1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 * 26 * cryptmod.h 27 * STREAMS based crypto module definitions. 28 * 29 * This is a Sun-private and undocumented interface. 30 */ 31 32 #ifndef _SYS_CRYPTMOD_H 33 #define _SYS_CRYPTMOD_H 34 35 #include <sys/types.h> 36 #include <sys/types32.h> 37 #ifdef _KERNEL 38 #include <sys/crypto/api.h> 39 #endif /* _KERNEL */ 40 41 #ifdef __cplusplus 42 extern "C" { 43 #endif 44 45 46 /* 47 * IOCTLs. 48 */ 49 #define CRYPTIOC (('C' << 24) | ('R' << 16) | ('Y' << 8) | 0x00) 50 51 #define CRYPTIOCSETUP (CRYPTIOC | 0x01) 52 #define CRYPTIOCSTOP (CRYPTIOC | 0x02) 53 #define CRYPTIOCSTARTENC (CRYPTIOC | 0x03) 54 #define CRYPTIOCSTARTDEC (CRYPTIOC | 0x04) 55 56 #define CRYPTPASSTHRU (CRYPTIOC | 0x80) 57 58 /* 59 * Crypto method definitions, to be used with the CRIOCSETUP ioctl. 60 */ 61 #define CRYPT_METHOD_NONE 0 62 #define CRYPT_METHOD_DES_CFB 101 63 #define CRYPT_METHOD_DES_CBC_NULL 102 64 #define CRYPT_METHOD_DES_CBC_MD5 103 65 #define CRYPT_METHOD_DES_CBC_CRC 104 66 #define CRYPT_METHOD_DES3_CBC_SHA1 105 67 #define CRYPT_METHOD_ARCFOUR_HMAC_MD5 106 68 #define CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP 107 69 #define CRYPT_METHOD_AES128 108 70 #define CRYPT_METHOD_AES256 109 71 72 #define CR_METHOD_OK(m) ((m) == CRYPT_METHOD_NONE || \ 73 ((m) >= CRYPT_METHOD_DES_CFB && \ 74 (m) <= CRYPT_METHOD_AES256)) 75 76 #define IS_RC4_METHOD(m) ((m) == CRYPT_METHOD_ARCFOUR_HMAC_MD5 || \ 77 (m) == CRYPT_METHOD_ARCFOUR_HMAC_MD5_EXP) 78 79 #define IS_AES_METHOD(m) ((m) == CRYPT_METHOD_AES128 || \ 80 (m) == CRYPT_METHOD_AES256) 81 82 /* 83 * Direction mask values, also to be used with the CRIOCSETUP ioctl. 84 */ 85 #define CRYPT_ENCRYPT 0x01 86 #define CRYPT_DECRYPT 0x02 87 88 #define CR_DIRECTION_OK(d) ((d) & (CRYPT_ENCRYPT | CRYPT_DECRYPT)) 89 90 /* 91 * Define constants for the 'ivec_usage' fields. 92 */ 93 #define IVEC_NEVER 0x00 94 #define IVEC_REUSE 0x01 95 #define IVEC_ONETIME 0x02 96 97 #define CR_IVUSAGE_OK(iv) \ 98 ((iv) == IVEC_NEVER || (iv) == IVEC_REUSE || (iv) == IVEC_ONETIME) 99 100 #define CRYPT_SHA1_BLOCKSIZE 64 101 #define CRYPT_SHA1_HASHSIZE 20 102 #define CRYPT_DES3_KEYBYTES 21 103 #define CRYPT_DES3_KEYLENGTH 24 104 #define CRYPT_ARCFOUR_KEYBYTES 16 105 #define CRYPT_ARCFOUR_KEYLENGTH 16 106 #define CRYPT_AES128_KEYBYTES 16 107 #define CRYPT_AES128_KEYLENGTH 16 108 #define CRYPT_AES256_KEYBYTES 32 109 #define CRYPT_AES256_KEYLENGTH 32 110 111 #define AES_TRUNCATED_HMAC_LEN 12 112 113 /* 114 * Max size of initialization vector and key. 115 * 256 bytes = 2048 bits. 116 */ 117 #define CRYPT_MAX_KEYLEN 256 118 #define CRYPT_MAX_IVLEN 256 119 120 typedef uint8_t crkeylen_t; 121 typedef uint8_t crivlen_t; 122 123 typedef uchar_t crmeth_t; 124 typedef uchar_t cropt_t; 125 typedef uchar_t crdir_t; 126 typedef uchar_t crivuse_t; 127 128 /* 129 * Define values for the option mask field. 130 * These can be extended to alter the behavior 131 * of the module. For example, when used by kerberized 132 * Unix r commands (rlogind, rshd), all msgs must be 133 * prepended with 4 bytes of clear text data that represent 134 * the 'length' of the cipher text that follows. 135 */ 136 #define CRYPTOPT_NONE 0x00 137 #define CRYPTOPT_RCMD_MODE_V1 0x01 138 #define CRYPTOPT_RCMD_MODE_V2 0x02 139 140 #define ANY_RCMD_MODE(m) ((m) & (CRYPTOPT_RCMD_MODE_V1 |\ 141 CRYPTOPT_RCMD_MODE_V2)) 142 143 /* Define the size of the length field used in 'rcmd' mode */ 144 #define RCMD_LEN_SZ sizeof (uint32_t) 145 146 #define CR_OPTIONS_OK(opt) ((opt) == CRYPTOPT_NONE || \ 147 ANY_RCMD_MODE(opt)) 148 /* 149 * Structure used by userland apps to pass data into crypto module 150 * with the CRIOCSETUP iotcl. 151 */ 152 struct cr_info_t { 153 uchar_t key[CRYPT_MAX_KEYLEN]; 154 uchar_t ivec[CRYPT_MAX_IVLEN]; 155 crkeylen_t keylen; 156 crivlen_t iveclen; 157 crivuse_t ivec_usage; 158 crdir_t direction_mask; 159 crmeth_t crypto_method; 160 cropt_t option_mask; 161 }; 162 163 #if defined(_KERNEL) 164 165 #define RCMDV1_USAGE 1026 166 #define ARCFOUR_DECRYPT_USAGE 1032 167 #define ARCFOUR_ENCRYPT_USAGE 1028 168 #define AES_ENCRYPT_USAGE 1028 169 #define AES_DECRYPT_USAGE 1032 170 171 #define DEFAULT_DES_BLOCKLEN 8 172 #define DEFAULT_AES_BLOCKLEN 16 173 #define ARCFOUR_EXP_SALT "fortybits" 174 175 struct cipher_data_t { 176 char *key; 177 char *block; 178 char *ivec; 179 char *saveblock; 180 crypto_mech_type_t mech_type; 181 crypto_key_t *ckey; /* initial encryption key */ 182 crypto_key_t d_encr_key; /* derived encr key */ 183 crypto_key_t d_hmac_key; /* derived hmac key */ 184 crypto_ctx_template_t enc_tmpl; 185 crypto_ctx_template_t hmac_tmpl; 186 crypto_context_t ctx; 187 size_t bytes; 188 crkeylen_t blocklen; 189 crkeylen_t keylen; 190 crkeylen_t ivlen; 191 crivuse_t ivec_usage; 192 crmeth_t method; 193 cropt_t option_mask; 194 }; 195 196 struct rcmd_state_t { 197 size_t pt_len; /* Plain text length */ 198 size_t cd_len; /* Cipher Data length */ 199 size_t cd_rcvd; /* Cipher Data bytes received so far */ 200 uint32_t next_len; 201 mblk_t *c_msg; /* mblk that will contain the new data */ 202 }; 203 204 /* Values for "ready" mask. */ 205 #define CRYPT_WRITE_READY 0x01 206 #define CRYPT_READ_READY 0x02 207 208 /* 209 * State information for the streams module. 210 */ 211 struct tmodinfo { 212 struct cipher_data_t enc_data; 213 struct cipher_data_t dec_data; 214 struct rcmd_state_t rcmd_state; 215 uchar_t ready; 216 }; 217 218 #endif /* _KERNEL */ 219 220 #ifdef __cplusplus 221 } 222 #endif 223 224 #endif /* _SYS_CRYPTMOD_H */ 225