adapters/iscsi/iscsiAuthClient.c

	iscsiAuthClient.c revision fcf3ce441efd61da9bb2884968af01cb7c1452cc
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2000 by Cisco Systems, Inc.  All rights reserved.
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * This file implements the iSCSI CHAP authentication method based.
 * The code in this file is meant to be platform independent, and
 * makes use of only limited library functions, presently only string.h.
 * Platform dependent routines are  defined in iscsiAuthClient.h, but
 * implemented in another file.
 *
 * This code in this files assumes a single thread of execution
 * for each IscsiAuthClient structure, and does no locking.
 */

#include "iscsi.h"
#include "iscsiAuthClient.h"


struct iscsiAuthKeyInfo_t {
    const char *name;
};
typedef struct iscsiAuthKeyInfo_t IscsiAuthKeyInfo;


IscsiAuthClientGlobalStats iscsiAuthClientGlobalStats;

/*
 * Note: The ordering of this table must match the order
 *       defined by IscsiAuthKeyType in iscsiAuthClient.h.
 */
static IscsiAuthKeyInfo iscsiAuthClientKeyInfo[iscsiAuthKeyTypeMaxCount] = {
    {"AuthMethod"},
    {"CHAP_A"},
    {"CHAP_N"},
    {"CHAP_R"},
    {"CHAP_I"},
    {"CHAP_C"}
};

static const char iscsiAuthClientHexString[] = "0123456789abcdefABCDEF";
static const char iscsiAuthClientBase64String[] =
    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
static const char iscsiAuthClientAuthMethodChapOptionName[] = "CHAP";


static int
iscsiAuthClientCheckString(const char *s,
    unsigned int maxLength, unsigned int *pOutLength)
{
    unsigned int length;

    if (!s) {
        return (TRUE);
    }

    for (length = 0; length < maxLength; length++) {
        if (*s++ == '\0') {
            if (pOutLength) {
                *pOutLength = length;
            }
            return (FALSE);
        }
    }

    return (TRUE);
}


static int
iscsiAuthClientStringCopy(char *stringOut, const char *stringIn,
    unsigned int length)
{
    if (!stringOut || !stringIn || length == 0) {
        return (TRUE);
    }

    while ((*stringOut++ = *stringIn++) != '\0') {
        if (--length == 0) {
            stringOut--;
            *stringOut = '\0';
            return (TRUE);
        }
    }

    return (FALSE);
}


static int
iscsiAuthClientStringAppend(char *stringOut, const char *stringIn,
    unsigned int length)
{
    if (!stringOut || !stringIn || length == 0) {
        return (TRUE);
    }

    while (*stringOut++ != '\0') {
        if (--length == 0) {
            stringOut--;
            *stringOut = '\0';
            return (TRUE);
        }
    }

    stringOut--;

    while ((*stringOut++ = *stringIn++) != '\0') {
        if (--length == 0) {
            stringOut--;
            *stringOut = '\0';
            return (TRUE);
        }
    }

    return (FALSE);
}


static int
iscsiAuthClientStringIndex(const char *s, int c)
{
    int n = 0;

    while (*s != '\0') {
        if (*s++ == c) {
            return (n);
        }
        n++;
    }

    return (-1);
}


static int
iscsiAuthClientCheckNodeType(int nodeType)
{
    if (nodeType == iscsiAuthNodeTypeInitiator ||
        nodeType == iscsiAuthNodeTypeTarget) {
        return (FALSE);
    }

    return (TRUE);
}


static int
iscsiAuthClientCheckVersion(int value)
{
    if (value == iscsiAuthVersionDraft8 || value == iscsiAuthVersionRfc) {

        return (FALSE);
    }

    return (TRUE);
}


static int
iscsiAuthClientCheckNegRole(int value)
{
    if (value == iscsiAuthNegRoleOriginator ||
        value == iscsiAuthNegRoleResponder) {
        return (FALSE);
    }

    return (TRUE);
}


static int
iscsiAuthClientCheckAuthMethodOption(int value)
{
    if (value == iscsiAuthOptionNone || value == iscsiAuthMethodChap) {

        return (FALSE);
    }

    return (TRUE);
}


static const char *
iscsiAuthClientAuthMethodOptionToText(IscsiAuthClient * client, int value)
{
    const char *s;

    switch (value) {
    case iscsiAuthOptionReject:
        s = client->rejectOptionName;
        break;

    case iscsiAuthOptionNone:
        s = client->noneOptionName;
        break;

    case iscsiAuthMethodChap:
        s = iscsiAuthClientAuthMethodChapOptionName;
        break;

    default:
        s = 0;
    }

    return (s);
}


static int
iscsiAuthClientCheckChapAlgorithmOption(int chapAlgorithm)
{
    if (chapAlgorithm == iscsiAuthOptionNone ||
        chapAlgorithm == iscsiAuthChapAlgorithmMd5) {
        return (FALSE);
    }

    return (TRUE);
}


static int
iscsiAuthClientDataToHex(unsigned char *data, unsigned int dataLength,
    char *text, unsigned int textLength)
{
    unsigned long n;

    if (!text || textLength == 0) {
        return (TRUE);
    }

    if (!data || dataLength == 0) {
        *text = '\0';
        return (TRUE);
    }

    if (textLength < 3) {
        *text = '\0';
        return (TRUE);
    }

    *text++ = '0';
    *text++ = 'x';

    textLength -= 2;

    while (dataLength > 0) {

        if (textLength < 3) {
            *text = '\0';
            return (TRUE);
        }

        n = *data++;
        dataLength--;

        *text++ = iscsiAuthClientHexString[(n >> 4) & 0xf];
        *text++ = iscsiAuthClientHexString[n & 0xf];

        textLength -= 2;
    }

    *text = '\0';

    return (FALSE);
}


static int
iscsiAuthClientDataToBase64(unsigned char *data, unsigned int dataLength,
    char *text, unsigned int textLength)
{
    unsigned long n;

    if (!text || textLength == 0) {
        return (TRUE);
    }

    if (!data || dataLength == 0) {
        *text = '\0';
        return (TRUE);
    }

    if (textLength < 3) {
        *text = '\0';
        return (TRUE);
    }

    *text++ = '0';
    *text++ = 'b';

    textLength -= 2;

    while (dataLength >= 3) {

        if (textLength < 5) {
            *text = '\0';
            return (TRUE);
        }

        n = *data++;
        n = (n << 8) | *data++;
        n = (n << 8) | *data++;
        dataLength -= 3;

        *text++ = iscsiAuthClientBase64String[(n >> 18) & 0x3f];
        *text++ = iscsiAuthClientBase64String[(n >> 12) & 0x3f];
        *text++ = iscsiAuthClientBase64String[(n >> 6) & 0x3f];
        *text++ = iscsiAuthClientBase64String[n & 0x3f];

        textLength -= 4;
    }

    if (dataLength == 1) {

        if (textLength < 5) {
            *text = '\0';
            return (TRUE);
        }

        n = *data++;
        n = n << 4;

        *text++ = iscsiAuthClientBase64String[(n >> 6) & 0x3f];
        *text++ = iscsiAuthClientBase64String[n & 0x3f];
        *text++ = '=';
        *text++ = '=';

    } else if (dataLength == 2) {

        if (textLength < 5) {
            return (TRUE);
        }

        n = *data++;
        n = (n << 8) | *data++;
        n = n << 2;

        *text++ = iscsiAuthClientBase64String[(n >> 12) & 0x3f];
        *text++ = iscsiAuthClientBase64String[(n >> 6) & 0x3f];
        *text++ = iscsiAuthClientBase64String[n & 0x3f];
        *text++ = '=';
    }

    *text = '\0';

    return (FALSE);
}


static int
iscsiAuthClientDataToText(int base64, unsigned char *data,
    unsigned int dataLength, char *text, unsigned int textLength)
{
    int status;

    if (base64) {
        status = iscsiAuthClientDataToBase64(
            data, dataLength, text, textLength);
    } else {
        status = iscsiAuthClientDataToHex(
            data, dataLength, text, textLength);
    }

    return (status);
}


static int
iscsiAuthClientHexToData(const char *text, unsigned int textLength,
    unsigned char *data, unsigned int *pDataLength)
{
    int i;
    unsigned int n1;
    unsigned int n2;
    unsigned int dataLength = *pDataLength;

    if ((textLength % 2) == 1) {
        i = iscsiAuthClientStringIndex(iscsiAuthClientHexString,
            *text++);
        if (i < 0) {
            return (TRUE);  /* error, bad character */
        }

        if (i > 15)
            i -= 6;
        n2 = i;

        if (dataLength < 1) {
            return (TRUE);  /* error, too much data */
        }

        *data++ = n2;
        dataLength--;
    }

    while (*text != '\0') {

        i = iscsiAuthClientStringIndex(
            iscsiAuthClientHexString, *text++);
        if (i < 0) {
            return (TRUE);  /* error, bad character */
        }

        if (i > 15)
            i -= 6;
        n1 = i;

        if (*text == '\0') {
            return (TRUE);  /* error, odd string length */
        }

        i = iscsiAuthClientStringIndex(
            iscsiAuthClientHexString, *text++);
        if (i < 0) {
            return (TRUE);  /* error, bad character */
        }

        if (i > 15)
            i -= 6;
        n2 = i;

        if (dataLength < 1) {
            return (TRUE);  /* error, too much data */
        }

        *data++ = (n1 << 4) | n2;
        dataLength--;
    }

    if (dataLength >= *pDataLength) {
        return (TRUE);  /* error, no data */
    }

    *pDataLength = *pDataLength - dataLength;

    return (FALSE);     /* no error */
}


static int
iscsiAuthClientBase64ToData(const char *text, unsigned int textLength,
    unsigned char *data, unsigned int *pDataLength)
{
    int i;
    unsigned int n;
    unsigned int count;
    unsigned int dataLength = *pDataLength;

    textLength = textLength;    /* not used */

    n = 0;
    count = 0;

    while (*text != '\0' && *text != '=') {

        i = iscsiAuthClientStringIndex(
            iscsiAuthClientBase64String, *text++);
        if (i < 0) {
            return (TRUE);  /* error, bad character */
        }

        n = (n << 6 | (unsigned int)i);
        count++;

        if (count >= 4) {
            if (dataLength < 3) {
                return (TRUE);  /* error, too much data */
            }
            *data++ = n >> 16;
            *data++ = n >> 8;
            *data++ = n;
            dataLength -= 3;
            n = 0;
            count = 0;
        }
    }

    while (*text != '\0') {
        if (*text++ != '=') {
            return (TRUE);  /* error, bad pad */
        }
    }

    if (count == 0) {
        /*
         * do nothing
         */
        /* EMPTY */
    } else if (count == 2) {
        if (dataLength < 1) {
            return (TRUE);  /* error, too much data */
        }
        n = n >> 4;
        *data++ = n;
        dataLength--;
    } else if (count == 3) {
        if (dataLength < 2) {
            return (TRUE);  /* error, too much data */
        }
        n = n >> 2;
        *data++ = n >> 8;
        *data++ = n;
        dataLength -= 2;
    } else {
        return (TRUE);  /* bad encoding */
    }

    if (dataLength >= *pDataLength) {
        return (TRUE);  /* error, no data */
    }

    *pDataLength = *pDataLength - dataLength;

    return (FALSE);     /* no error */
}


static int
iscsiAuthClientTextToData(const char *text, unsigned char *data,
    unsigned int *dataLength)
{
    int status;
    unsigned int textLength;

    status = iscsiAuthClientCheckString(text,
        2 + 2 * iscsiAuthLargeBinaryMaxLength + 1, &textLength);

    if (status) {
        return (status);
    }

    if (text[0] == '0' && (text[1] == 'x' || text[1] == 'X')) {
        /*
         * skip prefix
         */
        text += 2;
        textLength -= 2;
        status = iscsiAuthClientHexToData(text,
            textLength, data, dataLength);
    } else if (text[0] == '0' && (text[1] == 'b' || text[1] == 'B')) {
        /*
         * skip prefix
         */
        text += 2;
        textLength -= 2;
        status = iscsiAuthClientBase64ToData(text,
            textLength, data, dataLength);
    } else {
        status = TRUE;  /* prefix not recognized. */
    }

    return (status);
}


static IscsiAuthDebugStatus
iscsiAuthClientChapComputeResponse(IscsiAuthClient * client,
    int remoteAuthentication, unsigned int id,
    unsigned char *challengeData, unsigned int challengeLength,
    unsigned char *responseData)
{
    unsigned char idData[1];
    IscsiAuthMd5Context context;
    unsigned char outData[iscsiAuthStringMaxLength];
    unsigned int outLength = iscsiAuthStringMaxLength;

    if (!client->passwordPresent) {
        return (iscsiAuthDebugStatusLocalPasswordNotSet);
    }

    iscsiAuthMd5Init(&context);

    /*
     * id byte
     */
    idData[0] = id;
    iscsiAuthMd5Update(&context, idData, 1);

    /*
     * decrypt password
     */
    if (iscsiAuthClientData(outData, &outLength,
        client->passwordData, client->passwordLength)) {

        return (iscsiAuthDebugStatusPasswordDecryptFailed);
    }

    if (!remoteAuthentication && !client->ipSec && outLength < 12) {
        return (iscsiAuthDebugStatusPasswordTooShortWithNoIpSec);
    }

    /*
     * shared secret
     */
    iscsiAuthMd5Update(&context, outData, outLength);

    /*
     * clear decrypted password
     */
    bzero(outData, iscsiAuthStringMaxLength);

    /*
     * challenge value
     */
    iscsiAuthMd5Update(&context, challengeData, challengeLength);

    iscsiAuthMd5Final(responseData, &context);

    return (iscsiAuthDebugStatusNotSet);    /* no error */
}


static void
iscsiAuthClientInitKeyBlock(IscsiAuthKeyBlock * keyBlock)
{
    char *stringBlock = keyBlock->stringBlock;

    bzero(keyBlock, sizeof (*keyBlock));
    keyBlock->stringBlock = stringBlock;
}


static void
iscsiAuthClientSetKeyValue(IscsiAuthKeyBlock * keyBlock,
    int keyType, const char *keyValue)
{
    unsigned int length;
    char *string;

    if (keyBlock->key[keyType].valueSet) {
        keyBlock->duplicateSet = TRUE;
        return;
    }

    keyBlock->key[keyType].valueSet = TRUE;

    if (!keyValue) {
        return;
    }

    if (iscsiAuthClientCheckString(keyValue,
        iscsiAuthStringMaxLength, &length)) {
        keyBlock->stringTooLong = TRUE;
        return;
    }

    length += 1;

    if ((keyBlock->blockLength + length) > iscsiAuthStringBlockMaxLength) {
        keyBlock->tooMuchData = TRUE;
        return;
    }

    string = &keyBlock->stringBlock[keyBlock->blockLength];

    if (iscsiAuthClientStringCopy(string, keyValue, length)) {
        keyBlock->tooMuchData = TRUE;
        return;
    }
    keyBlock->blockLength += length;

    keyBlock->key[keyType].string = string;
    keyBlock->key[keyType].present = TRUE;
}


static const char *
iscsiAuthClientGetKeyValue(IscsiAuthKeyBlock * keyBlock, int keyType)
{
    keyBlock->key[keyType].processed = TRUE;

    if (!keyBlock->key[keyType].present) {
        return (0);
    }

    return (keyBlock->key[keyType].string);
}


static void
iscsiAuthClientCheckKey(IscsiAuthClient * client,
    int keyType,
    int *negotiatedOption,
    unsigned int optionCount,
    int *optionList, const char *(*valueToText) (IscsiAuthClient *, int))
{
    const char *keyValue;
    int length;
    unsigned int i;

    keyValue = iscsiAuthClientGetKeyValue(&client->recvKeyBlock, keyType);
    if (!keyValue) {
        *negotiatedOption = iscsiAuthOptionNotPresent;
        return;
    }

    while (*keyValue != '\0') {

        length = 0;

        while (*keyValue != '\0' && *keyValue != ',') {
            client->scratchKeyValue[length++] = *keyValue++;
        }

        if (*keyValue == ',')
            keyValue++;
        client->scratchKeyValue[length++] = '\0';

        for (i = 0; i < optionCount; i++) {
            const char *s = (*valueToText) (client, optionList[i]);

            if (!s)
                continue;

            if (strcmp(client->scratchKeyValue, s) == 0) {
                *negotiatedOption = optionList[i];
                return;
            }
        }
    }

    *negotiatedOption = iscsiAuthOptionReject;
}


static void
iscsiAuthClientSetKey(IscsiAuthClient * client,
    int keyType,
    unsigned int optionCount,
    int *optionList, const char *(*valueToText) (IscsiAuthClient *, int))
{
    unsigned int i;

    if (optionCount == 0) {
        /*
         * No valid options to send, but we always want to
         * send something.
         */
        iscsiAuthClientSetKeyValue(&client->sendKeyBlock, keyType,
            client->noneOptionName);
        return;
    }

    if (optionCount == 1 && optionList[0] == iscsiAuthOptionNotPresent) {
        iscsiAuthClientSetKeyValue(&client->sendKeyBlock, keyType, 0);
        return;
    }

    for (i = 0; i < optionCount; i++) {
        const char *s = (*valueToText) (client, optionList[i]);

        if (!s)
            continue;

        if (i == 0) {
            (void) iscsiAuthClientStringCopy(
                client->scratchKeyValue,
                s, iscsiAuthStringMaxLength);
        } else {
            (void) iscsiAuthClientStringAppend(
                client->scratchKeyValue,
                ",", iscsiAuthStringMaxLength);
            (void) iscsiAuthClientStringAppend(
                client->scratchKeyValue,
                s, iscsiAuthStringMaxLength);
        }
    }

    iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
        keyType, client->scratchKeyValue);
}


static void
iscsiAuthClientCheckAuthMethodKey(IscsiAuthClient * client)
{
    iscsiAuthClientCheckKey(client,
        iscsiAuthKeyTypeAuthMethod,
        &client->negotiatedAuthMethod,
        client->authMethodValidCount,
        client->authMethodValidList, iscsiAuthClientAuthMethodOptionToText);
}


static void
iscsiAuthClientSetAuthMethodKey(IscsiAuthClient * client,
    unsigned int authMethodCount, int *authMethodList)
{
    iscsiAuthClientSetKey(client, iscsiAuthKeyTypeAuthMethod,
        authMethodCount, authMethodList,
        iscsiAuthClientAuthMethodOptionToText);
}


static void
iscsiAuthClientCheckChapAlgorithmKey(IscsiAuthClient * client)
{
    const char *keyValue;
    int length;
    unsigned long number;
    unsigned int i;

    keyValue = iscsiAuthClientGetKeyValue(&client->recvKeyBlock,
        iscsiAuthKeyTypeChapAlgorithm);
    if (!keyValue) {
        client->negotiatedChapAlgorithm = iscsiAuthOptionNotPresent;
        return;
    }

    while (*keyValue != '\0') {
        length = 0;

        while (*keyValue != '\0' && *keyValue != ',') {
            client->scratchKeyValue[length++] = *keyValue++;
        }

        if (*keyValue == ',')
            keyValue++;
        client->scratchKeyValue[length++] = '\0';

        if (iscsiAuthClientTextToNumber(client->scratchKeyValue,
            &number)) {
            continue;
        }

        for (i = 0; i < client->chapAlgorithmCount; i++) {

            if (number == (unsigned long)client->
                chapAlgorithmList[i]) {
                client->negotiatedChapAlgorithm = number;
                return;
            }
        }
    }

    client->negotiatedChapAlgorithm = iscsiAuthOptionReject;
}


static void
iscsiAuthClientSetChapAlgorithmKey(IscsiAuthClient * client,
    unsigned int chapAlgorithmCount, int *chapAlgorithmList)
{
    unsigned int i;

    if (chapAlgorithmCount == 0) {
        iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
            iscsiAuthKeyTypeChapAlgorithm, 0);
        return;
    }

    if (chapAlgorithmCount == 1 &&
        chapAlgorithmList[0] == iscsiAuthOptionNotPresent) {
        iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
            iscsiAuthKeyTypeChapAlgorithm, 0);
        return;
    }

    if (chapAlgorithmCount == 1 &&
        chapAlgorithmList[0] == iscsiAuthOptionReject) {
        iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
            iscsiAuthKeyTypeChapAlgorithm, client->rejectOptionName);
        return;
    }

    for (i = 0; i < chapAlgorithmCount; i++) {
        char s[20];

        iscsiAuthClientNumberToText(chapAlgorithmList[i],
            s, sizeof (s));

        if (i == 0) {
            (void) iscsiAuthClientStringCopy(
                client->scratchKeyValue, s,
                iscsiAuthStringMaxLength);
        } else {
            (void) iscsiAuthClientStringAppend(
                client->scratchKeyValue,
                ",", iscsiAuthStringMaxLength);
            (void) iscsiAuthClientStringAppend(
                client->scratchKeyValue,
                s, iscsiAuthStringMaxLength);
        }
    }

    iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
        iscsiAuthKeyTypeChapAlgorithm, client->scratchKeyValue);
}


static void
iscsiAuthClientNextPhase(IscsiAuthClient * client)
{
    switch (client->phase) {
    case iscsiAuthPhaseConfigure:
        client->phase = iscsiAuthPhaseNegotiate;
        break;

    case iscsiAuthPhaseNegotiate:
        client->phase = iscsiAuthPhaseAuthenticate;

        if (client->negotiatedAuthMethod ==
            iscsiAuthOptionReject ||
            client->negotiatedAuthMethod ==
            iscsiAuthOptionNotPresent ||
            client->negotiatedAuthMethod == iscsiAuthOptionNone) {

            client->localState = iscsiAuthLocalStateDone;
            client->remoteState = iscsiAuthRemoteStateDone;

            if (client->authRemote) {
                client->remoteAuthStatus = iscsiAuthStatusFail;
                client->phase = iscsiAuthPhaseDone;
            } else {
                client->remoteAuthStatus = iscsiAuthStatusPass;
            }

            switch (client->negotiatedAuthMethod) {
            case iscsiAuthOptionReject:
                client->debugStatus =
                    iscsiAuthDebugStatusAuthMethodReject;
                break;

            case iscsiAuthOptionNotPresent:
                client->debugStatus =
                    iscsiAuthDebugStatusAuthMethodNotPresent;
                break;

            case iscsiAuthOptionNone:
                client->debugStatus =
                    iscsiAuthDebugStatusAuthMethodNone;
            }

        } else if (client->negotiatedAuthMethod ==
            iscsiAuthMethodChap) {
            client->localState = iscsiAuthLocalStateSendAlgorithm;
            client->remoteState = iscsiAuthRemoteStateSendAlgorithm;
        } else {
            client->localState = iscsiAuthLocalStateDone;
            client->remoteState = iscsiAuthRemoteStateDone;
            client->remoteAuthStatus = iscsiAuthStatusFail;
            client->debugStatus = iscsiAuthDebugStatusAuthMethodBad;
        }

        break;

    case iscsiAuthPhaseAuthenticate:
        client->phase = iscsiAuthPhaseDone;
        break;

    case iscsiAuthPhaseDone:
    case iscsiAuthPhaseError:
    default:
        client->phase = iscsiAuthPhaseError;
    }
}


static void
iscsiAuthClientLocalAuthentication(IscsiAuthClient * client)
{
    unsigned int chapIdentifier;
    unsigned char responseData[iscsiAuthChapResponseLength];
    unsigned long number;
    int status;
    IscsiAuthDebugStatus debugStatus;
    const char *chapIdentifierKeyValue;
    const char *chapChallengeKeyValue;

    switch (client->localState) {
    case iscsiAuthLocalStateSendAlgorithm:
        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
            iscsiAuthClientSetChapAlgorithmKey(
                client, client->chapAlgorithmCount,
                client->chapAlgorithmList);
            client->localState = iscsiAuthLocalStateRecvAlgorithm;
            break;
        }

        /* FALLTHRU */

    case iscsiAuthLocalStateRecvAlgorithm:
        iscsiAuthClientCheckChapAlgorithmKey(client);

        if (client->nodeType == iscsiAuthNodeTypeTarget) {

            iscsiAuthClientSetChapAlgorithmKey(client, 1,
                &client->negotiatedChapAlgorithm);
        }

        /*
         * Make sure only supported CHAP algorithm is used.
         */
        if (client->negotiatedChapAlgorithm ==
            iscsiAuthOptionNotPresent) {
            client->localState = iscsiAuthLocalStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapAlgorithmExpected;
            break;

        } else if (client->negotiatedChapAlgorithm ==
            iscsiAuthOptionReject) {
            client->localState = iscsiAuthLocalStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapAlgorithmReject;
            break;

        } else if (client->negotiatedChapAlgorithm !=
            iscsiAuthChapAlgorithmMd5) {
            client->localState = iscsiAuthLocalStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapAlgorithmBad;
            break;
        }

        if (client->nodeType == iscsiAuthNodeTypeTarget) {

            client->localState = iscsiAuthLocalStateRecvChallenge;
            break;
        }

        /* FALLTHRU */

    case iscsiAuthLocalStateRecvChallenge:
        chapIdentifierKeyValue = iscsiAuthClientGetKeyValue(
            &client->recvKeyBlock, iscsiAuthKeyTypeChapIdentifier);
        chapChallengeKeyValue = iscsiAuthClientGetKeyValue(
            &client->recvKeyBlock, iscsiAuthKeyTypeChapChallenge);

        if (client->nodeType == iscsiAuthNodeTypeTarget) {
            if (!chapIdentifierKeyValue && !chapChallengeKeyValue) {
                client->localState = iscsiAuthLocalStateDone;
                break;
            }
        }

        if (!chapIdentifierKeyValue) {
            client->localState = iscsiAuthLocalStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapIdentifierExpected;
            break;
        }

        if (!chapChallengeKeyValue) {
            client->localState = iscsiAuthLocalStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapChallengeExpected;
            break;
        }

        status = iscsiAuthClientTextToNumber(
            chapIdentifierKeyValue, &number);

        if (status || (255 < number)) {
            client->localState = iscsiAuthLocalStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapIdentifierBad;
            break;
        }
        chapIdentifier = number;

        if (client->recvChapChallengeStatus) {
            client->localState = iscsiAuthLocalStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapChallengeBad;
            break;
        }

        if (client->nodeType == iscsiAuthNodeTypeTarget &&
            client->recvChapChallenge.length ==
            client->sendChapChallenge.length &&
            bcmp(client->recvChapChallenge.largeBinary,
            client->sendChapChallenge.largeBinary,
            client->sendChapChallenge.length) == 0) {

            client->localState = iscsiAuthLocalStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapChallengeReflected;
            break;
        }

        debugStatus = iscsiAuthClientChapComputeResponse(client,
            FALSE,
            chapIdentifier,
            client->recvChapChallenge.largeBinary,
            client->recvChapChallenge.length, responseData);

        if (debugStatus != iscsiAuthDebugStatusNotSet) {
            client->localState = iscsiAuthLocalStateError;
            client->debugStatus = debugStatus;
            break;
        }

        (void) iscsiAuthClientDataToText(client->base64,
            responseData, iscsiAuthChapResponseLength,
            client->scratchKeyValue, iscsiAuthStringMaxLength);
        iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
            iscsiAuthKeyTypeChapResponse, client->scratchKeyValue);

        iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
            iscsiAuthKeyTypeChapUsername, client->username);

        client->localState = iscsiAuthLocalStateDone;
        break;

    case iscsiAuthLocalStateDone:
        break;

    case iscsiAuthLocalStateError:
    default:
        client->phase = iscsiAuthPhaseError;
    }
}


static void
iscsiAuthClientRemoteAuthentication(IscsiAuthClient * client)
{
    unsigned char idData[1];
    unsigned char responseData[iscsiAuthStringMaxLength];
    unsigned int responseLength = iscsiAuthStringMaxLength;
    unsigned char myResponseData[iscsiAuthChapResponseLength];
    int status;
    IscsiAuthDebugStatus debugStatus;
    const char *chapResponseKeyValue;
    const char *chapUsernameKeyValue;

    switch (client->remoteState) {
    case iscsiAuthRemoteStateSendAlgorithm:
        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
            client->remoteState = iscsiAuthRemoteStateSendChallenge;
            break;
        }

        /* FALLTHRU */

    case iscsiAuthRemoteStateSendChallenge:
        if (!client->authRemote) {
            client->remoteAuthStatus = iscsiAuthStatusPass;
            client->debugStatus =
                iscsiAuthDebugStatusAuthRemoteFalse;
            client->remoteState = iscsiAuthRemoteStateDone;
            break;
        }

        iscsiAuthRandomSetData(idData, 1);
        client->sendChapIdentifier = idData[0];

        iscsiAuthClientNumberToText(client->sendChapIdentifier,
            client->scratchKeyValue, iscsiAuthStringMaxLength);
        iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
            iscsiAuthKeyTypeChapIdentifier, client->scratchKeyValue);

        client->sendChapChallenge.length = client->chapChallengeLength;
        iscsiAuthRandomSetData(client->sendChapChallenge.largeBinary,
            client->sendChapChallenge.length);

        iscsiAuthClientSetKeyValue(&client->sendKeyBlock,
            iscsiAuthKeyTypeChapChallenge, "");

        client->remoteState = iscsiAuthRemoteStateRecvResponse;
        break;

    case iscsiAuthRemoteStateRecvResponse:
        chapResponseKeyValue = iscsiAuthClientGetKeyValue(
            &client->recvKeyBlock, iscsiAuthKeyTypeChapResponse);

        chapUsernameKeyValue = iscsiAuthClientGetKeyValue(
            &client->recvKeyBlock, iscsiAuthKeyTypeChapUsername);

        if (!chapResponseKeyValue) {
            client->remoteState = iscsiAuthRemoteStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapResponseExpected;
            break;
        }

        if (!chapUsernameKeyValue) {
            client->remoteState = iscsiAuthRemoteStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapUsernameExpected;
            break;
        }

        status = iscsiAuthClientTextToData(chapResponseKeyValue,
            responseData, &responseLength);

        if (status) {
            client->remoteState = iscsiAuthRemoteStateError;
            client->debugStatus =
                iscsiAuthDebugStatusChapResponseBad;
            break;
        }

        if (responseLength == iscsiAuthChapResponseLength) {
            debugStatus = iscsiAuthClientChapComputeResponse(
                client, TRUE, client->sendChapIdentifier,
                client->sendChapChallenge.largeBinary,
                client->sendChapChallenge.length, myResponseData);

            /*
             * Check if the same CHAP secret is being used for
             * authentication in both directions.
             */
            if (debugStatus == iscsiAuthDebugStatusNotSet &&
                bcmp(myResponseData, responseData,
                iscsiAuthChapResponseLength) == 0) {

                client->remoteState =
                    iscsiAuthRemoteStateError;
                client->debugStatus =
                    iscsiAuthDebugStatusPasswordIdentical;
                break;
            }
        }

        (void) iscsiAuthClientStringCopy(client->chapUsername,
            chapUsernameKeyValue, iscsiAuthStringMaxLength);

        /* To verify the target's response. */
        status = iscsiAuthClientChapAuthRequest(
            client, client->chapUsername, client->sendChapIdentifier,
            client->sendChapChallenge.largeBinary,
            client->sendChapChallenge.length, responseData,
            responseLength);

        if (status == iscsiAuthStatusInProgress) {
            iscsiAuthClientGlobalStats.requestSent++;
            client->remoteState = iscsiAuthRemoteStateAuthRequest;
            break;
        }

        client->remoteAuthStatus = (IscsiAuthStatus) status;
        client->authResponseFlag = TRUE;

        /* FALLTHRU */

    case iscsiAuthRemoteStateAuthRequest:
        /*
         * client->remoteAuthStatus already set
         */
        if (client->authServerErrorFlag) {
            client->remoteAuthStatus = iscsiAuthStatusFail;
            client->debugStatus =
                iscsiAuthDebugStatusAuthServerError;
        } else if (client->remoteAuthStatus == iscsiAuthStatusPass) {
            client->debugStatus = iscsiAuthDebugStatusAuthPass;
        } else if (client->remoteAuthStatus == iscsiAuthStatusFail) {
            client->debugStatus = iscsiAuthDebugStatusAuthFail;
        } else {
            client->remoteAuthStatus = iscsiAuthStatusFail;
            client->debugStatus = iscsiAuthDebugStatusAuthStatusBad;
        }
        client->remoteState = iscsiAuthRemoteStateDone;

        /* FALLTHRU */

    case iscsiAuthRemoteStateDone:
        break;

    case iscsiAuthRemoteStateError:
    default:
        client->phase = iscsiAuthPhaseError;
    }
}


static void
iscsiAuthClientHandshake(IscsiAuthClient * client)
{
    if (client->phase == iscsiAuthPhaseDone) {
        /*
         * Should only happen if authentication
         * protocol error occured.
         */
        return;
    }

    if (client->remoteState == iscsiAuthRemoteStateAuthRequest) {
        /*
         * Defer until authentication response received
         * from internal authentication service.
         */
        return;
    }

    if (client->nodeType == iscsiAuthNodeTypeInitiator) {

        /*
         * Target should only have set T bit on response if
         * initiator set it on previous message.
         */
        if (client->recvKeyBlock.transitBit &&
            client->transitBitSentFlag == 0) {
            client->remoteAuthStatus = iscsiAuthStatusFail;
            client->phase = iscsiAuthPhaseDone;
            client->debugStatus =
                iscsiAuthDebugStatusTbitSetIllegal;
            return;
        }
    }

    if (client->phase == iscsiAuthPhaseNegotiate) {
        /*
         * Should only happen if waiting for peer
         * to send AuthMethod key or set Transit Bit.
         */
        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
            client->sendKeyBlock.transitBit = TRUE;
        }
        return;
    }

    if (client->remoteState == iscsiAuthRemoteStateRecvResponse ||
        client->remoteState == iscsiAuthRemoteStateDone) {

        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
            if (client->recvKeyBlock.transitBit) {
                if (client->remoteState !=
                    iscsiAuthRemoteStateDone) {
                    goto recvTransitBitError;
                }
                iscsiAuthClientNextPhase(client);
            } else {
                client->sendKeyBlock.transitBit = TRUE;
            }
        } else {
            if (client->remoteState == iscsiAuthRemoteStateDone &&
                client->remoteAuthStatus != iscsiAuthStatusPass) {

                /*
                 * Authentication failed, don't
                 * do T bit handshake.
                 */
                iscsiAuthClientNextPhase(client);
            } else {

                /*
                 * Target can only set T bit on response if
                 * initiator set it on current message.
                 */
                if (client->recvKeyBlock.transitBit) {
                    client->sendKeyBlock.transitBit = TRUE;
                    iscsiAuthClientNextPhase(client);
                }
            }
        }
    } else {
        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
            if (client->recvKeyBlock.transitBit) {
                goto recvTransitBitError;
            }
        }
    }

    return;

recvTransitBitError:
    /*
     * Target set T bit on response but
     * initiator was not done with authentication.
     */
    client->remoteAuthStatus = iscsiAuthStatusFail;
    client->phase = iscsiAuthPhaseDone;
    client->debugStatus = iscsiAuthDebugStatusTbitSetPremature;
}


static int
iscsiAuthClientRecvEndStatus(IscsiAuthClient * client)
{
    int authStatus;
    int keyType;

    if (client->phase == iscsiAuthPhaseError) {
        return (iscsiAuthStatusError);
    }

    if (client->phase == iscsiAuthPhaseDone) {

        /*
         * Perform sanity check against configured parameters.
         */

        if (client->authRemote && !client->authResponseFlag &&
            client->remoteAuthStatus == iscsiAuthStatusPass) {

            client->remoteAuthStatus = iscsiAuthStatusFail;
            client->debugStatus =
                iscsiAuthDebugStatusAuthPassNotValid;
        }

        authStatus = client->remoteAuthStatus;
    } else if (client->remoteState == iscsiAuthRemoteStateAuthRequest) {
        authStatus = iscsiAuthStatusInProgress;
    } else {
        authStatus = iscsiAuthStatusContinue;
    }

    if (authStatus != iscsiAuthStatusInProgress) {
        client->recvInProgressFlag = FALSE;
    }

    if (authStatus == iscsiAuthStatusContinue ||
        authStatus == iscsiAuthStatusPass) {
        if (client->sendKeyBlock.duplicateSet) {
            client->remoteAuthStatus = iscsiAuthStatusFail;
            client->phase = iscsiAuthPhaseDone;
            client->debugStatus =
                iscsiAuthDebugStatusSendDuplicateSetKeyValue;
            authStatus = iscsiAuthStatusFail;
        } else if (client->sendKeyBlock.stringTooLong) {
            client->remoteAuthStatus = iscsiAuthStatusFail;
            client->phase = iscsiAuthPhaseDone;
            client->debugStatus =
                iscsiAuthDebugStatusSendStringTooLong;
            authStatus = iscsiAuthStatusFail;
        } else if (client->sendKeyBlock.tooMuchData) {
            client->remoteAuthStatus = iscsiAuthStatusFail;
            client->phase = iscsiAuthPhaseDone;
            client->debugStatus =
                iscsiAuthDebugStatusSendTooMuchData;
            authStatus = iscsiAuthStatusFail;
        } else {
            /*
             * Check that all incoming keys have been processed.
             */
            for (keyType = iscsiAuthKeyTypeFirst;
                keyType < iscsiAuthKeyTypeMaxCount; keyType++) {
                if (client->recvKeyBlock.key[keyType].present &&
                    client->recvKeyBlock.key[keyType].
                    processed == 0) {
                    break;
                }
            }

            if (keyType < iscsiAuthKeyTypeMaxCount) {
                client->remoteAuthStatus = iscsiAuthStatusFail;
                client->phase = iscsiAuthPhaseDone;
                client->debugStatus =
                    iscsiAuthDebugStatusUnexpectedKeyPresent;
                authStatus = iscsiAuthStatusFail;
            }
        }
    }

    if (authStatus != iscsiAuthStatusPass &&
        authStatus != iscsiAuthStatusContinue &&
        authStatus != iscsiAuthStatusInProgress) {
        int authMethodKeyPresent = FALSE;
        int chapAlgorithmKeyPresent = FALSE;

        /*
         * Suppress send keys on error, except
         * for AuthMethod and CHAP_A.
         */
        if (client->nodeType == iscsiAuthNodeTypeTarget) {
            if (iscsiAuthClientGetKeyValue(&client->sendKeyBlock,
                iscsiAuthKeyTypeAuthMethod)) {
                authMethodKeyPresent = TRUE;
            } else if (iscsiAuthClientGetKeyValue(
                &client->sendKeyBlock,
                iscsiAuthKeyTypeChapAlgorithm)) {
                chapAlgorithmKeyPresent = TRUE;
            }
        }

        iscsiAuthClientInitKeyBlock(&client->sendKeyBlock);

        if (client->nodeType == iscsiAuthNodeTypeTarget) {
            if (authMethodKeyPresent &&
                client->negotiatedAuthMethod ==
                iscsiAuthOptionReject) {
                iscsiAuthClientSetKeyValue(
                    &client->sendKeyBlock,
                    iscsiAuthKeyTypeAuthMethod,
                    client->rejectOptionName);
            } else if (chapAlgorithmKeyPresent &&
                client->negotiatedChapAlgorithm ==
                iscsiAuthOptionReject) {
                iscsiAuthClientSetKeyValue(
                    &client->sendKeyBlock,
                    iscsiAuthKeyTypeChapAlgorithm,
                    client->rejectOptionName);
            }
        }
    }

    return (authStatus);
}


int
iscsiAuthClientRecvBegin(IscsiAuthClient * client)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase == iscsiAuthPhaseError) {
        return (iscsiAuthStatusError);
    }

    if (client->phase == iscsiAuthPhaseDone) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (client->recvInProgressFlag) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    client->recvInProgressFlag = TRUE;

    if (client->phase == iscsiAuthPhaseConfigure) {
        iscsiAuthClientNextPhase(client);
    }

    client->transitBitSentFlag = client->sendKeyBlock.transitBit;

    iscsiAuthClientInitKeyBlock(&client->recvKeyBlock);
    iscsiAuthClientInitKeyBlock(&client->sendKeyBlock);

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientRecvEnd(IscsiAuthClient * client,
    IscsiAuthClientCallback * callback, void *userHandle, void *messageHandle)
{
    int nextPhaseFlag = FALSE;

    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase == iscsiAuthPhaseError) {
        return (iscsiAuthStatusError);
    }

    if (!callback || !client->recvInProgressFlag) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (client->recvEndCount > iscsiAuthRecvEndMaxCount) {
        client->remoteAuthStatus = iscsiAuthStatusFail;
        client->phase = iscsiAuthPhaseDone;
        client->debugStatus =
            iscsiAuthDebugStatusRecvMessageCountLimit;
    } else if (client->recvKeyBlock.duplicateSet) {
        client->remoteAuthStatus = iscsiAuthStatusFail;
        client->phase = iscsiAuthPhaseDone;
        client->debugStatus =
            iscsiAuthDebugStatusRecvDuplicateSetKeyValue;
    } else if (client->recvKeyBlock.stringTooLong) {
        client->remoteAuthStatus = iscsiAuthStatusFail;
        client->phase = iscsiAuthPhaseDone;
        client->debugStatus = iscsiAuthDebugStatusRecvStringTooLong;
    } else if (client->recvKeyBlock.tooMuchData) {
        client->remoteAuthStatus = iscsiAuthStatusFail;
        client->phase = iscsiAuthPhaseDone;
        client->debugStatus = iscsiAuthDebugStatusRecvTooMuchData;
    }

    client->recvEndCount++;

    client->callback = callback;
    client->userHandle = userHandle;
    client->messageHandle = messageHandle;

    switch (client->phase) {
    case iscsiAuthPhaseNegotiate:
        iscsiAuthClientCheckAuthMethodKey(client);

        if (client->authMethodValidNegRole ==
            iscsiAuthNegRoleResponder) {
            if (client->negotiatedAuthMethod ==
                iscsiAuthOptionNotPresent) {
                if (client->authRemote ||
                    client->recvKeyBlock.transitBit == 0) {
                    /*
                     * No AuthMethod key from peer
                     * on first message, try moving
                     * the process along by sending
                     * the AuthMethod key.
                     */

                    client->authMethodValidNegRole =
                        iscsiAuthNegRoleOriginator;

                    iscsiAuthClientSetAuthMethodKey(client,
                        client->authMethodValidCount,
                        client->authMethodValidList);
                    break;
                }

                /*
                 * Special case if peer sent no
                 * AuthMethod key, but did set Transit
                 * Bit, allowing this side to do a
                 * null authentication, and compelete
                 * the iSCSI security phase without
                 * either side sending the AuthMethod
                 * key.
                 */
            } else {
                /*
                 * Send response to AuthMethod key.
                 */

                iscsiAuthClientSetAuthMethodKey(client, 1,
                    &client->negotiatedAuthMethod);
            }

            if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                iscsiAuthClientNextPhase(client);
            } else {
                nextPhaseFlag = TRUE;
            }

        } else {
            if (client->negotiatedAuthMethod ==
                iscsiAuthOptionNotPresent) {
                client->remoteAuthStatus = iscsiAuthStatusFail;
                client->phase = iscsiAuthPhaseDone;
                client->debugStatus =
                    iscsiAuthDebugStatusAuthMethodExpected;
                break;
            }

            iscsiAuthClientNextPhase(client);
        }
        break;

    case iscsiAuthPhaseAuthenticate:
    case iscsiAuthPhaseDone:
        break;

    default:
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    switch (client->phase) {
    case iscsiAuthPhaseNegotiate:
        if (nextPhaseFlag) {
            iscsiAuthClientNextPhase(client);
        }
        break;

    case iscsiAuthPhaseAuthenticate:
        /*
         * Must call iscsiAuthClientLocalAuthentication()
         * before iscsiAuthClientRemoteAuthentication()
         * to insure processing of the CHAP algorithm key,
         * and to avoid leaving an in progress request to the
         * authentication service.
         */
        iscsiAuthClientLocalAuthentication(client);

        if (client->localState != iscsiAuthLocalStateError) {
            iscsiAuthClientRemoteAuthentication(client);
        }

        if (client->localState == iscsiAuthLocalStateError ||
            client->remoteState == iscsiAuthRemoteStateError) {

            client->remoteAuthStatus = iscsiAuthStatusFail;
            client->phase = iscsiAuthPhaseDone;
            /*
             * client->debugStatus should already be set.
             */
        }
        break;

    case iscsiAuthPhaseDone:
        break;

    default:
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    iscsiAuthClientHandshake(client);

    return (iscsiAuthClientRecvEndStatus(client));
}


void
iscsiAuthClientAuthResponse(IscsiAuthClient * client, int authStatus)
{
    iscsiAuthClientGlobalStats.responseReceived++;

    if (!client || client->signature != iscsiAuthClientSignature) {
        return;
    }

    if (!client->recvInProgressFlag ||
        client->phase != iscsiAuthPhaseAuthenticate ||
        client->remoteState != iscsiAuthRemoteStateAuthRequest) {

        client->phase = iscsiAuthPhaseError;
        return;
    }

    client->remoteAuthStatus = (IscsiAuthStatus) authStatus;
    client->authResponseFlag = TRUE;

    iscsiAuthClientRemoteAuthentication(client);

    iscsiAuthClientHandshake(client);

    authStatus = iscsiAuthClientRecvEndStatus(client);

    client->callback(client->userHandle, client->messageHandle, authStatus);
}


const char *
iscsiAuthClientGetKeyName(int keyType)
{
    if (keyType < iscsiAuthKeyTypeFirst || keyType > iscsiAuthKeyTypeLast) {
        return (0);
    }
    return (iscsiAuthClientKeyInfo[keyType].name);
}


int
iscsiAuthClientGetNextKeyType(int *pKeyType)
{
    int keyType = *pKeyType;

    if (keyType >= iscsiAuthKeyTypeLast) {
        return (iscsiAuthStatusError);
    }

    if (keyType < iscsiAuthKeyTypeFirst) {
        keyType = iscsiAuthKeyTypeFirst;
    } else {
        keyType++;
    }

    *pKeyType = keyType;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientKeyNameToKeyType(const char *keyName)
{
    int keyType = iscsiAuthKeyTypeNone;

    while (iscsiAuthClientGetNextKeyType(&keyType) ==
        iscsiAuthStatusNoError) {
        const char *keyName2 = iscsiAuthClientGetKeyName(keyType);

        if (!keyName2) {
            return (iscsiAuthKeyTypeNone);
        }

        if (strcmp(keyName, keyName2) == 0) {
            return (keyType);
        }
    }

    return (iscsiAuthKeyTypeNone);
}


int
iscsiAuthClientRecvKeyValue(IscsiAuthClient * client, int keyType,
    const char *userKeyValue)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseNegotiate &&
        client->phase != iscsiAuthPhaseAuthenticate) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (keyType < iscsiAuthKeyTypeFirst || keyType > iscsiAuthKeyTypeLast) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (keyType == iscsiAuthKeyTypeChapChallenge) {
        client->recvChapChallenge.length =
            iscsiAuthLargeBinaryMaxLength;
        client->recvChapChallengeStatus =
            iscsiAuthClientTextToData(userKeyValue,
            client->recvChapChallenge.largeBinary,
            &client->recvChapChallenge.length);
        userKeyValue = "";
    }

    iscsiAuthClientSetKeyValue(&client->recvKeyBlock,
        keyType, userKeyValue);

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSendKeyValue(IscsiAuthClient * client, int keyType,
    int *keyPresent, char *userKeyValue, unsigned int maxLength)
{
    const char *keyValue;

    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure &&
        client->phase != iscsiAuthPhaseNegotiate &&
        client->phase != iscsiAuthPhaseAuthenticate &&
        client->phase != iscsiAuthPhaseDone) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (keyType < iscsiAuthKeyTypeFirst || keyType > iscsiAuthKeyTypeLast) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    keyValue = iscsiAuthClientGetKeyValue(&client->sendKeyBlock, keyType);
    if (keyValue) {
        if (keyType == iscsiAuthKeyTypeChapChallenge) {
            if (iscsiAuthClientDataToText(client->base64,
                client->sendChapChallenge.largeBinary,
                client->sendChapChallenge.length,
                userKeyValue, maxLength)) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
            }
        } else {
            if (iscsiAuthClientStringCopy(userKeyValue,
                keyValue, maxLength)) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
            }
        }
        *keyPresent = TRUE;
    } else {
        *keyPresent = FALSE;
    }

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientRecvTransitBit(IscsiAuthClient * client, int value)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseNegotiate &&
        client->phase != iscsiAuthPhaseAuthenticate) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (value) {
        client->recvKeyBlock.transitBit = TRUE;
    } else {
        client->recvKeyBlock.transitBit = FALSE;
    }

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSendTransitBit(IscsiAuthClient * client, int *value)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure &&
        client->phase != iscsiAuthPhaseNegotiate &&
        client->phase != iscsiAuthPhaseAuthenticate &&
        client->phase != iscsiAuthPhaseDone) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    *value = client->sendKeyBlock.transitBit;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientInit(int nodeType, int bufferDescCount,
    IscsiAuthBufferDesc * bufferDesc)
{
    IscsiAuthClient *client;
    IscsiAuthStringBlock *recvStringBlock;
    IscsiAuthStringBlock *sendStringBlock;
    IscsiAuthLargeBinary *recvChapChallenge;
    IscsiAuthLargeBinary *sendChapChallenge;
    int valueList[2];

    if (bufferDescCount != 5 ||
        bufferDesc == 0) {
        return (iscsiAuthStatusError);
    }

    if (!bufferDesc[0].address ||
        bufferDesc[0].length != sizeof (*client)) {
        return (iscsiAuthStatusError);
    }
    client = (IscsiAuthClient *) bufferDesc[0].address;

    if (bufferDesc[1].address == 0 ||
        bufferDesc[1].length != sizeof (*recvStringBlock)) {
        return (iscsiAuthStatusError);
    }
    recvStringBlock = (IscsiAuthStringBlock *) bufferDesc[1].address;

    if (bufferDesc[2].address == 0 ||
        bufferDesc[2].length != sizeof (*sendStringBlock)) {
        return (iscsiAuthStatusError);
    }
    sendStringBlock = (IscsiAuthStringBlock *) bufferDesc[2].address;

    if (bufferDesc[3].address == 0 ||
        bufferDesc[3].length != sizeof (*recvChapChallenge)) {
        return (iscsiAuthStatusError);
    }
    recvChapChallenge = (IscsiAuthLargeBinary *) bufferDesc[3].address;

    if (bufferDesc[4].address == 0 ||
        bufferDesc[4].length != sizeof (*sendChapChallenge)) {
        return (iscsiAuthStatusError);
    }
    sendChapChallenge = (IscsiAuthLargeBinary *) bufferDesc[4].address;

    bzero(client, sizeof (*client));
    bzero(recvStringBlock, sizeof (*recvStringBlock));
    bzero(sendStringBlock, sizeof (*sendStringBlock));
    bzero(recvChapChallenge, sizeof (*recvChapChallenge));
    bzero(sendChapChallenge, sizeof (*sendChapChallenge));

    client->recvKeyBlock.stringBlock = recvStringBlock->stringBlock;
    client->sendKeyBlock.stringBlock = sendStringBlock->stringBlock;
    client->recvChapChallenge.largeBinary = recvChapChallenge->largeBinary;
    client->sendChapChallenge.largeBinary = sendChapChallenge->largeBinary;

    if (iscsiAuthClientCheckNodeType(nodeType)) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    client->signature = iscsiAuthClientSignature;
    client->nodeType = (IscsiAuthNodeType) nodeType;
    /* Assume bi-directional authentication enabled. */
    client->authRemote = TRUE;
    client->passwordPresent = FALSE;
    client->version = iscsiAuthVersionRfc;
    client->chapChallengeLength = iscsiAuthChapResponseLength;
    client->ipSec = TRUE;
    client->base64 = FALSE;

    client->phase = iscsiAuthPhaseConfigure;
    client->negotiatedAuthMethod = iscsiAuthOptionNotPresent;
    client->negotiatedChapAlgorithm = iscsiAuthOptionNotPresent;

    if (client->nodeType == iscsiAuthNodeTypeInitiator) {
        client->authMethodNegRole = iscsiAuthNegRoleOriginator;
    } else {
        /*
         * Initial value ignored for Target.
         */
        client->authMethodNegRole = iscsiAuthNegRoleResponder;
    }

    /* All supported authentication methods */
    valueList[0] = iscsiAuthMethodChap;
    valueList[1] = iscsiAuthOptionNone;

    /*
     * Must call after setting authRemote, password,
     * version and authMethodNegRole
     */
    if (iscsiAuthClientSetAuthMethodList(client, 2, valueList) !=
        iscsiAuthStatusNoError) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    valueList[0] = iscsiAuthChapAlgorithmMd5;

    if (iscsiAuthClientSetChapAlgorithmList(client, 1, valueList) !=
        iscsiAuthStatusNoError) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientFinish(IscsiAuthClient * client)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    iscsiAuthClientChapAuthCancel(client);

    bzero(client, sizeof (*client));

    return (iscsiAuthStatusNoError);
}


static int
iscsiAuthClientSetOptionList(IscsiAuthClient * client,
    unsigned int optionCount,
    const int *optionList,
    unsigned int *clientOptionCount,
    int *clientOptionList,
    unsigned int optionMaxCount,
    int (*checkOption) (int),
    int (*checkList) (unsigned int optionCount, const int *optionList))
{
    unsigned int i;
    unsigned int j;

    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure ||
        optionCount > optionMaxCount) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    for (i = 0; i < optionCount; i++) {
        if ((*checkOption) (optionList[i])) {
            client->phase = iscsiAuthPhaseError;
            return (iscsiAuthStatusError);
        }
    }

    /*
     * Check for duplicate entries.
     */
    for (i = 0; i < optionCount; i++) {
        for (j = 0; j < optionCount; j++) {
            if (j == i)
                continue;
            if (optionList[i] == optionList[j]) {
                client->phase = iscsiAuthPhaseError;
                return (iscsiAuthStatusError);
            }
        }
    }

    /*
     * Check for key specific constraints.
     */
    if (checkList) {
        if ((*checkList) (optionCount, optionList)) {
            client->phase = iscsiAuthPhaseError;
            return (iscsiAuthStatusError);
        }
    }

    for (i = 0; i < optionCount; i++) {
        clientOptionList[i] = optionList[i];
    }

    *clientOptionCount = optionCount;

    return (iscsiAuthStatusNoError);
}


static void
iscsiAuthClientSetAuthMethodValid(IscsiAuthClient * client)
{
    static const char rejectOptionNameDraft8[] = "reject";
    static const char rejectOptionNameRfc[] = "Reject";
    static const char noneOptionNameDraft8[] = "none";
    static const char noneOptionNameRfc[] = "None";
    unsigned int i;
    unsigned int j = 0;
    int option = 0;

    if (client->version == iscsiAuthVersionDraft8) {
        client->rejectOptionName = rejectOptionNameDraft8;
        client->noneOptionName = noneOptionNameDraft8;
    } else {
        client->rejectOptionName = rejectOptionNameRfc;
        client->noneOptionName = noneOptionNameRfc;
    }

    /*
     * Following checks may need to be revised if
     * authentication options other than CHAP and none
     * are supported.
     */

    if (client->nodeType == iscsiAuthNodeTypeInitiator) {

        if (client->authRemote) {
            /*
             * If initiator doing authentication,
             * don't offer authentication option none.
             */
            option = 1;
        } else if (!client->passwordPresent) {
            /*
             * If initiator password not set,
             * only offer authentication option none.
             */
            option = 2;
        }
    }

    if (client->nodeType == iscsiAuthNodeTypeTarget) {

        if (client->authRemote) {
            /*
             * If target doing authentication,
             * don't accept authentication option none.
             */
            option = 1;
        } else {
            /*
             * If target not doing authentication,
             * only accept authentication option none.
             */
            option = 2;
        }
    }

    for (i = 0; i < client->authMethodCount; i++) {

        if (option == 1) {
            if (client->authMethodList[i] == iscsiAuthOptionNone) {
                continue;
            }
        } else if (option == 2) {
            if (client->authMethodList[i] != iscsiAuthOptionNone) {
                continue;
            }
        }

        client->authMethodValidList[j++] = client->authMethodList[i];
    }

    client->authMethodValidCount = j;

    iscsiAuthClientInitKeyBlock(&client->sendKeyBlock);

    if (client->nodeType == iscsiAuthNodeTypeInitiator) {
        if (client->authRemote) {
            /*
             * Initiator wants to authenticate target,
             * always send AuthMethod key.
             */
            client->sendKeyBlock.transitBit = FALSE;
            client->authMethodValidNegRole =
                iscsiAuthNegRoleOriginator;
        } else {
            client->sendKeyBlock.transitBit = TRUE;
            client->authMethodValidNegRole =
                client->authMethodNegRole;
        }
    } else {
        client->sendKeyBlock.transitBit = FALSE;
        client->authMethodValidNegRole = iscsiAuthNegRoleResponder;
    }

    if (client->authMethodValidNegRole == iscsiAuthNegRoleOriginator) {
        iscsiAuthClientSetAuthMethodKey(client,
            client->authMethodValidCount,
            client->authMethodValidList);
    } else {
        int value = iscsiAuthOptionNotPresent;
        iscsiAuthClientSetAuthMethodKey(client, 1, &value);
    }
}


static int
iscsiAuthClientCheckAuthMethodList(unsigned int optionCount,
    const int *optionList)
{
    unsigned int i;

    if (!optionList || optionCount < 2) {
        return (TRUE);
    }

    if (optionList[optionCount - 1] != iscsiAuthOptionNone) {
        return (TRUE);
    }

    for (i = 0; i < (optionCount - 1); i++) {
        if (optionList[i] != iscsiAuthOptionNone) {
            return (FALSE);
        }
    }

    return (FALSE);
}


int
iscsiAuthClientSetAuthMethodList(IscsiAuthClient * client,
    unsigned int optionCount, const int *optionList)
{
    int status;

    status = iscsiAuthClientSetOptionList(
        client, optionCount, optionList, &client->authMethodCount,
        client->authMethodList, iscsiAuthMethodMaxCount,
        iscsiAuthClientCheckAuthMethodOption,
        iscsiAuthClientCheckAuthMethodList);

    if (status != iscsiAuthStatusNoError) {
        return (status);
    }

    /*
     * Setting authMethod affects authMethodValid.
     */
    iscsiAuthClientSetAuthMethodValid(client);

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetAuthMethodNegRole(IscsiAuthClient * client, int negRole)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure ||
        iscsiAuthClientCheckNegRole(negRole) ||
        client->nodeType != iscsiAuthNodeTypeInitiator) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    client->authMethodNegRole = (IscsiAuthNegRole) negRole;

    /*
     * Setting negRole affects authMethodValid.
     */
    iscsiAuthClientSetAuthMethodValid(client);

    return (iscsiAuthStatusNoError);
}


static int
iscsiAuthClientCheckChapAlgorithmList(unsigned int optionCount,
    const int *optionList)
{
    if (!optionList || optionCount < 1) {
        return (TRUE);
    }

    return (FALSE);
}


int
iscsiAuthClientSetChapAlgorithmList(IscsiAuthClient * client,
    unsigned int optionCount, const int *optionList)
{
    return (iscsiAuthClientSetOptionList(client,
        optionCount,
        optionList,
        &client->chapAlgorithmCount,
        client->chapAlgorithmList,
        iscsiAuthChapAlgorithmMaxCount,
        iscsiAuthClientCheckChapAlgorithmOption,
        iscsiAuthClientCheckChapAlgorithmList));
}


int
iscsiAuthClientSetUsername(IscsiAuthClient * client, const char *username)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure ||
        iscsiAuthClientCheckString(username, iscsiAuthStringMaxLength, 0)) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (iscsiAuthClientStringCopy(client->username, username,
        iscsiAuthStringMaxLength)) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetPassword(IscsiAuthClient * client,
    const unsigned char *passwordData, unsigned int passwordLength)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure ||
        passwordLength > iscsiAuthStringMaxLength) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    bcopy(passwordData, client->passwordData, passwordLength);
    client->passwordLength = passwordLength;
    if (client->passwordLength > 0) {
        client->passwordPresent = TRUE;
    } else {
        client->passwordPresent = FALSE;
    }

    /*
     * Setting password may affect authMethodValid.
     */
    iscsiAuthClientSetAuthMethodValid(client);

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetAuthRemote(IscsiAuthClient * client, int authRemote)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    client->authRemote = authRemote;

    /*
     * Setting authRemote may affect authMethodValid.
     */
    iscsiAuthClientSetAuthMethodValid(client);

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetGlueHandle(IscsiAuthClient * client, void *glueHandle)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure &&
        client->phase != iscsiAuthPhaseNegotiate &&
        client->phase != iscsiAuthPhaseAuthenticate) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    client->glueHandle = glueHandle;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetMethodListName(IscsiAuthClient *client,
    const char *methodListName)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure ||
        iscsiAuthClientCheckString(methodListName,
        iscsiAuthStringMaxLength, 0)) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (iscsiAuthClientStringCopy(client->methodListName, methodListName,
        iscsiAuthStringMaxLength)) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetVersion(IscsiAuthClient * client, int version)
{
    if (client == 0 ||
        client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure ||
        iscsiAuthClientCheckVersion(version)) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    client->version = (IscsiAuthVersion) version;

    iscsiAuthClientSetAuthMethodValid(client);

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetIpSec(IscsiAuthClient * client, int ipSec)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    client->ipSec = ipSec;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetBase64(IscsiAuthClient * client, int base64)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    client->base64 = base64;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSetChapChallengeLength(IscsiAuthClient * client,
    unsigned int chapChallengeLength)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure ||
        chapChallengeLength < iscsiAuthChapResponseLength ||
        chapChallengeLength > iscsiAuthLargeBinaryMaxLength) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    client->chapChallengeLength = chapChallengeLength;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientCheckPasswordNeeded(IscsiAuthClient *client, int *passwordNeeded)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (client->nodeType == iscsiAuthNodeTypeInitiator) {
        if (client->authRemote && !client->passwordPresent) {
            *passwordNeeded = TRUE;
        } else {
            *passwordNeeded = FALSE;
        }
    } else {
        *passwordNeeded = FALSE;
    }

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetAuthPhase(IscsiAuthClient * client, int *value)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    *value = client->phase;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetAuthStatus(IscsiAuthClient * client, int *value)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseDone) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    *value = client->remoteAuthStatus;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientAuthStatusPass(int authStatus)
{
    if (authStatus == iscsiAuthStatusPass) {
        return (TRUE);
    }

    return (FALSE);
}


int
iscsiAuthClientGetAuthMethod(IscsiAuthClient * client, int *value)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseDone &&
        client->phase != iscsiAuthPhaseAuthenticate) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    *value = client->negotiatedAuthMethod;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetChapAlgorithm(IscsiAuthClient * client, int *value)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseDone) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    *value = client->negotiatedChapAlgorithm;

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetChapUsername(IscsiAuthClient * client,
    char *value, unsigned int maxLength)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseDone) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (iscsiAuthClientStringCopy(value, client->chapUsername, maxLength)) {
        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientSendStatusCode(IscsiAuthClient * client, int *statusCode)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseConfigure &&
        client->phase != iscsiAuthPhaseNegotiate &&
        client->phase != iscsiAuthPhaseAuthenticate &&
        client->phase != iscsiAuthPhaseDone) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseDone) {
        *statusCode = 0x0000;
        return (iscsiAuthStatusNoError);
    }

    switch (client->remoteAuthStatus) {
    case iscsiAuthStatusPass:
        *statusCode = 0x0000;   /* no error */
        break;

    case iscsiAuthStatusFail:
        switch (client->debugStatus) {
        case iscsiAuthDebugStatusAuthFail:
            /*
             * Authentication error with peer.
             */
            if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                *statusCode = 0x0300;
                /*
                 * iSCSI Target error
                 */
            } else {
                *statusCode = 0x0201;
                /*
                 * iSCSI Initiator error
                 */
            }
            break;

        case iscsiAuthDebugStatusAuthMethodExpected:
        case iscsiAuthDebugStatusChapAlgorithmExpected:
        case iscsiAuthDebugStatusChapIdentifierExpected:
        case iscsiAuthDebugStatusChapChallengeExpected:
        case iscsiAuthDebugStatusChapResponseExpected:
        case iscsiAuthDebugStatusChapUsernameExpected:
            /*
             * Missing parameter with peer.
             */
            if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                *statusCode = 0x0300;
                /*
                 * iSCSI Target error
                 */
            } else {
                *statusCode = 0x0207;
                /*
                 * iSCSI Initiator error
                 */
            }
            break;

        case iscsiAuthDebugStatusAuthMethodNotPresent:
        case iscsiAuthDebugStatusAuthMethodReject:
        case iscsiAuthDebugStatusAuthMethodNone:
        case iscsiAuthDebugStatusChapAlgorithmReject:
        case iscsiAuthDebugStatusChapChallengeReflected:
        case iscsiAuthDebugStatusPasswordIdentical:
            /*
             * Could not authenticate with peer.
             */
            if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                *statusCode = 0x0300;
                /*
                 * iSCSI Target error
                 */
            } else {
                *statusCode = 0x0201;
                /*
                 * iSCSI Initiator error
                 */
            }
            break;

        case iscsiAuthDebugStatusLocalPasswordNotSet:
            /*
             * Local password not set.
             */
            if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                *statusCode = 0x0200;
                /*
                 * iSCSI Initiator error
                 */
            } else {
                *statusCode = 0x0201;
                /*
                 * iSCSI Target error
                 */
            }
            break;

        case iscsiAuthDebugStatusChapIdentifierBad:
        case iscsiAuthDebugStatusChapChallengeBad:
        case iscsiAuthDebugStatusChapResponseBad:
        case iscsiAuthDebugStatusUnexpectedKeyPresent:
        case iscsiAuthDebugStatusTbitSetIllegal:
        case iscsiAuthDebugStatusTbitSetPremature:
        case iscsiAuthDebugStatusRecvMessageCountLimit:
        case iscsiAuthDebugStatusRecvDuplicateSetKeyValue:
        case iscsiAuthDebugStatusRecvStringTooLong:
        case iscsiAuthDebugStatusRecvTooMuchData:
            /*
             * Other error with peer.
             */
            if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                *statusCode = 0x0300;
                /*
                 * iSCSI Target error
                 */
            } else {
                *statusCode = 0x0200;
                /*
                 * iSCSI Initiator error
                 */
            }
            break;

        case iscsiAuthDebugStatusNotSet:
        case iscsiAuthDebugStatusAuthPass:
        case iscsiAuthDebugStatusAuthRemoteFalse:
        case iscsiAuthDebugStatusAuthMethodBad:
        case iscsiAuthDebugStatusChapAlgorithmBad:
        case iscsiAuthDebugStatusPasswordDecryptFailed:
        case iscsiAuthDebugStatusPasswordTooShortWithNoIpSec:
        case iscsiAuthDebugStatusAuthServerError:
        case iscsiAuthDebugStatusAuthStatusBad:
        case iscsiAuthDebugStatusAuthPassNotValid:
        case iscsiAuthDebugStatusSendDuplicateSetKeyValue:
        case iscsiAuthDebugStatusSendStringTooLong:
        case iscsiAuthDebugStatusSendTooMuchData:
        default:
            /*
             * Error on this side.
             */
            if (client->nodeType == iscsiAuthNodeTypeInitiator) {
                *statusCode = 0x0200;
                /*
                 * iSCSI Initiator error
                 */
            } else {
                *statusCode = 0x0300;
                /*
                 * iSCSI Target error
                 */
            }

        }
        break;

    case iscsiAuthStatusNoError:
    case iscsiAuthStatusError:
    case iscsiAuthStatusContinue:
    case iscsiAuthStatusInProgress:
    default:
        /*
         * Bad authStatus
         */
        if (client->nodeType == iscsiAuthNodeTypeInitiator) {
            *statusCode = 0x0200;
            /*
             * iSCSI Initiator error
             */
        } else {
            *statusCode = 0x0300;
            /*
             * iSCSI Target error
             */
        }
    }

    return (iscsiAuthStatusNoError);
}


int
iscsiAuthClientGetDebugStatus(IscsiAuthClient * client, int *value)
{
    if (!client || client->signature != iscsiAuthClientSignature) {
        return (iscsiAuthStatusError);
    }

    if (client->phase != iscsiAuthPhaseDone) {

        client->phase = iscsiAuthPhaseError;
        return (iscsiAuthStatusError);
    }

    *value = client->debugStatus;

    return (iscsiAuthStatusNoError);
}


const char *
iscsiAuthClientDebugStatusToText(int debugStatus)
{
    const char *s;

    switch (debugStatus) {
    case iscsiAuthDebugStatusNotSet:
        s = "Debug status not set";
        break;

    case iscsiAuthDebugStatusAuthPass:
        s = "Authentication request passed";
        break;

    case iscsiAuthDebugStatusAuthRemoteFalse:
        s = "Authentication not enabled";
        break;

    case iscsiAuthDebugStatusAuthFail:
        s = "Authentication request failed";
        break;

    case iscsiAuthDebugStatusAuthMethodBad:
        s = "AuthMethod bad";
        break;

    case iscsiAuthDebugStatusChapAlgorithmBad:
        s = "CHAP algorithm bad";
        break;

    case iscsiAuthDebugStatusPasswordDecryptFailed:
        s = "Decrypt password failed";
        break;

    case iscsiAuthDebugStatusPasswordTooShortWithNoIpSec:
        s = "Local password too short with no IPSec";
        break;

    case iscsiAuthDebugStatusAuthServerError:
        s = "Unexpected error from authentication server";
        break;

    case iscsiAuthDebugStatusAuthStatusBad:
        s = "Authentication request status bad";
        break;

    case iscsiAuthDebugStatusAuthPassNotValid:
        s = "Authentication pass status not valid";
        break;

    case iscsiAuthDebugStatusSendDuplicateSetKeyValue:
        s = "Same key set more than once on send";
        break;

    case iscsiAuthDebugStatusSendStringTooLong:
        s = "Key value too long on send";
        break;

    case iscsiAuthDebugStatusSendTooMuchData:
        s = "Too much data on send";
        break;

    case iscsiAuthDebugStatusAuthMethodExpected:
        s = "AuthMethod key expected";
        break;

    case iscsiAuthDebugStatusChapAlgorithmExpected:
        s = "CHAP algorithm key expected";
        break;

    case iscsiAuthDebugStatusChapIdentifierExpected:
        s = "CHAP identifier expected";
        break;

    case iscsiAuthDebugStatusChapChallengeExpected:
        s = "CHAP challenge expected";
        break;

    case iscsiAuthDebugStatusChapResponseExpected:
        s = "CHAP response expected";
        break;

    case iscsiAuthDebugStatusChapUsernameExpected:
        s = "CHAP username expected";
        break;

    case iscsiAuthDebugStatusAuthMethodNotPresent:
        s = "AuthMethod key not present";
        break;

    case iscsiAuthDebugStatusAuthMethodReject:
        s = "AuthMethod negotiation failed";
        break;

    case iscsiAuthDebugStatusAuthMethodNone:
        s = "AuthMethod negotiated to none";
        break;

    case iscsiAuthDebugStatusChapAlgorithmReject:
        s = "CHAP algorithm negotiation failed";
        break;

    case iscsiAuthDebugStatusChapChallengeReflected:
        s = "CHAP challange reflected";
        break;

    case iscsiAuthDebugStatusPasswordIdentical:
        s = "Local password same as remote";
        break;

    case iscsiAuthDebugStatusLocalPasswordNotSet:
        s = "Local password not set";
        break;

    case iscsiAuthDebugStatusChapIdentifierBad:
        s = "CHAP identifier bad";
        break;

    case iscsiAuthDebugStatusChapChallengeBad:
        s = "CHAP challenge bad";
        break;

    case iscsiAuthDebugStatusChapResponseBad:
        s = "CHAP response bad";
        break;

    case iscsiAuthDebugStatusUnexpectedKeyPresent:
        s = "Unexpected key present";
        break;

    case iscsiAuthDebugStatusTbitSetIllegal:
        s = "T bit set on response, but not on previous message";
        break;

    case iscsiAuthDebugStatusTbitSetPremature:
        s = "T bit set on response, but authenticaton not complete";
        break;

    case iscsiAuthDebugStatusRecvMessageCountLimit:
        s = "Message count limit reached on receive";
        break;

    case iscsiAuthDebugStatusRecvDuplicateSetKeyValue:
        s = "Same key set more than once on receive";
        break;

    case iscsiAuthDebugStatusRecvStringTooLong:
        s = "Key value too long on receive";
        break;

    case iscsiAuthDebugStatusRecvTooMuchData:
        s = "Too much data on receive";
        break;

    default:
        s = "Unknown error";
    }

    return (s);
}