/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2000 by Cisco Systems, Inc.  All rights reserved.
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * This file implements the iSCSI CHAP authentication method based.
 * The code in this file is meant to be platform independent, and
 * makes use of only limited library functions, presently only string.h.
 * Platform dependent routines are  defined in iscsiAuthClient.h, but
 * implemented in another file.
 *
 * This code in this files assumes a single thread of execution
 * for each IscsiAuthClient structure, and does no locking.
 */

#include "iscsi.h"
#include "iscsiAuthClient.h"


struct iscsiAuthKeyInfo_t {
        const char *name;
};
typedef struct iscsiAuthKeyInfo_t IscsiAuthKeyInfo;


IscsiAuthClientGlobalStats iscsiAuthClientGlobalStats;

/*
 * Note: The ordering of this table must match the order
 *       defined by IscsiAuthKeyType in iscsiAuthClient.h.
 */
static IscsiAuthKeyInfo iscsiAuthClientKeyInfo[iscsiAuthKeyTypeMaxCount] = {
        {"AuthMethod"},
        {"CHAP_A"},
        {"CHAP_N"},
        {"CHAP_R"},
        {"CHAP_I"},
        {"CHAP_C"}
};

static const char iscsiAuthClientHexString[] = "0123456789abcdefABCDEF";
static const char iscsiAuthClientBase64String[] =
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
static const char iscsiAuthClientAuthMethodChapOptionName[] = "CHAP";


static int
iscsiAuthClientCheckString(const char *s,
    unsigned int maxLength, unsigned int *pOutLength)
{
        unsigned int length;

        if (!s) {
                return (TRUE);
        }

        for (length = 0; length < maxLength; length++) {
                if (*s++ == '\0') {
                        if (pOutLength) {
                                *pOutLength = length;
                        }
                        return (FALSE);
                }
        }

        return (TRUE);
}


static int
iscsiAuthClientStringCopy(char *stringOut, const char *stringIn,
    unsigned int length)
{
        if (!stringOut || !stringIn || length == 0) {
                return (TRUE);
        }

        while ((*stringOut++ = *stringIn++) != '\0') {
                if (--length == 0) {
                        stringOut--;
                        *stringOut = '\0';
                        return (TRUE);
                }
        }

        return (FALSE);
}


static int
iscsiAuthClientStringAppend(char *stringOut, const char *stringIn,
    unsigned int length)
{
        if (!stringOut || !stringIn || length == 0) {
                return (TRUE);
        }

        while (*stringOut++ != '\0') {
                if (--length == 0) {
                        stringOut--;
                        *stringOut = '\0';
                        return (TRUE);
                }
        }

        stringOut--;

        while ((*stringOut++ = *stringIn++) != '\0') {
                if (--length == 0) {
                        stringOut--;
                        *stringOut = '\0';
                        return (TRUE);
                }
        }

        return (FALSE);
}


static int
iscsiAuthClientStringIndex(const char *s, int c)
{
        int n = 0;

        while (*s != '\0') {
                if (*s++ == c) {
                        return (n);
                }
                n++;
        }

        return (-1);
}


static int
iscsiAuthClientCheckNodeType(int nodeType)
{
        if (nodeType == iscsiAuthNodeTypeInitiator ||
            nodeType == iscsiAuthNodeTypeTarget) {
                return (FALSE);
        }

        return (TRUE);
}


static int
iscsiAuthClientCheckVersion(int value)
{
        if (value == iscsiAuthVersionDraft8 || value == iscsiAuthVersionRfc) {

                return (FALSE);
        }

        return (TRUE);
}


static int
iscsiAuthClientCheckNegRole(int value)
{
        if (value == iscsiAuthNegRoleOriginator ||
            value == iscsiAuthNegRoleResponder) {
                return (FALSE);
        }

        return (TRUE);
}


static int
iscsiAuthClientCheckAuthMethodOption(int value)
{
        if (value == iscsiAuthOptionNone || value == iscsiAuthMethodChap) {

                return (FALSE);
        }

        return (TRUE);
}


static const char *
iscsiAuthClientAuthMethodOptionToText(IscsiAuthClient * client, int value)
{
        const char *s;

        switch (value) {
        case iscsiAuthOptionReject:
                s = client->rejectOptionName;
                break;

        case iscsiAuthOptionNone:
                s = client->noneOptionName;
                break;

        case iscsiAuthMethodChap:
                s = iscsiAuthClientAuthMethodChapOptionName;
                break;

        default:
                s = 0;
        }

        return (s);
}


static int
iscsiAuthClientCheckChapAlgorithmOption(int chapAlgorithm)
{
        if (chapAlgorithm == iscsiAuthOptionNone ||
            chapAlgorithm == iscsiAuthChapAlgorithmMd5) {
                return (FALSE);
        }

        return (TRUE);
}


static int
iscsiAuthClientDataToHex(unsigned char *data, unsigned int dataLength,
    char *text, unsigned int textLength)
{
        unsigned long n;

        if (!text || textLength == 0) {
                return (TRUE);
        }

        if (!data || dataLength == 0) {
                *text = '\0';
                return (TRUE);
        }

        if (textLength < 3) {
                *text = '\0';
                return (TRUE);
        }

        *text++ = '0';
        *text++ = 'x';

        textLength -= 2;

        while (dataLength > 0) {

                if (textLength < 3) {
                        *text = '\0';
                        return (TRUE);
                }

                n = *data++;
                dataLength--;

                *text++ = iscsiAuthClientHexString[(n >> 4) & 0xf];
                *text++ = iscsiAuthClientHexString[n & 0xf];

                textLength -= 2;
        }

        *text = '\0';

        return (FALSE);
}


static int
iscsiAuthClientDataToBase64(unsigned char *data, unsigned int dataLength,
    char *text, unsigned int textLength)
{
        unsigned long n;

        if (!text || textLength == 0) {
                return (TRUE);
        }

        if (!data || dataLength == 0) {
                *text = '\0';
                return (TRUE);
        }

        if (textLength < 3) {
                *text = '\0';
                return (TRUE);
        }

        *text++ = '0';
        *text++ = 'b';

        textLength -= 2;

        while (dataLength >= 3) {

                if (textLength < 5) {
                        *text = '\0';
                        return (TRUE);
                }

                n = *data++;
                n = (n << 8) | *data++;
                n = (n << 8) | *data++;
                dataLength -= 3;

                *text++ = iscsiAuthClientBase64String[(n >> 18) & 0x3f];
                *text++ = iscsiAuthClientBase64String[(n >> 12) & 0x3f];
                *text++ = iscsiAuthClientBase64String[(n >> 6) & 0x3f];
                *text++ = iscsiAuthClientBase64String[n & 0x3f];

                textLength -= 4;
        }

        if (dataLength == 1) {

                if (textLength < 5) {
                        *text = '\0';
                        return (TRUE);
                }

                n = *data++;
                n = n << 4;

                *text++ = iscsiAuthClientBase64String[(n >> 6) & 0x3f];
                *text++ = iscsiAuthClientBase64String[n & 0x3f];
                *text++ = '=';
                *text++ = '=';

        } else if (dataLength == 2) {

                if (textLength < 5) {
                        return (TRUE);
                }

                n = *data++;
                n = (n << 8) | *data++;
                n = n << 2;

                *text++ = iscsiAuthClientBase64String[(n >> 12) & 0x3f];
                *text++ = iscsiAuthClientBase64String[(n >> 6) & 0x3f];
                *text++ = iscsiAuthClientBase64String[n & 0x3f];
                *text++ = '=';
        }

        *text = '\0';

        return (FALSE);
}


static int
iscsiAuthClientDataToText(int base64, unsigned char *data,
    unsigned int dataLength, char *text, unsigned int textLength)
{
        int status;

        if (base64) {
                status = iscsiAuthClientDataToBase64(
                    data, dataLength, text, textLength);
        } else {
                status = iscsiAuthClientDataToHex(
                    data, dataLength, text, textLength);
        }

        return (status);
}


static int
iscsiAuthClientHexToData(const char *text, unsigned int textLength,
    unsigned char *data, unsigned int *pDataLength)
{
        int i;
        unsigned int n1;
        unsigned int n2;
        unsigned int dataLength = *pDataLength;

        if ((textLength % 2) == 1) {
                i = iscsiAuthClientStringIndex(iscsiAuthClientHexString,
                    *text++);
                if (i < 0) {
                        return (TRUE);  /* error, bad character */
                }

                if (i > 15)
                        i -= 6;
                n2 = i;

                if (dataLength < 1) {
                        return (TRUE);  /* error, too much data */
                }

                *data++ = n2;
                dataLength--;
        }

        while (*text != '\0') {

                i = iscsiAuthClientStringIndex(
                    iscsiAuthClientHexString, *text++);
                if (i < 0) {
                        return (TRUE);  /* error, bad character */
                }

                if (i > 15)
                        i -= 6;
                n1 = i;

                if (*text == '\0') {
                        return (TRUE);  /* error, odd string length */
                }

                i = iscsiAuthClientStringIndex(
                    iscsiAuthClientHexString, *text++);
                if (i < 0) {
                        return (TRUE);  /* error, bad character */
                }

                if (i > 15)
                        i -= 6;
                n2 = i;

                if (dataLength < 1) {
                        return (TRUE);  /* error, too much data */
                }

                *data++ = (n1 << 4) | n2;
                dataLength--;
        }

        if (dataLength >= *pDataLength) {
                return (TRUE);  /* error, no data */
        }

        *pDataLength = *pDataLength - dataLength;

        return (FALSE);         /* no error */
}


static int
iscsiAuthClientBase64ToData(const char *text, unsigned int textLength,
    unsigned char *data, unsigned int *pDataLength)
{
        int i;
        unsigned int n;
        unsigned int count;
        unsigned int dataLength = *pDataLength;

        textLength = textLength;        /* not used */

        n = 0;
        count = 0;

        while (*text != '\0' && *text != '=') {

                i = iscsiAuthClientStringIndex(
                    iscsiAuthClientBase64String, *text++);
                if (i < 0) {
                        return (TRUE);  /* error, bad character */
                }

                n = (n << 6 | (unsigned int)i);
                count++;

                if (count >= 4) {
                        if (dataLength < 3) {
                                return (TRUE);  /* error, too much data */
                        }
                        *data++ = n >> 16;
                        *data++ = n >> 8;
                        *data++ = n;
                        dataLength -= 3;
                        n = 0;
                        count = 0;
                }
        }

        while (*text != '\0') {
                if (*text++ != '=') {
                        return (TRUE);  /* error, bad pad */
                }
        }

        if (count == 0) {
                /*
                 * do nothing
                 */
                /* EMPTY */
        } else if (count == 2) {
                if (dataLength < 1) {
                        return (TRUE);  /* error, too much data */
                }
                n = n >> 4;
                *data++ = n;
                dataLength--;
        } else if (count == 3) {
                if (dataLength < 2) {
                        return (TRUE);  /* error, too much data */
                }
                n = n >> 2;
                *data++ = n >> 8;
                *data++ = n;
                dataLength -= 2;
        } else {
                return (TRUE);  /* bad encoding */
        }

        if (dataLength >= *pDataLength) {
                return (TRUE);  /* error, no data */
        }

        *pDataLength = *pDataLength - dataLength;

        return (FALSE);         /* no error */
}


static int
iscsiAuthClientTextToData(const char *text, unsigned char *data,
    unsigned int *dataLength)
{
        int status;
        unsigned int textLength;

        status = iscsiAuthClientCheckString(text,
            2 + 2 * iscsiAuthLargeBinaryMaxLength + 1, &textLength);

        if (status) {
                return (status);
        }

        if (text[0] == '0' && (text[1] == 'x' || text[1] == 'X')) {
                /*
                 * skip prefix
                 */
                text += 2;
                textLength -= 2;
                status = iscsiAuthClientHexToData(text,
                    textLength, data, dataLength);
        } else if (text[0] == '0' && (text[1] == 'b' || text[1] == 'B')) {
                /*
                 * skip prefix
                 */
                text += 2;
                textLength -= 2;
                status = iscsiAuthClientBase64ToData(text,
                    textLength, data, dataLength);
        } else {
                status = TRUE;  /* prefix not recognized. */
        }

        return (status);
}


static IscsiAuthDebugStatus
iscsiAuthClientChapComputeResponse(IscsiAuthClient * client,
    int remoteAuthentication, unsigned int id,
    unsigned char *challengeData, unsigned int challengeLength,
    unsigned char *responseData)
{
        unsigned char idData[1];
        IscsiAuthMd5Context context;
        unsigned char outData[iscsiAuthStringMaxLength];
        unsigned int outLength = iscsiAuthStringMaxLength;

        if (!client->passwordPresent) {
                return (iscsiAuthDebugStatusLocalPasswordNotSet);
        }

        iscsiAuthMd5Init(&context);

        /*
         * id byte
         */
        idData[0] = id;
        iscsiAuthMd5Update(&context, idData, 1);

        /*
         * decrypt password
         */
        if (iscsiAuthClientData(outData, &outLength,
            client->passwordData, client->passwordLength)) {

                return (iscsiAuthDebugStatusPasswordDecryptFailed);
        }

        if (!remoteAuthentication && !client->ipSec && outLength < 12) {
                return (iscsiAuthDebugStatusPasswordTooShortWithNoIpSec);
        }

        /*
         * shared secret
         */
        iscsiAuthMd5Update(&context, outData, outLength);

        /*
         * clear decrypted password
         */
        bzero(outData, iscsiAuthStringMaxLength);

        /*
         * challenge value
         */
        iscsiAuthMd5Update(&context, challengeData, challengeLength);

        iscsiAuthMd5Final(responseData, &context);

        return (iscsiAuthDebugStatusNotSet);    /* no error */
}


static void
iscsiAuthClientInitKeyBlock(IscsiAuthKeyBlock * keyBlock)
{
        char *stringBlock = keyBlock->stringBlock;

        bzero(keyBlock, sizeof (*keyBlock));
        keyBlock->stringBlock = stringBlock;
}


static void
iscsiAuthClientSetKeyValue(IscsiAuthKeyBlock * keyBlock,
    int keyType, const char *keyValue)
{
        unsigned int length;
        char *string;

        if (keyBlock->key[keyType].valueSet) {
                keyBlock->duplicateSet = TRUE;
                return;
        }

        keyBlock->key[keyType].valueSet = TRUE;

        if (!keyValue) {
                return;
        }

        if (iscsiAuthClientCheckString(keyValue,
            iscsiAuthStringMaxLength, &length)) {
                keyBlock->stringTooLong = TRUE;
                return;
        }

        length += 1;

        if ((keyBlock->blockLength + length) > iscsiAuthStringBlockMaxLength) {
                keyBlock->tooMuchData = TRUE;
                return;
        }

        string = &keyBlock->stringBlock[keyBlock->blockLength];

        if (iscsiAuthClientStringCopy(string, keyValue, length)) {
                keyBlock->tooMuchData = TRUE;
                return;
        }
        keyBlock->blockLength += length;

        keyBlock->key[keyType].string = string;
        keyBlock->key[keyType].present = TRUE;
}


static const char *
iscsiAuthClientGetKeyValue(IscsiAuthKeyBlock * keyBlock, int keyType)
{
        keyBlock->key[keyType].processed = TRUE;

        if (!keyBlock->key[keyType].present) {
                return (0);
        }

        return (keyBlock->key[keyType].string);
}


static void
iscsiAuthClientCheckKey(IscsiAuthClient * client,
    int keyType,
    int *negotiatedOption,
    unsigned int optionCount,
    int *optionList, const char *(*valueToText) (IscsiAuthClient *, int))
{
        const char *keyValue;
        int length;
        unsigned int i;

        keyValue = iscsiAuthClientGetKeyValue(&client->recvKeyBlock, keyType);
        if (!keyValue) {
                *negotiatedOption = iscsiAuthOptionNotPresent;
                return;
        }

        while (*keyValue != '\0') {

                length = 0;

                while (*keyValue != '\0' && *keyValue != ',') {
                        client->scratchKeyValue[length++] = *keyValue++;
                }

                if (*keyValue == ',')
                        keyValue++;
                client->scratchKeyValue[length++] = '\0';

                for (i = 0; i < optionCount; i++) {
                        const char *s = (*valueToText) (client, optionList[i]);

                        if (!s)
                                continue;

                        if (strcmp(client->scratchKeyValue, s) == 0) {
                                *negotiatedOption = optionList[i];
                                return;
                        }
                }
        }

        *negotiatedOption = iscsiAuthOptionReject;
}


static void
iscsiAuthClientSetKey(IscsiAuthClient * client,
    int keyType,
    unsigned int optionCount,
    int *optionList, const char *(*valueToText) (IscsiAuthClient *, int))
{
        unsigned int i;

        if (optionCount == 0) {
                /*
                 * No valid options to send, but we always want to
                 * send something.
                 */
                iscsiAuthClientSetKeyValue(&client->sendKeyBlock, keyType,
                    client->noneOptionName);
                return;
        }

        if (optionCount == 1 && optionList[0] == iscsiAuthOptionNotPresent) {
                iscsiAuthClientSetKeyValue(&client->sendKeyBlock, keyType, 0);
                return;
        }

        for (i = 0; i < optionCount; i++) {
                const char *s = (*valueToText) (client, optionList[i]);

                if (!s)
                        continue;

                if (i == 0) {
                        (void) iscsiAuthClientStringCopy(
                            client->scratchKeyValue,
                            s, iscsiAuthStringMaxLength);
                } else {
                        (void) iscsiAuthClientStringAppend(
                            client->scratchKeyValue,
                            ",", iscsiAuthStringMaxLength);
                        (void) iscsiAuthClientStringAppend(
                            client->scratchKeyValue,
                            s, iscsiAuthStringMaxLength);
                }
        }

        iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
            keyType, client->scratchKeyValue);
}


static void
iscsiAuthClientCheckAuthMethodKey(IscsiAuthClient * client)
{
        iscsiAuthClientCheckKey(client,
            iscsiAuthKeyTypeAuthMethod,
            &client->negotiatedAuthMethod,
            client->authMethodValidCount,
            client->authMethodValidList, iscsiAuthClientAuthMethodOptionToText);
}


static void
iscsiAuthClientSetAuthMethodKey(IscsiAuthClient * client,
    unsigned int authMethodCount, int *authMethodList)
{
        iscsiAuthClientSetKey(client, iscsiAuthKeyTypeAuthMethod,
            authMethodCount, authMethodList,
            iscsiAuthClientAuthMethodOptionToText);
}


static void
iscsiAuthClientCheckChapAlgorithmKey(IscsiAuthClient * client)
{
        const char *keyValue;
        int length;
        unsigned long number;
        unsigned int i;

        keyValue = iscsiAuthClientGetKeyValue(&client->recvKeyBlock,
            iscsiAuthKeyTypeChapAlgorithm);
        if (!keyValue) {
                client->negotiatedChapAlgorithm = iscsiAuthOptionNotPresent;
                return;
        }

        while (*keyValue != '\0') {
                length = 0;

                while (*keyValue != '\0' && *keyValue != ',') {
                        client->scratchKeyValue[length++] = *keyValue++;
                }

                if (*keyValue == ',')
                        keyValue++;
                client->scratchKeyValue[length++] = '\0';

                if (iscsiAuthClientTextToNumber(client->scratchKeyValue,
                    &number)) {
                        continue;
                }

                for (i = 0; i < client->chapAlgorithmCount; i++) {

                        if (number == (unsigned long)client->
                            chapAlgorithmList[i]) {
                                client->negotiatedChapAlgorithm = number;
                                return;
                        }
                }
        }

        client->negotiatedChapAlgorithm = iscsiAuthOptionReject;
}


static void
iscsiAuthClientSetChapAlgorithmKey(IscsiAuthClient * client,
    unsigned int chapAlgorithmCount, int *chapAlgorithmList)
{
        unsigned int i;

        if (chapAlgorithmCount == 0) {
                iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
                    iscsiAuthKeyTypeChapAlgorithm, 0);
                return;
        }

        if (chapAlgorithmCount == 1 &&
            chapAlgorithmList[0] == iscsiAuthOptionNotPresent) {
                iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
                    iscsiAuthKeyTypeChapAlgorithm, 0);
                return;
        }

        if (chapAlgorithmCount == 1 &&
            chapAlgorithmList[0] == iscsiAuthOptionReject) {
                iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
                    iscsiAuthKeyTypeChapAlgorithm, client->rejectOptionName);
                return;
        }

        for (i = 0; i < chapAlgorithmCount; i++) {
                char s[20];

                iscsiAuthClientNumberToText(chapAlgorithmList[i],
                    s, sizeof (s));

                if (i == 0) {
                        (void) iscsiAuthClientStringCopy(
                            client->scratchKeyValue, s,
                            iscsiAuthStringMaxLength);
                } else {
                        (void) iscsiAuthClientStringAppend(
                            client->scratchKeyValue,
                            ",", iscsiAuthStringMaxLength);
                        (void) iscsiAuthClientStringAppend(
                            client->scratchKeyValue,
                            s, iscsiAuthStringMaxLength);
                }
        }

        iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
            iscsiAuthKeyTypeChapAlgorithm, client->scratchKeyValue);
}


static void
iscsiAuthClientNextPhase(IscsiAuthClient * client)
{
        switch (client->phase) {
        case iscsiAuthPhaseConfigure:
                client->phase = iscsiAuthPhaseNegotiate;
                break;

        case iscsiAuthPhaseNegotiate:
                client->phase = iscsiAuthPhaseAuthenticate;

                if (client->negotiatedAuthMethod ==
                    iscsiAuthOptionReject ||
                    client->negotiatedAuthMethod ==
                    iscsiAuthOptionNotPresent ||
                    client->negotiatedAuthMethod == iscsiAuthOptionNone) {

                        client->localState = iscsiAuthLocalStateDone;
                        client->remoteState = iscsiAuthRemoteStateDone;

                        if (client->authRemote) {
                                client->remoteAuthStatus = iscsiAuthStatusFail;
                                client->phase = iscsiAuthPhaseDone;
                        } else {
                                client->remoteAuthStatus = iscsiAuthStatusPass;
                        }

                        switch (client->negotiatedAuthMethod) {
                        case iscsiAuthOptionReject:
                                client->debugStatus =
                                    iscsiAuthDebugStatusAuthMethodReject;
                                break;

                        case iscsiAuthOptionNotPresent:
                                client->debugStatus =
                                    iscsiAuthDebugStatusAuthMethodNotPresent;
                                break;

                        case iscsiAuthOptionNone:
                                client->debugStatus =
                                    iscsiAuthDebugStatusAuthMethodNone;
                        }

                } else if (client->negotiatedAuthMethod ==
                    iscsiAuthMethodChap) {
                        client->localState = iscsiAuthLocalStateSendAlgorithm;
                        client->remoteState = iscsiAuthRemoteStateSendAlgorithm;
                } else {
                        client->localState = iscsiAuthLocalStateDone;
                        client->remoteState = iscsiAuthRemoteStateDone;
                        client->remoteAuthStatus = iscsiAuthStatusFail;
                        client->debugStatus = iscsiAuthDebugStatusAuthMethodBad;
                }

                break;

        case iscsiAuthPhaseAuthenticate:
                client->phase = iscsiAuthPhaseDone;
                break;

        case iscsiAuthPhaseDone:
        case iscsiAuthPhaseError:
        default:
                client->phase = iscsiAuthPhaseError;
        }
}


static void
iscsiAuthClientLocalAuthentication(IscsiAuthClient * client)
{
        unsigned int chapIdentifier;
        unsigned char responseData[iscsiAuthChapResponseLength];
        unsigned long number;
        int status;
        IscsiAuthDebugStatus debugStatus;
        const char *chapIdentifierKeyValue;
        const char *chapChallengeKeyValue;

        switch (client->localState) {
        case iscsiAuthLocalStateSendAlgorithm:
                if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                        iscsiAuthClientSetChapAlgorithmKey(
                            client, client->chapAlgorithmCount,
                            client->chapAlgorithmList);
                        client->localState = iscsiAuthLocalStateRecvAlgorithm;
                        break;
                }

                /* FALLTHRU */

        case iscsiAuthLocalStateRecvAlgorithm:
                iscsiAuthClientCheckChapAlgorithmKey(client);

                if (client->nodeType == iscsiAuthNodeTypeTarget) {

                        iscsiAuthClientSetChapAlgorithmKey(client, 1,
                            &client->negotiatedChapAlgorithm);
                }

                /*
                 * Make sure only supported CHAP algorithm is used.
                 */
                if (client->negotiatedChapAlgorithm ==
                    iscsiAuthOptionNotPresent) {
                        client->localState = iscsiAuthLocalStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapAlgorithmExpected;
                        break;

                } else if (client->negotiatedChapAlgorithm ==
                    iscsiAuthOptionReject) {
                        client->localState = iscsiAuthLocalStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapAlgorithmReject;
                        break;

                } else if (client->negotiatedChapAlgorithm !=
                    iscsiAuthChapAlgorithmMd5) {
                        client->localState = iscsiAuthLocalStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapAlgorithmBad;
                        break;
                }

                if (client->nodeType == iscsiAuthNodeTypeTarget) {

                        client->localState = iscsiAuthLocalStateRecvChallenge;
                        break;
                }

                /* FALLTHRU */

        case iscsiAuthLocalStateRecvChallenge:
                chapIdentifierKeyValue = iscsiAuthClientGetKeyValue(
                    &client->recvKeyBlock, iscsiAuthKeyTypeChapIdentifier);
                chapChallengeKeyValue = iscsiAuthClientGetKeyValue(
                    &client->recvKeyBlock, iscsiAuthKeyTypeChapChallenge);

                if (client->nodeType == iscsiAuthNodeTypeTarget) {
                        if (!chapIdentifierKeyValue && !chapChallengeKeyValue) {
                                client->localState = iscsiAuthLocalStateDone;
                                break;
                        }
                }

                if (!chapIdentifierKeyValue) {
                        client->localState = iscsiAuthLocalStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapIdentifierExpected;
                        break;
                }

                if (!chapChallengeKeyValue) {
                        client->localState = iscsiAuthLocalStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapChallengeExpected;
                        break;
                }

                status = iscsiAuthClientTextToNumber(
                    chapIdentifierKeyValue, &number);

                if (status || (255 < number)) {
                        client->localState = iscsiAuthLocalStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapIdentifierBad;
                        break;
                }
                chapIdentifier = number;

                if (client->recvChapChallengeStatus) {
                        client->localState = iscsiAuthLocalStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapChallengeBad;
                        break;
                }

                if (client->nodeType == iscsiAuthNodeTypeTarget &&
                    client->recvChapChallenge.length ==
                    client->sendChapChallenge.length &&
                    bcmp(client->recvChapChallenge.largeBinary,
                    client->sendChapChallenge.largeBinary,
                    client->sendChapChallenge.length) == 0) {

                        client->localState = iscsiAuthLocalStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapChallengeReflected;
                        break;
                }

                debugStatus = iscsiAuthClientChapComputeResponse(client,
                    FALSE,
                    chapIdentifier,
                    client->recvChapChallenge.largeBinary,
                    client->recvChapChallenge.length, responseData);

                if (debugStatus != iscsiAuthDebugStatusNotSet) {
                        client->localState = iscsiAuthLocalStateError;
                        client->debugStatus = debugStatus;
                        break;
                }

                (void) iscsiAuthClientDataToText(client->base64,
                    responseData, iscsiAuthChapResponseLength,
                    client->scratchKeyValue, iscsiAuthStringMaxLength);
                iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
                    iscsiAuthKeyTypeChapResponse, client->scratchKeyValue);

                iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
                    iscsiAuthKeyTypeChapUsername, client->username);

                client->localState = iscsiAuthLocalStateDone;
                break;

        case iscsiAuthLocalStateDone:
                break;

        case iscsiAuthLocalStateError:
        default:
                client->phase = iscsiAuthPhaseError;
        }
}


static void
iscsiAuthClientRemoteAuthentication(IscsiAuthClient * client)
{
        unsigned char idData[1];
        unsigned char responseData[iscsiAuthStringMaxLength];
        unsigned int responseLength = iscsiAuthStringMaxLength;
        unsigned char myResponseData[iscsiAuthChapResponseLength];
        int status;
        IscsiAuthDebugStatus debugStatus;
        const char *chapResponseKeyValue;
        const char *chapUsernameKeyValue;

        switch (client->remoteState) {
        case iscsiAuthRemoteStateSendAlgorithm:
                if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                        client->remoteState = iscsiAuthRemoteStateSendChallenge;
                        break;
                }

                /* FALLTHRU */

        case iscsiAuthRemoteStateSendChallenge:
                if (!client->authRemote) {
                        client->remoteAuthStatus = iscsiAuthStatusPass;
                        client->debugStatus =
                            iscsiAuthDebugStatusAuthRemoteFalse;
                        client->remoteState = iscsiAuthRemoteStateDone;
                        break;
                }

                iscsiAuthRandomSetData(idData, 1);
                client->sendChapIdentifier = idData[0];

                iscsiAuthClientNumberToText(client->sendChapIdentifier,
                    client->scratchKeyValue, iscsiAuthStringMaxLength);
                iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
                    iscsiAuthKeyTypeChapIdentifier, client->scratchKeyValue);

                client->sendChapChallenge.length = client->chapChallengeLength;
                iscsiAuthRandomSetData(client->sendChapChallenge.largeBinary,
                    client->sendChapChallenge.length);

                iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
                    iscsiAuthKeyTypeChapChallenge, "");

                client->remoteState = iscsiAuthRemoteStateRecvResponse;
                break;

        case iscsiAuthRemoteStateRecvResponse:
                chapResponseKeyValue = iscsiAuthClientGetKeyValue(
                    &client->recvKeyBlock, iscsiAuthKeyTypeChapResponse);

                chapUsernameKeyValue = iscsiAuthClientGetKeyValue(
                    &client->recvKeyBlock, iscsiAuthKeyTypeChapUsername);

                if (!chapResponseKeyValue) {
                        client->remoteState = iscsiAuthRemoteStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapResponseExpected;
                        break;
                }

                if (!chapUsernameKeyValue) {
                        client->remoteState = iscsiAuthRemoteStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapUsernameExpected;
                        break;
                }

                status = iscsiAuthClientTextToData(chapResponseKeyValue,
                    responseData, &responseLength);

                if (status) {
                        client->remoteState = iscsiAuthRemoteStateError;
                        client->debugStatus =
                            iscsiAuthDebugStatusChapResponseBad;
                        break;
                }

                if (responseLength == iscsiAuthChapResponseLength) {
                        debugStatus = iscsiAuthClientChapComputeResponse(
                            client, TRUE, client->sendChapIdentifier,
                            client->sendChapChallenge.largeBinary,
                            client->sendChapChallenge.length, myResponseData);

                        /*
                         * Check if the same CHAP secret is being used for
                         * authentication in both directions.
                         */
                        if (debugStatus == iscsiAuthDebugStatusNotSet &&
                            bcmp(myResponseData, responseData,
                            iscsiAuthChapResponseLength) == 0) {

                                client->remoteState =
                                    iscsiAuthRemoteStateError;
                                client->debugStatus =
                                    iscsiAuthDebugStatusPasswordIdentical;
                                break;
                        }
                }

                (void) iscsiAuthClientStringCopy(client->chapUsername,
                    chapUsernameKeyValue, iscsiAuthStringMaxLength);

                /* To verify the target's response. */
                status = iscsiAuthClientChapAuthRequest(
                    client, client->chapUsername, client->sendChapIdentifier,
                    client->sendChapChallenge.largeBinary,
                    client->sendChapChallenge.length, responseData,
                    responseLength);

                if (status == iscsiAuthStatusInProgress) {
                        iscsiAuthClientGlobalStats.requestSent++;
                        client->remoteState = iscsiAuthRemoteStateAuthRequest;
                        break;
                }

                client->remoteAuthStatus = (IscsiAuthStatus) status;
                client->authResponseFlag = TRUE;

                /* FALLTHRU */

        case iscsiAuthRemoteStateAuthRequest:
                /*
                 * client->remoteAuthStatus already set
                 */
                if (client->authServerErrorFlag) {
                        client->remoteAuthStatus = iscsiAuthStatusFail;
                        client->debugStatus =
                            iscsiAuthDebugStatusAuthServerError;
                } else if (client->remoteAuthStatus == iscsiAuthStatusPass) {
                        client->debugStatus = iscsiAuthDebugStatusAuthPass;
                } else if (client->remoteAuthStatus == iscsiAuthStatusFail) {
                        client->debugStatus = iscsiAuthDebugStatusAuthFail;
                } else {
                        client->remoteAuthStatus = iscsiAuthStatusFail;
                        client->debugStatus = iscsiAuthDebugStatusAuthStatusBad;
                }
                client->remoteState = iscsiAuthRemoteStateDone;

                /* FALLTHRU */

        case iscsiAuthRemoteStateDone:
                break;

        case iscsiAuthRemoteStateError:
        default:
                client->phase = iscsiAuthPhaseError;
        }
}


static void
iscsiAuthClientHandshake(IscsiAuthClient * client)
{
        if (client->phase == iscsiAuthPhaseDone) {
                /*
                 * Should only happen if authentication
                 * protocol error occured.
                 */
                return;
        }

        if (client->remoteState == iscsiAuthRemoteStateAuthRequest) {
                /*
                 * Defer until authentication response received
                 * from internal authentication service.
                 */
                return;
        }

        if (client->nodeType == iscsiAuthNodeTypeInitiator) {

                /*
                 * Target should only have set T bit on response if
                 * initiator set it on previous message.
                 */
                if (client->recvKeyBlock.transitBit &&
                    client->transitBitSentFlag == 0) {
                        client->remoteAuthStatus = iscsiAuthStatusFail;
                        client->phase = iscsiAuthPhaseDone;
                        client->debugStatus =
                            iscsiAuthDebugStatusTbitSetIllegal;
                        return;
                }
        }

        if (client->phase == iscsiAuthPhaseNegotiate) {
                /*
                 * Should only happen if waiting for peer
                 * to send AuthMethod key or set Transit Bit.
                 */
                if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                        client->sendKeyBlock.transitBit = TRUE;
                }
                return;
        }

        if (client->remoteState == iscsiAuthRemoteStateRecvResponse ||
            client->remoteState == iscsiAuthRemoteStateDone) {

                if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                        if (client->recvKeyBlock.transitBit) {
                                if (client->remoteState !=
                                    iscsiAuthRemoteStateDone) {
                                        goto recvTransitBitError;
                                }
                                iscsiAuthClientNextPhase(client);
                        } else {
                                client->sendKeyBlock.transitBit = TRUE;
                        }
                } else {
                        if (client->remoteState == iscsiAuthRemoteStateDone &&
                            client->remoteAuthStatus != iscsiAuthStatusPass) {

                                /*
                                 * Authentication failed, don't
                                 * do T bit handshake.
                                 */
                                iscsiAuthClientNextPhase(client);
                        } else {

                                /*
                                 * Target can only set T bit on response if
                                 * initiator set it on current message.
                                 */
                                if (client->recvKeyBlock.transitBit) {
                                        client->sendKeyBlock.transitBit = TRUE;
                                        iscsiAuthClientNextPhase(client);
                                }
                        }
                }
        } else {
                if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                        if (client->recvKeyBlock.transitBit) {
                                goto recvTransitBitError;
                        }
                }
        }

        return;

recvTransitBitError:
        /*
         * Target set T bit on response but
         * initiator was not done with authentication.
         */
        client->remoteAuthStatus = iscsiAuthStatusFail;
        client->phase = iscsiAuthPhaseDone;
        client->debugStatus = iscsiAuthDebugStatusTbitSetPremature;
}


static int
iscsiAuthClientRecvEndStatus(IscsiAuthClient * client)
{
        int authStatus;
        int keyType;

        if (client->phase == iscsiAuthPhaseError) {
                return (iscsiAuthStatusError);
        }

        if (client->phase == iscsiAuthPhaseDone) {

                /*
                 * Perform sanity check against configured parameters.
                 */

                if (client->authRemote && !client->authResponseFlag &&
                    client->remoteAuthStatus == iscsiAuthStatusPass) {

                        client->remoteAuthStatus = iscsiAuthStatusFail;
                        client->debugStatus =
                            iscsiAuthDebugStatusAuthPassNotValid;
                }

                authStatus = client->remoteAuthStatus;
        } else if (client->remoteState == iscsiAuthRemoteStateAuthRequest) {
                authStatus = iscsiAuthStatusInProgress;
        } else {
                authStatus = iscsiAuthStatusContinue;
        }

        if (authStatus != iscsiAuthStatusInProgress) {
                client->recvInProgressFlag = FALSE;
        }

        if (authStatus == iscsiAuthStatusContinue ||
            authStatus == iscsiAuthStatusPass) {
                if (client->sendKeyBlock.duplicateSet) {
                        client->remoteAuthStatus = iscsiAuthStatusFail;
                        client->phase = iscsiAuthPhaseDone;
                        client->debugStatus =
                            iscsiAuthDebugStatusSendDuplicateSetKeyValue;
                        authStatus = iscsiAuthStatusFail;
                } else if (client->sendKeyBlock.stringTooLong) {
                        client->remoteAuthStatus = iscsiAuthStatusFail;
                        client->phase = iscsiAuthPhaseDone;
                        client->debugStatus =
                            iscsiAuthDebugStatusSendStringTooLong;
                        authStatus = iscsiAuthStatusFail;
                } else if (client->sendKeyBlock.tooMuchData) {
                        client->remoteAuthStatus = iscsiAuthStatusFail;
                        client->phase = iscsiAuthPhaseDone;
                        client->debugStatus =
                            iscsiAuthDebugStatusSendTooMuchData;
                        authStatus = iscsiAuthStatusFail;
                } else {
                        /*
                         * Check that all incoming keys have been processed.
                         */
                        for (keyType = iscsiAuthKeyTypeFirst;
                            keyType < iscsiAuthKeyTypeMaxCount; keyType++) {
                                if (client->recvKeyBlock.key[keyType].present &&
                                    client->recvKeyBlock.key[keyType].
                                    processed == 0) {
                                        break;
                                }
                        }

                        if (keyType < iscsiAuthKeyTypeMaxCount) {
                                client->remoteAuthStatus = iscsiAuthStatusFail;
                                client->phase = iscsiAuthPhaseDone;
                                client->debugStatus =
                                    iscsiAuthDebugStatusUnexpectedKeyPresent;
                                authStatus = iscsiAuthStatusFail;
                        }
                }
        }

        if (authStatus != iscsiAuthStatusPass &&
            authStatus != iscsiAuthStatusContinue &&
            authStatus != iscsiAuthStatusInProgress) {
                int authMethodKeyPresent = FALSE;
                int chapAlgorithmKeyPresent = FALSE;

                /*
                 * Suppress send keys on error, except
                 * for AuthMethod and CHAP_A.
                 */
                if (client->nodeType == iscsiAuthNodeTypeTarget) {
                        if (iscsiAuthClientGetKeyValue(&client->sendKeyBlock,
                            iscsiAuthKeyTypeAuthMethod)) {
                                authMethodKeyPresent = TRUE;
                        } else if (iscsiAuthClientGetKeyValue(
                            &client->sendKeyBlock,
                            iscsiAuthKeyTypeChapAlgorithm)) {
                                chapAlgorithmKeyPresent = TRUE;
                        }
                }

                iscsiAuthClientInitKeyBlock(&client->sendKeyBlock);

                if (client->nodeType == iscsiAuthNodeTypeTarget) {
                        if (authMethodKeyPresent &&
                            client->negotiatedAuthMethod ==
                            iscsiAuthOptionReject) {
                                iscsiAuthClientSetKeyValue(
                                    &client->sendKeyBlock,
                                    iscsiAuthKeyTypeAuthMethod,
                                    client->rejectOptionName);
                        } else if (chapAlgorithmKeyPresent &&
                            client->negotiatedChapAlgorithm ==
                            iscsiAuthOptionReject) {
                                iscsiAuthClientSetKeyValue(
                                    &client->sendKeyBlock,
                                    iscsiAuthKeyTypeChapAlgorithm,
                                    client->rejectOptionName);
                        }
                }
        }

        return (authStatus);
}


int
iscsiAuthClientRecvBegin(IscsiAuthClient * client)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase == iscsiAuthPhaseError) {
                return (iscsiAuthStatusError);
        }

        if (client->phase == iscsiAuthPhaseDone) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (client->recvInProgressFlag) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        client->recvInProgressFlag = TRUE;

        if (client->phase == iscsiAuthPhaseConfigure) {
                iscsiAuthClientNextPhase(client);
        }

        client->transitBitSentFlag = client->sendKeyBlock.transitBit;

        iscsiAuthClientInitKeyBlock(&client->recvKeyBlock);
        iscsiAuthClientInitKeyBlock(&client->sendKeyBlock);

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientRecvEnd(IscsiAuthClient * client,
    IscsiAuthClientCallback * callback, void *userHandle, void *messageHandle)
{
        int nextPhaseFlag = FALSE;

        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase == iscsiAuthPhaseError) {
                return (iscsiAuthStatusError);
        }

        if (!callback || !client->recvInProgressFlag) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (client->recvEndCount > iscsiAuthRecvEndMaxCount) {
                client->remoteAuthStatus = iscsiAuthStatusFail;
                client->phase = iscsiAuthPhaseDone;
                client->debugStatus =
                    iscsiAuthDebugStatusRecvMessageCountLimit;
        } else if (client->recvKeyBlock.duplicateSet) {
                client->remoteAuthStatus = iscsiAuthStatusFail;
                client->phase = iscsiAuthPhaseDone;
                client->debugStatus =
                    iscsiAuthDebugStatusRecvDuplicateSetKeyValue;
        } else if (client->recvKeyBlock.stringTooLong) {
                client->remoteAuthStatus = iscsiAuthStatusFail;
                client->phase = iscsiAuthPhaseDone;
                client->debugStatus = iscsiAuthDebugStatusRecvStringTooLong;
        } else if (client->recvKeyBlock.tooMuchData) {
                client->remoteAuthStatus = iscsiAuthStatusFail;
                client->phase = iscsiAuthPhaseDone;
                client->debugStatus = iscsiAuthDebugStatusRecvTooMuchData;
        }

        client->recvEndCount++;

        client->callback = callback;
        client->userHandle = userHandle;
        client->messageHandle = messageHandle;

        switch (client->phase) {
        case iscsiAuthPhaseNegotiate:
                iscsiAuthClientCheckAuthMethodKey(client);

                if (client->authMethodValidNegRole ==
                    iscsiAuthNegRoleResponder) {
                        if (client->negotiatedAuthMethod ==
                            iscsiAuthOptionNotPresent) {
                                if (client->authRemote ||
                                    client->recvKeyBlock.transitBit == 0) {
                                        /*
                                         * No AuthMethod key from peer
                                         * on first message, try moving
                                         * the process along by sending
                                         * the AuthMethod key.
                                         */

                                        client->authMethodValidNegRole =
                                            iscsiAuthNegRoleOriginator;

                                        iscsiAuthClientSetAuthMethodKey(client,
                                            client->authMethodValidCount,
                                            client->authMethodValidList);
                                        break;
                                }

                                /*
                                 * Special case if peer sent no
                                 * AuthMethod key, but did set Transit
                                 * Bit, allowing this side to do a
                                 * null authentication, and compelete
                                 * the iSCSI security phase without
                                 * either side sending the AuthMethod
                                 * key.
                                 */
                        } else {
                                /*
                                 * Send response to AuthMethod key.
                                 */

                                iscsiAuthClientSetAuthMethodKey(client, 1,
                                    &client->negotiatedAuthMethod);
                        }

                        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                                iscsiAuthClientNextPhase(client);
                        } else {
                                nextPhaseFlag = TRUE;
                        }

                } else {
                        if (client->negotiatedAuthMethod ==
                            iscsiAuthOptionNotPresent) {
                                client->remoteAuthStatus = iscsiAuthStatusFail;
                                client->phase = iscsiAuthPhaseDone;
                                client->debugStatus =
                                    iscsiAuthDebugStatusAuthMethodExpected;
                                break;
                        }

                        iscsiAuthClientNextPhase(client);
                }
                break;

        case iscsiAuthPhaseAuthenticate:
        case iscsiAuthPhaseDone:
                break;

        default:
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        switch (client->phase) {
        case iscsiAuthPhaseNegotiate:
                if (nextPhaseFlag) {
                        iscsiAuthClientNextPhase(client);
                }
                break;

        case iscsiAuthPhaseAuthenticate:
                /*
                 * Must call iscsiAuthClientLocalAuthentication()
                 * before iscsiAuthClientRemoteAuthentication()
                 * to insure processing of the CHAP algorithm key,
                 * and to avoid leaving an in progress request to the
                 * authentication service.
                 */
                iscsiAuthClientLocalAuthentication(client);

                if (client->localState != iscsiAuthLocalStateError) {
                        iscsiAuthClientRemoteAuthentication(client);
                }

                if (client->localState == iscsiAuthLocalStateError ||
                    client->remoteState == iscsiAuthRemoteStateError) {

                        client->remoteAuthStatus = iscsiAuthStatusFail;
                        client->phase = iscsiAuthPhaseDone;
                        /*
                         * client->debugStatus should already be set.
                         */
                }
                break;

        case iscsiAuthPhaseDone:
                break;

        default:
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        iscsiAuthClientHandshake(client);

        return (iscsiAuthClientRecvEndStatus(client));
}


void
iscsiAuthClientAuthResponse(IscsiAuthClient * client, int authStatus)
{
        iscsiAuthClientGlobalStats.responseReceived++;

        if (!client || client->signature != iscsiAuthClientSignature) {
                return;
        }

        if (!client->recvInProgressFlag ||
            client->phase != iscsiAuthPhaseAuthenticate ||
            client->remoteState != iscsiAuthRemoteStateAuthRequest) {

                client->phase = iscsiAuthPhaseError;
                return;
        }

        client->remoteAuthStatus = (IscsiAuthStatus) authStatus;
        client->authResponseFlag = TRUE;

        iscsiAuthClientRemoteAuthentication(client);

        iscsiAuthClientHandshake(client);

        authStatus = iscsiAuthClientRecvEndStatus(client);

        client->callback(client->userHandle, client->messageHandle, authStatus);
}


const char *
iscsiAuthClientGetKeyName(int keyType)
{
        if (keyType < iscsiAuthKeyTypeFirst || keyType > iscsiAuthKeyTypeLast) {
                return (0);
        }
        return (iscsiAuthClientKeyInfo[keyType].name);
}


int
iscsiAuthClientGetNextKeyType(int *pKeyType)
{
        int keyType = *pKeyType;

        if (keyType >= iscsiAuthKeyTypeLast) {
                return (iscsiAuthStatusError);
        }

        if (keyType < iscsiAuthKeyTypeFirst) {
                keyType = iscsiAuthKeyTypeFirst;
        } else {
                keyType++;
        }

        *pKeyType = keyType;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientKeyNameToKeyType(const char *keyName)
{
        int keyType = iscsiAuthKeyTypeNone;

        while (iscsiAuthClientGetNextKeyType(&keyType) ==
            iscsiAuthStatusNoError) {
                const char *keyName2 = iscsiAuthClientGetKeyName(keyType);

                if (!keyName2) {
                        return (iscsiAuthKeyTypeNone);
                }

                if (strcmp(keyName, keyName2) == 0) {
                        return (keyType);
                }
        }

        return (iscsiAuthKeyTypeNone);
}


int
iscsiAuthClientRecvKeyValue(IscsiAuthClient * client, int keyType,
    const char *userKeyValue)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseNegotiate &&
            client->phase != iscsiAuthPhaseAuthenticate) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (keyType < iscsiAuthKeyTypeFirst || keyType > iscsiAuthKeyTypeLast) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (keyType == iscsiAuthKeyTypeChapChallenge) {
                client->recvChapChallenge.length =
                    iscsiAuthLargeBinaryMaxLength;
                client->recvChapChallengeStatus =
                    iscsiAuthClientTextToData(userKeyValue,
                    client->recvChapChallenge.largeBinary,
                    &client->recvChapChallenge.length);
                userKeyValue = "";
        }

        iscsiAuthClientSetKeyValue(&client->recvKeyBlock,
            keyType, userKeyValue);

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSendKeyValue(IscsiAuthClient * client, int keyType,
    int *keyPresent, char *userKeyValue, unsigned int maxLength)
{
        const char *keyValue;

        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure &&
            client->phase != iscsiAuthPhaseNegotiate &&
            client->phase != iscsiAuthPhaseAuthenticate &&
            client->phase != iscsiAuthPhaseDone) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (keyType < iscsiAuthKeyTypeFirst || keyType > iscsiAuthKeyTypeLast) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        keyValue = iscsiAuthClientGetKeyValue(&client->sendKeyBlock, keyType);
        if (keyValue) {
                if (keyType == iscsiAuthKeyTypeChapChallenge) {
                        if (iscsiAuthClientDataToText(client->base64,
                            client->sendChapChallenge.largeBinary,
                            client->sendChapChallenge.length,
                            userKeyValue, maxLength)) {
                                client->phase = iscsiAuthPhaseError;
                                return (iscsiAuthStatusError);
                        }
                } else {
                        if (iscsiAuthClientStringCopy(userKeyValue,
                            keyValue, maxLength)) {
                                client->phase = iscsiAuthPhaseError;
                                return (iscsiAuthStatusError);
                        }
                }
                *keyPresent = TRUE;
        } else {
                *keyPresent = FALSE;
        }

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientRecvTransitBit(IscsiAuthClient * client, int value)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseNegotiate &&
            client->phase != iscsiAuthPhaseAuthenticate) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (value) {
                client->recvKeyBlock.transitBit = TRUE;
        } else {
                client->recvKeyBlock.transitBit = FALSE;
        }

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSendTransitBit(IscsiAuthClient * client, int *value)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure &&
            client->phase != iscsiAuthPhaseNegotiate &&
            client->phase != iscsiAuthPhaseAuthenticate &&
            client->phase != iscsiAuthPhaseDone) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        *value = client->sendKeyBlock.transitBit;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientInit(int nodeType, int bufferDescCount,
    IscsiAuthBufferDesc * bufferDesc)
{
        IscsiAuthClient *client;
        IscsiAuthStringBlock *recvStringBlock;
        IscsiAuthStringBlock *sendStringBlock;
        IscsiAuthLargeBinary *recvChapChallenge;
        IscsiAuthLargeBinary *sendChapChallenge;
        int valueList[2];

        if (bufferDescCount != 5 ||
            bufferDesc == 0) {
                return (iscsiAuthStatusError);
        }

        if (!bufferDesc[0].address ||
            bufferDesc[0].length != sizeof (*client)) {
                return (iscsiAuthStatusError);
        }
        client = (IscsiAuthClient *) bufferDesc[0].address;

        if (bufferDesc[1].address == 0 ||
            bufferDesc[1].length != sizeof (*recvStringBlock)) {
                return (iscsiAuthStatusError);
        }
        recvStringBlock = (IscsiAuthStringBlock *) bufferDesc[1].address;

        if (bufferDesc[2].address == 0 ||
            bufferDesc[2].length != sizeof (*sendStringBlock)) {
                return (iscsiAuthStatusError);
        }
        sendStringBlock = (IscsiAuthStringBlock *) bufferDesc[2].address;

        if (bufferDesc[3].address == 0 ||
            bufferDesc[3].length != sizeof (*recvChapChallenge)) {
                return (iscsiAuthStatusError);
        }
        recvChapChallenge = (IscsiAuthLargeBinary *) bufferDesc[3].address;

        if (bufferDesc[4].address == 0 ||
            bufferDesc[4].length != sizeof (*sendChapChallenge)) {
                return (iscsiAuthStatusError);
        }
        sendChapChallenge = (IscsiAuthLargeBinary *) bufferDesc[4].address;

        bzero(client, sizeof (*client));
        bzero(recvStringBlock, sizeof (*recvStringBlock));
        bzero(sendStringBlock, sizeof (*sendStringBlock));
        bzero(recvChapChallenge, sizeof (*recvChapChallenge));
        bzero(sendChapChallenge, sizeof (*sendChapChallenge));

        client->recvKeyBlock.stringBlock = recvStringBlock->stringBlock;
        client->sendKeyBlock.stringBlock = sendStringBlock->stringBlock;
        client->recvChapChallenge.largeBinary = recvChapChallenge->largeBinary;
        client->sendChapChallenge.largeBinary = sendChapChallenge->largeBinary;

        if (iscsiAuthClientCheckNodeType(nodeType)) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        client->signature = iscsiAuthClientSignature;
        client->nodeType = (IscsiAuthNodeType) nodeType;
        /* Assume bi-directional authentication enabled. */
        client->authRemote = TRUE;
        client->passwordPresent = FALSE;
        client->version = iscsiAuthVersionRfc;
        client->chapChallengeLength = iscsiAuthChapResponseLength;
        client->ipSec = TRUE;
        client->base64 = FALSE;

        client->phase = iscsiAuthPhaseConfigure;
        client->negotiatedAuthMethod = iscsiAuthOptionNotPresent;
        client->negotiatedChapAlgorithm = iscsiAuthOptionNotPresent;

        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                client->authMethodNegRole = iscsiAuthNegRoleOriginator;
        } else {
                /*
                 * Initial value ignored for Target.
                 */
                client->authMethodNegRole = iscsiAuthNegRoleResponder;
        }

        /* All supported authentication methods */
        valueList[0] = iscsiAuthMethodChap;
        valueList[1] = iscsiAuthOptionNone;

        /*
         * Must call after setting authRemote, password,
         * version and authMethodNegRole
         */
        if (iscsiAuthClientSetAuthMethodList(client, 2, valueList) !=
            iscsiAuthStatusNoError) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        valueList[0] = iscsiAuthChapAlgorithmMd5;

        if (iscsiAuthClientSetChapAlgorithmList(client, 1, valueList) !=
            iscsiAuthStatusNoError) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientFinish(IscsiAuthClient * client)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        iscsiAuthClientChapAuthCancel(client);

        bzero(client, sizeof (*client));

        return (iscsiAuthStatusNoError);
}


static int
iscsiAuthClientSetOptionList(IscsiAuthClient * client,
    unsigned int optionCount,
    const int *optionList,
    unsigned int *clientOptionCount,
    int *clientOptionList,
    unsigned int optionMaxCount,
    int (*checkOption) (int),
    int (*checkList) (unsigned int optionCount, const int *optionList))
{
        unsigned int i;
        unsigned int j;

        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure ||
            optionCount > optionMaxCount) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        for (i = 0; i < optionCount; i++) {
                if ((*checkOption) (optionList[i])) {
                        client->phase = iscsiAuthPhaseError;
                        return (iscsiAuthStatusError);
                }
        }

        /*
         * Check for duplicate entries.
         */
        for (i = 0; i < optionCount; i++) {
                for (j = 0; j < optionCount; j++) {
                        if (j == i)
                                continue;
                        if (optionList[i] == optionList[j]) {
                                client->phase = iscsiAuthPhaseError;
                                return (iscsiAuthStatusError);
                        }
                }
        }

        /*
         * Check for key specific constraints.
         */
        if (checkList) {
                if ((*checkList) (optionCount, optionList)) {
                        client->phase = iscsiAuthPhaseError;
                        return (iscsiAuthStatusError);
                }
        }

        for (i = 0; i < optionCount; i++) {
                clientOptionList[i] = optionList[i];
        }

        *clientOptionCount = optionCount;

        return (iscsiAuthStatusNoError);
}


static void
iscsiAuthClientSetAuthMethodValid(IscsiAuthClient * client)
{
        static const char rejectOptionNameDraft8[] = "reject";
        static const char rejectOptionNameRfc[] = "Reject";
        static const char noneOptionNameDraft8[] = "none";
        static const char noneOptionNameRfc[] = "None";
        unsigned int i;
        unsigned int j = 0;
        int option = 0;

        if (client->version == iscsiAuthVersionDraft8) {
                client->rejectOptionName = rejectOptionNameDraft8;
                client->noneOptionName = noneOptionNameDraft8;
        } else {
                client->rejectOptionName = rejectOptionNameRfc;
                client->noneOptionName = noneOptionNameRfc;
        }

        /*
         * Following checks may need to be revised if
         * authentication options other than CHAP and none
         * are supported.
         */

        if (client->nodeType == iscsiAuthNodeTypeInitiator) {

                if (client->authRemote) {
                        /*
                         * If initiator doing authentication,
                         * don't offer authentication option none.
                         */
                        option = 1;
                } else if (!client->passwordPresent) {
                        /*
                         * If initiator password not set,
                         * only offer authentication option none.
                         */
                        option = 2;
                }
        }

        if (client->nodeType == iscsiAuthNodeTypeTarget) {

                if (client->authRemote) {
                        /*
                         * If target doing authentication,
                         * don't accept authentication option none.
                         */
                        option = 1;
                } else {
                        /*
                         * If target not doing authentication,
                         * only accept authentication option none.
                         */
                        option = 2;
                }
        }

        for (i = 0; i < client->authMethodCount; i++) {

                if (option == 1) {
                        if (client->authMethodList[i] == iscsiAuthOptionNone) {
                                continue;
                        }
                } else if (option == 2) {
                        if (client->authMethodList[i] != iscsiAuthOptionNone) {
                                continue;
                        }
                }

                client->authMethodValidList[j++] = client->authMethodList[i];
        }

        client->authMethodValidCount = j;

        iscsiAuthClientInitKeyBlock(&client->sendKeyBlock);

        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                if (client->authRemote) {
                        /*
                         * Initiator wants to authenticate target,
                         * always send AuthMethod key.
                         */
                        client->sendKeyBlock.transitBit = FALSE;
                        client->authMethodValidNegRole =
                            iscsiAuthNegRoleOriginator;
                } else {
                        client->sendKeyBlock.transitBit = TRUE;
                        client->authMethodValidNegRole =
                            client->authMethodNegRole;
                }
        } else {
                client->sendKeyBlock.transitBit = FALSE;
                client->authMethodValidNegRole = iscsiAuthNegRoleResponder;
        }

        if (client->authMethodValidNegRole == iscsiAuthNegRoleOriginator) {
                iscsiAuthClientSetAuthMethodKey(client,
                    client->authMethodValidCount,
                    client->authMethodValidList);
        } else {
                int value = iscsiAuthOptionNotPresent;
                iscsiAuthClientSetAuthMethodKey(client, 1, &value);
        }
}


static int
iscsiAuthClientCheckAuthMethodList(unsigned int optionCount,
    const int *optionList)
{
        unsigned int i;

        if (!optionList || optionCount < 2) {
                return (TRUE);
        }

        if (optionList[optionCount - 1] != iscsiAuthOptionNone) {
                return (TRUE);
        }

        for (i = 0; i < (optionCount - 1); i++) {
                if (optionList[i] != iscsiAuthOptionNone) {
                        return (FALSE);
                }
        }

        return (FALSE);
}


int
iscsiAuthClientSetAuthMethodList(IscsiAuthClient * client,
    unsigned int optionCount, const int *optionList)
{
        int status;

        status = iscsiAuthClientSetOptionList(
            client, optionCount, optionList, &client->authMethodCount,
            client->authMethodList, iscsiAuthMethodMaxCount,
            iscsiAuthClientCheckAuthMethodOption,
            iscsiAuthClientCheckAuthMethodList);

        if (status != iscsiAuthStatusNoError) {
                return (status);
        }

        /*
         * Setting authMethod affects authMethodValid.
         */
        iscsiAuthClientSetAuthMethodValid(client);

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetAuthMethodNegRole(IscsiAuthClient * client, int negRole)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure ||
            iscsiAuthClientCheckNegRole(negRole) ||
            client->nodeType != iscsiAuthNodeTypeInitiator) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        client->authMethodNegRole = (IscsiAuthNegRole) negRole;

        /*
         * Setting negRole affects authMethodValid.
         */
        iscsiAuthClientSetAuthMethodValid(client);

        return (iscsiAuthStatusNoError);
}


static int
iscsiAuthClientCheckChapAlgorithmList(unsigned int optionCount,
    const int *optionList)
{
        if (!optionList || optionCount < 1) {
                return (TRUE);
        }

        return (FALSE);
}


int
iscsiAuthClientSetChapAlgorithmList(IscsiAuthClient * client,
    unsigned int optionCount, const int *optionList)
{
        return (iscsiAuthClientSetOptionList(client,
            optionCount,
            optionList,
            &client->chapAlgorithmCount,
            client->chapAlgorithmList,
            iscsiAuthChapAlgorithmMaxCount,
            iscsiAuthClientCheckChapAlgorithmOption,
            iscsiAuthClientCheckChapAlgorithmList));
}


int
iscsiAuthClientSetUsername(IscsiAuthClient * client, const char *username)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure ||
            iscsiAuthClientCheckString(username, iscsiAuthStringMaxLength, 0)) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (iscsiAuthClientStringCopy(client->username, username,
            iscsiAuthStringMaxLength)) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetPassword(IscsiAuthClient * client,
    const unsigned char *passwordData, unsigned int passwordLength)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure ||
            passwordLength > iscsiAuthStringMaxLength) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        bcopy(passwordData, client->passwordData, passwordLength);
        client->passwordLength = passwordLength;
        if (client->passwordLength > 0) {
                client->passwordPresent = TRUE;
        } else {
                client->passwordPresent = FALSE;
        }

        /*
         * Setting password may affect authMethodValid.
         */
        iscsiAuthClientSetAuthMethodValid(client);

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetAuthRemote(IscsiAuthClient * client, int authRemote)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        client->authRemote = authRemote;

        /*
         * Setting authRemote may affect authMethodValid.
         */
        iscsiAuthClientSetAuthMethodValid(client);

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetGlueHandle(IscsiAuthClient * client, void *glueHandle)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure &&
            client->phase != iscsiAuthPhaseNegotiate &&
            client->phase != iscsiAuthPhaseAuthenticate) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        client->glueHandle = glueHandle;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetMethodListName(IscsiAuthClient *client,
    const char *methodListName)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure ||
            iscsiAuthClientCheckString(methodListName,
            iscsiAuthStringMaxLength, 0)) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (iscsiAuthClientStringCopy(client->methodListName, methodListName,
            iscsiAuthStringMaxLength)) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetVersion(IscsiAuthClient * client, int version)
{
        if (client == 0 ||
            client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure ||
            iscsiAuthClientCheckVersion(version)) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        client->version = (IscsiAuthVersion) version;

        iscsiAuthClientSetAuthMethodValid(client);

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetIpSec(IscsiAuthClient * client, int ipSec)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        client->ipSec = ipSec;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetBase64(IscsiAuthClient * client, int base64)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        client->base64 = base64;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetChapChallengeLength(IscsiAuthClient * client,
    unsigned int chapChallengeLength)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure ||
            chapChallengeLength < iscsiAuthChapResponseLength ||
            chapChallengeLength > iscsiAuthLargeBinaryMaxLength) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        client->chapChallengeLength = chapChallengeLength;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientCheckPasswordNeeded(IscsiAuthClient *client, int *passwordNeeded)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                if (client->authRemote && !client->passwordPresent) {
                        *passwordNeeded = TRUE;
                } else {
                        *passwordNeeded = FALSE;
                }
        } else {
                *passwordNeeded = FALSE;
        }

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetAuthPhase(IscsiAuthClient * client, int *value)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        *value = client->phase;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetAuthStatus(IscsiAuthClient * client, int *value)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseDone) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        *value = client->remoteAuthStatus;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientAuthStatusPass(int authStatus)
{
        if (authStatus == iscsiAuthStatusPass) {
                return (TRUE);
        }

        return (FALSE);
}


int
iscsiAuthClientGetAuthMethod(IscsiAuthClient * client, int *value)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseDone &&
            client->phase != iscsiAuthPhaseAuthenticate) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        *value = client->negotiatedAuthMethod;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetChapAlgorithm(IscsiAuthClient * client, int *value)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseDone) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        *value = client->negotiatedChapAlgorithm;

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetChapUsername(IscsiAuthClient * client,
    char *value, unsigned int maxLength)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseDone) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (iscsiAuthClientStringCopy(value, client->chapUsername, maxLength)) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSendStatusCode(IscsiAuthClient * client, int *statusCode)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseConfigure &&
            client->phase != iscsiAuthPhaseNegotiate &&
            client->phase != iscsiAuthPhaseAuthenticate &&
            client->phase != iscsiAuthPhaseDone) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseDone) {
                *statusCode = 0x0000;
                return (iscsiAuthStatusNoError);
        }

        switch (client->remoteAuthStatus) {
        case iscsiAuthStatusPass:
                *statusCode = 0x0000;   /* no error */
                break;

        case iscsiAuthStatusFail:
                switch (client->debugStatus) {
                case iscsiAuthDebugStatusAuthFail:
                        /*
                         * Authentication error with peer.
                         */
                        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                                *statusCode = 0x0300;
                                /*
                                 * iSCSI Target error
                                 */
                        } else {
                                *statusCode = 0x0201;
                                /*
                                 * iSCSI Initiator error
                                 */
                        }
                        break;

                case iscsiAuthDebugStatusAuthMethodExpected:
                case iscsiAuthDebugStatusChapAlgorithmExpected:
                case iscsiAuthDebugStatusChapIdentifierExpected:
                case iscsiAuthDebugStatusChapChallengeExpected:
                case iscsiAuthDebugStatusChapResponseExpected:
                case iscsiAuthDebugStatusChapUsernameExpected:
                        /*
                         * Missing parameter with peer.
                         */
                        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                                *statusCode = 0x0300;
                                /*
                                 * iSCSI Target error
                                 */
                        } else {
                                *statusCode = 0x0207;
                                /*
                                 * iSCSI Initiator error
                                 */
                        }
                        break;

                case iscsiAuthDebugStatusAuthMethodNotPresent:
                case iscsiAuthDebugStatusAuthMethodReject:
                case iscsiAuthDebugStatusAuthMethodNone:
                case iscsiAuthDebugStatusChapAlgorithmReject:
                case iscsiAuthDebugStatusChapChallengeReflected:
                case iscsiAuthDebugStatusPasswordIdentical:
                        /*
                         * Could not authenticate with peer.
                         */
                        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                                *statusCode = 0x0300;
                                /*
                                 * iSCSI Target error
                                 */
                        } else {
                                *statusCode = 0x0201;
                                /*
                                 * iSCSI Initiator error
                                 */
                        }
                        break;

                case iscsiAuthDebugStatusLocalPasswordNotSet:
                        /*
                         * Local password not set.
                         */
                        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                                *statusCode = 0x0200;
                                /*
                                 * iSCSI Initiator error
                                 */
                        } else {
                                *statusCode = 0x0201;
                                /*
                                 * iSCSI Target error
                                 */
                        }
                        break;

                case iscsiAuthDebugStatusChapIdentifierBad:
                case iscsiAuthDebugStatusChapChallengeBad:
                case iscsiAuthDebugStatusChapResponseBad:
                case iscsiAuthDebugStatusUnexpectedKeyPresent:
                case iscsiAuthDebugStatusTbitSetIllegal:
                case iscsiAuthDebugStatusTbitSetPremature:
                case iscsiAuthDebugStatusRecvMessageCountLimit:
                case iscsiAuthDebugStatusRecvDuplicateSetKeyValue:
                case iscsiAuthDebugStatusRecvStringTooLong:
                case iscsiAuthDebugStatusRecvTooMuchData:
                        /*
                         * Other error with peer.
                         */
                        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                                *statusCode = 0x0300;
                                /*
                                 * iSCSI Target error
                                 */
                        } else {
                                *statusCode = 0x0200;
                                /*
                                 * iSCSI Initiator error
                                 */
                        }
                        break;

                case iscsiAuthDebugStatusNotSet:
                case iscsiAuthDebugStatusAuthPass:
                case iscsiAuthDebugStatusAuthRemoteFalse:
                case iscsiAuthDebugStatusAuthMethodBad:
                case iscsiAuthDebugStatusChapAlgorithmBad:
                case iscsiAuthDebugStatusPasswordDecryptFailed:
                case iscsiAuthDebugStatusPasswordTooShortWithNoIpSec:
                case iscsiAuthDebugStatusAuthServerError:
                case iscsiAuthDebugStatusAuthStatusBad:
                case iscsiAuthDebugStatusAuthPassNotValid:
                case iscsiAuthDebugStatusSendDuplicateSetKeyValue:
                case iscsiAuthDebugStatusSendStringTooLong:
                case iscsiAuthDebugStatusSendTooMuchData:
                default:
                        /*
                         * Error on this side.
                         */
                        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                                *statusCode = 0x0200;
                                /*
                                 * iSCSI Initiator error
                                 */
                        } else {
                                *statusCode = 0x0300;
                                /*
                                 * iSCSI Target error
                                 */
                        }

                }
                break;

        case iscsiAuthStatusNoError:
        case iscsiAuthStatusError:
        case iscsiAuthStatusContinue:
        case iscsiAuthStatusInProgress:
        default:
                /*
                 * Bad authStatus
                 */
                if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                        *statusCode = 0x0200;
                        /*
                         * iSCSI Initiator error
                         */
                } else {
                        *statusCode = 0x0300;
                        /*
                         * iSCSI Target error
                         */
                }
        }

        return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetDebugStatus(IscsiAuthClient * client, int *value)
{
        if (!client || client->signature != iscsiAuthClientSignature) {
                return (iscsiAuthStatusError);
        }

        if (client->phase != iscsiAuthPhaseDone) {

                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
        }

        *value = client->debugStatus;

        return (iscsiAuthStatusNoError);
}


const char *
iscsiAuthClientDebugStatusToText(int debugStatus)
{
        const char *s;

        switch (debugStatus) {
        case iscsiAuthDebugStatusNotSet:
                s = "Debug status not set";
                break;

        case iscsiAuthDebugStatusAuthPass:
                s = "Authentication request passed";
                break;

        case iscsiAuthDebugStatusAuthRemoteFalse:
                s = "Authentication not enabled";
                break;

        case iscsiAuthDebugStatusAuthFail:
                s = "Authentication request failed";
                break;

        case iscsiAuthDebugStatusAuthMethodBad:
                s = "AuthMethod bad";
                break;

        case iscsiAuthDebugStatusChapAlgorithmBad:
                s = "CHAP algorithm bad";
                break;

        case iscsiAuthDebugStatusPasswordDecryptFailed:
                s = "Decrypt password failed";
                break;

        case iscsiAuthDebugStatusPasswordTooShortWithNoIpSec:
                s = "Local password too short with no IPSec";
                break;

        case iscsiAuthDebugStatusAuthServerError:
                s = "Unexpected error from authentication server";
                break;

        case iscsiAuthDebugStatusAuthStatusBad:
                s = "Authentication request status bad";
                break;

        case iscsiAuthDebugStatusAuthPassNotValid:
                s = "Authentication pass status not valid";
                break;

        case iscsiAuthDebugStatusSendDuplicateSetKeyValue:
                s = "Same key set more than once on send";
                break;

        case iscsiAuthDebugStatusSendStringTooLong:
                s = "Key value too long on send";
                break;

        case iscsiAuthDebugStatusSendTooMuchData:
                s = "Too much data on send";
                break;

        case iscsiAuthDebugStatusAuthMethodExpected:
                s = "AuthMethod key expected";
                break;

        case iscsiAuthDebugStatusChapAlgorithmExpected:
                s = "CHAP algorithm key expected";
                break;

        case iscsiAuthDebugStatusChapIdentifierExpected:
                s = "CHAP identifier expected";
                break;

        case iscsiAuthDebugStatusChapChallengeExpected:
                s = "CHAP challenge expected";
                break;

        case iscsiAuthDebugStatusChapResponseExpected:
                s = "CHAP response expected";
                break;

        case iscsiAuthDebugStatusChapUsernameExpected:
                s = "CHAP username expected";
                break;

        case iscsiAuthDebugStatusAuthMethodNotPresent:
                s = "AuthMethod key not present";
                break;

        case iscsiAuthDebugStatusAuthMethodReject:
                s = "AuthMethod negotiation failed";
                break;

        case iscsiAuthDebugStatusAuthMethodNone:
                s = "AuthMethod negotiated to none";
                break;

        case iscsiAuthDebugStatusChapAlgorithmReject:
                s = "CHAP algorithm negotiation failed";
                break;

        case iscsiAuthDebugStatusChapChallengeReflected:
                s = "CHAP challange reflected";
                break;

        case iscsiAuthDebugStatusPasswordIdentical:
                s = "Local password same as remote";
                break;

        case iscsiAuthDebugStatusLocalPasswordNotSet:
                s = "Local password not set";
                break;

        case iscsiAuthDebugStatusChapIdentifierBad:
                s = "CHAP identifier bad";
                break;

        case iscsiAuthDebugStatusChapChallengeBad:
                s = "CHAP challenge bad";
                break;

        case iscsiAuthDebugStatusChapResponseBad:
                s = "CHAP response bad";
                break;

        case iscsiAuthDebugStatusUnexpectedKeyPresent:
                s = "Unexpected key present";
                break;

        case iscsiAuthDebugStatusTbitSetIllegal:
                s = "T bit set on response, but not on previous message";
                break;

        case iscsiAuthDebugStatusTbitSetPremature:
                s = "T bit set on response, but authenticaton not complete";
                break;

        case iscsiAuthDebugStatusRecvMessageCountLimit:
                s = "Message count limit reached on receive";
                break;

        case iscsiAuthDebugStatusRecvDuplicateSetKeyValue:
                s = "Same key set more than once on receive";
                break;

        case iscsiAuthDebugStatusRecvStringTooLong:
                s = "Key value too long on receive";
                break;

        case iscsiAuthDebugStatusRecvTooMuchData:
                s = "Too much data on receive";
                break;

        default:
                s = "Unknown error";
        }

        return (s);
}