Changes in Kconfig

6c922ea7 - SUNRPC: Remove CONFIG_RPCSEC_GSS_KRB5_CRYPTOSYSTEM

Thu, 29 Jun 2023 17:51:19 +0000

SUNRPC: Remove CONFIG_RPCSEC_GSS_KRB5_CRYPTOSYSTEMThis code is now always on, so the ifdef can be removed.Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever List of files: /linux-6.15/net/sunrpc/Kconfig

788849b6 - SUNRPC: Remove RPCSEC_GSS_KRB5_ENCTYPES_DES

Thu, 29 Jun 2023 17:50:39 +0000

SUNRPC: Remove RPCSEC_GSS_KRB5_ENCTYPES_DESMake it impossible to enable support for the DES or DES3 Kerberosencryption types in SunRPC. These enctypes were deprecated by RFCs6649 and 8429 because they are known to be insecure.Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever List of files: /linux-6.15/net/sunrpc/Kconfig

eebd8c2d - SUNRPC: Add KUnit tests for rpcsec_krb5.ko

Sun, 15 Jan 2023 17:23:34 +0000

SUNRPC: Add KUnit tests for rpcsec_krb5.koThe Kerberos RFCs provide test vectors to verify the operation ofan implementation. Introduce a KUnit test framework to exercise theLinux kernel's implementation of Kerberos.Start with test cases for the RFC 3961-defined n-fold function. Thesample vectors for that are found in RFC 3961 Section 10.Run the GSS Kerberos 5 mechanism's unit tests with this command:$ ./tools/testing/kunit/kunit.py run \ --kunitconfig ./net/sunrpc/.kunitconfigTested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever List of files: /linux-6.15/net/sunrpc/Kconfig

3394682f - SUNRPC: Support the Camellia enctypes

Sun, 15 Jan 2023 17:23:08 +0000

SUNRPC: Support the Camellia enctypesRFC 6803 defines two encryption types that use Camellia ciphers (RFC3713) and CMAC digests. Implement support for those in SunRPC's GSSKerberos 5 mechanism.There has not been an explicit request to support these enctypes.However, this new set of enctypes provides a good alternative to theAES-SHA1 enctypes that are to be deprecated at some point.As this implementation is still a "beta", the default is to notbuild it automatically.Tested-by: Scott Mayhew Signed-off-by: Chuck Lever List of files: /linux-6.15/net/sunrpc/Kconfig

a40cf753 - SUNRPC: Add gk5e definitions for RFC 8009 encryption types

Sun, 15 Jan 2023 17:22:43 +0000

SUNRPC: Add gk5e definitions for RFC 8009 encryption typesFill in entries in the supported_gss_krb5_enctypes array for theencryption types defined in RFC 8009. These new enctypes use theSHA-256 and SHA-384 message digest algorithms (as defined inFIPS-180) instead of the deprecated SHA-1 algorithm, and are thusmore secure.Note that NIST has scheduled SHA-1 for deprecation:https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithmThus these new encryption types are placed under a separate CONFIGoption to enable distributors to separately introduce support forthe AES-SHA2 enctypes and deprecate support for the current set ofAES-SHA1 encryption types as their user space allows.As this implementation is still a "beta", the default is to notbuild it automatically.Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever List of files: /linux-6.15/net/sunrpc/Kconfig

dfe9a123 - SUNRPC: Enable rpcsec_gss_krb5.ko to be built without CRYPTO_DES

Sun, 15 Jan 2023 17:21:52 +0000

SUNRPC: Enable rpcsec_gss_krb5.ko to be built without CRYPTO_DESBecause the DES block cipher has been deprecated by Internetstandard, highly secure configurations might require that DESsupport be blacklisted or not installed. NFS Kerberos should stillbe able to work correctly with only the AES-based enctypes in thatsituation.Also note that MIT Kerberos has begun a deprecation process for DESencryption types. Their README for 1.19.3 states:> Beginning with the krb5-1.19 release, a warning will be issued> if initial credentials are acquired using the des3-cbc-sha1> encryption type. In future releases, this encryption type will> be disabled by default and eventually removed.>> Beginning with the krb5-1.18 release, single-DES encryption> types have been removed.Aside from the CONFIG option name change, there are two importantpolicy changes:1. The 'insecure enctype' group is now disabled by default. Distributors have to take action to enable support for deprecated enctypes. Implementation of these enctypes will be removed in a future kernel release.2. des3-cbc-sha1 is now considered part of the 'insecure enctype' group, having been deprecated by RFC 8429, and is thus disabled by defaultAfter this patch is applied, SunRPC support can be built withKerberos 5 support but without CRYPTO_DES enabled in the kernel.And, when these enctypes are disabled, the Linux kernel's SunRPCRPCSEC GSS implementation fully complies with BCP 179 / RFC 6649and BCP 218 / RFC 8429.Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever List of files: /linux-6.15/net/sunrpc/Kconfig

e33d2a7b - SUNRPC: remove RC4-HMAC-MD5 support from KerberosV

Mon, 31 Aug 2020 15:16:45 +0000

SUNRPC: remove RC4-HMAC-MD5 support from KerberosVThe RC4-HMAC-MD5 KerberosV algorithm is based on RFC 4757 [0], whichwas specifically issued for interoperability with Windows 2000, but wasnever intended to receive the same level of support. The RFC says The IETF Kerberos community supports publishing this specification as an informational document in order to describe this widely implemented technology. However, while these encryption types provide the operations necessary to implement the base Kerberos specification [RFC4120], they do not provide all the required operations in the Kerberos cryptography framework [RFC3961]. As a result, it is not generally possible to implement potential extensions to Kerberos using these encryption types. The Kerberos encryption type negotiation mechanism [RFC4537] provides one approach for using such extensions even when a Kerberos infrastructure uses long-term RC4 keys. Because this specification does not implement operations required by RFC 3961 and because of security concerns with the use of RC4 and MD4 discussed in Section 8, this specification is not appropriate for publication on the standards track. The RC4-HMAC encryption types are used to ease upgrade of existing Windows NT environments, provide strong cryptography (128-bit key lengths), and provide exportable (meet United States government export restriction requirements) encryption. This document describes the implementation of those encryption types.Furthermore, this RFC was re-classified as 'historic' by RFC 8429 [1] in2018, stating that 'none of the encryption types it specifies should beused'Note that other outdated algorithms are left in place (some of which areguarded by CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES), so this should onlyadversely affect interoperability with Windows NT/2000 systems that havenot received any updates since 2008 (but are connected to a networknonetheless)[0] https://tools.ietf.org/html/rfc4757[1] https://tools.ietf.org/html/rfc8429Signed-off-by: Ard Biesheuvel Acked-by: J. Bruce Fields Signed-off-by: Herbert Xu List of files: /linux-6.15/net/sunrpc/Kconfig

4368d77a - SUNRPC: Drop redundant CONFIG_ from CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES

Wed, 19 Jun 2019 21:24:10 +0000

SUNRPC: Drop redundant CONFIG_ from CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPESThe "CONFIG_" portion is added automatically, so this was being expandedinto "CONFIG_CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES"Signed-off-by: Anna Schumaker Signed-off-by: Trond Myklebust List of files: /linux-6.15/net/sunrpc/Kconfig

ec8f24b7 - treewide: Add SPDX license identifier - Makefile/Kconfig

Sun, 19 May 2019 12:07:45 +0000

treewide: Add SPDX license identifier - Makefile/KconfigAdd SPDX license identifiers to all Make/Kconfig files which: - Have no license information of any formThese files fall under the project license, GPL v2 only. The resulting SPDXlicense identifier is: GPL-2.0-onlySigned-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman List of files: /linux-6.15/net/sunrpc/Kconfig

fe9a2705 - SUNRPC: Add build option to disable support for insecure enctypes

Mon, 11 Feb 2019 16:24:43 +0000

SUNRPC: Add build option to disable support for insecure enctypesEnable distributions to enforce the rejection of ancient andinsecure Kerberos enctypes in the kernel's RPCSEC_GSSimplementation. These are the single-DES encryption types thatwere deprecated in 2012 by RFC 6649.Enctypes that were deprecated more recently (by RFC 8429) remainfully supported for now because they are still likely to be widelyused.Signed-off-by: Chuck Lever Acked-by: Simo Sorce Signed-off-by: Anna Schumaker List of files: /linux-6.15/net/sunrpc/Kconfig

533d1dae - IB: Revert "remove redundant INFINIBAND kconfig dependencies"

Fri, 25 May 2018 21:29:59 +0000

IB: Revert "remove redundant INFINIBAND kconfig dependencies"Several subsystems depend on INFINIBAND_ADDR_TRANS, which in turn dependson INFINIBAND. However, when with CONFIG_INIFIBAND=m, this leads to alink error when another driver using it is built-in. TheINFINIBAND_ADDR_TRANS dependency is insufficient here as this isa 'bool' symbol that does not force anything to be a module in turn.fs/cifs/smbdirect.o: In function `smbd_disconnect_rdma_work':smbdirect.c:(.text+0x1e4): undefined reference to `rdma_disconnect'net/9p/trans_rdma.o: In function `rdma_request':trans_rdma.c:(.text+0x7bc): undefined reference to `rdma_disconnect'net/9p/trans_rdma.o: In function `rdma_destroy_trans':trans_rdma.c:(.text+0x830): undefined reference to `ib_destroy_qp'trans_rdma.c:(.text+0x858): undefined reference to `ib_dealloc_pd'Fixes: 9533b292a7ac ("IB: remove redundant INFINIBAND kconfig dependencies")Signed-off-by: Arnd Bergmann Acked-by: Greg Thelen Signed-off-by: Jason Gunthorpe List of files: /linux-6.15/net/sunrpc/Kconfig

9533b292 - IB: remove redundant INFINIBAND kconfig dependencies

Fri, 04 May 2018 03:29:19 +0000

IB: remove redundant INFINIBAND kconfig dependenciesINFINIBAND_ADDR_TRANS depends on INFINIBAND. So there's no need foroptions which depend INFINIBAND_ADDR_TRANS to also depend on INFINIBAND.Remove the unnecessary INFINIBAND depends.Signed-off-by: Greg Thelen Signed-off-by: Doug Ledford List of files: /linux-6.15/net/sunrpc/Kconfig

f13193f5 - svcrdma: Introduce local rdma_rw API helpers

Sun, 09 Apr 2017 17:06:16 +0000

svcrdma: Introduce local rdma_rw API helpersThe plan is to replace the local bespoke code that constructs andposts RDMA Read and Write Work Requests with calls to the rdma_rwAPI. This shares code with other RDMA-enabled ULPs that manages thegory details of buffer registration and posting Work Requests.Some design notes: o The structure of RPC-over-RDMA transport headers is flexible, allowing multiple segments per Reply with arbitrary alignment, each with a unique R_key. Write and Send WRs continue to be built and posted in separate code paths. However, one whole chunk (with one or more RDMA segments apiece) gets exactly one ib_post_send and one work completion. o svc_xprt reference counting is modified, since a chain of rdma_rw_ctx structs generates one completion, no matter how many Write WRs are posted. o The current code builds the transport header as it is construct- ing Write WRs. I've replaced that with marshaling of transport header data items in a separate step. This is because the exact structure of client-provided segments may not align with the components of the server's reply xdr_buf, or the pages in the page list. Thus parts of each client-provided segment may be written at different points in the send path.Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields List of files: /linux-6.15/net/sunrpc/Kconfig

ffe1f0df - rpcrdma: Merge svcrdma and xprtrdma modules into one

Thu, 04 Jun 2015 15:21:42 +0000

rpcrdma: Merge svcrdma and xprtrdma modules into oneBi-directional RPC support means code in svcrdma.ko invokes a bit ofcode in xprtrdma.ko, and vice versa. To avoid loader/linker loops,merge the server and client side modules together into a singlemodule.When backchannel capabilities are added, the combined module willregister all needed transport capabilities so that Upper Layerconsumers automatically have everything needed to create abi-directional transport connection.Module aliases are added for backwards compatibility with userspace, which still may expect svcrdma.ko or xprtrdma.ko to bepresent.This commit reverts commit 2e8c12e1b765 ("xprtrdma: add separateKconfig options for NFSoRDMA client and server support") andprovides a single CONFIG option for enabling the new module.Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields List of files: /linux-6.15/net/sunrpc/Kconfig

2813893f - kernel: conditionally support non-root users, groups and capabilities

Wed, 15 Apr 2015 23:16:41 +0000

kernel: conditionally support non-root users, groups and capabilitiesThere are a lot of embedded systems that run most or all of theirfunctionality in init, running as root:root. For these systems,supporting multiple users is not necessary.This patch adds a new symbol, CONFIG_MULTIUSER, that makes support fornon-root users, non-root groups, and capabilities optional. It is enabledunder CONFIG_EXPERT menu.When this symbol is not defined, UID and GID are zero in any possible caseand processes always have all capabilities.The following syscalls are compiled out: setuid, setregid, setgid,setreuid, setresuid, getresuid, setresgid, getresgid, setgroups,getgroups, setfsuid, setfsgid, capget, capset.Also, groups.c is compiled out completely.In kernel/capability.c, capable function was moved in order to avoidadding two ifdef blocks.This change saves about 25 KB on a defconfig build. The most minimalkernels have total text sizes in the high hundreds of kB rather thanlow MB. (The 25k goes down a bit with allnoconfig, but not that much.The kernel was booted in Qemu. All the common functionalities work.Adding users/groups is not possible, failing with -ENOSYS.Bloat-o-meter output:add/remove: 7/87 grow/shrink: 19/397 up/down: 1675/-26325 (-24650)[akpm@linux-foundation.org: coding-style fixes]Signed-off-by: Iulia Manda Reviewed-by: Josh Triplett Acked-by: Geert Uytterhoeven Tested-by: Paul E. McKenney Reviewed-by: Paul E. McKenney Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds List of files: /linux-6.15/net/sunrpc/Kconfig

b4b9d2cc - sunrpc: add debugfs file for displaying client rpc_task queue

Wed, 26 Nov 2014 19:44:43 +0000

sunrpc: add debugfs file for displaying client rpc_task queueIt's possible to get a dump of the RPC task queue by writing a value to/proc/sys/sunrpc/rpc_debug. If you write any value to that file, you geta dump of the RPC client task list into the log buffer. This is a ratherinconvenient interface however, and makes it hard to get immediate infoabout the task queue.Add a new directory hierarchy under debugfs: sunrpc/ rpc_clnt/ /Within each clientid directory we create a new "tasks" file that willdump info similar to what shows up in the log buffer, but with a fewsmall differences -- we avoid printing raw kernel addresses in favor ofsymbolic names and the XID is also displayed.Signed-off-by: Jeff Layton Signed-off-by: Trond Myklebust List of files: /linux-6.15/net/sunrpc/Kconfig

2e8c12e1 - xprtrdma: add separate Kconfig options for NFSoRDMA client and server support

Tue, 18 Mar 2014 23:45:47 +0000

xprtrdma: add separate Kconfig options for NFSoRDMA client and server supportThere are two entirely separate modules under xprtrdma/ and there's noreason that enabling one should automatically enable the other. Addconfig options for each one so they can be enabled/disabled separately.Signed-off-by: Jeff Layton Signed-off-by: J. Bruce Fields List of files: /linux-6.15/net/sunrpc/Kconfig

cb607187 - sunrpc: drop "select NETVM"

Sat, 09 Mar 2013 16:02:31 +0000

sunrpc: drop "select NETVM"The Kconfig entry for SUNRPC_SWAP selects NETVM. That select statementwas added in commit a564b8f0398636ba30b07c0eaebdef7ff7837249 ("nfs:enable swap on NFS"). But there's no Kconfig symbol NETVM. It apparentlywas only in used in development versions of the swap over nfsfunctionality but never entered mainline. Anyhow, it is a nop and cansafely be dropped.Signed-off-by: Paul Bolle Signed-off-by: Trond Myklebust List of files: /linux-6.15/net/sunrpc/Kconfig

f783288f - SUNRPC: Load GSS kernel module by OID

Sat, 16 Mar 2013 19:54:52 +0000

SUNRPC: Load GSS kernel module by OIDThe current GSS mech switch can find and load GSS pseudoflavormodules by name ("krb5") or pseudoflavor number ("390003"), butcannot find GSS modules by GSS tuple: [ "1.2.840.113554.1.2.2", GSS_C_QOP_DEFAULT, RPC_GSS_SVC_NONE ]This is important when dealing with a SECINFO request. A SECINFOreply contains a list of flavors the server supports for therequested export, but GSS flavors also have a GSS tuple that mapsto a pseudoflavor (like 390003 for krb5).If the GSS module that supports the OID in the tuple is not loaded,our client is not able to load that module dynamically to supportthat pseudoflavor.Add a way for the GSS mech switch to load GSS pseudoflavor supportby OID before searching for the pseudoflavor that matches the OIDand service.Signed-off-by: Chuck Lever Cc: David Howells Signed-off-by: Trond Myklebust List of files: /linux-6.15/net/sunrpc/Kconfig

3fb790ee - net/sunrpc: remove depends on CONFIG_EXPERIMENTAL

Tue, 02 Oct 2012 18:20:01 +0000

net/sunrpc: remove depends on CONFIG_EXPERIMENTALThe CONFIG_EXPERIMENTAL config item has not carried much meaning for awhile now and is almost always enabled by default. As agreed during theLinux kernel summit, remove it from any "depends on" lines in Kconfigs.CC: Trond Myklebust CC: "J. Bruce Fields" CC: "David S. Miller" Signed-off-by: Kees Cook Acked-by: David S. Miller Acked-by: Trond Myklebust List of files: /linux-6.15/net/sunrpc/Kconfig