1 # SPDX-License-Identifier: GPL-2.0-only 1 # SPDX-License-Identifier: GPL-2.0-only
2 config SUNRPC 2 config SUNRPC
3 tristate 3 tristate
4 depends on MULTIUSER 4 depends on MULTIUSER
5 5
6 config SUNRPC_GSS 6 config SUNRPC_GSS
7 tristate 7 tristate
8 select OID_REGISTRY 8 select OID_REGISTRY
9 depends on MULTIUSER 9 depends on MULTIUSER
10 10
11 config SUNRPC_BACKCHANNEL 11 config SUNRPC_BACKCHANNEL
12 bool 12 bool
13 depends on SUNRPC 13 depends on SUNRPC
14 14
15 config SUNRPC_SWAP 15 config SUNRPC_SWAP
16 bool 16 bool
17 depends on SUNRPC 17 depends on SUNRPC
18 18
19 config RPCSEC_GSS_KRB5 19 config RPCSEC_GSS_KRB5
20 tristate "Secure RPC: Kerberos V mecha 20 tristate "Secure RPC: Kerberos V mechanism"
21 depends on SUNRPC && CRYPTO 21 depends on SUNRPC && CRYPTO
22 default y 22 default y
23 select SUNRPC_GSS 23 select SUNRPC_GSS
24 select CRYPTO_SKCIPHER 24 select CRYPTO_SKCIPHER
25 select CRYPTO_HASH 25 select CRYPTO_HASH
26 help 26 help
27 Choose Y here to enable Secure RPC u 27 Choose Y here to enable Secure RPC using the Kerberos version 5
28 GSS-API mechanism (RFC 1964). 28 GSS-API mechanism (RFC 1964).
29 29
30 Secure RPC calls with Kerberos requi 30 Secure RPC calls with Kerberos require an auxiliary user-space
31 daemon which may be found in the Lin 31 daemon which may be found in the Linux nfs-utils package
32 available from http://linux-nfs.org/ 32 available from http://linux-nfs.org/. In addition, user-space
33 Kerberos support should be installed 33 Kerberos support should be installed.
34 34
35 If unsure, say Y. 35 If unsure, say Y.
36 36
>> 37 config RPCSEC_GSS_KRB5_SIMPLIFIED
>> 38 bool
>> 39 depends on RPCSEC_GSS_KRB5
>> 40
>> 41 config RPCSEC_GSS_KRB5_CRYPTOSYSTEM
>> 42 bool
>> 43 depends on RPCSEC_GSS_KRB5
>> 44
>> 45 config RPCSEC_GSS_KRB5_ENCTYPES_DES
>> 46 bool "Enable Kerberos enctypes based on DES (deprecated)"
>> 47 depends on RPCSEC_GSS_KRB5
>> 48 depends on CRYPTO_CBC && CRYPTO_CTS && CRYPTO_ECB
>> 49 depends on CRYPTO_HMAC && CRYPTO_MD5 && CRYPTO_SHA1
>> 50 depends on CRYPTO_DES
>> 51 default n
>> 52 select RPCSEC_GSS_KRB5_SIMPLIFIED
>> 53 help
>> 54 Choose Y to enable the use of deprecated Kerberos 5
>> 55 encryption types that utilize Data Encryption Standard
>> 56 (DES) based ciphers. These include des-cbc-md5,
>> 57 des-cbc-crc, and des-cbc-md4, which were deprecated by
>> 58 RFC 6649, and des3-cbc-sha1, which was deprecated by RFC
>> 59 8429.
>> 60
>> 61 These encryption types are known to be insecure, therefore
>> 62 the default setting of this option is N. Support for these
>> 63 encryption types is available only for compatibility with
>> 64 legacy NFS client and server implementations.
>> 65
>> 66 Removal of support is planned for a subsequent kernel
>> 67 release.
>> 68
37 config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1 69 config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1
38 bool "Enable Kerberos enctypes based o 70 bool "Enable Kerberos enctypes based on AES and SHA-1"
39 depends on RPCSEC_GSS_KRB5 71 depends on RPCSEC_GSS_KRB5
40 depends on CRYPTO_CBC && CRYPTO_CTS 72 depends on CRYPTO_CBC && CRYPTO_CTS
41 depends on CRYPTO_HMAC && CRYPTO_SHA1 73 depends on CRYPTO_HMAC && CRYPTO_SHA1
42 depends on CRYPTO_AES 74 depends on CRYPTO_AES
43 default y 75 default y
>> 76 select RPCSEC_GSS_KRB5_CRYPTOSYSTEM
44 help 77 help
45 Choose Y to enable the use of Kerber 78 Choose Y to enable the use of Kerberos 5 encryption types
46 that utilize Advanced Encryption Sta 79 that utilize Advanced Encryption Standard (AES) ciphers and
47 SHA-1 digests. These include aes128- 80 SHA-1 digests. These include aes128-cts-hmac-sha1-96 and
48 aes256-cts-hmac-sha1-96. 81 aes256-cts-hmac-sha1-96.
49 82
50 config RPCSEC_GSS_KRB5_ENCTYPES_CAMELLIA 83 config RPCSEC_GSS_KRB5_ENCTYPES_CAMELLIA
51 bool "Enable Kerberos encryption types 84 bool "Enable Kerberos encryption types based on Camellia and CMAC"
52 depends on RPCSEC_GSS_KRB5 85 depends on RPCSEC_GSS_KRB5
53 depends on CRYPTO_CBC && CRYPTO_CTS && 86 depends on CRYPTO_CBC && CRYPTO_CTS && CRYPTO_CAMELLIA
54 depends on CRYPTO_CMAC 87 depends on CRYPTO_CMAC
55 default n 88 default n
>> 89 select RPCSEC_GSS_KRB5_CRYPTOSYSTEM
56 help 90 help
57 Choose Y to enable the use of Kerber 91 Choose Y to enable the use of Kerberos 5 encryption types
58 that utilize Camellia ciphers (RFC 3 92 that utilize Camellia ciphers (RFC 3713) and CMAC digests
59 (NIST Special Publication 800-38B). 93 (NIST Special Publication 800-38B). These include
60 camellia128-cts-cmac and camellia256 94 camellia128-cts-cmac and camellia256-cts-cmac.
61 95
62 config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2 96 config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2
63 bool "Enable Kerberos enctypes based o 97 bool "Enable Kerberos enctypes based on AES and SHA-2"
64 depends on RPCSEC_GSS_KRB5 98 depends on RPCSEC_GSS_KRB5
65 depends on CRYPTO_CBC && CRYPTO_CTS 99 depends on CRYPTO_CBC && CRYPTO_CTS
66 depends on CRYPTO_HMAC && CRYPTO_SHA25 100 depends on CRYPTO_HMAC && CRYPTO_SHA256 && CRYPTO_SHA512
67 depends on CRYPTO_AES 101 depends on CRYPTO_AES
68 default n 102 default n
>> 103 select RPCSEC_GSS_KRB5_CRYPTOSYSTEM
69 help 104 help
70 Choose Y to enable the use of Kerber 105 Choose Y to enable the use of Kerberos 5 encryption types
71 that utilize Advanced Encryption Sta 106 that utilize Advanced Encryption Standard (AES) ciphers and
72 SHA-2 digests. These include aes128- 107 SHA-2 digests. These include aes128-cts-hmac-sha256-128 and
73 aes256-cts-hmac-sha384-192. 108 aes256-cts-hmac-sha384-192.
74 109
75 config RPCSEC_GSS_KRB5_KUNIT_TEST 110 config RPCSEC_GSS_KRB5_KUNIT_TEST
76 tristate "KUnit tests for RPCSEC GSS K 111 tristate "KUnit tests for RPCSEC GSS Kerberos" if !KUNIT_ALL_TESTS
77 depends on RPCSEC_GSS_KRB5 && KUNIT 112 depends on RPCSEC_GSS_KRB5 && KUNIT
78 default KUNIT_ALL_TESTS 113 default KUNIT_ALL_TESTS
79 help 114 help
80 This builds the KUnit tests for RPCS 115 This builds the KUnit tests for RPCSEC GSS Kerberos 5.
81 116
82 KUnit tests run during boot and outp 117 KUnit tests run during boot and output the results to the debug
83 log in TAP format (https://testanyth 118 log in TAP format (https://testanything.org/). Only useful for
84 kernel devs running KUnit test harne 119 kernel devs running KUnit test harness and are not for inclusion
85 into a production build. 120 into a production build.
86 121
87 For more information on KUnit and un 122 For more information on KUnit and unit tests in general, refer
88 to the KUnit documentation in Docume 123 to the KUnit documentation in Documentation/dev-tools/kunit/.
89 124
90 config SUNRPC_DEBUG 125 config SUNRPC_DEBUG
91 bool "RPC: Enable dprintk debugging" 126 bool "RPC: Enable dprintk debugging"
92 depends on SUNRPC && SYSCTL 127 depends on SUNRPC && SYSCTL
93 select DEBUG_FS 128 select DEBUG_FS
94 help 129 help
95 This option enables a sysctl-based d 130 This option enables a sysctl-based debugging interface
96 that is be used by the 'rpcdebug' ut 131 that is be used by the 'rpcdebug' utility to turn on or off
97 logging of different aspects of the 132 logging of different aspects of the kernel RPC activity.
98 133
99 Disabling this option will make your 134 Disabling this option will make your kernel slightly smaller,
100 but makes troubleshooting NFS issues 135 but makes troubleshooting NFS issues significantly harder.
101 136
102 If unsure, say Y. 137 If unsure, say Y.
103 138
104 config SUNRPC_XPRT_RDMA 139 config SUNRPC_XPRT_RDMA
105 tristate "RPC-over-RDMA transport" 140 tristate "RPC-over-RDMA transport"
106 depends on SUNRPC && INFINIBAND && INF 141 depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS
107 default SUNRPC && INFINIBAND 142 default SUNRPC && INFINIBAND
108 select SG_POOL 143 select SG_POOL
109 help 144 help
110 This option allows the NFS client an 145 This option allows the NFS client and server to use RDMA
111 transports (InfiniBand, iWARP, or Ro 146 transports (InfiniBand, iWARP, or RoCE).
112 147
113 To compile this support as a module, 148 To compile this support as a module, choose M. The module
114 will be called rpcrdma.ko. 149 will be called rpcrdma.ko.
115 150
116 If unsure, or you know there is no R 151 If unsure, or you know there is no RDMA capability on your
117 hardware platform, say N. 152 hardware platform, say N.
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.