From fa85acd4ff11fd948bad462179f284c085d88add Mon Sep 17 00:00:00 2001
From: szaimen <szaimen@e.mail.de>
Date: Sun, 1 Nov 2020 12:14:34 +0100
Subject: [PATCH] SMB-Server - Encrypt SMB transfer if AES-NI is enabled
 (#1640)

---
 not-supported/smbserver.sh | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/not-supported/smbserver.sh b/not-supported/smbserver.sh
index f74db3ef..aed9a6a4 100644
--- a/not-supported/smbserver.sh
+++ b/not-supported/smbserver.sh
@@ -71,7 +71,7 @@ install_if_not samba
 install_if_not members
 
 # Use SMB3
-if ! grep -q "^protocol" /etc/samba/smb.conf
+if ! grep -q "^protocol" "$SMB_CONF"
 then
     sed -i '/\[global\]/a protocol = SMB3' "$SMB_CONF"
 else
@@ -86,6 +86,18 @@ else
     sed -i 's|.*access based share enum =.*|access based share enum = yes|' "$SMB_CONF"
 fi
 
+# Activate encrypted transfer if AES-NI is enabled (passwords are encrypted by default)
+install_if_not cpuid
+if cpuid | grep " AES" | grep -q true
+then
+    if ! grep -q "^smb encrypt =" "$SMB_CONF"
+    then
+        sed -i '/\[global\]/a smb encrypt = desired' "$SMB_CONF"
+    else
+        sed -i 's|^smb encrypt =.*|smb encrypt = desired|' "$SMB_CONF"
+    fi
+fi
+
 # Disable the [homes] share by default only if active
 if grep -q "^\[homes\]" "$SMB_CONF"
 then