From: Stefan Metzmacher Date: Tue, 13 Jul 2021 16:00:59 +0000 (+0200) Subject: docs-xml: add "client/server smb3 encryption algorithms" options X-Git-Tag: samba-4.15.0rc1~40 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5ca01e48da3339a0810ff72ba204e05b4e555025;p=thirdparty%2Fsamba.git docs-xml: add "client/server smb3 encryption algorithms" options This gives administrators more control over the used algorithms. Signed-off-by: Stefan Metzmacher Reviewed-by: Jeremy Allison --- diff --git a/docs-xml/smbdotconf/security/clientsmbencryptionalgos.xml b/docs-xml/smbdotconf/security/clientsmbencryptionalgos.xml new file mode 100644 index 00000000000..b5916cc3e4a --- /dev/null +++ b/docs-xml/smbdotconf/security/clientsmbencryptionalgos.xml @@ -0,0 +1,21 @@ + + + This parameter specifies the availability and order of + encryption algorithms which are available for negotiation in the SMB3_11 dialect. + + It is also possible to remove individual algorithms from the default list, + by prefixing them with '-'. This can avoid having to specify a hardcoded list. + + Note: that the removal of aes-128-ccm from the list will result + in SMB3_00 and SMB3_02 being unavailable, as it is the default and only + available algorithm for these dialects. + + + +aes-128-gcm, aes-128-ccm +aes-128-gcm +-aes-128-ccm + diff --git a/docs-xml/smbdotconf/security/serversmbencryptionalgos.xml b/docs-xml/smbdotconf/security/serversmbencryptionalgos.xml new file mode 100644 index 00000000000..025e582d674 --- /dev/null +++ b/docs-xml/smbdotconf/security/serversmbencryptionalgos.xml @@ -0,0 +1,21 @@ + + + This parameter specifies the availability and order of + encryption algorithms which are available for negotiation in the SMB3_11 dialect. + + It is also possible to remove individual algorithms from the default list, + by prefixing them with '-'. This can avoid having to specify a hardcoded list. + + Note: that the removal of aes-128-ccm from the list will result + in SMB3_00 and SMB3_02 being unavailable, as it is the default and only + available algorithm for these dialects. + + + +aes-128-gcm, aes-128-ccm +aes-128-gcm +-aes-128-ccm + diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index b3dd77279cc..6bfbe1077f6 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -2980,6 +2980,13 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) "winbind use krb5 enterprise principals", "yes"); + lpcfg_do_global_parameter(lp_ctx, + "client smb3 encryption algorithms", + DEFAULT_SMB3_ENCRYPTION_ALGORITHMS); + lpcfg_do_global_parameter(lp_ctx, + "server smb3 encryption algorithms", + DEFAULT_SMB3_ENCRYPTION_ALGORITHMS); + for (i = 0; parm_table[i].label; i++) { if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { lp_ctx->flags[i] |= FLAG_DEFAULT; diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h index e66ce2324b4..8b7f6001e30 100644 --- a/lib/param/loadparm.h +++ b/lib/param/loadparm.h @@ -285,6 +285,8 @@ enum samba_weak_crypto { #define DEFAULT_SMB2_MAX_TRANSACT (8*1024*1024) #define DEFAULT_SMB2_MAX_CREDITS 8192 +#define DEFAULT_SMB3_ENCRYPTION_ALGORITHMS "aes-128-gcm aes-128-ccm" + #define LOADPARM_EXTRA_LOCALS \ int usershare; \ struct timespec usershare_last_mod; \ diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 3b9cd1835fb..2e559177135 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -966,6 +966,11 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) Globals.winbind_use_krb5_enterprise_principals = true; + Globals.client_smb3_encryption_algorithms = + str_list_make_v3_const(NULL, DEFAULT_SMB3_ENCRYPTION_ALGORITHMS, NULL); + Globals.server_smb3_encryption_algorithms = + str_list_make_v3_const(NULL, DEFAULT_SMB3_ENCRYPTION_ALGORITHMS, NULL); + /* Now put back the settings that were set with lp_set_cmdline() */ apply_lp_set_cmdline(); }