xref: /linux/net/sunrpc/Kconfig (revision 3394682fba3b9010c6147e94f37633f044876e5e)

# SPDX-License-Identifier: GPL-2.0-only
config SUNRPC
	tristate
	depends on MULTIUSER

config SUNRPC_GSS
	tristate
	select OID_REGISTRY
	depends on MULTIUSER

config SUNRPC_BACKCHANNEL
	bool
	depends on SUNRPC

config SUNRPC_SWAP
	bool
	depends on SUNRPC

config RPCSEC_GSS_KRB5
	tristate "Secure RPC: Kerberos V mechanism"
	depends on SUNRPC && CRYPTO
	default y
	select SUNRPC_GSS
	select CRYPTO_SKCIPHER
	select CRYPTO_HASH
	help
	  Choose Y here to enable Secure RPC using the Kerberos version 5
	  GSS-API mechanism (RFC 1964).

	  Secure RPC calls with Kerberos require an auxiliary user-space
	  daemon which may be found in the Linux nfs-utils package
	  available from http://linux-nfs.org/.  In addition, user-space
	  Kerberos support should be installed.

	  If unsure, say Y.

config RPCSEC_GSS_KRB5_SIMPLIFIED
	bool
	depends on RPCSEC_GSS_KRB5

config RPCSEC_GSS_KRB5_CRYPTOSYSTEM
	bool
	depends on RPCSEC_GSS_KRB5

config RPCSEC_GSS_KRB5_ENCTYPES_DES
	bool "Enable Kerberos enctypes based on DES (deprecated)"
	depends on RPCSEC_GSS_KRB5
	depends on CRYPTO_CBC && CRYPTO_CTS && CRYPTO_ECB
	depends on CRYPTO_HMAC && CRYPTO_MD5 && CRYPTO_SHA1
	depends on CRYPTO_DES
	default n
	select RPCSEC_GSS_KRB5_SIMPLIFIED
	help
	  Choose Y to enable the use of deprecated Kerberos 5
	  encryption types that utilize Data Encryption Standard
	  (DES) based ciphers. These include des-cbc-md5,
	  des-cbc-crc, and des-cbc-md4, which were deprecated by
	  RFC 6649, and des3-cbc-sha1, which was deprecated by RFC
	  8429.

	  These encryption types are known to be insecure, therefore
	  the default setting of this option is N. Support for these
	  encryption types is available only for compatibility with
	  legacy NFS client and server implementations.

	  Removal of support is planned for a subsequent kernel
	  release.

config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1
	bool "Enable Kerberos enctypes based on AES and SHA-1"
	depends on RPCSEC_GSS_KRB5
	depends on CRYPTO_CBC && CRYPTO_CTS
	depends on CRYPTO_HMAC && CRYPTO_SHA1
	depends on CRYPTO_AES
	default y
	select RPCSEC_GSS_KRB5_CRYPTOSYSTEM
	help
	  Choose Y to enable the use of Kerberos 5 encryption types
	  that utilize Advanced Encryption Standard (AES) ciphers and
	  SHA-1 digests. These include aes128-cts-hmac-sha1-96 and
	  aes256-cts-hmac-sha1-96.

config RPCSEC_GSS_KRB5_ENCTYPES_CAMELLIA
	bool "Enable Kerberos encryption types based on Camellia and CMAC"
	depends on RPCSEC_GSS_KRB5
	depends on CRYPTO_CBC && CRYPTO_CTS && CRYPTO_CAMELLIA
	depends on CRYPTO_CMAC
	default n
	select RPCSEC_GSS_KRB5_CRYPTOSYSTEM
	help
	  Choose Y to enable the use of Kerberos 5 encryption types
	  that utilize Camellia ciphers (RFC 3713) and CMAC digests
	  (NIST Special Publication 800-38B). These include
	  camellia128-cts-cmac and camellia256-cts-cmac.

config RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2
	bool "Enable Kerberos enctypes based on AES and SHA-2"
	depends on RPCSEC_GSS_KRB5
	depends on CRYPTO_CBC && CRYPTO_CTS
	depends on CRYPTO_HMAC && CRYPTO_SHA256 && CRYPTO_SHA512
	depends on CRYPTO_AES
	default n
	select RPCSEC_GSS_KRB5_CRYPTOSYSTEM
	help
	  Choose Y to enable the use of Kerberos 5 encryption types
	  that utilize Advanced Encryption Standard (AES) ciphers and
	  SHA-2 digests. These include aes128-cts-hmac-sha256-128 and
	  aes256-cts-hmac-sha384-192.

config SUNRPC_DEBUG
	bool "RPC: Enable dprintk debugging"
	depends on SUNRPC && SYSCTL
	select DEBUG_FS
	help
	  This option enables a sysctl-based debugging interface
	  that is be used by the 'rpcdebug' utility to turn on or off
	  logging of different aspects of the kernel RPC activity.

	  Disabling this option will make your kernel slightly smaller,
	  but makes troubleshooting NFS issues significantly harder.

	  If unsure, say Y.

config SUNRPC_XPRT_RDMA
	tristate "RPC-over-RDMA transport"
	depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS
	default SUNRPC && INFINIBAND
	select SG_POOL
	help
	  This option allows the NFS client and server to use RDMA
	  transports (InfiniBand, iWARP, or RoCE).

	  To compile this support as a module, choose M. The module
	  will be called rpcrdma.ko.

	  If unsure, or you know there is no RDMA capability on your
	  hardware platform, say N.