Thomas Gleixner | ec8f24b | 2019-05-19 13:07:45 +0100 | [diff] [blame] | 1 | # SPDX-License-Identifier: GPL-2.0-only |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 2 | config CIFS |
Steve French | 2a38e12 | 2017-07-08 18:48:15 -0500 | [diff] [blame] | 3 | tristate "SMB3 and CIFS support (advanced network filesystem)" |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 4 | depends on INET |
| 5 | select NLS |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 6 | select CRYPTO |
Jeff Layton | f855f6c | 2011-01-31 08:41:36 -0500 | [diff] [blame] | 7 | select CRYPTO_MD4 |
Shirish Pargaonkar | d2b9152 | 2010-10-21 14:25:08 -0500 | [diff] [blame] | 8 | select CRYPTO_MD5 |
Benjamin Gilbert | 5b454a6 | 2017-10-19 13:09:29 -0700 | [diff] [blame] | 9 | select CRYPTO_SHA256 |
Stefan Metzmacher | 5890184 | 2018-09-07 18:24:17 +0200 | [diff] [blame] | 10 | select CRYPTO_SHA512 |
Benjamin Gilbert | 5b454a6 | 2017-10-19 13:09:29 -0700 | [diff] [blame] | 11 | select CRYPTO_CMAC |
Steve French | 362d312 | 2010-11-14 03:34:30 +0000 | [diff] [blame] | 12 | select CRYPTO_HMAC |
Ard Biesheuvel | 97a5fee | 2019-06-12 18:19:59 +0200 | [diff] [blame] | 13 | select CRYPTO_LIB_ARC4 |
Benjamin Gilbert | 5b454a6 | 2017-10-19 13:09:29 -0700 | [diff] [blame] | 14 | select CRYPTO_AEAD2 |
| 15 | select CRYPTO_CCM |
Aurelien Aptel | 5fc3681 | 2019-06-14 21:46:35 +0200 | [diff] [blame] | 16 | select CRYPTO_GCM |
Suresh Jayaraman | 5f0b23e | 2011-06-03 14:19:01 +0530 | [diff] [blame] | 17 | select CRYPTO_ECB |
Benjamin Gilbert | 5b454a6 | 2017-10-19 13:09:29 -0700 | [diff] [blame] | 18 | select CRYPTO_AES |
Ard Biesheuvel | 9a394d1 | 2019-08-15 12:01:12 +0300 | [diff] [blame] | 19 | select CRYPTO_LIB_DES |
Steve French | e7a1a2d | 2019-06-30 18:00:41 -0500 | [diff] [blame] | 20 | select KEYS |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 21 | help |
Steve French | 2a38e12 | 2017-07-08 18:48:15 -0500 | [diff] [blame] | 22 | This is the client VFS module for the SMB3 family of NAS protocols, |
Steve French | 0fdfef9 | 2018-06-28 19:30:23 -0500 | [diff] [blame] | 23 | (including support for the most recent, most secure dialect SMB3.1.1) |
| 24 | as well as for earlier dialects such as SMB2.1, SMB2 and the older |
Steve French | 2a38e12 | 2017-07-08 18:48:15 -0500 | [diff] [blame] | 25 | Common Internet File System (CIFS) protocol. CIFS was the successor |
| 26 | to the original dialect, the Server Message Block (SMB) protocol, the |
| 27 | native file sharing mechanism for most early PC operating systems. |
| 28 | |
Steve French | 0fdfef9 | 2018-06-28 19:30:23 -0500 | [diff] [blame] | 29 | The SMB3 protocol is supported by most modern operating systems |
| 30 | and NAS appliances (e.g. Samba, Windows 10, Windows Server 2016, |
| 31 | MacOS) and even in the cloud (e.g. Microsoft Azure). |
Steve French | 2a38e12 | 2017-07-08 18:48:15 -0500 | [diff] [blame] | 32 | The older CIFS protocol was included in Windows NT4, 2000 and XP (and |
| 33 | later) as well by Samba (which provides excellent CIFS and SMB3 |
Steve French | 0fdfef9 | 2018-06-28 19:30:23 -0500 | [diff] [blame] | 34 | server support for Linux and many other operating systems). Use of |
| 35 | dialects older than SMB2.1 is often discouraged on public networks. |
| 36 | This module also provides limited support for OS/2 and Windows ME |
| 37 | and similar very old servers. |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 38 | |
Steve French | 0fdfef9 | 2018-06-28 19:30:23 -0500 | [diff] [blame] | 39 | This module provides an advanced network file system client |
Steve French | 2a38e12 | 2017-07-08 18:48:15 -0500 | [diff] [blame] | 40 | for mounting to SMB3 (and CIFS) compliant servers. It includes |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 41 | support for DFS (hierarchical name space), secure per-user |
Steve French | 0fdfef9 | 2018-06-28 19:30:23 -0500 | [diff] [blame] | 42 | session establishment via Kerberos or NTLM or NTLMv2, RDMA |
| 43 | (smbdirect), advanced security features, per-share encryption, |
| 44 | directory leases, safe distributed caching (oplock), optional packet |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 45 | signing, Unicode and other internationalization improvements. |
Steve French | 2a38e12 | 2017-07-08 18:48:15 -0500 | [diff] [blame] | 46 | |
| 47 | In general, the default dialects, SMB3 and later, enable better |
| 48 | performance, security and features, than would be possible with CIFS. |
| 49 | Note that when mounting to Samba, due to the CIFS POSIX extensions, |
| 50 | CIFS mounts can provide slightly better POSIX compatibility |
| 51 | than SMB3 mounts. SMB2/SMB3 mount options are also |
| 52 | slightly simpler (compared to CIFS) due to protocol improvements. |
| 53 | |
Steve French | 0fdfef9 | 2018-06-28 19:30:23 -0500 | [diff] [blame] | 54 | If you need to mount to Samba, Azure, Macs or Windows from this machine, say Y. |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 55 | |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 56 | config CIFS_STATS2 |
| 57 | bool "Extended statistics" |
Steve French | fcabb89 | 2018-07-31 01:21:37 -0500 | [diff] [blame] | 58 | depends on CIFS |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 59 | help |
| 60 | Enabling this option will allow more detailed statistics on SMB |
| 61 | request timing to be displayed in /proc/fs/cifs/DebugData and also |
| 62 | allow optional logging of slow responses to dmesg (depending on the |
Steve French | e68f4a7 | 2020-12-11 23:31:16 -0600 | [diff] [blame] | 63 | value of /proc/fs/cifs/cifsFYI). See Documentation/admin-guide/cifs/usage.rst |
| 64 | for more details. These additional statistics may have a minor effect |
| 65 | on performance and memory utilization. |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 66 | |
| 67 | Unless you are a developer or are doing network performance analysis |
| 68 | or tuning, say N. |
| 69 | |
Steve French | 7420451 | 2018-06-19 14:34:08 -0500 | [diff] [blame] | 70 | config CIFS_ALLOW_INSECURE_LEGACY |
| 71 | bool "Support legacy servers which use less secure dialects" |
| 72 | depends on CIFS |
| 73 | default y |
| 74 | help |
| 75 | Modern dialects, SMB2.1 and later (including SMB3 and 3.1.1), have |
| 76 | additional security features, including protection against |
| 77 | man-in-the-middle attacks and stronger crypto hashes, so the use |
| 78 | of legacy dialects (SMB1/CIFS and SMB2.0) is discouraged. |
| 79 | |
| 80 | Disabling this option prevents users from using vers=1.0 or vers=2.0 |
| 81 | on mounts with cifs.ko |
| 82 | |
| 83 | If unsure, say Y. |
| 84 | |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 85 | config CIFS_WEAK_PW_HASH |
| 86 | bool "Support legacy servers which use weaker LANMAN security" |
Steve French | 7420451 | 2018-06-19 14:34:08 -0500 | [diff] [blame] | 87 | depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 88 | help |
| 89 | Modern CIFS servers including Samba and most Windows versions |
| 90 | (since 1997) support stronger NTLM (and even NTLMv2 and Kerberos) |
| 91 | security mechanisms. These hash the password more securely |
| 92 | than the mechanisms used in the older LANMAN version of the |
| 93 | SMB protocol but LANMAN based authentication is needed to |
| 94 | establish sessions with some old SMB servers. |
| 95 | |
| 96 | Enabling this option allows the cifs module to mount to older |
| 97 | LANMAN based servers such as OS/2 and Windows 95, but such |
| 98 | mounts may be less secure than mounts using NTLM or more recent |
| 99 | security mechanisms if you are on a public network. Unless you |
| 100 | have a need to access old SMB servers (and are on a private |
| 101 | network) you probably want to say N. Even if this support |
| 102 | is enabled in the kernel build, LANMAN authentication will not be |
| 103 | used automatically. At runtime LANMAN mounts are disabled but |
| 104 | can be set to required (or optional) either in |
Steve French | e68f4a7 | 2020-12-11 23:31:16 -0600 | [diff] [blame] | 105 | /proc/fs/cifs (see Documentation/admin-guide/cifs/usage.rst for |
| 106 | more detail) or via an option on the mount command. This support |
| 107 | is disabled by default in order to reduce the possibility of a |
| 108 | downgrade attack. |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 109 | |
| 110 | If unsure, say N. |
| 111 | |
| 112 | config CIFS_UPCALL |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 113 | bool "Kerberos/SPNEGO advanced session setup" |
Steve French | e7a1a2d | 2019-06-30 18:00:41 -0500 | [diff] [blame] | 114 | depends on CIFS |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 115 | select DNS_RESOLVER |
| 116 | help |
| 117 | Enables an upcall mechanism for CIFS which accesses userspace helper |
| 118 | utilities to provide SPNEGO packaged (RFC 4178) Kerberos tickets |
| 119 | which are needed to mount to certain secure servers (for which more |
Steve French | 2a38e12 | 2017-07-08 18:48:15 -0500 | [diff] [blame] | 120 | secure Kerberos authentication is required). If unsure, say Y. |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 121 | |
| 122 | config CIFS_XATTR |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 123 | bool "CIFS extended attributes" |
| 124 | depends on CIFS |
| 125 | help |
| 126 | Extended attributes are name:value pairs associated with inodes by |
| 127 | the kernel or by users (see the attr(5) manual page for details). |
| 128 | CIFS maps the name of extended attributes beginning with the user |
| 129 | namespace prefix to SMB/CIFS EAs. EAs are stored on Windows |
| 130 | servers without the user namespace prefix, but their names are |
| 131 | seen by Linux cifs clients prefaced by the user namespace prefix. |
| 132 | The system namespace (used by some filesystems to store ACLs) is |
| 133 | not supported at this time. |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 134 | |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 135 | If unsure, say Y. |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 136 | |
| 137 | config CIFS_POSIX |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 138 | bool "CIFS POSIX Extensions" |
| 139 | depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR |
| 140 | help |
| 141 | Enabling this option will cause the cifs client to attempt to |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 142 | negotiate a newer dialect with servers, such as Samba 3.0.5 |
| 143 | or later, that optionally can handle more POSIX like (rather |
| 144 | than Windows like) file behavior. It also enables |
| 145 | support for POSIX ACLs (getfacl and setfacl) to servers |
| 146 | (such as Samba 3.10 and later) which can negotiate |
| 147 | CIFS POSIX ACL support. If unsure, say N. |
| 148 | |
Joe Perches | 471b1f9 | 2012-12-05 12:42:58 -0800 | [diff] [blame] | 149 | config CIFS_DEBUG |
| 150 | bool "Enable CIFS debugging routines" |
| 151 | default y |
| 152 | depends on CIFS |
| 153 | help |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 154 | Enabling this option adds helpful debugging messages to |
| 155 | the cifs code which increases the size of the cifs module. |
| 156 | If unsure, say Y. |
| 157 | |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 158 | config CIFS_DEBUG2 |
| 159 | bool "Enable additional CIFS debugging routines" |
Joe Perches | 471b1f9 | 2012-12-05 12:42:58 -0800 | [diff] [blame] | 160 | depends on CIFS_DEBUG |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 161 | help |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 162 | Enabling this option adds a few more debugging routines |
| 163 | to the cifs code which slightly increases the size of |
| 164 | the cifs module and can cause additional logging of debug |
| 165 | messages in some error paths, slowing performance. This |
| 166 | option can be turned off unless you are debugging |
| 167 | cifs problems. If unsure, say N. |
Alexey Dobriyan | bb26b96 | 2008-10-18 20:28:49 -0700 | [diff] [blame] | 168 | |
Aurélien Aptel | d38de3c6 | 2017-05-24 16:13:25 +0200 | [diff] [blame] | 169 | config CIFS_DEBUG_DUMP_KEYS |
| 170 | bool "Dump encryption keys for offline decryption (Unsafe)" |
Steve French | 2a38e12 | 2017-07-08 18:48:15 -0500 | [diff] [blame] | 171 | depends on CIFS_DEBUG |
Aurélien Aptel | d38de3c6 | 2017-05-24 16:13:25 +0200 | [diff] [blame] | 172 | help |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 173 | Enabling this will dump the encryption and decryption keys |
| 174 | used to communicate on an encrypted share connection on the |
| 175 | console. This allows Wireshark to decrypt and dissect |
| 176 | encrypted network captures. Enable this carefully. |
| 177 | If unsure, say N. |
Aurélien Aptel | d38de3c6 | 2017-05-24 16:13:25 +0200 | [diff] [blame] | 178 | |
Steve French | 10e70af | 2009-02-22 01:33:07 +0000 | [diff] [blame] | 179 | config CIFS_DFS_UPCALL |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 180 | bool "DFS feature support" |
Steve French | e7a1a2d | 2019-06-30 18:00:41 -0500 | [diff] [blame] | 181 | depends on CIFS |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 182 | select DNS_RESOLVER |
| 183 | help |
| 184 | Distributed File System (DFS) support is used to access shares |
| 185 | transparently in an enterprise name space, even if the share |
| 186 | moves to a different server. This feature also enables |
| 187 | an upcall mechanism for CIFS which contacts userspace helper |
| 188 | utilities to provide server name resolution (host names to |
| 189 | IP addresses) which is needed in order to reconnect to |
| 190 | servers if their addresses change or for implicit mounts of |
| 191 | DFS junction points. If unsure, say Y. |
Steve French | 10e70af | 2009-02-22 01:33:07 +0000 | [diff] [blame] | 192 | |
Samuel Cabrero | 06f08da | 2020-11-30 19:02:49 +0100 | [diff] [blame] | 193 | config CIFS_SWN_UPCALL |
| 194 | bool "SWN feature support" |
| 195 | depends on CIFS |
| 196 | help |
| 197 | The Service Witness Protocol (SWN) is used to get notifications |
| 198 | from a highly available server of resource state changes. This |
Steve French | e68f4a7 | 2020-12-11 23:31:16 -0600 | [diff] [blame] | 199 | feature enables an upcall mechanism for CIFS which contacts a |
Samuel Cabrero | 06f08da | 2020-11-30 19:02:49 +0100 | [diff] [blame] | 200 | userspace daemon to establish the DCE/RPC connection to retrieve |
| 201 | the cluster available interfaces and resource change notifications. |
| 202 | If unsure, say Y. |
| 203 | |
Shirish Pargaonkar | 2572087 | 2011-02-25 10:48:55 -0600 | [diff] [blame] | 204 | config CIFS_NFSD_EXPORT |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 205 | bool "Allow nfsd to export CIFS file system" |
| 206 | depends on CIFS && BROKEN |
| 207 | help |
| 208 | Allows NFS server to export a CIFS mounted share (nfsd over cifs) |
Steve French | 675f36f | 2011-02-24 17:58:00 +0000 | [diff] [blame] | 209 | |
Long Li | 2b6ed88 | 2017-11-07 01:54:54 -0700 | [diff] [blame] | 210 | config CIFS_SMB_DIRECT |
Steve French | e963066 | 2019-07-15 21:59:41 -0500 | [diff] [blame] | 211 | bool "SMB Direct support" |
Arnd Bergmann | 533d1da | 2018-05-25 23:29:59 +0200 | [diff] [blame] | 212 | depends on CIFS=m && INFINIBAND && INFINIBAND_ADDR_TRANS || CIFS=y && INFINIBAND=y && INFINIBAND_ADDR_TRANS=y |
Long Li | 2b6ed88 | 2017-11-07 01:54:54 -0700 | [diff] [blame] | 213 | help |
Steve French | e963066 | 2019-07-15 21:59:41 -0500 | [diff] [blame] | 214 | Enables SMB Direct support for SMB 3.0, 3.02 and 3.1.1. |
Long Li | 2b6ed88 | 2017-11-07 01:54:54 -0700 | [diff] [blame] | 215 | SMB Direct allows transferring SMB packets over RDMA. If unsure, |
Steve French | 2bcb4fd | 2020-04-07 10:23:27 -0500 | [diff] [blame] | 216 | say Y. |
Long Li | 2b6ed88 | 2017-11-07 01:54:54 -0700 | [diff] [blame] | 217 | |
Steve French | 1d4ab90 | 2012-10-01 12:48:03 -0500 | [diff] [blame] | 218 | config CIFS_FSCACHE |
Enrico Weigelt, metux IT consult | 50cfad7 | 2019-03-06 23:22:59 +0100 | [diff] [blame] | 219 | bool "Provide CIFS client caching support" |
| 220 | depends on CIFS=m && FSCACHE || CIFS=y && FSCACHE=y |
| 221 | help |
| 222 | Makes CIFS FS-Cache capable. Say Y here if you want your CIFS data |
| 223 | to be cached locally on disk through the general filesystem cache |
| 224 | manager. If unsure, say N. |
Paulo Alcantara (SUSE) | 8eecd1c | 2019-07-16 19:04:50 -0300 | [diff] [blame] | 225 | |
| 226 | config CIFS_ROOT |
| 227 | bool "SMB root file system (Experimental)" |
| 228 | depends on CIFS=y && IP_PNP |
| 229 | help |
| 230 | Enables root file system support over SMB protocol. |
| 231 | |
| 232 | Most people say N here. |