/*
 * Copyright (c) 2012 Apple Computer, Inc. All rights reserved.
 *
 * @APPLE_LICENSE_HEADER_START@
 * 
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this
 * file.
 * 
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 * 
 * @APPLE_LICENSE_HEADER_END@
 */
/*
 * eap.h - Extensible Authentication Protocol definitions.
 *
 * Redistribution and use in source and binary forms are permitted
 * provided that the above copyright notice and this paragraph are
 * duplicated in all such forms and that any documentation,
 * advertising materials, and other materials related to such
 * distribution and use acknowledge that the software was developed
 * by the author.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 *
 * $Id: eap.h,v 1.7 2004/08/03 23:11:15 lindak Exp $
 */

#ifndef __EAP_H__
#define __EAP_H__

#include "vmbuf.h"
#include <CoreFoundation/CoreFoundation.h>

/*
 *  Challenge lengths (for challenges we send) and other limits.
 */
#define MAX_EAP_RESPONSE_LENGTH	1024	/* Max len for the EAP data part */
#define MAX_NAME_LENGTH		256

/* Code + ID + length */
#define EAP_HEADERLEN		4

/*
 * EAP codes.
 */

/* support for request types 1..4 is mandatory */
#define EAP_TYPE_NONE       0	/* No EAP type */
#define EAP_TYPE_IDENTITY	1	/* request for identity */
#define EAP_TYPE_NOTIFICATION	2	/* notification message */
#define EAP_TYPE_NAK		3	/* nak (response only) */
#define EAP_TYPE_MD5CHALLENGE	4	/* password MD5 coded */

#define EAP_TYPE_OTP		5	/* One Time Password (OTP) */
#define EAP_TYPE_TOKEN		6	/* Generic Token Card */

#define EAP_TYPE_RSA		9	/* RSA Public Key Authentication */
#define EAP_TYPE_DSS		10	/* DSS Unilateral */
#define EAP_TYPE_KEA		11	/* KEA */
#define EAP_TYPE_KEA_VALIDATE	12	/* KEA-VALIDATE */
#define EAP_TYPE_TLS		13	/* EAP-TLS */
#define EAP_TYPE_AXENT		14	/* Defender Token (AXENT) */
#define EAP_TYPE_RSA_SECURID	15	/* RSA Security SecurID EAP */
#define EAP_TYPE_ARCOT		16	/* Arcot Systems EAP */
#define EAP_TYPE_CISCO		17	/* EAP-Cisco Wireless */
#define EAP_TYPE_SIM		18	/* EAP-SIM */
#define EAP_TYPE_SRP_SHA1_1	19	/* SRP-SHA1 Part 1 */
#define EAP_TYPE_SRP_SHA1_2	20	/* SRP-SHA1 Part 2 */
#define EAP_TYPE_TTLS		21	/* EAP-TTLS */
#define EAP_TYPE_RAS		22	/* Remote Access Service */
#define EAP_TYPE_AKA		23	/* EAP-AKA */
#define EAP_TYPE_3COM		24	/* EAP-3Com Wireless */
#define EAP_TYPE_PEAP		25	/* PEAP */
#define EAP_TYPE_MS		26	/* MS-EAP-Authentication */
#define EAP_TYPE_MAKE		27	/* Mutual Authentication w/Key Exchange (MAKE) */
#define EAP_TYPE_CRYPTO		28	/* CRYPTOCard */
#define EAP_TYPE_MSCHAP_V2	29	/* EAP-MSCHAP-V2 */
#define EAP_TYPE_DYNAM_ID	30	/* DynamID */
#define EAP_TYPE_ROB		31	/* Rob EAP */
#define EAP_TYPE_SECUR_ID	32	/* SecurID EAP */
#define EAP_TYPE_MS_TLV		33	/* MS-Authentication-TLV  */
#define EAP_TYPE_SENTRINET	34	/* SentriNET */
#define EAP_TYPE_ACTIONTEC	35	/* EAP-Actiontec Wireless */
#define EAP_TYPE_COGENT		36	/* Cogent Systems Biometrics Authentication EAP */

#define kEAPPropertiesTypeEAPSIM        CFSTR("EAPSIMProperties")
#define kEAPPropertiesTypeEAPAKA        CFSTR("EAPAKAProperties")

#define EAP_REQUEST		1
#define EAP_RESPONSE		2
#define EAP_SUCCESS		3
#define EAP_FAILURE    		4


struct EAP_Packet
{
	u_int8_t    code;       	// packet type : 1 = Request, 2 = Response, 3 = Success, 4 = Failure
	u_int8_t    id;         	// packet id
	u_int16_t   len;  		// packet len (network order)
	u_int8_t    data[1];    	// packet data
} __attribute__((__packed__));

#define EAP_NOTIFICATION_NONE 		0
#define EAP_NOTIFICATION_START		1
#define EAP_NOTIFICATION_RESTART	2
#define EAP_NOTIFICATION_SUCCESS	3
#define EAP_NOTIFICATION_PACKET		4
#define EAP_NOTIFICATION_DATA_FROM_UI	5
#define EAP_NOTIFICATION_TIMEOUT	6

typedef struct EAP_Input {
	u_int16_t 	size; 		// size of the structure (for future extension)
	u_int8_t 	mode;		// 0 for client, 1 for server
	u_int8_t 	initial_id;	// initial EAP ID
	u_int16_t	mtu;		// mtu wll determine the maximum packet size to send
	u_int16_t	notification;	// notification the EAP engine sends to the module
	u_int16_t	data_len;	// len of the data
	void	*data;		// data to be consumed depending on the notification
	char 	*identity;	// authenticatee identity
	char 	*username;	// authenticatee user name
	char 	*password;	// authenticatee password
} EAP_Input_t;

#define EAP_ACTION_NONE			0
#define EAP_ACTION_SEND			1
#define EAP_ACTION_INVOKE_UI		2
#define EAP_ACTION_ACCESS_GRANTED	3
#define EAP_ACTION_ACCESS_DENIED	4
#define EAP_ACTION_SEND_WITH_TIMEOUT	5
#define EAP_ACTION_SEND_AND_DONE	6
#define EAP_ACTION_CANCEL		7


typedef struct EAP_Output {
	u_int16_t 	size; 		// size of the structure (for future extension)
	u_int16_t	action;		// action the EAP engine needs to perform
	u_int16_t	data_len;	// len of the data
	void	*data;		// data to be consumed depending on the action
	char 	*username;	// authenticatee user name (useful in server mode)
} EAP_Output_t;

enum {
	EAP_NO_ERROR = 0,
	EAP_ERROR_GENERIC,
	EAP_ERROR_INVALID_PACKET
};

/* attribute information returned upon successful authentication */

#define EAP_ATTRIBUTE_NONE		0
#define EAP_ATTRIBUTE_MPPE_SEND_KEY	1
#define EAP_ATTRIBUTE_MPPE_RECV_KEY	2

typedef struct EAP_Attribute {
	u_int16_t	type;		// type of the attribute
	u_int16_t	data_len;	// len of the data
	void	*data;		// data to be consumed depending on the type
	/* data follow according to the size */
} __attribute__((__packed__)) EAP_Attribute_t;

/*
 * Extension structure for eap types.
 */

#define EAP_EXT_CLIENT		0x1	// support client mode  

typedef struct eap_ext {
    struct eap_ext 	*next;		// next extensiopn structure
    u_int8_t 		type;		// eap type
    char 		*name;		// extension name
    u_int32_t 		flags;		// support flags
    void		*plugin;	// used to keep ref of the plugin
    int (*init) (EAP_Input_t *eap_in, void **context, CFDictionaryRef options);
    //int (*reinit) (void *context);
    int (*dispose) (void *context);
    int (*process) (void *context, EAP_Input_t *eap_in, EAP_Output_t *eap_out);
    int (*free) (void *context, EAP_Output_t *eap_out);
    int (*attribute) (void *context, EAP_Attribute_t *eap_attr);
    int (*identity) (char *identity, int maxlen);
	
} eap_ext_t;

typedef struct eap_state {
    int clientstate;		/* Client state */
	
    char *our_identity;		/* Our identity name */
    char *username;		/* the user name (only for client mode) */
    char *password;		/* the password (only for client mode) */
    char peer_identity[MAX_NAME_LENGTH];	/* peer name discovered with identity request */
	
    u_char req_id;		/* ID of last challenge */
    u_char resp_id;		/* ID of last response */
    u_char req_type;		/* last request type  */
	vchar_t *rcvd_msg;
    vchar_t *send_key;
    vchar_t *recv_key;
    
    eap_ext_t *client_ext;	/* client eap extension */
    void *client_ext_ctx;	/* client eap extension context */
    EAP_Input_t *client_ext_input;	/* client eap extension input structure */
    EAP_Output_t *client_ext_output;	/* client eap extension output structure */
    
    struct etypes *supported_eap_types;
    CFDictionaryRef extra_options;
} eap_state_t;

#define MPPE_MAX_KEY_LEN        16      /* largest key length (128-bit) */

int EapExtAdd(eap_ext_t *newext);

/*
 * Client (peer) states.
 */
#define EAPCS_INITIAL		0	/* Lower layer down, not opened */
#define EAPCS_CLOSED		1	/* Lower layer up, not opened */
#define EAPCS_PENDING		2	/* Auth us to peer when lower up */
#define EAPCS_LISTEN		3	/* Listening for a challenge */
#define EAPCS_OPEN		4	/* We've received Success */

int EapAuthWithPeer (eap_state_t *, vchar_t *, vchar_t *);
void EapLostFailure (eap_state_t *state);

int EAPLoad(eap_state_t *cstate);

void EapInit(eap_state_t *cstate);

void EapStart(eap_state_t *cstate, int);

void EapStop(eap_state_t *cstate);

int EapInput(eap_state_t *cstate, u_char *inpacket, int packet_len);

#endif