1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25#ifndef	_INET_KSSL_KSSL_H
26#define	_INET_KSSL_KSSL_H
27
28#ifdef	__cplusplus
29extern "C" {
30#endif
31
32#include <sys/types.h>
33#include <netinet/in.h>
34#include <sys/crypto/common.h>
35
36/* These are re-definition from <crypto/ioctl.h>  */
37typedef struct kssl_object_attribute {
38	uint64_t	ka_type;		/* attribute type */
39	uint32_t	ka_value_offset;	/* offset to attribute value */
40	uint32_t	ka_value_len;		/* length of attribute value */
41} kssl_object_attribute_t;
42
43typedef struct kssl_key {
44	crypto_key_format_t ks_format;	/* format identifier */
45	uint32_t ks_count;		/* number of attributes */
46	uint32_t ks_attrs_offset;	/* offset to the attributes */
47} kssl_key_t;
48
49typedef struct kssl_certs_s {
50	uint32_t sc_count;		/* number of certificates */
51	uint32_t sc_sizes_offset;	/* offset to certificates sizes array */
52	uint32_t sc_certs_offset;	/* offset to certificates array */
53} kssl_certs_t;
54
55#define	MAX_PIN_LENGTH			1024
56
57typedef struct kssl_tokinfo_s {
58	uint8_t toklabel[CRYPTO_EXT_SIZE_LABEL];
59	uint32_t pinlen;
60	uint32_t tokpin_offset;		/* offset to the pin */
61	uint32_t ck_rv;			/* PKCS #11 specific error */
62} kssl_tokinfo_t;
63
64/* Code point for Signalling Cipher Suite Value (SCSV) */
65#define	SSL_SCSV			0x00ff
66
67/* Cipher suites */
68#define	SSL_RSA_WITH_NULL_SHA		0x0002
69#define	SSL_RSA_WITH_RC4_128_MD5	0x0004
70#define	SSL_RSA_WITH_RC4_128_SHA	0x0005
71#define	SSL_RSA_WITH_DES_CBC_SHA	0x0009
72#define	SSL_RSA_WITH_3DES_EDE_CBC_SHA	0x000a
73#define	TLS_RSA_WITH_AES_128_CBC_SHA	0x002f
74#define	TLS_RSA_WITH_AES_256_CBC_SHA	0x0035
75/* total number of cipher suites supported */
76#define	CIPHER_SUITE_COUNT		7
77#define	CIPHER_NOTSET			0xffff
78
79/* TLS extension types */
80#define	TLSEXT_RENEGOTIATION_INFO	0xff01
81
82#define	DEFAULT_SID_TIMEOUT		86400	/* 24 hours in seconds */
83#define	DEFAULT_SID_CACHE_NENTRIES	5000
84
85typedef struct kssl_params_s {
86	uint64_t		kssl_params_size; /* total params buf len */
87	/* address and port number */
88	struct sockaddr_in6	kssl_addr;
89	uint16_t		kssl_proxy_port;
90
91	uint32_t		kssl_session_cache_timeout;	/* In seconds */
92	uint32_t		kssl_session_cache_size;
93
94	/*
95	 * Contains ordered list of cipher suites. We do not include
96	 * the one suite with no encryption. Hence the -1.
97	 */
98	uint16_t		kssl_suites[CIPHER_SUITE_COUNT - 1];
99
100	uint8_t			kssl_is_nxkey;
101	kssl_tokinfo_t		kssl_token;
102
103	/* certificates */
104	kssl_certs_t		kssl_certs;
105
106	/* private key */
107	kssl_key_t		kssl_privkey;
108} kssl_params_t;
109
110/* The ioctls to /dev/kssl */
111#define	KSSL_IOC(x)		(('s' << 24) | ('s' << 16) | ('l' << 8) | (x))
112#define	KSSL_ADD_ENTRY		KSSL_IOC(1)
113#define	KSSL_DELETE_ENTRY	KSSL_IOC(2)
114
115#ifdef	_KERNEL
116
117extern int kssl_add_entry(kssl_params_t *);
118extern int kssl_delete_entry(struct sockaddr_in6 *);
119
120#endif	/* _KERNEL */
121
122#ifdef	__cplusplus
123}
124#endif
125
126#endif /* _INET_KSSL_KSSL_H */
127