Module codec 

Pure EAPOL / EAP codec — IEEE 802.1X-2004 §11.3 and RFC 3748.

No I/O, no locks, no async, no state. Everything here is a total function over bytes, so tests/server/eapol/codec_test.rs can pin it against literal specification bytes without a socket, an interface or a privilege. That split is the point: the transport in mod.rs is a thin shell over these functions, and the transport is the part that has never run.

The one rule this file exists to enforce

An EAP-Success frame is an admission decision, so there is exactly one function in this crate that can produce those bytes — eapol_eap_success_frame — and it shares no code with eapol_eap_failure_frame. Neither takes a code, a boolean, or anything else that could select the other. grep -rn EAP_CODE_SUCCESS src/ --include='*.rs' finds five code sites and exactly one of them writes the octet: the constant, that one builder, the EapPacket::decode arm, eap_code_name, and classify_frame in mod.rs. The other four only read. A sixth site, or a second one that constructs a frame, wants careful reading.

A generic encode_eap_result(code, id) would be shorter and is precisely what must not exist: one wrong argument, one inverted condition, and an authentication bypass is a single character wide.

Structs

EapPacket

A decoded EAP packet. eap_type is present only for Request and Response (RFC 3748 §4.1); Success and Failure have no type octet and are exactly four octets long (§4.2).

EapolFrame

An EAPOL PDU: protocol version, packet type, and the body the length field delimits.

EthernetFrame

A parsed Ethernet II frame. payload has any trailing pad removed only insofar as the EAPOL layer declares its own length — Ethernet itself cannot tell pad from data.

Enums

CodecError

Everything that can be wrong with a frame. Deliberately specific: an authenticator that logs “bad packet” tells an operator nothing about which of six layers failed.

Constants

EAPOL_HEADER_LEN

Protocol version (1) + packet type (1) + body length (2).

EAPOL_TYPE_ASF_ALERT

EAPOL_TYPE_EAP_PACKET

EAPOL_TYPE_KEY

EAPOL_TYPE_LOGOFF

EAPOL_TYPE_START

EAPOL_VERSION_2001

802.1X-2001. Still what many supplicants put on the wire.

EAPOL_VERSION_2004

802.1X-2004. NetGet’s default.

EAPOL_VERSION_2010

802.1X-2010.

EAP_CODE_FAILURE

EAP_CODE_REQUEST

EAP_CODE_RESPONSE

EAP_CODE_SUCCESS

EAP_HEADER_LEN

Code (1) + identifier (1) + length (2).

EAP_TYPE_IDENTITY

EAP_TYPE_MD5_CHALLENGE

EAP_TYPE_MSCHAPV2

EAP_TYPE_NAK

EAP_TYPE_NOTIFICATION

EAP_TYPE_PEAP

EAP_TYPE_TLS

ETHERNET_HEADER_LEN

Destination MAC (6) + source MAC (6) + EtherType (2).

ETHERNET_MIN_FRAME_LEN

An Ethernet frame is padded out to 60 octets before the FCS. EAPOL frames are far shorter than that, so trailing padding is the normal case and must be ignored rather than parsed.

ETHERTYPE_EAPOL

EtherType carrying EAPOL, IEEE 802.1X-2004 §11.3.1.

MD5_CHALLENGE_LEN

RFC 1994 §2.2 recommends a challenge of at least the digest length.

PAE_GROUP_ADDRESS

The PAE group address supplicants send to, IEEE 802.1X-2004 §7.8 Table 7-2.

TLS_FLAG_LENGTH_INCLUDED

EAP-TLS flag bits, RFC 5216 §3.1. Shared by PEAP (RFC 7170 §3.1 uses the same layout).

TLS_FLAG_MORE_FRAGMENTS

TLS_FLAG_START

Functions

build_ethernet_frame

Build an Ethernet II frame, padding the tail to the 60-octet minimum the MAC layer requires. Pad octets are zero, and the EAPOL body-length field is what lets the receiver ignore them.

decode_md5_value

Split an MD5-Challenge type-data field into its value and its trailing name.

eap_code_name

eap_request_identity

EAP-Request/Identity — the first thing an authenticator says. Carries no prompt.

eap_request_md5_challenge

EAP-Request/MD5-Challenge — RFC 3748 §5.4, whose value field follows RFC 1994 §4.1: Value-Size (1) | Value | Name.

eap_request_notification

EAP-Request/Notification — a displayable message, RFC 3748 §5.2. Not a decision.

eap_request_tls_start

EAP-Request/TLS or /PEAP carrying only the Start flag, RFC 5216 §3.2.

eap_response

Encode a Response body. Used by the supplicant role and by tests playing a supplicant.

eap_response_identity

EAP-Response/Identity carrying a claimed identity.

eap_type_name

eapol_eap_failure_frame

The denial. Every fail-closed path in mod.rs calls this directly, bypassing the action executor entirely, so no model output and no error path can reach the function above.

eapol_eap_success_frame

The only function in NetGet that can produce an EAP-Success.

eapol_logoff_frame

An EAPOL-Logoff.

eapol_packet_type_name

eapol_start_frame

An EAPOL-Start, used by the supplicant role and by tests playing one.

eapol_wrap_eap

Wrap an already-encoded EAP packet in an EAPOL header.

encode_md5_value

Value-Size (1) | Value | Name — RFC 1994 §4.1, reused by EAP-MD5-Challenge.

format_mac

Lower-case colon-separated form, which is what every event field carries.

md5

RFC 1321 MD5 of a single buffer.

md5_challenge_digest

RFC 1994 §2.2: MD5(Identifier || Secret || Challenge).

md5_response_matches

Whether a supplicant’s MD5-Challenge response matches the digest of the expected secret.

parse_ethernet_frame

parse_mac

Accepts aa:bb:cc:dd:ee:ff, aa-bb-cc-dd-ee-ff and aabbccddeeff, any case.

tls_flags

Flags on an EAP-TLS/PEAP fragment, RFC 5216 §3.1, as a structured triple. Returns None when the fragment carries no flags octet at all.

Type Aliases

CodecResult