ipsec_pfkey_init(void)
{ {
int err = proto_register(&key_proto, 0); int err = proto_register(&key_proto, 0);
pr_warn_once("PFKEY is deprecated and scheduled to be removed in 2027, "
"please contact the netdev mailing list\n");
if (err != 0) if (err != 0)
goto out; goto out;

11
net/xfrm/Kconfig
View File

@@ -110,14 +110,17 @@ config XFRM_IPCOMP
select CRYPTO_DEFLATE select CRYPTO_DEFLATE
config NET_KEY config NET_KEY
tristate "PF_KEY sockets" tristate "PF_KEY sockets (deprecated)"
select XFRM_ALGO select XFRM_ALGO
help help
PF_KEYv2 socket family, compatible to KAME ones. PF_KEYv2 socket family, compatible to KAME ones.
They are required if you are going to use IPsec tools ported
from KAME.
Say Y unless you know what you are doing. The PF_KEYv2 socket interface is deprecated and
scheduled for removal. All maintained IKE daemons
no longer need PF_KEY sockets. Please use the netlink
interface (XFRM_USER) to configure IPsec.
If unsure, say N.
config NET_KEY_MIGRATE config NET_KEY_MIGRATE
bool "PF_KEY MIGRATE" bool "PF_KEY MIGRATE"