Commit 29e27923 authored by Steve French's avatar Steve French

smb3.1.1: add new module load parm enable_gcm_256

Add new module load parameter enable_gcm_256. If set, then add
AES-256-GCM (strongest encryption type) to the list of encryption
types requested. Put it in the list as the second choice (since
AES-128-GCM is faster and much more broadly supported by
SMB3 servers).  To make this stronger encryption type, GCM-256,
required (the first and only choice, you would use module parameter
"require_gcm_256."
Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent fbfd0b46
...@@ -71,6 +71,7 @@ bool enable_oplocks = true; ...@@ -71,6 +71,7 @@ bool enable_oplocks = true;
bool linuxExtEnabled = true; bool linuxExtEnabled = true;
bool lookupCacheEnabled = true; bool lookupCacheEnabled = true;
bool disable_legacy_dialects; /* false by default */ bool disable_legacy_dialects; /* false by default */
bool enable_gcm_256; /* false by default, change when more servers support it */
bool require_gcm_256; /* false by default */ bool require_gcm_256; /* false by default */
unsigned int global_secflags = CIFSSEC_DEF; unsigned int global_secflags = CIFSSEC_DEF;
/* unsigned int ntlmv2_support = 0; */ /* unsigned int ntlmv2_support = 0; */
...@@ -105,6 +106,9 @@ MODULE_PARM_DESC(slow_rsp_threshold, "Amount of time (in seconds) to wait " ...@@ -105,6 +106,9 @@ MODULE_PARM_DESC(slow_rsp_threshold, "Amount of time (in seconds) to wait "
module_param(enable_oplocks, bool, 0644); module_param(enable_oplocks, bool, 0644);
MODULE_PARM_DESC(enable_oplocks, "Enable or disable oplocks. Default: y/Y/1"); MODULE_PARM_DESC(enable_oplocks, "Enable or disable oplocks. Default: y/Y/1");
module_param(enable_gcm_256, bool, 0644);
MODULE_PARM_DESC(enable_gcm_256, "Enable requesting strongest (256 bit) GCM encryption. Default: n/N/0");
module_param(require_gcm_256, bool, 0644); module_param(require_gcm_256, bool, 0644);
MODULE_PARM_DESC(require_gcm_256, "Require strongest (256 bit) GCM encryption. Default: n/N/0"); MODULE_PARM_DESC(require_gcm_256, "Require strongest (256 bit) GCM encryption. Default: n/N/0");
......
...@@ -1956,6 +1956,7 @@ extern bool lookupCacheEnabled; ...@@ -1956,6 +1956,7 @@ extern bool lookupCacheEnabled;
extern unsigned int global_secflags; /* if on, session setup sent extern unsigned int global_secflags; /* if on, session setup sent
with more secure ntlmssp2 challenge/resp */ with more secure ntlmssp2 challenge/resp */
extern unsigned int sign_CIFS_PDUs; /* enable smb packet signing */ extern unsigned int sign_CIFS_PDUs; /* enable smb packet signing */
extern bool enable_gcm_256; /* allow optional negotiate of strongest signing (aes-gcm-256) */
extern bool require_gcm_256; /* require use of strongest signing (aes-gcm-256) */ extern bool require_gcm_256; /* require use of strongest signing (aes-gcm-256) */
extern bool linuxExtEnabled;/*enable Linux/Unix CIFS extensions*/ extern bool linuxExtEnabled;/*enable Linux/Unix CIFS extensions*/
extern unsigned int CIFSMaxBufSize; /* max size not including hdr */ extern unsigned int CIFSMaxBufSize; /* max size not including hdr */
......
...@@ -453,6 +453,12 @@ build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt) ...@@ -453,6 +453,12 @@ build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt)
pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */ pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + 1 cipher */
pneg_ctxt->CipherCount = cpu_to_le16(1); pneg_ctxt->CipherCount = cpu_to_le16(1);
pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM; pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES256_GCM;
} else if (enable_gcm_256) {
pneg_ctxt->DataLength = cpu_to_le16(8); /* Cipher Count + 3 ciphers */
pneg_ctxt->CipherCount = cpu_to_le16(3);
pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;
pneg_ctxt->Ciphers[1] = SMB2_ENCRYPTION_AES256_GCM;
pneg_ctxt->Ciphers[2] = SMB2_ENCRYPTION_AES128_CCM;
} else { } else {
pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */ pneg_ctxt->DataLength = cpu_to_le16(6); /* Cipher Count + 2 ciphers */
pneg_ctxt->CipherCount = cpu_to_le16(2); pneg_ctxt->CipherCount = cpu_to_le16(2);
......
...@@ -361,8 +361,9 @@ struct smb2_encryption_neg_context { ...@@ -361,8 +361,9 @@ struct smb2_encryption_neg_context {
__le16 ContextType; /* 2 */ __le16 ContextType; /* 2 */
__le16 DataLength; __le16 DataLength;
__le32 Reserved; __le32 Reserved;
__le16 CipherCount; /* AES-128-GCM and AES-128-CCM */ /* CipherCount usally 2, but can be 3 when AES256-GCM enabled */
__le16 Ciphers[2]; __le16 CipherCount; /* AES128-GCM and AES128-CCM by default */
__le16 Ciphers[3];
} __packed; } __packed;
/* See MS-SMB2 2.2.3.1.3 */ /* See MS-SMB2 2.2.3.1.3 */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment