docs-xml: add "client/server smb3 encryption algorithms" options

This gives administrators more control over the used algorithms.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/docs-xml/smbdotconf/security/clientsmbencryptionalgos.xml b/docs-xml/smbdotconf/security/clientsmbencryptionalgos.xml
new file mode 100644 (file)
index 0000000..b5916cc
--- /dev/null
+++ b/docs-xml/smbdotconf/security/clientsmbencryptionalgos.xml
@@ -0,0 +1,21 @@
+<samba:parameter name="client smb3 encryption algorithms"
+                 context="G"
+                 type="list"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+       <para>This parameter specifies the availability and order of
+       encryption algorithms which are available for negotiation in the SMB3_11 dialect.
+       </para>
+       <para>It is also possible to remove individual algorithms from the default list,
+       by prefixing them with '-'. This can avoid having to specify a hardcoded list.
+       </para>
+       <para>Note: that the removal of aes-128-ccm from the list will result
+       in SMB3_00 and SMB3_02 being unavailable, as it is the default and only
+       available algorithm for these dialects.
+       </para>
+</description>
+
+<value type="default">aes-128-gcm, aes-128-ccm</value>
+<value type="example">aes-128-gcm</value>
+<value type="example">-aes-128-ccm</value>
+</samba:parameter>

diff --git a/docs-xml/smbdotconf/security/serversmbencryptionalgos.xml b/docs-xml/smbdotconf/security/serversmbencryptionalgos.xml
new file mode 100644 (file)
index 0000000..025e582
--- /dev/null
+++ b/docs-xml/smbdotconf/security/serversmbencryptionalgos.xml
@@ -0,0 +1,21 @@
+<samba:parameter name="server smb3 encryption algorithms"
+                 context="G"
+                 type="list"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+       <para>This parameter specifies the availability and order of
+       encryption algorithms which are available for negotiation in the SMB3_11 dialect.
+       </para>
+       <para>It is also possible to remove individual algorithms from the default list,
+       by prefixing them with '-'. This can avoid having to specify a hardcoded list.
+       </para>
+       <para>Note: that the removal of aes-128-ccm from the list will result
+       in SMB3_00 and SMB3_02 being unavailable, as it is the default and only
+       available algorithm for these dialects.
+       </para>
+</description>
+
+<value type="default">aes-128-gcm, aes-128-ccm</value>
+<value type="example">aes-128-gcm</value>
+<value type="example">-aes-128-ccm</value>
+</samba:parameter>

diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index b3dd77279cc687311ab682f84a208513e2e48c2e..6bfbe1077f64f6d3d874b0e82928059e07d26c00 100644 (file)
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -2980,6 +2980,13 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
                                  "winbind use krb5 enterprise principals",
                                  "yes");
 
+       lpcfg_do_global_parameter(lp_ctx,
+                                 "client smb3 encryption algorithms",
+                                 DEFAULT_SMB3_ENCRYPTION_ALGORITHMS);
+       lpcfg_do_global_parameter(lp_ctx,
+                                 "server smb3 encryption algorithms",
+                                 DEFAULT_SMB3_ENCRYPTION_ALGORITHMS);
+
        for (i = 0; parm_table[i].label; i++) {
                if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) {
                        lp_ctx->flags[i] |= FLAG_DEFAULT;

diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h
index e66ce2324b46f3d2972904b010d3b0eaa4b140e4..8b7f6001e30692352c543516a4bca1d954bc42cc 100644 (file)
--- a/lib/param/loadparm.h
+++ b/lib/param/loadparm.h
@@ -285,6 +285,8 @@ enum samba_weak_crypto {
 #define DEFAULT_SMB2_MAX_TRANSACT (8*1024*1024)
 #define DEFAULT_SMB2_MAX_CREDITS 8192
 
+#define DEFAULT_SMB3_ENCRYPTION_ALGORITHMS "aes-128-gcm aes-128-ccm"
+
 #define LOADPARM_EXTRA_LOCALS                                          \
        int usershare;                                                  \
        struct timespec usershare_last_mod;                             \

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 3b9cd1835fba71aee586d02e8c8ad76923c42736..2e559177135e0268a5509523ff29ba42ff65cfd6 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -966,6 +966,11 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
 
        Globals.winbind_use_krb5_enterprise_principals = true;
 
+       Globals.client_smb3_encryption_algorithms =
+               str_list_make_v3_const(NULL, DEFAULT_SMB3_ENCRYPTION_ALGORITHMS, NULL);
+       Globals.server_smb3_encryption_algorithms =
+               str_list_make_v3_const(NULL, DEFAULT_SMB3_ENCRYPTION_ALGORITHMS, NULL);
+
        /* Now put back the settings that were set with lp_set_cmdline() */
        apply_lp_set_cmdline();
 }