17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 50f2065ccSmarkfen * Common Development and Distribution License (the "License"). 60f2065ccSmarkfen * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 225d01c172SVladimir Kotal * Copyright (c) 2001, 2010, Oracle and/or its affiliates. All rights reserved. 237c478bd9Sstevel@tonic-gate */ 247c478bd9Sstevel@tonic-gate 257c478bd9Sstevel@tonic-gate #ifndef _IKEDOOR_H 267c478bd9Sstevel@tonic-gate #define _IKEDOOR_H 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate #ifdef __cplusplus 297c478bd9Sstevel@tonic-gate extern "C" { 307c478bd9Sstevel@tonic-gate #endif 317c478bd9Sstevel@tonic-gate 327c478bd9Sstevel@tonic-gate #include <limits.h> 337c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 347c478bd9Sstevel@tonic-gate #include <net/pfkeyv2.h> 357c478bd9Sstevel@tonic-gate #include <door.h> 367c478bd9Sstevel@tonic-gate 370f2065ccSmarkfen /* 380f2065ccSmarkfen * This version number is intended to stop the calling process from 390f2065ccSmarkfen * getting confused if a structure is changed and a mismatch occurs. 400f2065ccSmarkfen * This should be incremented each time a structure is changed. 410f2065ccSmarkfen */ 42dc739cedSDan McDonald 43dc739cedSDan McDonald /* 44dc739cedSDan McDonald * The IKE process may be a 64-bit process, but ikeadm or any other IKE 45dc739cedSDan McDonald * door consumer does not have to be. We need to be strict ala. PF_KEY or 46dc739cedSDan McDonald * any on-the-wire-protocol with respect to structure fields offsets and 47dc739cedSDan McDonald * alignment. Please make sure all structures are the same size on both 48dc739cedSDan McDonald * 64-bit and 32-bit execution environments (or even other ones), and that 49dc739cedSDan McDonald * apart from trivial 4-byte enums or base headers, that all structures are 50dc739cedSDan McDonald * multiples of 8-bytes (64-bits). 51dc739cedSDan McDonald */ 525d01c172SVladimir Kotal #define DOORVER 4 537c478bd9Sstevel@tonic-gate #define DOORNM "/var/run/ike_door" 547c478bd9Sstevel@tonic-gate 557c478bd9Sstevel@tonic-gate 567c478bd9Sstevel@tonic-gate typedef enum { 577c478bd9Sstevel@tonic-gate IKE_SVC_GET_DBG, 587c478bd9Sstevel@tonic-gate IKE_SVC_SET_DBG, 597c478bd9Sstevel@tonic-gate 607c478bd9Sstevel@tonic-gate IKE_SVC_GET_PRIV, 617c478bd9Sstevel@tonic-gate IKE_SVC_SET_PRIV, 627c478bd9Sstevel@tonic-gate 637c478bd9Sstevel@tonic-gate IKE_SVC_GET_STATS, 647c478bd9Sstevel@tonic-gate 657c478bd9Sstevel@tonic-gate IKE_SVC_GET_P1, 667c478bd9Sstevel@tonic-gate IKE_SVC_DEL_P1, 677c478bd9Sstevel@tonic-gate IKE_SVC_DUMP_P1S, 687c478bd9Sstevel@tonic-gate IKE_SVC_FLUSH_P1S, 697c478bd9Sstevel@tonic-gate 707c478bd9Sstevel@tonic-gate IKE_SVC_GET_RULE, 717c478bd9Sstevel@tonic-gate IKE_SVC_NEW_RULE, 727c478bd9Sstevel@tonic-gate IKE_SVC_DEL_RULE, 737c478bd9Sstevel@tonic-gate IKE_SVC_DUMP_RULES, 747c478bd9Sstevel@tonic-gate IKE_SVC_READ_RULES, 757c478bd9Sstevel@tonic-gate IKE_SVC_WRITE_RULES, 767c478bd9Sstevel@tonic-gate 777c478bd9Sstevel@tonic-gate IKE_SVC_GET_PS, 787c478bd9Sstevel@tonic-gate IKE_SVC_NEW_PS, 797c478bd9Sstevel@tonic-gate IKE_SVC_DEL_PS, 807c478bd9Sstevel@tonic-gate IKE_SVC_DUMP_PS, 817c478bd9Sstevel@tonic-gate IKE_SVC_READ_PS, 827c478bd9Sstevel@tonic-gate IKE_SVC_WRITE_PS, 837c478bd9Sstevel@tonic-gate 847c478bd9Sstevel@tonic-gate IKE_SVC_DBG_RBDUMP, 857c478bd9Sstevel@tonic-gate 860f2065ccSmarkfen IKE_SVC_GET_DEFS, 870f2065ccSmarkfen 88c7777ac8SPaul Wernau IKE_SVC_SET_PIN, 89c7777ac8SPaul Wernau IKE_SVC_DEL_PIN, 90c7777ac8SPaul Wernau 91c7777ac8SPaul Wernau IKE_SVC_DUMP_CERTCACHE, 92c7777ac8SPaul Wernau IKE_SVC_FLUSH_CERTCACHE, 93c7777ac8SPaul Wernau 945d01c172SVladimir Kotal IKE_SVC_DUMP_GROUPS, 955d01c172SVladimir Kotal IKE_SVC_DUMP_ENCRALGS, 965d01c172SVladimir Kotal IKE_SVC_DUMP_AUTHALGS, 975d01c172SVladimir Kotal 987c478bd9Sstevel@tonic-gate IKE_SVC_ERROR 997c478bd9Sstevel@tonic-gate } ike_svccmd_t; 1007c478bd9Sstevel@tonic-gate 1019c2c14abSThejaswini Singarajipura /* DPD status */ 1029c2c14abSThejaswini Singarajipura 1039c2c14abSThejaswini Singarajipura typedef enum dpd_status { 1049c2c14abSThejaswini Singarajipura DPD_NOT_INITIATED = 0, 1059c2c14abSThejaswini Singarajipura DPD_IN_PROGRESS, 1069c2c14abSThejaswini Singarajipura DPD_SUCCESSFUL, 1079c2c14abSThejaswini Singarajipura DPD_FAILURE 1089c2c14abSThejaswini Singarajipura } dpd_status_t; 1099c2c14abSThejaswini Singarajipura 1107c478bd9Sstevel@tonic-gate #define IKE_SVC_MAX IKE_SVC_ERROR 1117c478bd9Sstevel@tonic-gate 1127c478bd9Sstevel@tonic-gate 1137c478bd9Sstevel@tonic-gate /* 1147c478bd9Sstevel@tonic-gate * Support structures/defines 1157c478bd9Sstevel@tonic-gate */ 1167c478bd9Sstevel@tonic-gate 1177c478bd9Sstevel@tonic-gate #define IKEDOORROUNDUP(i) P2ROUNDUP((i), sizeof (uint64_t)) 1187c478bd9Sstevel@tonic-gate 1197c478bd9Sstevel@tonic-gate /* 1207c478bd9Sstevel@tonic-gate * Debug categories. The debug level is a bitmask made up of 1217c478bd9Sstevel@tonic-gate * flags indicating the desired categories; only 31 bits are 1227c478bd9Sstevel@tonic-gate * available, as the highest-order bit designates an invalid 1237c478bd9Sstevel@tonic-gate * setting. 1247c478bd9Sstevel@tonic-gate */ 1257c478bd9Sstevel@tonic-gate #define D_INVALID 0x80000000 1267c478bd9Sstevel@tonic-gate 1277c478bd9Sstevel@tonic-gate #define D_CERT 0x00000001 /* certificate management */ 1287c478bd9Sstevel@tonic-gate #define D_KEY 0x00000002 /* key management */ 1297c478bd9Sstevel@tonic-gate #define D_OP 0x00000004 /* operational: config, init, mem */ 1307c478bd9Sstevel@tonic-gate #define D_P1 0x00000008 /* phase 1 negotiation */ 1317c478bd9Sstevel@tonic-gate #define D_P2 0x00000010 /* phase 2 negotiation */ 1327c478bd9Sstevel@tonic-gate #define D_PFKEY 0x00000020 /* pf key interface */ 1337c478bd9Sstevel@tonic-gate #define D_POL 0x00000040 /* policy management */ 1347c478bd9Sstevel@tonic-gate #define D_PROP 0x00000080 /* proposal construction */ 1357c478bd9Sstevel@tonic-gate #define D_DOOR 0x00000100 /* door server */ 1367c478bd9Sstevel@tonic-gate #define D_CONFIG 0x00000200 /* config file processing */ 1375d3b8cb7SBill Sommerfeld #define D_LABEL 0x00000400 /* MAC labels */ 1387c478bd9Sstevel@tonic-gate 1395d3b8cb7SBill Sommerfeld #define D_HIGHBIT 0x00000400 1405d3b8cb7SBill Sommerfeld #define D_ALL 0x000007ff 1417c478bd9Sstevel@tonic-gate 1427c478bd9Sstevel@tonic-gate /* 1437c478bd9Sstevel@tonic-gate * Access privilege levels: define level of access to keying information. 1447c478bd9Sstevel@tonic-gate * The privileges granted at each level is a superset of the privileges 1457c478bd9Sstevel@tonic-gate * granted at all lower levels. 1467c478bd9Sstevel@tonic-gate * 1477c478bd9Sstevel@tonic-gate * The door operations which require special privileges are: 1487c478bd9Sstevel@tonic-gate * 1497c478bd9Sstevel@tonic-gate * - receiving keying material for SAs and preshared key entries 1507c478bd9Sstevel@tonic-gate * IKE_PRIV_KEYMAT must be set for this. 1517c478bd9Sstevel@tonic-gate * 1527c478bd9Sstevel@tonic-gate * - get/dump/new/delete/read/write preshared keys 1537c478bd9Sstevel@tonic-gate * IKE_PRIV_KEYMAT or IKE_PRIV_MODKEYS must be set to do this. 1547c478bd9Sstevel@tonic-gate * If IKE_PRIV_MODKEYS is set, the information returned for a 1557c478bd9Sstevel@tonic-gate * get/dump request will not include the actual key; in order 1567c478bd9Sstevel@tonic-gate * to get the key itself, IKE_PRIV_KEYMAT must be set. 1577c478bd9Sstevel@tonic-gate * 1587c478bd9Sstevel@tonic-gate * - modifying the privilege level: the daemon's privilege level 1597c478bd9Sstevel@tonic-gate * is set when the daemon is started; the level may only be 1607c478bd9Sstevel@tonic-gate * lowered via the door interface. 1617c478bd9Sstevel@tonic-gate * 1627c478bd9Sstevel@tonic-gate * All other operations are allowed at any privilege level. 1637c478bd9Sstevel@tonic-gate */ 1647c478bd9Sstevel@tonic-gate #define IKE_PRIV_MINIMUM 0 1657c478bd9Sstevel@tonic-gate #define IKE_PRIV_MODKEYS 1 1667c478bd9Sstevel@tonic-gate #define IKE_PRIV_KEYMAT 2 1677c478bd9Sstevel@tonic-gate #define IKE_PRIV_MAXIMUM 2 1687c478bd9Sstevel@tonic-gate 1697c478bd9Sstevel@tonic-gate /* global ike stats formatting structure */ 1707c478bd9Sstevel@tonic-gate typedef struct { 1717c478bd9Sstevel@tonic-gate uint32_t st_init_p1_current; 1727c478bd9Sstevel@tonic-gate uint32_t st_resp_p1_current; 1737c478bd9Sstevel@tonic-gate uint32_t st_init_p1_total; 1747c478bd9Sstevel@tonic-gate uint32_t st_resp_p1_total; 1757c478bd9Sstevel@tonic-gate uint32_t st_init_p1_attempts; 1767c478bd9Sstevel@tonic-gate uint32_t st_resp_p1_attempts; 1777c478bd9Sstevel@tonic-gate uint32_t st_init_p1_noresp; /* failed; no response from peer */ 1787c478bd9Sstevel@tonic-gate uint32_t st_init_p1_respfail; /* failed, but peer responded */ 1797c478bd9Sstevel@tonic-gate uint32_t st_resp_p1_fail; 1807c478bd9Sstevel@tonic-gate uint32_t st_reserved; 1817c478bd9Sstevel@tonic-gate char st_pkcs11_libname[PATH_MAX]; 1827c478bd9Sstevel@tonic-gate } ike_stats_t; 1837c478bd9Sstevel@tonic-gate 1840f2065ccSmarkfen /* structure used to pass default values used by in.iked back to ikeadm */ 1850f2065ccSmarkfen typedef struct { 1860f2065ccSmarkfen uint32_t rule_p1_lifetime_secs; 1870f2065ccSmarkfen uint32_t rule_p1_minlife; 1880f2065ccSmarkfen uint32_t rule_p1_nonce_len; 1890f2065ccSmarkfen uint32_t rule_p2_lifetime_secs; 1900f2065ccSmarkfen uint32_t rule_p2_softlife_secs; 1919c2c14abSThejaswini Singarajipura uint32_t rule_p2_idletime_secs; 1921a6921e0Smarkfen uint32_t sys_p2_lifetime_secs; 1931a6921e0Smarkfen uint32_t sys_p2_softlife_secs; 1949c2c14abSThejaswini Singarajipura uint32_t sys_p2_idletime_secs; 1950f2065ccSmarkfen uint32_t rule_p2_lifetime_kb; 1960f2065ccSmarkfen uint32_t rule_p2_softlife_kb; 1971a6921e0Smarkfen uint32_t sys_p2_lifetime_bytes; 1981a6921e0Smarkfen uint32_t sys_p2_softlife_bytes; 199510c3f91SVladimir Kotal uint32_t rule_p2_minlife_hard_secs; 200510c3f91SVladimir Kotal uint32_t rule_p2_minlife_soft_secs; 201510c3f91SVladimir Kotal uint32_t rule_p2_minlife_idle_secs; 202510c3f91SVladimir Kotal uint32_t rule_p2_minlife_hard_kb; 203510c3f91SVladimir Kotal uint32_t rule_p2_minlife_soft_kb; 204510c3f91SVladimir Kotal uint32_t rule_p2_maxlife_secs; 205510c3f91SVladimir Kotal uint32_t rule_p2_maxlife_kb; 2060f2065ccSmarkfen uint32_t rule_p2_nonce_len; 2070f2065ccSmarkfen uint32_t rule_p2_pfs; 208510c3f91SVladimir Kotal uint32_t rule_p2_mindiff_secs; 209510c3f91SVladimir Kotal uint32_t rule_p2_mindiff_kb; 210510c3f91SVladimir Kotal uint32_t conversion_factor; /* for secs to kbytes */ 2110f2065ccSmarkfen uint32_t rule_max_certs; 2120f2065ccSmarkfen uint32_t rule_ike_port; 2130f2065ccSmarkfen uint32_t rule_natt_port; 214dc739cedSDan McDonald uint32_t defaults_reserved; /* For 64-bit alignment. */ 2150f2065ccSmarkfen } ike_defaults_t; 2167c478bd9Sstevel@tonic-gate 2177c478bd9Sstevel@tonic-gate /* data formatting structures for P1 SA dumps */ 2187c478bd9Sstevel@tonic-gate typedef struct { 2197c478bd9Sstevel@tonic-gate struct sockaddr_storage loc_addr; 2207c478bd9Sstevel@tonic-gate struct sockaddr_storage rem_addr; 2217c478bd9Sstevel@tonic-gate #define beg_iprange loc_addr 2227c478bd9Sstevel@tonic-gate #define end_iprange rem_addr 2237c478bd9Sstevel@tonic-gate } ike_addr_pr_t; 2247c478bd9Sstevel@tonic-gate 2257c478bd9Sstevel@tonic-gate typedef struct { 2267c478bd9Sstevel@tonic-gate uint64_t cky_i; 2277c478bd9Sstevel@tonic-gate uint64_t cky_r; 2287c478bd9Sstevel@tonic-gate } ike_cky_pr_t; 2297c478bd9Sstevel@tonic-gate 2307c478bd9Sstevel@tonic-gate typedef struct { 2317c478bd9Sstevel@tonic-gate ike_cky_pr_t p1hdr_cookies; 2327c478bd9Sstevel@tonic-gate uint8_t p1hdr_major; 2337c478bd9Sstevel@tonic-gate uint8_t p1hdr_minor; 2347c478bd9Sstevel@tonic-gate uint8_t p1hdr_xchg; 2357c478bd9Sstevel@tonic-gate uint8_t p1hdr_isinit; 2367c478bd9Sstevel@tonic-gate uint32_t p1hdr_state; 2379c2c14abSThejaswini Singarajipura boolean_t p1hdr_support_dpd; 2389c2c14abSThejaswini Singarajipura dpd_status_t p1hdr_dpd_state; 239dc739cedSDan McDonald uint64_t p1hdr_dpd_time; 2407c478bd9Sstevel@tonic-gate } ike_p1_hdr_t; 2417c478bd9Sstevel@tonic-gate 2427c478bd9Sstevel@tonic-gate /* values for p1hdr_xchg (aligned with RFC2408, section 3.1) */ 2437c478bd9Sstevel@tonic-gate #define IKE_XCHG_NONE 0 2447c478bd9Sstevel@tonic-gate #define IKE_XCHG_BASE 1 2457c478bd9Sstevel@tonic-gate #define IKE_XCHG_IDENTITY_PROTECT 2 2467c478bd9Sstevel@tonic-gate #define IKE_XCHG_AUTH_ONLY 3 2477c478bd9Sstevel@tonic-gate #define IKE_XCHG_AGGRESSIVE 4 2487c478bd9Sstevel@tonic-gate /* following not from RFC; used only for preshared key definitions */ 2497c478bd9Sstevel@tonic-gate #define IKE_XCHG_IP_AND_AGGR 240 2507c478bd9Sstevel@tonic-gate /* also not from RFC; used as wildcard */ 2517c478bd9Sstevel@tonic-gate #define IKE_XCHG_ANY 256 2527c478bd9Sstevel@tonic-gate 2537c478bd9Sstevel@tonic-gate /* values for p1hdr_state */ 2547c478bd9Sstevel@tonic-gate #define IKE_SA_STATE_INVALID 0 2557c478bd9Sstevel@tonic-gate #define IKE_SA_STATE_INIT 1 2567c478bd9Sstevel@tonic-gate #define IKE_SA_STATE_SENT_SA 2 2577c478bd9Sstevel@tonic-gate #define IKE_SA_STATE_SENT_KE 3 2587c478bd9Sstevel@tonic-gate #define IKE_SA_STATE_SENT_LAST 4 2597c478bd9Sstevel@tonic-gate #define IKE_SA_STATE_DONE 5 2607c478bd9Sstevel@tonic-gate #define IKE_SA_STATE_DELETED 6 2617c478bd9Sstevel@tonic-gate 2627c478bd9Sstevel@tonic-gate typedef struct { 2637c478bd9Sstevel@tonic-gate uint16_t p1xf_dh_group; 2647c478bd9Sstevel@tonic-gate uint16_t p1xf_encr_alg; 26520dc9b2eSvk199839 uint16_t p1xf_encr_low_bits; 26620dc9b2eSvk199839 uint16_t p1xf_encr_high_bits; 2677c478bd9Sstevel@tonic-gate uint16_t p1xf_auth_alg; 2687c478bd9Sstevel@tonic-gate uint16_t p1xf_auth_meth; 2697c478bd9Sstevel@tonic-gate uint16_t p1xf_prf; 2707c478bd9Sstevel@tonic-gate uint16_t p1xf_pfs; 2717c478bd9Sstevel@tonic-gate uint32_t p1xf_max_secs; 2727c478bd9Sstevel@tonic-gate uint32_t p1xf_max_kbytes; 2737c478bd9Sstevel@tonic-gate uint32_t p1xf_max_keyuses; 274dc739cedSDan McDonald uint32_t p1xf_reserved; /* Alignment to 64-bit. */ 2757c478bd9Sstevel@tonic-gate } ike_p1_xform_t; 2767c478bd9Sstevel@tonic-gate 2777c478bd9Sstevel@tonic-gate /* values for p1xf_dh_group (aligned with RFC2409, Appendix A) */ 2787c478bd9Sstevel@tonic-gate #define IKE_GRP_DESC_MODP_768 1 2797c478bd9Sstevel@tonic-gate #define IKE_GRP_DESC_MODP_1024 2 2807c478bd9Sstevel@tonic-gate #define IKE_GRP_DESC_EC2N_155 3 2817c478bd9Sstevel@tonic-gate #define IKE_GRP_DESC_EC2N_185 4 282020bf065Smarkfen /* values for p1xf_dh_group (aligned with RFC3526) */ 2837c478bd9Sstevel@tonic-gate #define IKE_GRP_DESC_MODP_1536 5 284020bf065Smarkfen #define IKE_GRP_DESC_MODP_2048 14 285020bf065Smarkfen #define IKE_GRP_DESC_MODP_3072 15 286020bf065Smarkfen #define IKE_GRP_DESC_MODP_4096 16 287020bf065Smarkfen #define IKE_GRP_DESC_MODP_6144 17 288020bf065Smarkfen #define IKE_GRP_DESC_MODP_8192 18 28946c08a97SBill Sommerfeld #define IKE_GRP_DESC_ECP_256 19 29046c08a97SBill Sommerfeld #define IKE_GRP_DESC_ECP_384 20 29146c08a97SBill Sommerfeld #define IKE_GRP_DESC_ECP_521 21 29246c08a97SBill Sommerfeld /* values for p1xf_dh_group (aligned with RFC5114) */ 29346c08a97SBill Sommerfeld #define IKE_GRP_DESC_MODP_1024_160 22 29446c08a97SBill Sommerfeld #define IKE_GRP_DESC_MODP_2048_224 23 29546c08a97SBill Sommerfeld #define IKE_GRP_DESC_MODP_2048_256 24 29646c08a97SBill Sommerfeld #define IKE_GRP_DESC_ECP_192 25 29746c08a97SBill Sommerfeld #define IKE_GRP_DESC_ECP_224 26 2987c478bd9Sstevel@tonic-gate 2997c478bd9Sstevel@tonic-gate /* values for p1xf_auth_meth (aligned with RFC2409, Appendix A) */ 3007c478bd9Sstevel@tonic-gate #define IKE_AUTH_METH_PRE_SHARED_KEY 1 3017c478bd9Sstevel@tonic-gate #define IKE_AUTH_METH_DSS_SIG 2 3027c478bd9Sstevel@tonic-gate #define IKE_AUTH_METH_RSA_SIG 3 3037c478bd9Sstevel@tonic-gate #define IKE_AUTH_METH_RSA_ENCR 4 3047c478bd9Sstevel@tonic-gate #define IKE_AUTH_METH_RSA_ENCR_REVISED 5 3057c478bd9Sstevel@tonic-gate 3067c478bd9Sstevel@tonic-gate /* values for p1xf_prf */ 3077c478bd9Sstevel@tonic-gate #define IKE_PRF_NONE 0 3087c478bd9Sstevel@tonic-gate #define IKE_PRF_HMAC_MD5 1 3097c478bd9Sstevel@tonic-gate #define IKE_PRF_HMAC_SHA1 2 3100358d3a6Sdanmcd #define IKE_PRF_HMAC_SHA256 5 3110358d3a6Sdanmcd #define IKE_PRF_HMAC_SHA384 6 3120358d3a6Sdanmcd #define IKE_PRF_HMAC_SHA512 7 3137c478bd9Sstevel@tonic-gate 3147c478bd9Sstevel@tonic-gate typedef struct { 3157c478bd9Sstevel@tonic-gate /* 3167c478bd9Sstevel@tonic-gate * NOTE: the new and del counters count the actual number of SAs, 3177c478bd9Sstevel@tonic-gate * not the number of "suites", as defined in the ike monitoring 3187c478bd9Sstevel@tonic-gate * mib draft; we do this because we don't have a good way of 3197c478bd9Sstevel@tonic-gate * tracking the deletion of entire suites (we're notified of 3207c478bd9Sstevel@tonic-gate * deleted qm sas individually). 3217c478bd9Sstevel@tonic-gate */ 3227c478bd9Sstevel@tonic-gate uint32_t p1stat_new_qm_sas; 3237c478bd9Sstevel@tonic-gate uint32_t p1stat_del_qm_sas; 3247c478bd9Sstevel@tonic-gate uint64_t p1stat_start; 3257c478bd9Sstevel@tonic-gate uint32_t p1stat_kbytes; 3267c478bd9Sstevel@tonic-gate uint32_t p1stat_keyuses; 3277c478bd9Sstevel@tonic-gate } ike_p1_stats_t; 3287c478bd9Sstevel@tonic-gate 3297c478bd9Sstevel@tonic-gate typedef struct { 3307c478bd9Sstevel@tonic-gate uint32_t p1err_decrypt; 3317c478bd9Sstevel@tonic-gate uint32_t p1err_hash; 3327c478bd9Sstevel@tonic-gate uint32_t p1err_otherrx; 3337c478bd9Sstevel@tonic-gate uint32_t p1err_tx; 3347c478bd9Sstevel@tonic-gate } ike_p1_errors_t; 3357c478bd9Sstevel@tonic-gate 3367c478bd9Sstevel@tonic-gate typedef struct { 3377c478bd9Sstevel@tonic-gate uint32_t p1key_type; 3387c478bd9Sstevel@tonic-gate uint32_t p1key_len; 3397c478bd9Sstevel@tonic-gate /* 3407c478bd9Sstevel@tonic-gate * followed by (len - sizeof (ike_p1_key_t)) bytes of hex data, 3417c478bd9Sstevel@tonic-gate * 64-bit aligned (pad bytes are added at the end, if necessary, 3427c478bd9Sstevel@tonic-gate * and NOT INCLUDED in the len value, which reflects the actual 3437c478bd9Sstevel@tonic-gate * key size). 3447c478bd9Sstevel@tonic-gate */ 3457c478bd9Sstevel@tonic-gate } ike_p1_key_t; 3467c478bd9Sstevel@tonic-gate 3477c478bd9Sstevel@tonic-gate /* key info types for ike_p1_key_t struct */ 3487c478bd9Sstevel@tonic-gate #define IKE_KEY_PRESHARED 1 3497c478bd9Sstevel@tonic-gate #define IKE_KEY_SKEYID 2 3507c478bd9Sstevel@tonic-gate #define IKE_KEY_SKEYID_D 3 3517c478bd9Sstevel@tonic-gate #define IKE_KEY_SKEYID_A 4 3527c478bd9Sstevel@tonic-gate #define IKE_KEY_SKEYID_E 5 3537c478bd9Sstevel@tonic-gate #define IKE_KEY_ENCR 6 3547c478bd9Sstevel@tonic-gate #define IKE_KEY_IV 7 3557c478bd9Sstevel@tonic-gate 3567c478bd9Sstevel@tonic-gate typedef struct { 3577c478bd9Sstevel@tonic-gate ike_p1_hdr_t p1sa_hdr; 3587c478bd9Sstevel@tonic-gate ike_p1_xform_t p1sa_xform; 3597c478bd9Sstevel@tonic-gate ike_addr_pr_t p1sa_ipaddrs; 3607c478bd9Sstevel@tonic-gate uint16_t p1sa_stat_off; 3617c478bd9Sstevel@tonic-gate uint16_t p1sa_stat_len; 3627c478bd9Sstevel@tonic-gate uint16_t p1sa_error_off; 3637c478bd9Sstevel@tonic-gate uint16_t p1sa_error_len; 3647c478bd9Sstevel@tonic-gate uint16_t p1sa_localid_off; 3657c478bd9Sstevel@tonic-gate uint16_t p1sa_localid_len; 3667c478bd9Sstevel@tonic-gate uint16_t p1sa_remoteid_off; 3677c478bd9Sstevel@tonic-gate uint16_t p1sa_remoteid_len; 3687c478bd9Sstevel@tonic-gate uint16_t p1sa_key_off; 3697c478bd9Sstevel@tonic-gate uint16_t p1sa_key_len; 3707c478bd9Sstevel@tonic-gate uint32_t p1sa_reserved; 3717c478bd9Sstevel@tonic-gate /* 3727c478bd9Sstevel@tonic-gate * variable-length structures will be included here, as 3737c478bd9Sstevel@tonic-gate * indicated by offset/length fields. 3747c478bd9Sstevel@tonic-gate * stats and errors will be formatted as ike_p1_stats_t and 3757c478bd9Sstevel@tonic-gate * ike_p1_errors_t, respectively. 3767c478bd9Sstevel@tonic-gate * key info will be formatted as a series of p1_key_t structs. 3777c478bd9Sstevel@tonic-gate * local/remote ids will be formatted as sadb_ident_t structs. 3787c478bd9Sstevel@tonic-gate */ 3797c478bd9Sstevel@tonic-gate } ike_p1_sa_t; 3807c478bd9Sstevel@tonic-gate 3817c478bd9Sstevel@tonic-gate 3827c478bd9Sstevel@tonic-gate #define MAX_LABEL_LEN 256 3837c478bd9Sstevel@tonic-gate 3847c478bd9Sstevel@tonic-gate 3857c478bd9Sstevel@tonic-gate /* data formatting structure for policy (rule) dumps */ 3867c478bd9Sstevel@tonic-gate 3877c478bd9Sstevel@tonic-gate typedef struct { 3887c478bd9Sstevel@tonic-gate char rule_label[MAX_LABEL_LEN]; 3897c478bd9Sstevel@tonic-gate uint32_t rule_kmcookie; 3907c478bd9Sstevel@tonic-gate uint16_t rule_ike_mode; 3917c478bd9Sstevel@tonic-gate uint16_t rule_local_idtype; /* SADB_IDENTTYPE_* value */ 3927c478bd9Sstevel@tonic-gate uint32_t rule_p1_nonce_len; 3937c478bd9Sstevel@tonic-gate uint32_t rule_p2_nonce_len; 3947c478bd9Sstevel@tonic-gate uint32_t rule_p2_pfs; 3950f2065ccSmarkfen uint32_t rule_p2_lifetime_secs; 3960f2065ccSmarkfen uint32_t rule_p2_softlife_secs; 3979c2c14abSThejaswini Singarajipura uint32_t rule_p2_idletime_secs; 3980f2065ccSmarkfen uint32_t rule_p2_lifetime_kb; 3990f2065ccSmarkfen uint32_t rule_p2_softlife_kb; 4007c478bd9Sstevel@tonic-gate uint16_t rule_xform_cnt; 4017c478bd9Sstevel@tonic-gate uint16_t rule_xform_off; 4027c478bd9Sstevel@tonic-gate uint16_t rule_locip_cnt; 4037c478bd9Sstevel@tonic-gate uint16_t rule_locip_off; 4047c478bd9Sstevel@tonic-gate uint16_t rule_remip_cnt; 4057c478bd9Sstevel@tonic-gate uint16_t rule_remip_off; 4067c478bd9Sstevel@tonic-gate uint16_t rule_locid_inclcnt; 4077c478bd9Sstevel@tonic-gate uint16_t rule_locid_exclcnt; 4087c478bd9Sstevel@tonic-gate uint16_t rule_locid_off; 4097c478bd9Sstevel@tonic-gate uint16_t rule_remid_inclcnt; 4107c478bd9Sstevel@tonic-gate uint16_t rule_remid_exclcnt; 4117c478bd9Sstevel@tonic-gate uint16_t rule_remid_off; 4127c478bd9Sstevel@tonic-gate /* 4137c478bd9Sstevel@tonic-gate * Followed by several lists of variable-length structures, described 4147c478bd9Sstevel@tonic-gate * by counts and offsets: 4157c478bd9Sstevel@tonic-gate * transforms ike_p1_xform_t structs 4167c478bd9Sstevel@tonic-gate * ranges of local ip addrs ike_addr_pr_t structs 4177c478bd9Sstevel@tonic-gate * ranges of remote ip addrs ike_addr_pr_t structs 4187c478bd9Sstevel@tonic-gate * local identification strings null-terminated ascii strings 4197c478bd9Sstevel@tonic-gate * remote identification strings null-terminated ascii strings 4207c478bd9Sstevel@tonic-gate */ 4217c478bd9Sstevel@tonic-gate } ike_rule_t; 4227c478bd9Sstevel@tonic-gate 4235d01c172SVladimir Kotal /* data formatting structure for DH group dumps */ 4245d01c172SVladimir Kotal typedef struct { 4255d01c172SVladimir Kotal uint16_t group_number; 4265d01c172SVladimir Kotal uint16_t group_bits; 4275d01c172SVladimir Kotal char group_label[MAX_LABEL_LEN]; 4285d01c172SVladimir Kotal } ike_group_t; 4295d01c172SVladimir Kotal 4305d01c172SVladimir Kotal /* data formatting structure for encryption algorithm dumps */ 4315d01c172SVladimir Kotal typedef struct { 4325d01c172SVladimir Kotal uint_t encr_value; 4335d01c172SVladimir Kotal char encr_name[MAX_LABEL_LEN]; 4345d01c172SVladimir Kotal int encr_keylen_min; 4355d01c172SVladimir Kotal int encr_keylen_max; 4365d01c172SVladimir Kotal } ike_encralg_t; 4375d01c172SVladimir Kotal 4385d01c172SVladimir Kotal /* data formatting structure for authentication algorithm dumps */ 4395d01c172SVladimir Kotal typedef struct { 4405d01c172SVladimir Kotal uint_t auth_value; 4415d01c172SVladimir Kotal char auth_name[MAX_LABEL_LEN]; 4425d01c172SVladimir Kotal } ike_authalg_t; 4437c478bd9Sstevel@tonic-gate 4447c478bd9Sstevel@tonic-gate /* 4457c478bd9Sstevel@tonic-gate * data formatting structure for preshared keys 4467c478bd9Sstevel@tonic-gate * ps_ike_mode field uses the IKE_XCHG_* defs 4477c478bd9Sstevel@tonic-gate */ 4487c478bd9Sstevel@tonic-gate typedef struct { 4497c478bd9Sstevel@tonic-gate ike_addr_pr_t ps_ipaddrs; 4507c478bd9Sstevel@tonic-gate uint16_t ps_ike_mode; 4517c478bd9Sstevel@tonic-gate uint16_t ps_localid_off; 4527c478bd9Sstevel@tonic-gate uint16_t ps_localid_len; 4537c478bd9Sstevel@tonic-gate uint16_t ps_remoteid_off; 4547c478bd9Sstevel@tonic-gate uint16_t ps_remoteid_len; 4557c478bd9Sstevel@tonic-gate uint16_t ps_key_off; 4567c478bd9Sstevel@tonic-gate uint16_t ps_key_len; 4577c478bd9Sstevel@tonic-gate uint16_t ps_key_bits; 458*41c215c2SPaul Wernau int ps_localid_plen; 459*41c215c2SPaul Wernau int ps_remoteid_plen; 4607c478bd9Sstevel@tonic-gate /* 4617c478bd9Sstevel@tonic-gate * followed by variable-length structures, as indicated by 4627c478bd9Sstevel@tonic-gate * offset/length fields. 4637c478bd9Sstevel@tonic-gate * key info will be formatted as an array of bytes. 4647c478bd9Sstevel@tonic-gate * local/remote ids will be formatted as sadb_ident_t structs. 4657c478bd9Sstevel@tonic-gate */ 4667c478bd9Sstevel@tonic-gate } ike_ps_t; 4677c478bd9Sstevel@tonic-gate 468c7777ac8SPaul Wernau #define DN_MAX 1024 469c7777ac8SPaul Wernau #define CERT_OFF_WIRE -1 470c7777ac8SPaul Wernau #define CERT_NO_PRIVKEY 0 471c7777ac8SPaul Wernau #define CERT_PRIVKEY_LOCKED 1 472c7777ac8SPaul Wernau #define CERT_PRIVKEY_AVAIL 2 473c7777ac8SPaul Wernau 474c7777ac8SPaul Wernau /* 475c7777ac8SPaul Wernau * data formatting structure for cached certs 476c7777ac8SPaul Wernau */ 477c7777ac8SPaul Wernau typedef struct { 478c7777ac8SPaul Wernau uint32_t cache_id; 479510c3f91SVladimir Kotal uint32_t certclass; 480c7777ac8SPaul Wernau int linkage; 481dc739cedSDan McDonald uint32_t certcache_padding; /* For 64-bit alignment. */ 482c7777ac8SPaul Wernau char subject[DN_MAX]; 483c7777ac8SPaul Wernau char issuer[DN_MAX]; 484c7777ac8SPaul Wernau } ike_certcache_t; 4857c478bd9Sstevel@tonic-gate 4867c478bd9Sstevel@tonic-gate /* identification types */ 4877c478bd9Sstevel@tonic-gate #define IKE_ID_IDENT_PAIR 1 4887c478bd9Sstevel@tonic-gate #define IKE_ID_ADDR_PAIR 2 4897c478bd9Sstevel@tonic-gate #define IKE_ID_CKY_PAIR 3 4907c478bd9Sstevel@tonic-gate #define IKE_ID_LABEL 4 4917c478bd9Sstevel@tonic-gate 4927c478bd9Sstevel@tonic-gate 4937c478bd9Sstevel@tonic-gate /* locations for read/write requests */ 4947c478bd9Sstevel@tonic-gate #define IKE_RW_LOC_DEFAULT 1 4957c478bd9Sstevel@tonic-gate #define IKE_RW_LOC_USER_SPEC 2 4967c478bd9Sstevel@tonic-gate 4977c478bd9Sstevel@tonic-gate 4987c478bd9Sstevel@tonic-gate /* door interface error codes */ 4997c478bd9Sstevel@tonic-gate #define IKE_ERR_NO_OBJ 1 /* nothing found to match the request */ 5007c478bd9Sstevel@tonic-gate #define IKE_ERR_NO_DESC 2 /* fd was required with this request */ 5017c478bd9Sstevel@tonic-gate #define IKE_ERR_ID_INVALID 3 /* invalid id info was provided */ 5027c478bd9Sstevel@tonic-gate #define IKE_ERR_LOC_INVALID 4 /* invalid location info was provided */ 5037c478bd9Sstevel@tonic-gate #define IKE_ERR_CMD_INVALID 5 /* invalid command was provided */ 5047c478bd9Sstevel@tonic-gate #define IKE_ERR_DATA_INVALID 6 /* invalid data was provided */ 5057c478bd9Sstevel@tonic-gate #define IKE_ERR_CMD_NOTSUP 7 /* unsupported command */ 5067c478bd9Sstevel@tonic-gate #define IKE_ERR_REQ_INVALID 8 /* badly formatted request */ 5077c478bd9Sstevel@tonic-gate #define IKE_ERR_NO_PRIV 9 /* privilege level not high enough */ 5087c478bd9Sstevel@tonic-gate #define IKE_ERR_SYS_ERR 10 /* syserr occurred while processing */ 50915b07f80Spwernau #define IKE_ERR_DUP_IGNORED 11 /* attempt to add a duplicate entry */ 510c7777ac8SPaul Wernau #define IKE_ERR_NO_TOKEN 12 /* cannot login into pkcs#11 token */ 511c7777ac8SPaul Wernau #define IKE_ERR_NO_AUTH 13 /* not authorized */ 512c7777ac8SPaul Wernau #define IKE_ERR_IN_PROGRESS 14 /* operation already in progress */ 513c7777ac8SPaul Wernau #define IKE_ERR_NO_MEM 15 /* insufficient memory */ 5147c478bd9Sstevel@tonic-gate 5157c478bd9Sstevel@tonic-gate 5167c478bd9Sstevel@tonic-gate /* 5177c478bd9Sstevel@tonic-gate * IKE_SVC_GET_DBG 5187c478bd9Sstevel@tonic-gate * Used to request the current debug level. 5197c478bd9Sstevel@tonic-gate * 5207c478bd9Sstevel@tonic-gate * Upon request, dbg_level is 0 (don't care). 5217c478bd9Sstevel@tonic-gate * 5227c478bd9Sstevel@tonic-gate * Upon return, dbg_level contains the current value. 5237c478bd9Sstevel@tonic-gate * 5247c478bd9Sstevel@tonic-gate * 5257c478bd9Sstevel@tonic-gate * IKE_SVC_SET_DBG 5267c478bd9Sstevel@tonic-gate * Used to request modification of the debug level. 5277c478bd9Sstevel@tonic-gate * 5287c478bd9Sstevel@tonic-gate * Upon request, dbg_level contains desired level. If debug output is 5297c478bd9Sstevel@tonic-gate * to be directed to a different file, the fd should be passed in the 5307c478bd9Sstevel@tonic-gate * door_desc_t field of the door_arg_t param. NOTE: if the daemon is 5317c478bd9Sstevel@tonic-gate * currently running in the background with no debug set, an output 5327c478bd9Sstevel@tonic-gate * file MUST be given. 5337c478bd9Sstevel@tonic-gate * 5347c478bd9Sstevel@tonic-gate * Upon return, dbg_level contains the old debug level, and acknowledges 5357c478bd9Sstevel@tonic-gate * successful completion of the request. If an error is encountered, 5367c478bd9Sstevel@tonic-gate * ike_err_t is returned instead, with appropriate error value and cmd 5377c478bd9Sstevel@tonic-gate * IKE_SVC_ERROR. 5387c478bd9Sstevel@tonic-gate */ 5397c478bd9Sstevel@tonic-gate typedef struct { 5407c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 5417c478bd9Sstevel@tonic-gate uint32_t dbg_level; 5427c478bd9Sstevel@tonic-gate } ike_dbg_t; 5437c478bd9Sstevel@tonic-gate 5447c478bd9Sstevel@tonic-gate /* 5457c478bd9Sstevel@tonic-gate * IKE_SVC_GET_PRIV 5467c478bd9Sstevel@tonic-gate * Used to request the current privilege level. 5477c478bd9Sstevel@tonic-gate * 5487c478bd9Sstevel@tonic-gate * Upon request, priv_level is 0 (don't care). 5497c478bd9Sstevel@tonic-gate * 5507c478bd9Sstevel@tonic-gate * Upon return, priv_level contains the current value. 5517c478bd9Sstevel@tonic-gate * 5527c478bd9Sstevel@tonic-gate * 5537c478bd9Sstevel@tonic-gate * IKE_SVC_SET_PRIV 5547c478bd9Sstevel@tonic-gate * Used to request modification of the privilege level. 5557c478bd9Sstevel@tonic-gate * 5567c478bd9Sstevel@tonic-gate * Upon request, priv_level contains the desired level. The level may 5577c478bd9Sstevel@tonic-gate * only be lowered via the door interface; it cannot be raised. Thus, 5587c478bd9Sstevel@tonic-gate * if in.iked is started at the lowest level, it cannot be changed. 5597c478bd9Sstevel@tonic-gate * 5607c478bd9Sstevel@tonic-gate * Upon return, priv_level contains the old privilege level, and 5617c478bd9Sstevel@tonic-gate * acknowledges successful completion of the request. If an error is 5627c478bd9Sstevel@tonic-gate * encountered, ike_err_t is returned instead, with appropriate error 5637c478bd9Sstevel@tonic-gate * value and cmd IKE_SVC_ERROR. 5647c478bd9Sstevel@tonic-gate */ 5657c478bd9Sstevel@tonic-gate typedef struct { 5667c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 5677c478bd9Sstevel@tonic-gate uint32_t priv_level; 5687c478bd9Sstevel@tonic-gate } ike_priv_t; 5697c478bd9Sstevel@tonic-gate 5707c478bd9Sstevel@tonic-gate 5717c478bd9Sstevel@tonic-gate /* 5727c478bd9Sstevel@tonic-gate * IKE_SVC_GET_STATS 5737c478bd9Sstevel@tonic-gate * Used to request current statistics on Phase 1 SA creation and 5747c478bd9Sstevel@tonic-gate * failures. The statistics represent all activity in in.iked. 5757c478bd9Sstevel@tonic-gate * 5767c478bd9Sstevel@tonic-gate * Upon request, cmd is set, and stat_len does not matter. 5777c478bd9Sstevel@tonic-gate * 5787c478bd9Sstevel@tonic-gate * Upon successful return, stat_len contains the total size of the 5797c478bd9Sstevel@tonic-gate * returned buffer, which contains first the ike_statreq_t struct, 5807c478bd9Sstevel@tonic-gate * followed by the stat data in the ike_stats_t structure. In case 5817c478bd9Sstevel@tonic-gate * of an error in processing the request, ike_err_t is returned with 5827c478bd9Sstevel@tonic-gate * IKE_SVC_ERROR command and appropriate error code. 5837c478bd9Sstevel@tonic-gate */ 5847c478bd9Sstevel@tonic-gate typedef struct { 5857c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 5867c478bd9Sstevel@tonic-gate uint32_t stat_len; 5877c478bd9Sstevel@tonic-gate } ike_statreq_t; 5887c478bd9Sstevel@tonic-gate 5890f2065ccSmarkfen /* 5900f2065ccSmarkfen * IKE_SVC_GET_DEFS 5910f2065ccSmarkfen * Used to request default values from in.iked. 5920f2065ccSmarkfen * 5930f2065ccSmarkfen * Upon request, cmd is set, and stat_len does not matter. 5940f2065ccSmarkfen * 5950f2065ccSmarkfen * Upon successful return, stat_len contains the total size of the 5960f2065ccSmarkfen * returned buffer, this contains a pair of ike_defaults_t's. 5970f2065ccSmarkfen */ 5980f2065ccSmarkfen typedef struct { 5990f2065ccSmarkfen ike_svccmd_t cmd; 6000f2065ccSmarkfen uint32_t stat_len; 6010f2065ccSmarkfen uint32_t version; 602dc739cedSDan McDonald uint32_t defreq_reserved; /* For 64-bit alignment. */ 6030f2065ccSmarkfen } ike_defreq_t; 6047c478bd9Sstevel@tonic-gate 6057c478bd9Sstevel@tonic-gate /* 606c7777ac8SPaul Wernau * IKE_SVC_DUMP_{P1S|RULES|PS|CERTCACHE} 6077c478bd9Sstevel@tonic-gate * Used to request a table dump, and to return info for a single table 6087c478bd9Sstevel@tonic-gate * item. The expectation is that all of the table data will be passed 6097c478bd9Sstevel@tonic-gate * through the door, one entry at a time; an individual request must be 6107c478bd9Sstevel@tonic-gate * sent for each entry, however (the door server can't send unrequested 6117c478bd9Sstevel@tonic-gate * data). 6127c478bd9Sstevel@tonic-gate * 6137c478bd9Sstevel@tonic-gate * Upon request: cmd is set, and dump_next contains the item number 6147c478bd9Sstevel@tonic-gate * requested (0 for first request). dump_len is 0; no data follows. 6157c478bd9Sstevel@tonic-gate * 6167c478bd9Sstevel@tonic-gate * Upon return: cmd is set, and dump_next contains the item number of 6177c478bd9Sstevel@tonic-gate * the *next* item in the table (to be used in the subsequent request). 6187c478bd9Sstevel@tonic-gate * dump_next = 0 indicates that this is the last item in the table. 6197c478bd9Sstevel@tonic-gate * dump_len is the total length (data + struct) returned. Data is 6207c478bd9Sstevel@tonic-gate * formatted as indicated by the cmd type: 6217c478bd9Sstevel@tonic-gate * IKE_SVC_DUMP_P1S: ike_p1_sa_t 6227c478bd9Sstevel@tonic-gate * IKE_SVC_DUMP_RULES: ike_rule_t 6237c478bd9Sstevel@tonic-gate * IKE_SVC_DUMP_PS: ike_ps_t 624c7777ac8SPaul Wernau * IKE_SVC_DUMP_CERTCACHE: ike_certcache_t 6257c478bd9Sstevel@tonic-gate */ 6267c478bd9Sstevel@tonic-gate typedef struct { 6277c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 6287c478bd9Sstevel@tonic-gate uint32_t dump_len; 6297c478bd9Sstevel@tonic-gate union { 6307c478bd9Sstevel@tonic-gate struct { 6317c478bd9Sstevel@tonic-gate uint32_t dump_unext; 6327c478bd9Sstevel@tonic-gate uint32_t dump_ureserved; 6337c478bd9Sstevel@tonic-gate } dump_actual; 6347c478bd9Sstevel@tonic-gate uint64_t dump_alignment; 6357c478bd9Sstevel@tonic-gate } dump_u; 6367c478bd9Sstevel@tonic-gate #define dump_next dump_u.dump_actual.dump_unext 6377c478bd9Sstevel@tonic-gate #define dump_reserved dump_u.dump_actual.dump_ureserved 6387c478bd9Sstevel@tonic-gate /* dump_len - sizeof (ike_dump_t) bytes of data included here */ 6397c478bd9Sstevel@tonic-gate } ike_dump_t; 6407c478bd9Sstevel@tonic-gate 6417c478bd9Sstevel@tonic-gate 6427c478bd9Sstevel@tonic-gate /* 6437c478bd9Sstevel@tonic-gate * IKE_SVC_GET_{P1|RULE|PS} 6447c478bd9Sstevel@tonic-gate * Used to request and return individual table items. 6457c478bd9Sstevel@tonic-gate * 6467c478bd9Sstevel@tonic-gate * Upon request: get_len is the total msg length (struct + id data); 6477c478bd9Sstevel@tonic-gate * get_idtype indicates the type of identification being used. 6487c478bd9Sstevel@tonic-gate * IKE_SVC_GET_P1: ike_addr_pr_t or ike_cky_pr_t 6497c478bd9Sstevel@tonic-gate * IKE_SVC_GET_RULE: char string (label) 6507c478bd9Sstevel@tonic-gate * IKE_SVC_GET_PS: ike_addr_pr_t or pair of sadb_ident_t 6517c478bd9Sstevel@tonic-gate * 6527c478bd9Sstevel@tonic-gate * Upon return: get_len is the total size (struct + data), get_idtype 6537c478bd9Sstevel@tonic-gate * is unused, and the data that follows is formatted according to cmd: 6547c478bd9Sstevel@tonic-gate * IKE_SVC_GET_P1: ike_p1_sa_t 6557c478bd9Sstevel@tonic-gate * IKE_SVC_GET_RULE: ike_rule_t 6567c478bd9Sstevel@tonic-gate * IKE_SVC_GET_PS: ike_ps_t 6577c478bd9Sstevel@tonic-gate */ 6587c478bd9Sstevel@tonic-gate typedef struct { 6597c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 6607c478bd9Sstevel@tonic-gate uint32_t get_len; 6617c478bd9Sstevel@tonic-gate union { 6627c478bd9Sstevel@tonic-gate struct { 6637c478bd9Sstevel@tonic-gate uint32_t getu_idtype; 6647c478bd9Sstevel@tonic-gate uint32_t getu_reserved; 6657c478bd9Sstevel@tonic-gate } get_actual; 6667c478bd9Sstevel@tonic-gate uint64_t get_alignment; 6677c478bd9Sstevel@tonic-gate } get_u; 6687c478bd9Sstevel@tonic-gate #define get_idtype get_u.get_actual.getu_idtype 6697c478bd9Sstevel@tonic-gate #define get_reserved get_u.get_actual.getu_reserved 6707c478bd9Sstevel@tonic-gate /* get_len - sizeof (ike_get_t) bytes of data included here */ 6717c478bd9Sstevel@tonic-gate } ike_get_t; 6727c478bd9Sstevel@tonic-gate 6737c478bd9Sstevel@tonic-gate 6747c478bd9Sstevel@tonic-gate /* 6757c478bd9Sstevel@tonic-gate * IKE_SVC_NEW_{RULE|PS} 6767c478bd9Sstevel@tonic-gate * Used to request and acknowledge insertion of a table item. 6777c478bd9Sstevel@tonic-gate * 6787c478bd9Sstevel@tonic-gate * Upon request: new_len is the total (data + struct) size passed, or 0. 6797c478bd9Sstevel@tonic-gate * new_len = 0 => a door_desc_t is also included with a file descriptor 6807c478bd9Sstevel@tonic-gate * for a file containing the data to be added. The file should include 6817c478bd9Sstevel@tonic-gate * a single item: a rule, or a pre-shared key. For new_len != 0, the 6827c478bd9Sstevel@tonic-gate * data is formatted according to the cmd type: 6837c478bd9Sstevel@tonic-gate * IKE_SVC_NEW_RULE: ike_rule_t 6847c478bd9Sstevel@tonic-gate * IKE_SVC_NEW_PS: ike_ps_t 6857c478bd9Sstevel@tonic-gate * 6867c478bd9Sstevel@tonic-gate * Upon return: new_len is 0; simply acknowledges successful insertion 6877c478bd9Sstevel@tonic-gate * of the requested item. If insertion is not successful, ike_err_t is 6887c478bd9Sstevel@tonic-gate * returned instead with appropriate error value. 6897c478bd9Sstevel@tonic-gate */ 6907c478bd9Sstevel@tonic-gate typedef struct { 6917c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 6927c478bd9Sstevel@tonic-gate uint32_t new_len; 6937c478bd9Sstevel@tonic-gate /* new_len - sizeof (ike_new_t) bytes included here */ 6947c478bd9Sstevel@tonic-gate uint64_t new_align; /* Padding for 64-bit alignment. */ 6957c478bd9Sstevel@tonic-gate } ike_new_t; 6967c478bd9Sstevel@tonic-gate 6977c478bd9Sstevel@tonic-gate 6987c478bd9Sstevel@tonic-gate /* 6997c478bd9Sstevel@tonic-gate * IKE_SVC_DEL_{P1|RULE|PS} 7007c478bd9Sstevel@tonic-gate * Used to request and acknowledge the deletion of an individual table 7017c478bd9Sstevel@tonic-gate * item. 7027c478bd9Sstevel@tonic-gate * 7037c478bd9Sstevel@tonic-gate * Upon request: del_len is the total msg length (struct + id data); 7047c478bd9Sstevel@tonic-gate * del_idtype indicates the type of identification being used. 7057c478bd9Sstevel@tonic-gate * IKE_SVC_DEL_P1: ike_addr_pr_t or ike_cky_pr_t 7067c478bd9Sstevel@tonic-gate * IKE_SVC_DEL_RULE: char string (label) 7077c478bd9Sstevel@tonic-gate * IKE_SVC_DEL_PS: ike_addr_pr_t or pair of sadb_ident_t 7087c478bd9Sstevel@tonic-gate * 7097c478bd9Sstevel@tonic-gate * Upon return: acknowledges deletion of the requested item; del_len and 7107c478bd9Sstevel@tonic-gate * del_idtype are unspecified. If deletion is not successful, ike_err_t 7117c478bd9Sstevel@tonic-gate * is returned instead with appropriate error value. 7127c478bd9Sstevel@tonic-gate */ 7137c478bd9Sstevel@tonic-gate typedef struct { 7147c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 7157c478bd9Sstevel@tonic-gate uint32_t del_len; 7167c478bd9Sstevel@tonic-gate uint32_t del_idtype; 7177c478bd9Sstevel@tonic-gate uint32_t del_reserved; 7187c478bd9Sstevel@tonic-gate /* del_len - sizeof (ike_del_t) bytes of data included here. */ 7197c478bd9Sstevel@tonic-gate } ike_del_t; 7207c478bd9Sstevel@tonic-gate 7217c478bd9Sstevel@tonic-gate 7227c478bd9Sstevel@tonic-gate /* 7237c478bd9Sstevel@tonic-gate * IKE_SVC_READ_{RULES|PS} 7247c478bd9Sstevel@tonic-gate * Used to ask daemon to re-read particular configuration info. 7257c478bd9Sstevel@tonic-gate * 7267c478bd9Sstevel@tonic-gate * Upon request: rw_loc indicates where the info should be read from: 7277c478bd9Sstevel@tonic-gate * either from a user-supplied file descriptor(s), or from the default 7287c478bd9Sstevel@tonic-gate * location(s). If rw_loc indicates user-supplied location, the file 7297c478bd9Sstevel@tonic-gate * descriptor(s) should be passed in the door_desc_t struct. For the 7307c478bd9Sstevel@tonic-gate * IKE_SVC_READ_RULES cmd, two file descriptors should be specified: 7317c478bd9Sstevel@tonic-gate * first, one for the config file which contains the data to be read, 7327c478bd9Sstevel@tonic-gate * and second, one for the cookie file which will be written to as 7337c478bd9Sstevel@tonic-gate * in.iked process the config file. 7347c478bd9Sstevel@tonic-gate * 7357c478bd9Sstevel@tonic-gate * Upon return: rw_loc is unspecified; the message simply acknowledges 7367c478bd9Sstevel@tonic-gate * successful completion of the request. If an error occurred, 7377c478bd9Sstevel@tonic-gate * ike_err_t is returned instead with appropriate error value. 7387c478bd9Sstevel@tonic-gate * 7397c478bd9Sstevel@tonic-gate * 7407c478bd9Sstevel@tonic-gate * IKE_SVC_WRITE_{RULES|PS} 7417c478bd9Sstevel@tonic-gate * Used to ask daemon to write its current config info to files. 7427c478bd9Sstevel@tonic-gate * 7437c478bd9Sstevel@tonic-gate * Request and return are handled the same as for the IKE_SVC_READ_* 7447c478bd9Sstevel@tonic-gate * cmds; however, the rw_loc MUST be a user-supplied location. Also, 7457c478bd9Sstevel@tonic-gate * for the IKE_SVC_WRITE_RULES cmd, the cookie file fd is not required; 7467c478bd9Sstevel@tonic-gate * only a single fd, for the file to which the config info should be 7477c478bd9Sstevel@tonic-gate * written, should be passed in. 7487c478bd9Sstevel@tonic-gate */ 7497c478bd9Sstevel@tonic-gate typedef struct { 7507c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 7517c478bd9Sstevel@tonic-gate uint32_t rw_loc; 7527c478bd9Sstevel@tonic-gate } ike_rw_t; 7537c478bd9Sstevel@tonic-gate 7547c478bd9Sstevel@tonic-gate 7557c478bd9Sstevel@tonic-gate /* 7567c478bd9Sstevel@tonic-gate * IKE_SVC_FLUSH_P1S 757c7777ac8SPaul Wernau * IKE_SVC_FLUSH_CERTCACHE 758c7777ac8SPaul Wernau * 759c7777ac8SPaul Wernau * Used to request and acknowledge tear-down of all P1 SAs 760c7777ac8SPaul Wernau * or to flush the certificate cache. 7617c478bd9Sstevel@tonic-gate */ 7627c478bd9Sstevel@tonic-gate typedef struct { 7637c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 7647c478bd9Sstevel@tonic-gate } ike_flush_t; 7657c478bd9Sstevel@tonic-gate 7667c478bd9Sstevel@tonic-gate 767c7777ac8SPaul Wernau #ifndef PKCS11_TOKSIZE 768c7777ac8SPaul Wernau #define PKCS11_TOKSIZE 32 769c7777ac8SPaul Wernau #endif 770c7777ac8SPaul Wernau #define MAX_PIN_LEN 256 771c7777ac8SPaul Wernau /* 772c7777ac8SPaul Wernau * IKE_SVC_SET_PIN 773c7777ac8SPaul Wernau * IKE_SVC_DEL_PIN 774c7777ac8SPaul Wernau * 775c7777ac8SPaul Wernau * Used to supply a pin for a PKCS#11 tokenj object. 776c7777ac8SPaul Wernau * 777c7777ac8SPaul Wernau */ 778c7777ac8SPaul Wernau typedef struct { 779c7777ac8SPaul Wernau ike_svccmd_t cmd; 780dc739cedSDan McDonald uint32_t pin_reserved; /* For 64-bit alignment. */ 781c7777ac8SPaul Wernau char pkcs11_token[PKCS11_TOKSIZE]; 782c7777ac8SPaul Wernau uchar_t token_pin[MAX_PIN_LEN]; 783c7777ac8SPaul Wernau } ike_pin_t; 784c7777ac8SPaul Wernau 7857c478bd9Sstevel@tonic-gate /* 7867c478bd9Sstevel@tonic-gate * IKE_SVC_ERROR 7877c478bd9Sstevel@tonic-gate * Used on return if server encountered an error while processing 7887c478bd9Sstevel@tonic-gate * the request. An appropriate error code is included (as defined 7897c478bd9Sstevel@tonic-gate * in this header file); in the case of IKE_ERR_SYS_ERR, a value 7907c478bd9Sstevel@tonic-gate * from the UNIX errno space is included in the ike_err_unix field. 7917c478bd9Sstevel@tonic-gate */ 7927c478bd9Sstevel@tonic-gate typedef struct { 7937c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 7947c478bd9Sstevel@tonic-gate uint32_t ike_err; 7957c478bd9Sstevel@tonic-gate uint32_t ike_err_unix; 7967c478bd9Sstevel@tonic-gate uint32_t ike_err_reserved; 7977c478bd9Sstevel@tonic-gate } ike_err_t; 7987c478bd9Sstevel@tonic-gate 7997c478bd9Sstevel@tonic-gate /* 8007c478bd9Sstevel@tonic-gate * Generic type for use when the request/reply type is unknown 8017c478bd9Sstevel@tonic-gate */ 8027c478bd9Sstevel@tonic-gate typedef struct { 8037c478bd9Sstevel@tonic-gate ike_svccmd_t cmd; 8047c478bd9Sstevel@tonic-gate } ike_cmd_t; 8057c478bd9Sstevel@tonic-gate 8067c478bd9Sstevel@tonic-gate 8077c478bd9Sstevel@tonic-gate /* 808c7777ac8SPaul Wernau * Union containing all possible request/return structures. 8097c478bd9Sstevel@tonic-gate */ 8107c478bd9Sstevel@tonic-gate typedef union { 8117c478bd9Sstevel@tonic-gate ike_cmd_t svc_cmd; 8127c478bd9Sstevel@tonic-gate ike_dbg_t svc_dbg; 8137c478bd9Sstevel@tonic-gate ike_priv_t svc_priv; 8147c478bd9Sstevel@tonic-gate ike_statreq_t svc_stats; 8157c478bd9Sstevel@tonic-gate ike_dump_t svc_dump; 8167c478bd9Sstevel@tonic-gate ike_get_t svc_get; 8177c478bd9Sstevel@tonic-gate ike_new_t svc_new; 8187c478bd9Sstevel@tonic-gate ike_del_t svc_del; 8197c478bd9Sstevel@tonic-gate ike_rw_t svc_rw; 8207c478bd9Sstevel@tonic-gate ike_flush_t svc_flush; 821c7777ac8SPaul Wernau ike_pin_t svc_pin; 8227c478bd9Sstevel@tonic-gate ike_err_t svc_err; 8230f2065ccSmarkfen ike_defreq_t svc_defaults; 8247c478bd9Sstevel@tonic-gate } ike_service_t; 8257c478bd9Sstevel@tonic-gate 8267c478bd9Sstevel@tonic-gate #ifdef __cplusplus 8277c478bd9Sstevel@tonic-gate } 8287c478bd9Sstevel@tonic-gate #endif 8297c478bd9Sstevel@tonic-gate 8307c478bd9Sstevel@tonic-gate #endif /* _IKEDOOR_H */ 831