diff options
| author |   Chuck Lever <chuck.lever@oracle.com> | 2019-02-11 11:24:43 -0500 |
|---|---|---|
| committer |   Anna Schumaker <Anna.Schumaker@Netapp.com> | 2019-02-13 13:33:12 -0500 |
| commit | fe9a270519c72bccb3af524db7ea6c7b67700d50 (patch) | |
| tree | c3a0026af4b4f69ed5880fd508c3e776870f92ab /net/sunrpc/auth_gss/gss_krb5_mech.c | |
| parent | SUNRPC: Remove rpc_xprt::tsh_size (diff) | |
| download | linux-dev-fe9a270519c72bccb3af524db7ea6c7b67700d50.tar.xz linux-dev-fe9a270519c72bccb3af524db7ea6c7b67700d50.zip | |
SUNRPC: Add build option to disable support for insecure enctypes
Enable distributions to enforce the rejection of ancient and
insecure Kerberos enctypes in the kernel's RPCSEC_GSS
implementation. These are the single-DES encryption types that
were deprecated in 2012 by RFC 6649.
Enctypes that were deprecated more recently (by RFC 8429) remain
fully supported for now because they are still likely to be widely
used.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Acked-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Diffstat (limited to 'net/sunrpc/auth_gss/gss_krb5_mech.c')
| -rw-r--r-- | net/sunrpc/auth_gss/gss_krb5_mech.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c index eab71fc7af3e..be31a58d54e0 100644 --- a/net/sunrpc/auth_gss/gss_krb5_mech.c +++ b/net/sunrpc/auth_gss/gss_krb5_mech.c @@ -53,6 +53,7 @@ static struct gss_api_mech gss_kerberos_mech; /* forward declaration */ static const struct gss_krb5_enctype supported_gss_krb5_enctypes[] = { +#ifndef CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES /* * DES (All DES enctypes are mapped to the same gss functionality) */ @@ -74,6 +75,7 @@ static const struct gss_krb5_enctype supported_gss_krb5_enctypes[] = { .cksumlength = 8, .keyed_cksum = 0, }, +#endif /* CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES */ /* * RC4-HMAC */ |