/*	$OpenBSD: eap.h,v 1.7 2024/07/13 12:22:46 yasuoka Exp $	*/

/*
 * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#ifndef IKED_EAP_H
#define IKED_EAP_H

struct eap_header {
	uint8_t		eap_code;
	uint8_t		eap_id;
	uint16_t	eap_length;
} __packed;

struct eap_message {
	uint8_t		eap_code;
	uint8_t		eap_id;
	uint16_t	eap_length;
	uint8_t		eap_type;
	/* Followed by type-specific data */
} __packed;

#define EAP_CODE_REQUEST	1	/* Request */
#define EAP_CODE_RESPONSE	2	/* Response */
#define EAP_CODE_SUCCESS	3	/* Success */
#define EAP_CODE_FAILURE	4	/* Failure */

extern struct iked_constmap eap_code_map[];

/* http://www.iana.org/assignments/eap-numbers */
#define EAP_TYPE_NONE		0	/* NONE */
#define EAP_TYPE_IDENTITY	1	/* RFC3748 */
#define EAP_TYPE_NOTIFICATION	2	/* RFC3748 */
#define EAP_TYPE_NAK		3	/* RFC3748 */
#define EAP_TYPE_MD5		4	/* RFC3748 */
#define EAP_TYPE_OTP		5	/* RFC3748 */
#define EAP_TYPE_GTC		6	/* RFC3748 */
#define EAP_TYPE_RSA		9	/* Whelan */
#define EAP_TYPE_DSS		10	/* Nace */
#define EAP_TYPE_KEA		11	/* Nace */
#define EAP_TYPE_KEA_VALIDATE	12	/* Nace */
#define EAP_TYPE_TLS		13	/* RFC5216 */
#define EAP_TYPE_AXENT		14	/* Rosselli */
#define EAP_TYPE_SECURID	15	/* Nystrm */
#define EAP_TYPE_ARCOT		16	/* Jerdonek */
#define EAP_TYPE_CISCO		17	/* Norman */
#define EAP_TYPE_SIM		18	/* RFC4186 */
#define EAP_TYPE_SRP_SHA1	19	/* Carlson */
#define EAP_TYPE_TTLS		21	/* Funk */
#define EAP_TYPE_RAS		22	/* Fields */
#define EAP_TYPE_OAAKA		23	/* RFC4187 */
#define EAP_TYPE_3COM		24	/* Young */
#define EAP_TYPE_PEAP		25	/* Palekar */
#define EAP_TYPE_MSCHAP_V2	26	/* Palekar */
#define EAP_TYPE_MAKE		27	/* Berrendonner */
#define EAP_TYPE_CRYPTOCARD	28	/* Webb */
#define EAP_TYPE_MSCHAP_V2_2	29	/* Potter */
#define EAP_TYPE_DYNAMID	30	/* Merlin */
#define EAP_TYPE_ROB		31	/* Ullah */
#define EAP_TYPE_POTP		32	/* RFC4794 */
#define EAP_TYPE_MS_TLV		33	/* Palekar */
#define EAP_TYPE_SENTRINET	34	/* Kelleher */
#define EAP_TYPE_ACTIONTEC	35	/* Chang */
#define EAP_TYPE_BIOMETRICS	36	/* Xiong */
#define EAP_TYPE_AIRFORTRESS	37	/* Hibbard */
#define EAP_TYPE_HTTP_DIGEST	38	/* Tavakoli */
#define EAP_TYPE_SECURESUITE	39	/* Clements */
#define EAP_TYPE_DEVICECONNECT	40	/* Pitard */
#define EAP_TYPE_SPEKE		41	/* Zick */
#define EAP_TYPE_MOBAC		42	/* Rixom */
#define EAP_TYPE_FAST		43	/* Cam-Winget */
#define EAP_TYPE_ZLX		44	/* Bogue */
#define EAP_TYPE_LINK		45	/* Zick */
#define EAP_TYPE_PAX		46	/* Clancy */
#define EAP_TYPE_PSK		47	/* RFC-bersani-eap-psk-11.txt */
#define EAP_TYPE_SAKE		48	/* RFC-vanderveen-eap-sake-02.txt */
#define EAP_TYPE_IKEV2		49	/* RFC5106 */
#define EAP_TYPE_AKA2		50	/* RFC5448 */
#define EAP_TYPE_GPSK		51	/* RFC5106 */
#define EAP_TYPE_PWD		52	/* RFC-harkins-emu-eap-pwd-12.txt */
#define EAP_TYPE_EXPANDED_TYPE	254	/* RFC3748 */
#define EAP_TYPE_EXPERIMENTAL	255	/* RFC3748 */
#define EAP_TYPE_RADIUS		10001	/* internal use for EAP RADIUS */

extern struct iked_constmap eap_type_map[];

/*
 * EAP MSCHAP-V2
 */

#define EAP_MSCHAP_CHALLENGE_SZ		16
#define EAP_MSCHAP_RESPONSE_SZ		49
#define EAP_MSCHAP_NTRESPONSE_SZ	24
#define EAP_MSCHAP_SUCCESS_SZ		42

#define EAP_MSOPCODE_CHALLENGE		1	/* Challenge */
#define EAP_MSOPCODE_RESPONSE		2	/* Response */
#define EAP_MSOPCODE_SUCCESS		3	/* Success */
#define EAP_MSOPCODE_FAILURE		4	/* Failure */
#define EAP_MSOPCODE_CHANGE_PASSWORD	7	/* Change Password */

extern struct iked_constmap eap_msopcode_map[];

struct eap_mschap {
	uint8_t				ms_opcode;
} __packed;

struct eap_mschap_challenge {
	uint8_t				msc_opcode;
	uint8_t				msc_id;
	uint16_t			msc_length;
	uint8_t				msc_valuesize;
	uint8_t				msc_challenge[EAP_MSCHAP_CHALLENGE_SZ];
	/* Followed by variable-size name field */
} __packed;

struct eap_mschap_peer {
	uint8_t				msp_challenge[EAP_MSCHAP_CHALLENGE_SZ];
	uint8_t				msp_reserved[8];
	uint8_t				msp_ntresponse[EAP_MSCHAP_NTRESPONSE_SZ];
	uint8_t				msp_flags;
};

struct eap_mschap_response {
	uint8_t				msr_opcode;
	uint8_t				msr_id;
	uint16_t			msr_length;
	uint8_t				msr_valuesize;
	union {
		uint8_t			resp_data[EAP_MSCHAP_RESPONSE_SZ];
		struct eap_mschap_peer	resp_peer;
	}				msr_response;
	/* Followed by variable-size name field */
} __packed;

struct eap_mschap_success {
	uint8_t				mss_opcode;
	uint8_t				mss_id;
	uint16_t			mss_length;
	/* Followed by variable-size success message */
} __packed;

struct eap_mschap_failure {
	uint8_t				msf_opcode;
	uint8_t				msf_id;
	uint16_t			msf_length;
	/* Followed by variable-size message field */
} __packed;

#define EAP_MSERROR_RESTRICTED_LOGON_HOURS	646	/* eap-mschapv2 */
#define EAP_MSERROR_ACCT_DISABLED		647	/* eap-mschapv2 */
#define EAP_MSERROR_PASSWD_EXPIRED		648	/* eap-mschapv2 */
#define EAP_MSERROR_NO_DIALIN_PERMISSION	649	/* eap-mschapv2 */
#define EAP_MSERROR_AUTHENTICATION_FAILURE	691	/* eap-mschapv2 */
#define EAP_MSERROR_CHANGING_PASSWORD		709	/* eap-mschapv2 */

extern struct iked_constmap eap_mserror_map[];

#endif /* IKED_EAP_H */