==============================================================
How to Configure Linux-2.4.X USAGI kernel

$USAGI: CONFIG.linux24,v 1.13 2002/09/28 15:58:37 sekiya Exp $
==============================================================

  **CAUTION**

   On most linux distributions, the maintainers apply many unofficial
   patches against the original linux kernel for their products. 
   USAGI patches don't include such the patches. It includes only our
   improvements, so you may get some troubles if you build a kernel
   applying only the usagi patch.

   To eliminate this (possible) issue, we provide binary packges basen on 
   our stable releases. If you want to build your kernel from original
   kernel source, you have better to apply distribution-oriented patches
   before applying the USAGI patch. 

   The binary packages are found at 
   <ftp://ftp.linux-ipv6.org/pub/usagi/stable/package/>.


---------------------------------------------------
Customizing the linux-2.4 kernerl with USAGI patch
---------------------------------------------------
We reccomend to configure kernel options as follows.

  Code maturity level options  ---> 
   [*] Prompt for development and/or incomplete code/drivers  

	+ Enabling the option, you can use experimental features
	  including IPv6. Say Y.

  
  Networking options  --->
   [*]   Restrict SO_REUSEADDR only for same user
     *CONFIG_NET_RESTRICTED_REUSE

	+ With this option, kernel restrict effect of SO_REUSEADDR to prevent 
	  other users from performing 'binding closer' type attacks like NFS 
	  theft.  Say Y.

   [ ]   The IPsec protocol (EXPERIMENTAL)
     *CONFIG_IPSEC

	+ You can say Y here if you want to enable IPsec.
	  This options enable PF_KEY(V2), Security Association Database and
	  Security Policy Database.

	  And also you must enable each IP version IPsec.

   [ ]    IPsec: IPsec Debug messages
     *CONFIG_IPSEC_DEBUG

	+ You can say Y here if you want to get additional messages useful in
	  debugging the IPsec(IPsec6,PFKEY,SADB,SPD) code.

	  You can enable/disable these parameters via sysctl(/proc/net/ipsec/).

   [ ]    IPsec: IPsec Debug Disable Default
     *CONFIG_IPSEC_DEBUG_DISABLE_DEFAULT

	+ Normally IPsec debugging messages are activated by default,
	  if you set CONFIG_IPSEC_DEBUG.

	  If you say Y here, it'll change this to off by default(boot time).
	  NOTICE: If you don't say Y here, you will receive tons of log messages.

   <*>	 Crypto: Cryptography Support (Crypto API)
     *CONFIG_CRYPTO

	+ If you say Y to this option, the cryptographic kernel API
	  framework will be enabled, and you'll be presented with additional
	  questions about cryptographic algorithms and kernel components
	  making use of the cryptographic API.
	
	  If you want to use IPsec, Say Y.

   <*>   Crypto: Crypto Ciphers Support
     *CONFIG_CIPHERS

	+ Ciphers basically help us scramble data so that other people don't
	  get access to it. Useful applications for this include hiding hard
	  drive contents or network traffic from unauthorized eyes. Compare a
	  file encrypted with a cipher with very good safe: The document is in
	  it, you can carry the document with you (if the safe is not too
	  heavy), but others can steal it, too. However, they will not be able
	  to read the document if the safe is any good.

	  Mathematically speaking, a cipher is a parameter-dependant function
	  E(K, ) that takes a fixed-length block M (usually 64 or 128 bits)
	  and maps it onto another (usually equal-sized) block C=E(K,M) in such
	  a way that, without knowledge of the "key" K, it is hard to compute

	  1. M, if C and the function E are given,

	  2. C, if M is given and the function E is known.

	  M is called the 'plaintext' and C the 'ciphertext'. The above
	  properties are commonly described as "All the security of the cipher
	  lies in its key". However, there always exists the inverse function
	  D(K, ) of E(K, ) such that D(K,E(K,M))=M for any M.  The ideal
	  cipher is one where it is impossible to compute M if you have C, but
	  not K. In this case, the easiest way to break the cipher is to use
	  'brute-force', i.e. try all K in turn until you hit the right
	  one. With most ciphers in this library, K is a 128-bit number. Here,
	  brute-force attacks are infeasible since they require testing all
	  2^128 possible keys K, which would take far too long on any
	  conceivable computer (some big multiple of the age of the universe
	  for example).

	  Unfortunately, the ideal cipher has not been found yet, so most
	  ciphers in this library, or certain 'reduced-round' versions
	  thereof, can be broken faster than brute-force. A cipher is secure,
	  if it cannot be broken _much_ faster than brute-force and
	  brute-force is infeasible.

	  If you say 'Y' or 'M' here, you are able to select a variety of
	  ciphers for the Cipher-API. Ciphers you select below can then be
	  used by cryptographic kernel modules. If you say 'N' here, those
	  modules will use their own implementations or even not work at all.

	  If you want to use IPsec, Say Y.

   <*>    Crypto: AES (aka Rijndeal) Cipher Support
     *CONFIG_CIPHER_AES

	+ If you answer yes to this option, the Rijndael cipher will be
	  compiled into your kernel.  Rijndael was submitted to the AES(Advanced
	  Encryption Standard) cipher competition and won, becoming the AES sta-
	  ndard.  It supports key sizes of 128, 192, and 256 bits which executes
	  10, 12, and 14 rounds respectively.
	  This cipher is freely available for anyone to use.  And the CryptoAPI 
	  implementation is under a BSD-style license of unrestricted, free use.

	  This driver is also available as a module ( = code which can be
	  inserted in and removed from the running kernel whenever you want).
	  The module will be called cipher-aes.o. If you want to compile it as a
	  module, say M here and read <file:Documentation/modules.txt>.

   <*>    Crypto: DES Cipher Support
     *CONFIG_CIPHER_DES

	+ If you answer yes to this option the DES(Data Encryption Standard)
	  cipher will be compiled into your kernel.  This cipher was designed
	  by IBM and the NSA based on the Lucifer cipher designed by IBM.  
	  It supports a 56-bit key size and is a 16 round cipher.
	  It should be noted that DES has a keylength of only 56 bits, which
	  is insufficient to provide real security today.
	  The DES algorithm has no restrictions on its use.  The CryptoAPI impl-
	  ementation of DES is released under the GPL.

	  This driver is also available as a module ( = code which can be
	  inserted in and removed from the running kernel whenever you want).
	  The module will be called cipher-des.o. If you want to compile it as a
	  module, say M here and read <file:Documentation/modules.txt>.

   <*>    Crypto: 3DES Cipher Support
     *CONFIG_CIPHER_DES_EDE3

	+ If you answer yes to this option the 3DES cipher will be compiled into
	  your kernel.  This cipher is a modification of the DES algorithm which
	  increases the effective keysize to 112-bits.  Instead of using one 56-
	  bit key(DES) you can use either 2 or 3 56-bit keys.
	  If E(K) is the original DES algorithm then 3DES is:
	      E(K1)->D(K2)->E(K3)
	      or with 2 keys
	      E(K1)->D(K2)->E(K1)
	  Where K1 != K2 != K3 or K1 != K2.  3DES is 3x slower than DES.
	  If K1 = K2 = K3 this breaks down to normal DES with 3x the runtime.
	  The CryptoAPI implementation of 3DES is released under the GPL.

	  This driver is also available as a module ( = code which can be
	  inserted in and removed from the running kernel whenever you want).
	  The module will be called cipher-des_ede3.o. If you want to compile it
	  as a module, say M here and read <file:Documentation/modules.txt>.

   <*>    Crypto: Dummy Cipher Support
     *CONFIG_CIPHER_DUMMY

	+ If you answer yes to this option the DUMMY cipher will be compiled into
	  your kernel.  This is a template for a new cipher to be implemented.
	  It currently does no encryption.
	
	  This driver is also available as a module ( = code which can be
	  inserted in and removed from the running kernel whenever you want).
	  The module will be called cipher-dummy.o. If you want to compile it as
	  a module, say M here and read <file:Documentation/modules.txt>.

   <*>    Crypto: NULL Cipher Support
     *CONFIG_CIPHER_NULL

	+ If you answer yes to this option the NULL cipher will be compiled into
	  your kernel.  This may be useful only for IPsec ESP NULL Encryption mode
	  (IPsec ESP Authentication only).
	  It does no encryption.

	  This driver is also available as a module ( = code which can be
	  inserted in and removed from the running kernel whenever you want).
	  The module will be called cipher-null.o. If you want to compile it as
	  a module, say M here and read <file:Documentation/modules.txt>.

   <*>   Crypto: Digest Algorithms Support
     *CONFIG_DIGESTS

	+ A message digest (or 'one-way function' or 'hash') is a function H
	  that maps an arbitrary-length message M onto a 128-bit or 160-bit
	  number h=H(M) such that the following conditions are satisfied:

	  1. For a given M, it is easy to compute h=H(M).

	  2. For a given h, it is hard to find M such that h=H(M).

	  3. For a given M, it is hard to find another message M' such that
	     H(M')=H(M).

	  4. It is hard to find M, M' such that H(M)=H(M').

	  This makes the name 'one-way function' plausible. Hashes are widely
	  used by cryptographic programs. E.g. the Linux kernel uses a hash to
	  generate random numbers.

	  If you say 'Y' or 'M' here, cryptographic modules are able to use
	  the Digest-API if they need a hash function. If you say 'N' here,
	  they will use their own implementations (which will probably
	  increase the size of the compiled kernel if there are more than one
	  such modules).

	  If you want to use IPsec, Say Y.

   <*>    Crypto: MD5 Digest Support
     *CONFIG_DIGEST_MD5

	+ If you answer yes to this option, the MD5(Message Digest 5) digest 
	  will be compiled into your kernel.  MD5 is an improved version of MD4
	  designed by Ron Rivest, it produces a 128-bit "hash value" from an in-
	  put of arbitrary length.
	  There are no restrictions on the use of the MD5 algorithm.  The Crypto-
	  API implementation of MD5 is released under the GPL.
	  
	  See also <http://www.faqs.org/rfcs/rfc1321.html>
	  
	  This driver is also available as a module ( = code which can be
	  inserted in and removed from the running kernel whenever you want).
	  The module will be called digest-md5.o. If you want to compile it as a
	  module, say M here and read <file:Documentation/modules.txt>.

   <*>    Crypto: SHA1 Digest Support
     *CONFIG_DIGEST_SHA1

	+ If you answer yes to this option the SHA1(Secure Hash Algorithm 1) will
	  be compiled into your kernel.  SHA1 was designed with NIST and the NSA
	  for use with the Digital Signature Standard.  It produces a 160-bit 
	  hash value from an input or arbitrary length.
	  There are no restrictions on the use of the SHA1 algorithm.  The 
	  CryptoAPI implementation of SHA1 is released under the GPL.
	  
	  See also <http://www.w3.org/PICS/DSig/SHA1_1_0.html>
	  
	  This driver is also available as a module ( = code which can be
	  inserted in and removed from the running kernel whenever you want).
	  The module will be called digest-sha1.o. If you want to compile it as a
	  module, say M here and read <file:Documentation/modules.txt>.

   <*>   Crypto: Crypto Device Support
     *CONFIG_CRYPTODEV
	+ With this option crypto devices are available. The devices provides
	  crypto functions.

   <*>    Crypto: Loop Crypto Device Support
     *CONFIG_CRYPTOLOOP

	+ If you say Y to this option, the loop driver will be able to
	  use all cryptographic ciphers selected.

	  This loop filter will use the ciphers in CBC-mode which is more
	  secure than ECB-mode.  This module will also initialize the CBC-mode
	  of the cipher with the block-number of the block being encrypted.

   <*>   The IPv6 protocol (EXPERIMENTAL)
     *CONFIG_IPV6

	+ Say Y. In order to avoid some troubles, we recommend to build
	  IPv6 protocol stack as a build-in function. Of course you can
	  build it as a module. It's up to you.

   [ ]     IPv6: Verbose debugging messages
     *CONFIG_IPV6_DEBUG

	+ Debugging option. It makes a lot of debug messages. It's only
	  for debugging purpose. If you want to track some behaviours of
	  IPv6 protocol stack, you can enable the option, otherwise
	  say N.

   [*]     IPv6: drop packets with fake ipv4-mapped address(es)  
     *CONFIG_IPV6_DROP_FAKE_V4MAPPED

	+ We reccomend to enable the option from security point of
	  view. Enabling the option, the linux kernel drops the
	  IPv6 packets which destination or source addresses are
	  IPv4-mapped IPv6 addresses. Say Y.

   [*]	   IPv6: Restrict "double binding" only for same user
     *CONFIG_IPV6_RESTRICTED_DOUBLE_BIND

	+ With this option, kernel doesn't allow bind the same port 
	  number of socket which already binded by other user with
	  other protocol.  For example, If user A binds #8000 port with
	  IPv6 protocol kernel doesn't allow to bind #8000 port with IPv4
	  protocol other than user A. For security reason, we recommend
	  say Y.

   [ ]	   IPv6: 6to4-address in nexthop support
     *CONFIG_IPV6_6TO4_NEXTHOP

	+ If you want to use 6to4 transition mechanism which is defined by
	  RFC2529, Say Y. It configures dynamic IPv6 over IPv4 tunnel 
	  according to 6to4 addresses which are registerd in DNS.
	  If unsure, Say N.

   [ ]     IPv6: Privacy Extensions (RFC 3041) Support
     *CONFIG_IPV6_PRIVACY

	+ Privacy Extensions for Stateless Address Autoconfiguration in IPv6
	  support.  With this option, additional periodically-alter 
	  pseudo-random global-scope unicast address(es) will assigned to
	  your interface(s).  At this moment, automatic source address
	  selection won't choose temporary address, so this option is 
	  only for testing purposes.

   [ ]    IPv6: anycast support
     *CONFIG_IPV6_ANYCAST

	+ Supporting anycast address in kernel. Say N.

   [ ]     IPv6: ISATAP interface support (EXPERIMENTAL)   
     *CONFIG_IPV6_ISATAP

	+ Intra-Site Automatic Tunnel Addressing Protocol Support. It
	  is a transition mechanism for Intra-Site network which doesn't
	  support native IPv6 protocol. Using dynamic IPv6 over IPv4 
	  tunneling, hosts can communicate via IPv6 in Intra-Site.
	  If unsure, Say N.

   [ ]     IPv6: Neighbor Discovery debugging       
     *CONFIG_IPV6_NDISC_DEBUG

	+ Debugging option, the kernel outputs verbose debugging
	  messages regarding Neighbour Discovery Protocol. Say N.

   [ ]     IPv6: Address Autoconfigration debugging
     *CONFIG_IPV6_ACONF_DEBUG

	+ Debugging option. the kernel outputs verbose debugging
	  messages regarding Stateless Auto Address Configuration.
	  Say N.

   [ ]      IPv6: Debug on source address selection
     *CONFIG_IPV6_ACONF_DEBUG_SADDR

	+ Debugging option, the kernel outputs verbose debugging
	  messages regarding Source Address Selection Algorithm.
	  Say N.

   [ ]     IPv6: Routing Informtation debugging
     *CONFIG_IPV6_RT6_DEBUG

	+ Debugging option. the kernel outputs verbose debugging
	  messages regarding IPv6 Routing Informations. Say N.

   [*]     IPv6: allow default route when forwarding is enabled
     *CONFIG_IPV6_EN_DFLT

	+ The original linux kernel doesn't recognize IPv6 default
	  routes when IPv6 forwarding is enabled. Enabling the option,
	  a kernel recognize IPv6 default routes as default routes
	  and forwards packets toward default router. 
	  If you want to use a Linux box as an IPv6 router, Say Y.

   [ ]     IPv6: Multicast Listener Discovery debugging
     *CONFIG_IPV6_MLD6_DEBUG

	+ Debugging option. the kernel outputs verbose debugging
	  messages regarding Multicast Listener Discovery messages.
	  Say N.

   [ ]     IPv6: Do not suppress MLD6 Done message
     *CONFIG_IPV6_MLD6_NO_SUPPRESS_DONE

	+ Enabling the option, the kernel sends MLD6(Multicast Listener
	  Discovery Protocol, defined in RFC2710) done message when
	  your linux box leaves a multicast group. Say N.

   [ ]     IPv6: enable Node Information Queries
     *CONFIG_IPV6_NODEINFO

	+ Enabling the ICMP name lookup feature which described in
	  <draft-ietf-ipngwg-icmp-name-lookups-07>. Enabling the option,
	  your linux box answers its host name or its ipv6/4 address(es)
	  in reply to a Node Information Query.  The information is
	  useful for administration, but it may also cause information
	  flaws.  if unsure, say N.

   [ ]       IPv6: Node Information Queries debugging
     *CONFIG_IPV6_NODEINFO_DEBUG

	+ Debugging option. The kernel outputs verbose debugging messages
	  regarding ICMPv6 node-info queries. Say N.

   [ ]       IPv6: regard NIS domain as DNS domain
     *CONFIG_IPV6_NODEINFO_USE_UTS_DOMAIN

	+ The kernel replies a NIS domain name as a domain name of
	  ICMP name reply. If unsure, say N.

   [ ]     IPv6: IP Security Support (EXPERIMENTAL)
     *CONFIG_IPV6_IPSEC

	+  In the specification of IPv6, IPsec support is mandatory.
	   For further information, please read README.USAGI-IPSEC under doc
	   directory.

	   At this moment, IPsec for IPv6 support is not so stable and 
	   only for testing puposes.  If unsure, say 'N'.

     	   NOTICE!: 
	        USAGI IPsec(IPv6) stack and FreeS/WAN IPsec(IPv4) stack are
	        currently NOT compatible.
	   If you want to try to compile it,
	   please read the usagi/doc/HOWTO/IPSEC

   [ ]     IPv6 Apply IPsec to ICMPv6 packets
     *CONFIG_APPLY_ICMPV6_IPSEC

	+  You can say Y here if you want to apply IPsec to ICMPv6 packets.

	   NOTICE:
	      currently we can't apply to NDISC packets(NA or RA receiving).

   [ ]     IPv6: Mobility Support
     *CONFIG_IPV6_MOBILITY

	+ Support for the upcoming specification of Mobile IPv6.
	  Currently Mobile IPv6 support is available only as a module.
	  For more information and configuration details, see
	  http://www.mipl.mediapoli.com/.
	  If unsure, say N.

   < >     Kernel httpd acceleration (EXPERIMENTAL)
   [ ]       Use IPv6 socket for khttpd

     *CONFIG_KHTTPD_IPV6
	+ Enabling kernel httpd acceleration which is capable for IPv6.
	  For more details of khttpd, please see a help message of IPv4
	  Kernel httpd acceleration.

   [ ]     IPv6 Enhance for ATM
     *CONFIG_ATM_IPV6

	+ IPv6 support on a PVC link. To install and for usage, please refer
	  usagi/doc/HOWTO/ATM. If unsure, say N.
