docs-xml: add "client/server smb3 encryption algorithms" options

This gives administrators more control over the used algorithms.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

5 files changed, 56 insertions, 0 deletions

diff --git a/docs-xml/smbdotconf/security/clientsmbencryptionalgos.xml b/docs-xml/smbdotconf/security/clientsmbencryptionalgos.xml
new file mode 100644
index 00000000000..b5916cc3e4a
--- /dev/null
+++ b/docs-xml/smbdotconf/security/clientsmbencryptionalgos.xml
@@ -0,0 +1,21 @@
+<samba:parameter name="client smb3 encryption algorithms"
+                 context="G"
+                 type="list"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+	<para>This parameter specifies the availability and order of
+	encryption algorithms which are available for negotiation in the SMB3_11 dialect.
+	</para>
+	<para>It is also possible to remove individual algorithms from the default list,
+	by prefixing them with '-'. This can avoid having to specify a hardcoded list.
+	</para>
+	<para>Note: that the removal of aes-128-ccm from the list will result
+	in SMB3_00 and SMB3_02 being unavailable, as it is the default and only
+	available algorithm for these dialects.
+	</para>
+</description>
+
+<value type="default">aes-128-gcm, aes-128-ccm</value>
+<value type="example">aes-128-gcm</value>
+<value type="example">-aes-128-ccm</value>
+</samba:parameter>
diff --git a/docs-xml/smbdotconf/security/serversmbencryptionalgos.xml b/docs-xml/smbdotconf/security/serversmbencryptionalgos.xml
new file mode 100644
index 00000000000..025e582d674
--- /dev/null
+++ b/docs-xml/smbdotconf/security/serversmbencryptionalgos.xml
@@ -0,0 +1,21 @@
+<samba:parameter name="server smb3 encryption algorithms"
+                 context="G"
+                 type="list"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+	<para>This parameter specifies the availability and order of
+	encryption algorithms which are available for negotiation in the SMB3_11 dialect.
+	</para>
+	<para>It is also possible to remove individual algorithms from the default list,
+	by prefixing them with '-'. This can avoid having to specify a hardcoded list.
+	</para>
+	<para>Note: that the removal of aes-128-ccm from the list will result
+	in SMB3_00 and SMB3_02 being unavailable, as it is the default and only
+	available algorithm for these dialects.
+	</para>
+</description>
+
+<value type="default">aes-128-gcm, aes-128-ccm</value>
+<value type="example">aes-128-gcm</value>
+<value type="example">-aes-128-ccm</value>
+</samba:parameter>
diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index b3dd77279cc..6bfbe1077f6 100644
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -2980,6 +2980,13 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
 				  "winbind use krb5 enterprise principals",
 				  "yes");
 
+	lpcfg_do_global_parameter(lp_ctx,
+				  "client smb3 encryption algorithms",
+				  DEFAULT_SMB3_ENCRYPTION_ALGORITHMS);
+	lpcfg_do_global_parameter(lp_ctx,
+				  "server smb3 encryption algorithms",
+				  DEFAULT_SMB3_ENCRYPTION_ALGORITHMS);
+
 	for (i = 0; parm_table[i].label; i++) {
 		if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) {
 			lp_ctx->flags[i] |= FLAG_DEFAULT;
diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h
index e66ce2324b4..8b7f6001e30 100644
--- a/lib/param/loadparm.h
+++ b/lib/param/loadparm.h
@@ -285,6 +285,8 @@ enum samba_weak_crypto {
 #define DEFAULT_SMB2_MAX_TRANSACT (8*1024*1024)
 #define DEFAULT_SMB2_MAX_CREDITS 8192
 
+#define DEFAULT_SMB3_ENCRYPTION_ALGORITHMS "aes-128-gcm aes-128-ccm"
+
 #define LOADPARM_EXTRA_LOCALS						\
 	int usershare;							\
 	struct timespec usershare_last_mod;				\
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 3b9cd1835fb..2e559177135 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -966,6 +966,11 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
 
 	Globals.winbind_use_krb5_enterprise_principals = true;
 
+	Globals.client_smb3_encryption_algorithms =
+		str_list_make_v3_const(NULL, DEFAULT_SMB3_ENCRYPTION_ALGORITHMS, NULL);
+	Globals.server_smb3_encryption_algorithms =
+		str_list_make_v3_const(NULL, DEFAULT_SMB3_ENCRYPTION_ALGORITHMS, NULL);
+
 	/* Now put back the settings that were set with lp_set_cmdline() */
 	apply_lp_set_cmdline();
 }