| /* SPDX-License-Identifier: GPL-2.0 */ |
| /* |
| * Define the string that exports the set of kernel-supported |
| * Kerberos enctypes. This list is sent via upcall to gssd, and |
| * is also exposed via the nfsd /proc API. The consumers generally |
| * treat this as an ordered list, where the first item in the list |
| * is the most preferred. |
| */ |
| |
| #ifndef _LINUX_SUNRPC_GSS_KRB5_ENCTYPES_H |
| #define _LINUX_SUNRPC_GSS_KRB5_ENCTYPES_H |
| |
| #ifdef CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES |
| |
| /* |
| * NB: This list includes DES3_CBC_SHA1, which was deprecated by RFC 8429. |
| * |
| * ENCTYPE_AES256_CTS_HMAC_SHA1_96 |
| * ENCTYPE_AES128_CTS_HMAC_SHA1_96 |
| * ENCTYPE_DES3_CBC_SHA1 |
| */ |
| #define KRB5_SUPPORTED_ENCTYPES "18,17,16" |
| |
| #else /* CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES */ |
| |
| /* |
| * NB: This list includes encryption types that were deprecated |
| * by RFC 8429 and RFC 6649. |
| * |
| * ENCTYPE_AES256_CTS_HMAC_SHA1_96 |
| * ENCTYPE_AES128_CTS_HMAC_SHA1_96 |
| * ENCTYPE_DES3_CBC_SHA1 |
| * ENCTYPE_DES_CBC_MD5 |
| * ENCTYPE_DES_CBC_CRC |
| * ENCTYPE_DES_CBC_MD4 |
| */ |
| #define KRB5_SUPPORTED_ENCTYPES "18,17,16,3,1,2" |
| |
| #endif /* CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES */ |
| |
| #endif /* _LINUX_SUNRPC_GSS_KRB5_ENCTYPES_H */ |
