blob: fe03cbdae9592fe015d5c98738587afe1c5d14c1 [file] [log] [blame]
Thomas Gleixnerec8f24b2019-05-19 13:07:45 +01001# SPDX-License-Identifier: GPL-2.0-only
Alexey Dobriyanbb26b962008-10-18 20:28:49 -07002config CIFS
Steve French2a38e122017-07-08 18:48:15 -05003 tristate "SMB3 and CIFS support (advanced network filesystem)"
Alexey Dobriyanbb26b962008-10-18 20:28:49 -07004 depends on INET
5 select NLS
Shirish Pargaonkard2b91522010-10-21 14:25:08 -05006 select CRYPTO
Jeff Laytonf855f6c2011-01-31 08:41:36 -05007 select CRYPTO_MD4
Shirish Pargaonkard2b91522010-10-21 14:25:08 -05008 select CRYPTO_MD5
Benjamin Gilbert5b454a62017-10-19 13:09:29 -07009 select CRYPTO_SHA256
Stefan Metzmacher58901842018-09-07 18:24:17 +020010 select CRYPTO_SHA512
Benjamin Gilbert5b454a62017-10-19 13:09:29 -070011 select CRYPTO_CMAC
Steve French362d3122010-11-14 03:34:30 +000012 select CRYPTO_HMAC
Ard Biesheuvel97a5fee2019-06-12 18:19:59 +020013 select CRYPTO_LIB_ARC4
Benjamin Gilbert5b454a62017-10-19 13:09:29 -070014 select CRYPTO_AEAD2
15 select CRYPTO_CCM
Aurelien Aptel5fc36812019-06-14 21:46:35 +020016 select CRYPTO_GCM
Suresh Jayaraman5f0b23e2011-06-03 14:19:01 +053017 select CRYPTO_ECB
Benjamin Gilbert5b454a62017-10-19 13:09:29 -070018 select CRYPTO_AES
Ard Biesheuvel9a394d12019-08-15 12:01:12 +030019 select CRYPTO_LIB_DES
Steve Frenche7a1a2d2019-06-30 18:00:41 -050020 select KEYS
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070021 help
Steve French2a38e122017-07-08 18:48:15 -050022 This is the client VFS module for the SMB3 family of NAS protocols,
Steve French0fdfef92018-06-28 19:30:23 -050023 (including support for the most recent, most secure dialect SMB3.1.1)
24 as well as for earlier dialects such as SMB2.1, SMB2 and the older
Steve French2a38e122017-07-08 18:48:15 -050025 Common Internet File System (CIFS) protocol. CIFS was the successor
26 to the original dialect, the Server Message Block (SMB) protocol, the
27 native file sharing mechanism for most early PC operating systems.
28
Steve French0fdfef92018-06-28 19:30:23 -050029 The SMB3 protocol is supported by most modern operating systems
30 and NAS appliances (e.g. Samba, Windows 10, Windows Server 2016,
31 MacOS) and even in the cloud (e.g. Microsoft Azure).
Steve French2a38e122017-07-08 18:48:15 -050032 The older CIFS protocol was included in Windows NT4, 2000 and XP (and
33 later) as well by Samba (which provides excellent CIFS and SMB3
Steve French0fdfef92018-06-28 19:30:23 -050034 server support for Linux and many other operating systems). Use of
35 dialects older than SMB2.1 is often discouraged on public networks.
36 This module also provides limited support for OS/2 and Windows ME
37 and similar very old servers.
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070038
Steve French0fdfef92018-06-28 19:30:23 -050039 This module provides an advanced network file system client
Steve French2a38e122017-07-08 18:48:15 -050040 for mounting to SMB3 (and CIFS) compliant servers. It includes
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070041 support for DFS (hierarchical name space), secure per-user
Steve French0fdfef92018-06-28 19:30:23 -050042 session establishment via Kerberos or NTLM or NTLMv2, RDMA
43 (smbdirect), advanced security features, per-share encryption,
44 directory leases, safe distributed caching (oplock), optional packet
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070045 signing, Unicode and other internationalization improvements.
Steve French2a38e122017-07-08 18:48:15 -050046
47 In general, the default dialects, SMB3 and later, enable better
48 performance, security and features, than would be possible with CIFS.
49 Note that when mounting to Samba, due to the CIFS POSIX extensions,
50 CIFS mounts can provide slightly better POSIX compatibility
51 than SMB3 mounts. SMB2/SMB3 mount options are also
52 slightly simpler (compared to CIFS) due to protocol improvements.
53
Steve French0fdfef92018-06-28 19:30:23 -050054 If you need to mount to Samba, Azure, Macs or Windows from this machine, say Y.
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070055
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070056config CIFS_STATS2
57 bool "Extended statistics"
Steve Frenchfcabb892018-07-31 01:21:37 -050058 depends on CIFS
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070059 help
60 Enabling this option will allow more detailed statistics on SMB
61 request timing to be displayed in /proc/fs/cifs/DebugData and also
62 allow optional logging of slow responses to dmesg (depending on the
Steve Frenche68f4a72020-12-11 23:31:16 -060063 value of /proc/fs/cifs/cifsFYI). See Documentation/admin-guide/cifs/usage.rst
64 for more details. These additional statistics may have a minor effect
65 on performance and memory utilization.
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070066
67 Unless you are a developer or are doing network performance analysis
68 or tuning, say N.
69
Steve French74204512018-06-19 14:34:08 -050070config CIFS_ALLOW_INSECURE_LEGACY
71 bool "Support legacy servers which use less secure dialects"
72 depends on CIFS
73 default y
74 help
75 Modern dialects, SMB2.1 and later (including SMB3 and 3.1.1), have
76 additional security features, including protection against
77 man-in-the-middle attacks and stronger crypto hashes, so the use
78 of legacy dialects (SMB1/CIFS and SMB2.0) is discouraged.
79
80 Disabling this option prevents users from using vers=1.0 or vers=2.0
81 on mounts with cifs.ko
82
83 If unsure, say Y.
84
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070085config CIFS_WEAK_PW_HASH
86 bool "Support legacy servers which use weaker LANMAN security"
Steve French74204512018-06-19 14:34:08 -050087 depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY
Alexey Dobriyanbb26b962008-10-18 20:28:49 -070088 help
89 Modern CIFS servers including Samba and most Windows versions
90 (since 1997) support stronger NTLM (and even NTLMv2 and Kerberos)
91 security mechanisms. These hash the password more securely
92 than the mechanisms used in the older LANMAN version of the
93 SMB protocol but LANMAN based authentication is needed to
94 establish sessions with some old SMB servers.
95
96 Enabling this option allows the cifs module to mount to older
97 LANMAN based servers such as OS/2 and Windows 95, but such
98 mounts may be less secure than mounts using NTLM or more recent
99 security mechanisms if you are on a public network. Unless you
100 have a need to access old SMB servers (and are on a private
101 network) you probably want to say N. Even if this support
102 is enabled in the kernel build, LANMAN authentication will not be
103 used automatically. At runtime LANMAN mounts are disabled but
104 can be set to required (or optional) either in
Steve Frenche68f4a72020-12-11 23:31:16 -0600105 /proc/fs/cifs (see Documentation/admin-guide/cifs/usage.rst for
106 more detail) or via an option on the mount command. This support
107 is disabled by default in order to reduce the possibility of a
108 downgrade attack.
Alexey Dobriyanbb26b962008-10-18 20:28:49 -0700109
110 If unsure, say N.
111
112config CIFS_UPCALL
Wang Lei1a4240f2010-08-04 15:16:33 +0100113 bool "Kerberos/SPNEGO advanced session setup"
Steve Frenche7a1a2d2019-06-30 18:00:41 -0500114 depends on CIFS
Wang Lei1a4240f2010-08-04 15:16:33 +0100115 select DNS_RESOLVER
116 help
117 Enables an upcall mechanism for CIFS which accesses userspace helper
118 utilities to provide SPNEGO packaged (RFC 4178) Kerberos tickets
119 which are needed to mount to certain secure servers (for which more
Steve French2a38e122017-07-08 18:48:15 -0500120 secure Kerberos authentication is required). If unsure, say Y.
Alexey Dobriyanbb26b962008-10-18 20:28:49 -0700121
122config CIFS_XATTR
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100123 bool "CIFS extended attributes"
124 depends on CIFS
125 help
126 Extended attributes are name:value pairs associated with inodes by
127 the kernel or by users (see the attr(5) manual page for details).
128 CIFS maps the name of extended attributes beginning with the user
129 namespace prefix to SMB/CIFS EAs. EAs are stored on Windows
130 servers without the user namespace prefix, but their names are
131 seen by Linux cifs clients prefaced by the user namespace prefix.
132 The system namespace (used by some filesystems to store ACLs) is
133 not supported at this time.
Alexey Dobriyanbb26b962008-10-18 20:28:49 -0700134
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100135 If unsure, say Y.
Alexey Dobriyanbb26b962008-10-18 20:28:49 -0700136
137config CIFS_POSIX
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100138 bool "CIFS POSIX Extensions"
139 depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR
140 help
141 Enabling this option will cause the cifs client to attempt to
Alexey Dobriyanbb26b962008-10-18 20:28:49 -0700142 negotiate a newer dialect with servers, such as Samba 3.0.5
143 or later, that optionally can handle more POSIX like (rather
144 than Windows like) file behavior. It also enables
145 support for POSIX ACLs (getfacl and setfacl) to servers
146 (such as Samba 3.10 and later) which can negotiate
147 CIFS POSIX ACL support. If unsure, say N.
148
Joe Perches471b1f92012-12-05 12:42:58 -0800149config CIFS_DEBUG
150 bool "Enable CIFS debugging routines"
151 default y
152 depends on CIFS
153 help
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100154 Enabling this option adds helpful debugging messages to
155 the cifs code which increases the size of the cifs module.
156 If unsure, say Y.
157
Alexey Dobriyanbb26b962008-10-18 20:28:49 -0700158config CIFS_DEBUG2
159 bool "Enable additional CIFS debugging routines"
Joe Perches471b1f92012-12-05 12:42:58 -0800160 depends on CIFS_DEBUG
Alexey Dobriyanbb26b962008-10-18 20:28:49 -0700161 help
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100162 Enabling this option adds a few more debugging routines
163 to the cifs code which slightly increases the size of
164 the cifs module and can cause additional logging of debug
165 messages in some error paths, slowing performance. This
166 option can be turned off unless you are debugging
167 cifs problems. If unsure, say N.
Alexey Dobriyanbb26b962008-10-18 20:28:49 -0700168
Aurélien Apteld38de3c62017-05-24 16:13:25 +0200169config CIFS_DEBUG_DUMP_KEYS
170 bool "Dump encryption keys for offline decryption (Unsafe)"
Steve French2a38e122017-07-08 18:48:15 -0500171 depends on CIFS_DEBUG
Aurélien Apteld38de3c62017-05-24 16:13:25 +0200172 help
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100173 Enabling this will dump the encryption and decryption keys
174 used to communicate on an encrypted share connection on the
175 console. This allows Wireshark to decrypt and dissect
176 encrypted network captures. Enable this carefully.
177 If unsure, say N.
Aurélien Apteld38de3c62017-05-24 16:13:25 +0200178
Steve French10e70af2009-02-22 01:33:07 +0000179config CIFS_DFS_UPCALL
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100180 bool "DFS feature support"
Steve Frenche7a1a2d2019-06-30 18:00:41 -0500181 depends on CIFS
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100182 select DNS_RESOLVER
183 help
184 Distributed File System (DFS) support is used to access shares
185 transparently in an enterprise name space, even if the share
186 moves to a different server. This feature also enables
187 an upcall mechanism for CIFS which contacts userspace helper
188 utilities to provide server name resolution (host names to
189 IP addresses) which is needed in order to reconnect to
190 servers if their addresses change or for implicit mounts of
191 DFS junction points. If unsure, say Y.
Steve French10e70af2009-02-22 01:33:07 +0000192
Samuel Cabrero06f08da2020-11-30 19:02:49 +0100193config CIFS_SWN_UPCALL
194 bool "SWN feature support"
195 depends on CIFS
196 help
197 The Service Witness Protocol (SWN) is used to get notifications
198 from a highly available server of resource state changes. This
Steve Frenche68f4a72020-12-11 23:31:16 -0600199 feature enables an upcall mechanism for CIFS which contacts a
Samuel Cabrero06f08da2020-11-30 19:02:49 +0100200 userspace daemon to establish the DCE/RPC connection to retrieve
201 the cluster available interfaces and resource change notifications.
202 If unsure, say Y.
203
Shirish Pargaonkar25720872011-02-25 10:48:55 -0600204config CIFS_NFSD_EXPORT
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100205 bool "Allow nfsd to export CIFS file system"
206 depends on CIFS && BROKEN
207 help
208 Allows NFS server to export a CIFS mounted share (nfsd over cifs)
Steve French675f36f2011-02-24 17:58:00 +0000209
Long Li2b6ed882017-11-07 01:54:54 -0700210config CIFS_SMB_DIRECT
Steve Frenche9630662019-07-15 21:59:41 -0500211 bool "SMB Direct support"
Arnd Bergmann533d1da2018-05-25 23:29:59 +0200212 depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y
Long Li2b6ed882017-11-07 01:54:54 -0700213 help
Steve Frenche9630662019-07-15 21:59:41 -0500214 Enables SMB Direct support for SMB 3.0, 3.02 and 3.1.1.
Long Li2b6ed882017-11-07 01:54:54 -0700215 SMB Direct allows transferring SMB packets over RDMA. If unsure,
Steve French2bcb4fd2020-04-07 10:23:27 -0500216 say Y.
Long Li2b6ed882017-11-07 01:54:54 -0700217
Steve French1d4ab902012-10-01 12:48:03 -0500218config CIFS_FSCACHE
Enrico Weigelt, metux IT consult50cfad72019-03-06 23:22:59 +0100219 bool "Provide CIFS client caching support"
220 depends on CIFS=m && FSCACHE || CIFS=y && FSCACHE=y
221 help
222 Makes CIFS FS-Cache capable. Say Y here if you want your CIFS data
223 to be cached locally on disk through the general filesystem cache
224 manager. If unsure, say N.
Paulo Alcantara (SUSE)8eecd1c2019-07-16 19:04:50 -0300225
226config CIFS_ROOT
227 bool "SMB root file system (Experimental)"
228 depends on CIFS=y && IP_PNP
229 help
230 Enables root file system support over SMB protocol.
231
232 Most people say N here.