| # SPDX-License-Identifier: GPL-2.0-only |
| config SUNRPC |
| tristate |
| depends on MULTIUSER |
| |
| config SUNRPC_GSS |
| tristate |
| select OID_REGISTRY |
| depends on MULTIUSER |
| |
| config SUNRPC_BACKCHANNEL |
| bool |
| depends on SUNRPC |
| |
| config SUNRPC_SWAP |
| bool |
| depends on SUNRPC |
| |
| config RPCSEC_GSS_KRB5 |
| tristate "Secure RPC: Kerberos V mechanism" |
| depends on SUNRPC && CRYPTO |
| default y |
| select SUNRPC_GSS |
| select CRYPTO_SKCIPHER |
| select CRYPTO_HASH |
| help |
| Choose Y here to enable Secure RPC using the Kerberos version 5 |
| GSS-API mechanism (RFC 1964). |
| |
| Secure RPC calls with Kerberos require an auxiliary user-space |
| daemon which may be found in the Linux nfs-utils package |
| available from http://linux-nfs.org/. In addition, user-space |
| Kerberos support should be installed. |
| |
| If unsure, say Y. |
| |
| config RPCSEC_GSS_KRB5_SIMPLIFIED |
| bool |
| depends on RPCSEC_GSS_KRB5 |
| |
| config RPCSEC_GSS_KRB5_CRYPTOSYSTEM |
| bool |
| depends on RPCSEC_GSS_KRB5 |
| |
| config RPCSEC_GSS_KRB5_ENCTYPES_DES |
| bool "Enable Kerberos enctypes based on DES (deprecated)" |
| depends on RPCSEC_GSS_KRB5 |
| depends on CRYPTO_CBC && CRYPTO_CTS && CRYPTO_ECB |
| depends on CRYPTO_HMAC && CRYPTO_MD5 && CRYPTO_SHA1 |
| depends on CRYPTO_DES |
| default n |
| select RPCSEC_GSS_KRB5_SIMPLIFIED |
| help |
| Choose Y to enable the use of deprecated Kerberos 5 |
| encryption types that utilize Data Encryption Standard |
| (DES) based ciphers. These include des-cbc-md5, |
| des-cbc-crc, and des-cbc-md4, which were deprecated by |
| RFC 6649, and des3-cbc-sha1, which was deprecated by RFC |
| 8429. |
| |
| These encryption types are known to be insecure, therefore |
| the default setting of this option is N. Support for these |
| encryption types is available only for compatibility with |
| legacy NFS client and server implementations. |
| |
| Removal of support is planned for a subsequent kernel |
| release. |
| |
| config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1 |
| bool "Enable Kerberos enctypes based on AES and SHA-1" |
| depends on RPCSEC_GSS_KRB5 |
| depends on CRYPTO_CBC && CRYPTO_CTS |
| depends on CRYPTO_HMAC && CRYPTO_SHA1 |
| depends on CRYPTO_AES |
| default y |
| select RPCSEC_GSS_KRB5_CRYPTOSYSTEM |
| help |
| Choose Y to enable the use of Kerberos 5 encryption types |
| that utilize Advanced Encryption Standard (AES) ciphers and |
| SHA-1 digests. These include aes128-cts-hmac-sha1-96 and |
| aes256-cts-hmac-sha1-96. |
| |
| config RPCSEC_GSS_KRB5_ENCTYPES_CAMELLIA |
| bool "Enable Kerberos encryption types based on Camellia and CMAC" |
| depends on RPCSEC_GSS_KRB5 |
| depends on CRYPTO_CBC && CRYPTO_CTS && CRYPTO_CAMELLIA |
| depends on CRYPTO_CMAC |
| default n |
| select RPCSEC_GSS_KRB5_CRYPTOSYSTEM |
| help |
| Choose Y to enable the use of Kerberos 5 encryption types |
| that utilize Camellia ciphers (RFC 3713) and CMAC digests |
| (NIST Special Publication 800-38B). These include |
| camellia128-cts-cmac and camellia256-cts-cmac. |
| |
| config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2 |
| bool "Enable Kerberos enctypes based on AES and SHA-2" |
| depends on RPCSEC_GSS_KRB5 |
| depends on CRYPTO_CBC && CRYPTO_CTS |
| depends on CRYPTO_HMAC && CRYPTO_SHA256 && CRYPTO_SHA512 |
| depends on CRYPTO_AES |
| default n |
| select RPCSEC_GSS_KRB5_CRYPTOSYSTEM |
| help |
| Choose Y to enable the use of Kerberos 5 encryption types |
| that utilize Advanced Encryption Standard (AES) ciphers and |
| SHA-2 digests. These include aes128-cts-hmac-sha256-128 and |
| aes256-cts-hmac-sha384-192. |
| |
| config RPCSEC_GSS_KRB5_KUNIT_TEST |
| tristate "KUnit tests for RPCSEC GSS Kerberos" if !KUNIT_ALL_TESTS |
| depends on RPCSEC_GSS_KRB5 && KUNIT |
| default KUNIT_ALL_TESTS |
| help |
| This builds the KUnit tests for RPCSEC GSS Kerberos 5. |
| |
| KUnit tests run during boot and output the results to the debug |
| log in TAP format (https://testanything.org/). Only useful for |
| kernel devs running KUnit test harness and are not for inclusion |
| into a production build. |
| |
| For more information on KUnit and unit tests in general, refer |
| to the KUnit documentation in Documentation/dev-tools/kunit/. |
| |
| config SUNRPC_DEBUG |
| bool "RPC: Enable dprintk debugging" |
| depends on SUNRPC && SYSCTL |
| select DEBUG_FS |
| help |
| This option enables a sysctl-based debugging interface |
| that is be used by the 'rpcdebug' utility to turn on or off |
| logging of different aspects of the kernel RPC activity. |
| |
| Disabling this option will make your kernel slightly smaller, |
| but makes troubleshooting NFS issues significantly harder. |
| |
| If unsure, say Y. |
| |
| config SUNRPC_XPRT_RDMA |
| tristate "RPC-over-RDMA transport" |
| depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS |
| default SUNRPC && INFINIBAND |
| select SG_POOL |
| help |
| This option allows the NFS client and server to use RDMA |
| transports (InfiniBand, iWARP, or RoCE). |
| |
| To compile this support as a module, choose M. The module |
| will be called rpcrdma.ko. |
| |
| If unsure, or you know there is no RDMA capability on your |
| hardware platform, say N. |
