1 /*
2 * EAP peer method: EAP-TEAP PAC file processing
3 * Copyright (c) 2004-2019, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "eap_config.h"
13 #include "eap_i.h"
14 #include "eap_teap_pac.h"
15
16 /* TODO: encrypt PAC-Key in the PAC file */
17
18
19 /* Text data format */
20 static const char *pac_file_hdr =
21 "wpa_supplicant EAP-TEAP PAC file - version 1";
22
23 /*
24 * Binary data format
25 * 4-octet magic value: 6A E4 92 1C
26 * 2-octet version (big endian)
27 * <version specific data>
28 *
29 * version=0:
30 * Sequence of PAC entries:
31 * 2-octet PAC-Type (big endian)
32 * 32-octet PAC-Key
33 * 2-octet PAC-Opaque length (big endian)
34 * <variable len> PAC-Opaque data (length bytes)
35 * 2-octet PAC-Info length (big endian)
36 * <variable len> PAC-Info data (length bytes)
37 */
38
39 #define EAP_TEAP_PAC_BINARY_MAGIC 0x6ae4921c
40 #define EAP_TEAP_PAC_BINARY_FORMAT_VERSION 0
41
42
43 /**
44 * eap_teap_free_pac - Free PAC data
45 * @pac: Pointer to the PAC entry
46 *
47 * Note that the PAC entry must not be in a list since this function does not
48 * remove the list links.
49 */
eap_teap_free_pac(struct eap_teap_pac * pac)50 void eap_teap_free_pac(struct eap_teap_pac *pac)
51 {
52 os_free(pac->pac_opaque);
53 os_free(pac->pac_info);
54 os_free(pac->a_id);
55 os_free(pac->i_id);
56 os_free(pac->a_id_info);
57 os_free(pac);
58 }
59
60
61 /**
62 * eap_teap_get_pac - Get a PAC entry based on A-ID
63 * @pac_root: Pointer to root of the PAC list
64 * @a_id: A-ID to search for
65 * @a_id_len: Length of A-ID
66 * @pac_type: PAC-Type to search for
67 * Returns: Pointer to the PAC entry, or %NULL if A-ID not found
68 */
eap_teap_get_pac(struct eap_teap_pac * pac_root,const u8 * a_id,size_t a_id_len,u16 pac_type)69 struct eap_teap_pac * eap_teap_get_pac(struct eap_teap_pac *pac_root,
70 const u8 *a_id, size_t a_id_len,
71 u16 pac_type)
72 {
73 struct eap_teap_pac *pac = pac_root;
74
75 while (pac) {
76 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
77 os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
78 return pac;
79 }
80 pac = pac->next;
81 }
82 return NULL;
83 }
84
85
eap_teap_remove_pac(struct eap_teap_pac ** pac_root,struct eap_teap_pac ** pac_current,const u8 * a_id,size_t a_id_len,u16 pac_type)86 static void eap_teap_remove_pac(struct eap_teap_pac **pac_root,
87 struct eap_teap_pac **pac_current,
88 const u8 *a_id, size_t a_id_len, u16 pac_type)
89 {
90 struct eap_teap_pac *pac, *prev;
91
92 pac = *pac_root;
93 prev = NULL;
94
95 while (pac) {
96 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
97 os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
98 if (!prev)
99 *pac_root = pac->next;
100 else
101 prev->next = pac->next;
102 if (*pac_current == pac)
103 *pac_current = NULL;
104 eap_teap_free_pac(pac);
105 break;
106 }
107 prev = pac;
108 pac = pac->next;
109 }
110 }
111
112
eap_teap_copy_buf(u8 ** dst,size_t * dst_len,const u8 * src,size_t src_len)113 static int eap_teap_copy_buf(u8 **dst, size_t *dst_len,
114 const u8 *src, size_t src_len)
115 {
116 if (src) {
117 *dst = os_memdup(src, src_len);
118 if (!(*dst))
119 return -1;
120 *dst_len = src_len;
121 }
122 return 0;
123 }
124
125
126 /**
127 * eap_teap_add_pac - Add a copy of a PAC entry to a list
128 * @pac_root: Pointer to PAC list root pointer
129 * @pac_current: Pointer to the current PAC pointer
130 * @entry: New entry to clone and add to the list
131 * Returns: 0 on success, -1 on failure
132 *
133 * This function makes a clone of the given PAC entry and adds this copied
134 * entry to the list (pac_root). If an old entry for the same A-ID is found,
135 * it will be removed from the PAC list and in this case, pac_current entry
136 * is set to %NULL if it was the removed entry.
137 */
eap_teap_add_pac(struct eap_teap_pac ** pac_root,struct eap_teap_pac ** pac_current,struct eap_teap_pac * entry)138 int eap_teap_add_pac(struct eap_teap_pac **pac_root,
139 struct eap_teap_pac **pac_current,
140 struct eap_teap_pac *entry)
141 {
142 struct eap_teap_pac *pac;
143
144 if (!entry || !entry->a_id)
145 return -1;
146
147 /* Remove a possible old entry for the matching A-ID. */
148 eap_teap_remove_pac(pac_root, pac_current,
149 entry->a_id, entry->a_id_len, entry->pac_type);
150
151 /* Allocate a new entry and add it to the list of PACs. */
152 pac = os_zalloc(sizeof(*pac));
153 if (!pac)
154 return -1;
155
156 pac->pac_type = entry->pac_type;
157 os_memcpy(pac->pac_key, entry->pac_key, EAP_TEAP_PAC_KEY_LEN);
158 if (eap_teap_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len,
159 entry->pac_opaque, entry->pac_opaque_len) < 0 ||
160 eap_teap_copy_buf(&pac->pac_info, &pac->pac_info_len,
161 entry->pac_info, entry->pac_info_len) < 0 ||
162 eap_teap_copy_buf(&pac->a_id, &pac->a_id_len,
163 entry->a_id, entry->a_id_len) < 0 ||
164 eap_teap_copy_buf(&pac->i_id, &pac->i_id_len,
165 entry->i_id, entry->i_id_len) < 0 ||
166 eap_teap_copy_buf(&pac->a_id_info, &pac->a_id_info_len,
167 entry->a_id_info, entry->a_id_info_len) < 0) {
168 eap_teap_free_pac(pac);
169 return -1;
170 }
171
172 pac->next = *pac_root;
173 *pac_root = pac;
174
175 return 0;
176 }
177
178
179 struct eap_teap_read_ctx {
180 FILE *f;
181 const char *pos;
182 const char *end;
183 int line;
184 char *buf;
185 size_t buf_len;
186 };
187
eap_teap_read_line(struct eap_teap_read_ctx * rc,char ** value)188 static int eap_teap_read_line(struct eap_teap_read_ctx *rc, char **value)
189 {
190 char *pos;
191
192 rc->line++;
193 if (rc->f) {
194 if (fgets(rc->buf, rc->buf_len, rc->f) == NULL)
195 return -1;
196 } else {
197 const char *l_end;
198 size_t len;
199
200 if (rc->pos >= rc->end)
201 return -1;
202 l_end = rc->pos;
203 while (l_end < rc->end && *l_end != '\n')
204 l_end++;
205 len = l_end - rc->pos;
206 if (len >= rc->buf_len)
207 len = rc->buf_len - 1;
208 os_memcpy(rc->buf, rc->pos, len);
209 rc->buf[len] = '\0';
210 rc->pos = l_end + 1;
211 }
212
213 rc->buf[rc->buf_len - 1] = '\0';
214 pos = rc->buf;
215 while (*pos != '\0') {
216 if (*pos == '\n' || *pos == '\r') {
217 *pos = '\0';
218 break;
219 }
220 pos++;
221 }
222
223 pos = os_strchr(rc->buf, '=');
224 if (pos)
225 *pos++ = '\0';
226 *value = pos;
227
228 return 0;
229 }
230
231
eap_teap_parse_hex(const char * value,size_t * len)232 static u8 * eap_teap_parse_hex(const char *value, size_t *len)
233 {
234 int hlen;
235 u8 *buf;
236
237 if (!value)
238 return NULL;
239 hlen = os_strlen(value);
240 if (hlen & 1)
241 return NULL;
242 *len = hlen / 2;
243 buf = os_malloc(*len);
244 if (!buf)
245 return NULL;
246 if (hexstr2bin(value, buf, *len)) {
247 os_free(buf);
248 return NULL;
249 }
250 return buf;
251 }
252
253
eap_teap_init_pac_data(struct eap_sm * sm,const char * pac_file,struct eap_teap_read_ctx * rc)254 static int eap_teap_init_pac_data(struct eap_sm *sm, const char *pac_file,
255 struct eap_teap_read_ctx *rc)
256 {
257 os_memset(rc, 0, sizeof(*rc));
258
259 rc->buf_len = 2048;
260 rc->buf = os_malloc(rc->buf_len);
261 if (!rc->buf)
262 return -1;
263
264 if (os_strncmp(pac_file, "blob://", 7) == 0) {
265 const struct wpa_config_blob *blob;
266
267 blob = eap_get_config_blob(sm, pac_file + 7);
268 if (!blob) {
269 wpa_printf(MSG_INFO,
270 "EAP-TEAP: No PAC blob '%s' - assume no PAC entries have been provisioned",
271 pac_file + 7);
272 os_free(rc->buf);
273 return -1;
274 }
275 rc->pos = (char *) blob->data;
276 rc->end = (char *) blob->data + blob->len;
277 } else {
278 rc->f = fopen(pac_file, "rb");
279 if (!rc->f) {
280 wpa_printf(MSG_INFO,
281 "EAP-TEAP: No PAC file '%s' - assume no PAC entries have been provisioned",
282 pac_file);
283 os_free(rc->buf);
284 return -1;
285 }
286 }
287
288 return 0;
289 }
290
291
eap_teap_deinit_pac_data(struct eap_teap_read_ctx * rc)292 static void eap_teap_deinit_pac_data(struct eap_teap_read_ctx *rc)
293 {
294 os_free(rc->buf);
295 if (rc->f)
296 fclose(rc->f);
297 }
298
299
eap_teap_parse_start(struct eap_teap_pac ** pac)300 static const char * eap_teap_parse_start(struct eap_teap_pac **pac)
301 {
302 if (*pac)
303 return "START line without END";
304
305 *pac = os_zalloc(sizeof(struct eap_teap_pac));
306 if (!(*pac))
307 return "No memory for PAC entry";
308 (*pac)->pac_type = PAC_TYPE_TUNNEL_PAC;
309 return NULL;
310 }
311
312
eap_teap_parse_end(struct eap_teap_pac ** pac_root,struct eap_teap_pac ** pac)313 static const char * eap_teap_parse_end(struct eap_teap_pac **pac_root,
314 struct eap_teap_pac **pac)
315 {
316 if (!(*pac))
317 return "END line without START";
318 if (*pac_root) {
319 struct eap_teap_pac *end = *pac_root;
320
321 while (end->next)
322 end = end->next;
323 end->next = *pac;
324 } else
325 *pac_root = *pac;
326
327 *pac = NULL;
328 return NULL;
329 }
330
331
eap_teap_parse_pac_type(struct eap_teap_pac * pac,char * pos)332 static const char * eap_teap_parse_pac_type(struct eap_teap_pac *pac,
333 char *pos)
334 {
335 if (!pos)
336 return "Cannot parse pac type";
337 pac->pac_type = atoi(pos);
338 if (pac->pac_type != PAC_TYPE_TUNNEL_PAC)
339 return "Unrecognized PAC-Type";
340
341 return NULL;
342 }
343
344
eap_teap_parse_pac_key(struct eap_teap_pac * pac,char * pos)345 static const char * eap_teap_parse_pac_key(struct eap_teap_pac *pac, char *pos)
346 {
347 u8 *key;
348 size_t key_len;
349
350 key = eap_teap_parse_hex(pos, &key_len);
351 if (!key || key_len != EAP_TEAP_PAC_KEY_LEN) {
352 os_free(key);
353 return "Invalid PAC-Key";
354 }
355
356 os_memcpy(pac->pac_key, key, EAP_TEAP_PAC_KEY_LEN);
357 os_free(key);
358
359 return NULL;
360 }
361
362
eap_teap_parse_pac_opaque(struct eap_teap_pac * pac,char * pos)363 static const char * eap_teap_parse_pac_opaque(struct eap_teap_pac *pac,
364 char *pos)
365 {
366 os_free(pac->pac_opaque);
367 pac->pac_opaque = eap_teap_parse_hex(pos, &pac->pac_opaque_len);
368 if (!pac->pac_opaque)
369 return "Invalid PAC-Opaque";
370 return NULL;
371 }
372
373
eap_teap_parse_a_id(struct eap_teap_pac * pac,char * pos)374 static const char * eap_teap_parse_a_id(struct eap_teap_pac *pac, char *pos)
375 {
376 os_free(pac->a_id);
377 pac->a_id = eap_teap_parse_hex(pos, &pac->a_id_len);
378 if (!pac->a_id)
379 return "Invalid A-ID";
380 return NULL;
381 }
382
383
eap_teap_parse_i_id(struct eap_teap_pac * pac,char * pos)384 static const char * eap_teap_parse_i_id(struct eap_teap_pac *pac, char *pos)
385 {
386 os_free(pac->i_id);
387 pac->i_id = eap_teap_parse_hex(pos, &pac->i_id_len);
388 if (!pac->i_id)
389 return "Invalid I-ID";
390 return NULL;
391 }
392
393
eap_teap_parse_a_id_info(struct eap_teap_pac * pac,char * pos)394 static const char * eap_teap_parse_a_id_info(struct eap_teap_pac *pac,
395 char *pos)
396 {
397 os_free(pac->a_id_info);
398 pac->a_id_info = eap_teap_parse_hex(pos, &pac->a_id_info_len);
399 if (!pac->a_id_info)
400 return "Invalid A-ID-Info";
401 return NULL;
402 }
403
404
405 /**
406 * eap_teap_load_pac - Load PAC entries (text format)
407 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
408 * @pac_root: Pointer to root of the PAC list (to be filled)
409 * @pac_file: Name of the PAC file/blob to load
410 * Returns: 0 on success, -1 on failure
411 */
eap_teap_load_pac(struct eap_sm * sm,struct eap_teap_pac ** pac_root,const char * pac_file)412 int eap_teap_load_pac(struct eap_sm *sm, struct eap_teap_pac **pac_root,
413 const char *pac_file)
414 {
415 struct eap_teap_read_ctx rc;
416 struct eap_teap_pac *pac = NULL;
417 int count = 0;
418 char *pos;
419 const char *err = NULL;
420
421 if (!pac_file)
422 return -1;
423
424 if (eap_teap_init_pac_data(sm, pac_file, &rc) < 0)
425 return 0;
426
427 if (eap_teap_read_line(&rc, &pos) < 0) {
428 /* empty file - assume it is fine to overwrite */
429 eap_teap_deinit_pac_data(&rc);
430 return 0;
431 }
432 if (os_strcmp(pac_file_hdr, rc.buf) != 0)
433 err = "Unrecognized header line";
434
435 while (!err && eap_teap_read_line(&rc, &pos) == 0) {
436 if (os_strcmp(rc.buf, "START") == 0)
437 err = eap_teap_parse_start(&pac);
438 else if (os_strcmp(rc.buf, "END") == 0) {
439 err = eap_teap_parse_end(pac_root, &pac);
440 count++;
441 } else if (!pac)
442 err = "Unexpected line outside START/END block";
443 else if (os_strcmp(rc.buf, "PAC-Type") == 0)
444 err = eap_teap_parse_pac_type(pac, pos);
445 else if (os_strcmp(rc.buf, "PAC-Key") == 0)
446 err = eap_teap_parse_pac_key(pac, pos);
447 else if (os_strcmp(rc.buf, "PAC-Opaque") == 0)
448 err = eap_teap_parse_pac_opaque(pac, pos);
449 else if (os_strcmp(rc.buf, "A-ID") == 0)
450 err = eap_teap_parse_a_id(pac, pos);
451 else if (os_strcmp(rc.buf, "I-ID") == 0)
452 err = eap_teap_parse_i_id(pac, pos);
453 else if (os_strcmp(rc.buf, "A-ID-Info") == 0)
454 err = eap_teap_parse_a_id_info(pac, pos);
455 }
456
457 if (pac) {
458 if (!err)
459 err = "PAC block not terminated with END";
460 eap_teap_free_pac(pac);
461 }
462
463 eap_teap_deinit_pac_data(&rc);
464
465 if (err) {
466 wpa_printf(MSG_INFO, "EAP-TEAP: %s in '%s:%d'",
467 err, pac_file, rc.line);
468 return -1;
469 }
470
471 wpa_printf(MSG_DEBUG, "EAP-TEAP: Read %d PAC entries from '%s'",
472 count, pac_file);
473
474 return 0;
475 }
476
477
eap_teap_write(char ** buf,char ** pos,size_t * buf_len,const char * field,const u8 * data,size_t len,int txt)478 static void eap_teap_write(char **buf, char **pos, size_t *buf_len,
479 const char *field, const u8 *data,
480 size_t len, int txt)
481 {
482 size_t i, need;
483 int ret;
484 char *end;
485
486 if (!data || !buf || !(*buf) || !pos || !(*pos) || *pos < *buf)
487 return;
488
489 need = os_strlen(field) + len * 2 + 30;
490 if (txt)
491 need += os_strlen(field) + len + 20;
492
493 if (*pos - *buf + need > *buf_len) {
494 char *nbuf = os_realloc(*buf, *buf_len + need);
495
496 if (!nbuf) {
497 os_free(*buf);
498 *buf = NULL;
499 return;
500 }
501 *pos = nbuf + (*pos - *buf);
502 *buf = nbuf;
503 *buf_len += need;
504 }
505 end = *buf + *buf_len;
506
507 ret = os_snprintf(*pos, end - *pos, "%s=", field);
508 if (os_snprintf_error(end - *pos, ret))
509 return;
510 *pos += ret;
511 *pos += wpa_snprintf_hex(*pos, end - *pos, data, len);
512 ret = os_snprintf(*pos, end - *pos, "\n");
513 if (os_snprintf_error(end - *pos, ret))
514 return;
515 *pos += ret;
516
517 if (txt) {
518 ret = os_snprintf(*pos, end - *pos, "%s-txt=", field);
519 if (os_snprintf_error(end - *pos, ret))
520 return;
521 *pos += ret;
522 for (i = 0; i < len; i++) {
523 ret = os_snprintf(*pos, end - *pos, "%c", data[i]);
524 if (os_snprintf_error(end - *pos, ret))
525 return;
526 *pos += ret;
527 }
528 ret = os_snprintf(*pos, end - *pos, "\n");
529 if (os_snprintf_error(end - *pos, ret))
530 return;
531 *pos += ret;
532 }
533 }
534
535
eap_teap_write_pac(struct eap_sm * sm,const char * pac_file,char * buf,size_t len)536 static int eap_teap_write_pac(struct eap_sm *sm, const char *pac_file,
537 char *buf, size_t len)
538 {
539 if (os_strncmp(pac_file, "blob://", 7) == 0) {
540 struct wpa_config_blob *blob;
541
542 blob = os_zalloc(sizeof(*blob));
543 if (!blob)
544 return -1;
545 blob->data = (u8 *) buf;
546 blob->len = len;
547 buf = NULL;
548 blob->name = os_strdup(pac_file + 7);
549 if (!blob->name) {
550 os_free(blob);
551 return -1;
552 }
553 eap_set_config_blob(sm, blob);
554 } else {
555 FILE *f;
556
557 f = fopen(pac_file, "wb");
558 if (!f) {
559 wpa_printf(MSG_INFO,
560 "EAP-TEAP: Failed to open PAC file '%s' for writing",
561 pac_file);
562 return -1;
563 }
564 if (fwrite(buf, 1, len, f) != len) {
565 wpa_printf(MSG_INFO,
566 "EAP-TEAP: Failed to write all PACs into '%s'",
567 pac_file);
568 fclose(f);
569 return -1;
570 }
571 os_free(buf);
572 fclose(f);
573 }
574
575 return 0;
576 }
577
578
eap_teap_add_pac_data(struct eap_teap_pac * pac,char ** buf,char ** pos,size_t * buf_len)579 static int eap_teap_add_pac_data(struct eap_teap_pac *pac, char **buf,
580 char **pos, size_t *buf_len)
581 {
582 int ret;
583
584 ret = os_snprintf(*pos, *buf + *buf_len - *pos,
585 "START\nPAC-Type=%d\n", pac->pac_type);
586 if (os_snprintf_error(*buf + *buf_len - *pos, ret))
587 return -1;
588
589 *pos += ret;
590 eap_teap_write(buf, pos, buf_len, "PAC-Key",
591 pac->pac_key, EAP_TEAP_PAC_KEY_LEN, 0);
592 eap_teap_write(buf, pos, buf_len, "PAC-Opaque",
593 pac->pac_opaque, pac->pac_opaque_len, 0);
594 eap_teap_write(buf, pos, buf_len, "PAC-Info",
595 pac->pac_info, pac->pac_info_len, 0);
596 eap_teap_write(buf, pos, buf_len, "A-ID",
597 pac->a_id, pac->a_id_len, 0);
598 eap_teap_write(buf, pos, buf_len, "I-ID",
599 pac->i_id, pac->i_id_len, 1);
600 eap_teap_write(buf, pos, buf_len, "A-ID-Info",
601 pac->a_id_info, pac->a_id_info_len, 1);
602 if (!(*buf)) {
603 wpa_printf(MSG_DEBUG, "EAP-TEAP: No memory for PAC data");
604 return -1;
605 }
606 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n");
607 if (os_snprintf_error(*buf + *buf_len - *pos, ret))
608 return -1;
609 *pos += ret;
610
611 return 0;
612 }
613
614
615 /**
616 * eap_teap_save_pac - Save PAC entries (text format)
617 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
618 * @pac_root: Root of the PAC list
619 * @pac_file: Name of the PAC file/blob
620 * Returns: 0 on success, -1 on failure
621 */
eap_teap_save_pac(struct eap_sm * sm,struct eap_teap_pac * pac_root,const char * pac_file)622 int eap_teap_save_pac(struct eap_sm *sm, struct eap_teap_pac *pac_root,
623 const char *pac_file)
624 {
625 struct eap_teap_pac *pac;
626 int ret, count = 0;
627 char *buf, *pos;
628 size_t buf_len;
629
630 if (!pac_file)
631 return -1;
632
633 buf_len = 1024;
634 pos = buf = os_malloc(buf_len);
635 if (!buf)
636 return -1;
637
638 ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);
639 if (os_snprintf_error(buf + buf_len - pos, ret)) {
640 os_free(buf);
641 return -1;
642 }
643 pos += ret;
644
645 pac = pac_root;
646 while (pac) {
647 if (eap_teap_add_pac_data(pac, &buf, &pos, &buf_len)) {
648 os_free(buf);
649 return -1;
650 }
651 count++;
652 pac = pac->next;
653 }
654
655 if (eap_teap_write_pac(sm, pac_file, buf, pos - buf)) {
656 os_free(buf);
657 return -1;
658 }
659
660 wpa_printf(MSG_DEBUG, "EAP-TEAP: Wrote %d PAC entries into '%s'",
661 count, pac_file);
662
663 return 0;
664 }
665
666
667 /**
668 * eap_teap_pac_list_truncate - Truncate a PAC list to the given length
669 * @pac_root: Root of the PAC list
670 * @max_len: Maximum length of the list (>= 1)
671 * Returns: Number of PAC entries removed
672 */
eap_teap_pac_list_truncate(struct eap_teap_pac * pac_root,size_t max_len)673 size_t eap_teap_pac_list_truncate(struct eap_teap_pac *pac_root,
674 size_t max_len)
675 {
676 struct eap_teap_pac *pac, *prev;
677 size_t count;
678
679 pac = pac_root;
680 prev = NULL;
681 count = 0;
682
683 while (pac) {
684 count++;
685 if (count > max_len)
686 break;
687 prev = pac;
688 pac = pac->next;
689 }
690
691 if (count <= max_len || !prev)
692 return 0;
693
694 count = 0;
695 prev->next = NULL;
696
697 while (pac) {
698 prev = pac;
699 pac = pac->next;
700 eap_teap_free_pac(prev);
701 count++;
702 }
703
704 return count;
705 }
706
707
eap_teap_pac_get_a_id(struct eap_teap_pac * pac)708 static void eap_teap_pac_get_a_id(struct eap_teap_pac *pac)
709 {
710 u8 *pos, *end;
711 u16 type, len;
712
713 pos = pac->pac_info;
714 end = pos + pac->pac_info_len;
715
716 while (end - pos > 4) {
717 type = WPA_GET_BE16(pos);
718 pos += 2;
719 len = WPA_GET_BE16(pos);
720 pos += 2;
721 if (len > (unsigned int) (end - pos))
722 break;
723
724 if (type == PAC_TYPE_A_ID) {
725 os_free(pac->a_id);
726 pac->a_id = os_memdup(pos, len);
727 if (!pac->a_id)
728 break;
729 pac->a_id_len = len;
730 }
731
732 if (type == PAC_TYPE_A_ID_INFO) {
733 os_free(pac->a_id_info);
734 pac->a_id_info = os_memdup(pos, len);
735 if (!pac->a_id_info)
736 break;
737 pac->a_id_info_len = len;
738 }
739
740 pos += len;
741 }
742 }
743
744
745 /**
746 * eap_teap_load_pac_bin - Load PAC entries (binary format)
747 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
748 * @pac_root: Pointer to root of the PAC list (to be filled)
749 * @pac_file: Name of the PAC file/blob to load
750 * Returns: 0 on success, -1 on failure
751 */
eap_teap_load_pac_bin(struct eap_sm * sm,struct eap_teap_pac ** pac_root,const char * pac_file)752 int eap_teap_load_pac_bin(struct eap_sm *sm, struct eap_teap_pac **pac_root,
753 const char *pac_file)
754 {
755 const struct wpa_config_blob *blob = NULL;
756 u8 *buf, *end, *pos;
757 size_t len, count = 0;
758 struct eap_teap_pac *pac, *prev;
759
760 *pac_root = NULL;
761
762 if (!pac_file)
763 return -1;
764
765 if (os_strncmp(pac_file, "blob://", 7) == 0) {
766 blob = eap_get_config_blob(sm, pac_file + 7);
767 if (!blob) {
768 wpa_printf(MSG_INFO,
769 "EAP-TEAP: No PAC blob '%s' - assume no PAC entries have been provisioned",
770 pac_file + 7);
771 return 0;
772 }
773 buf = blob->data;
774 len = blob->len;
775 } else {
776 buf = (u8 *) os_readfile(pac_file, &len);
777 if (!buf) {
778 wpa_printf(MSG_INFO,
779 "EAP-TEAP: No PAC file '%s' - assume no PAC entries have been provisioned",
780 pac_file);
781 return 0;
782 }
783 }
784
785 if (len == 0) {
786 if (!blob)
787 os_free(buf);
788 return 0;
789 }
790
791 if (len < 6 || WPA_GET_BE32(buf) != EAP_TEAP_PAC_BINARY_MAGIC ||
792 WPA_GET_BE16(buf + 4) != EAP_TEAP_PAC_BINARY_FORMAT_VERSION) {
793 wpa_printf(MSG_INFO, "EAP-TEAP: Invalid PAC file '%s' (bin)",
794 pac_file);
795 if (!blob)
796 os_free(buf);
797 return -1;
798 }
799
800 pac = prev = NULL;
801 pos = buf + 6;
802 end = buf + len;
803 while (pos < end) {
804 u16 val;
805
806 if (end - pos < 2 + EAP_TEAP_PAC_KEY_LEN + 2 + 2) {
807 pac = NULL;
808 goto parse_fail;
809 }
810
811 pac = os_zalloc(sizeof(*pac));
812 if (!pac)
813 goto parse_fail;
814
815 pac->pac_type = WPA_GET_BE16(pos);
816 pos += 2;
817 os_memcpy(pac->pac_key, pos, EAP_TEAP_PAC_KEY_LEN);
818 pos += EAP_TEAP_PAC_KEY_LEN;
819 val = WPA_GET_BE16(pos);
820 pos += 2;
821 if (val > end - pos)
822 goto parse_fail;
823 pac->pac_opaque_len = val;
824 pac->pac_opaque = os_memdup(pos, pac->pac_opaque_len);
825 if (!pac->pac_opaque)
826 goto parse_fail;
827 pos += pac->pac_opaque_len;
828 if (end - pos < 2)
829 goto parse_fail;
830 val = WPA_GET_BE16(pos);
831 pos += 2;
832 if (val > end - pos)
833 goto parse_fail;
834 pac->pac_info_len = val;
835 pac->pac_info = os_memdup(pos, pac->pac_info_len);
836 if (!pac->pac_info)
837 goto parse_fail;
838 pos += pac->pac_info_len;
839 eap_teap_pac_get_a_id(pac);
840
841 count++;
842 if (prev)
843 prev->next = pac;
844 else
845 *pac_root = pac;
846 prev = pac;
847 }
848
849 if (!blob)
850 os_free(buf);
851
852 wpa_printf(MSG_DEBUG, "EAP-TEAP: Read %lu PAC entries from '%s' (bin)",
853 (unsigned long) count, pac_file);
854
855 return 0;
856
857 parse_fail:
858 wpa_printf(MSG_INFO, "EAP-TEAP: Failed to parse PAC file '%s' (bin)",
859 pac_file);
860 if (!blob)
861 os_free(buf);
862 if (pac)
863 eap_teap_free_pac(pac);
864 return -1;
865 }
866
867
868 /**
869 * eap_teap_save_pac_bin - Save PAC entries (binary format)
870 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
871 * @pac_root: Root of the PAC list
872 * @pac_file: Name of the PAC file/blob
873 * Returns: 0 on success, -1 on failure
874 */
eap_teap_save_pac_bin(struct eap_sm * sm,struct eap_teap_pac * pac_root,const char * pac_file)875 int eap_teap_save_pac_bin(struct eap_sm *sm, struct eap_teap_pac *pac_root,
876 const char *pac_file)
877 {
878 size_t len, count = 0;
879 struct eap_teap_pac *pac;
880 u8 *buf, *pos;
881
882 len = 6;
883 pac = pac_root;
884 while (pac) {
885 if (pac->pac_opaque_len > 65535 ||
886 pac->pac_info_len > 65535)
887 return -1;
888 len += 2 + EAP_TEAP_PAC_KEY_LEN + 2 + pac->pac_opaque_len +
889 2 + pac->pac_info_len;
890 pac = pac->next;
891 }
892
893 buf = os_malloc(len);
894 if (!buf)
895 return -1;
896
897 pos = buf;
898 WPA_PUT_BE32(pos, EAP_TEAP_PAC_BINARY_MAGIC);
899 pos += 4;
900 WPA_PUT_BE16(pos, EAP_TEAP_PAC_BINARY_FORMAT_VERSION);
901 pos += 2;
902
903 pac = pac_root;
904 while (pac) {
905 WPA_PUT_BE16(pos, pac->pac_type);
906 pos += 2;
907 os_memcpy(pos, pac->pac_key, EAP_TEAP_PAC_KEY_LEN);
908 pos += EAP_TEAP_PAC_KEY_LEN;
909 WPA_PUT_BE16(pos, pac->pac_opaque_len);
910 pos += 2;
911 os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len);
912 pos += pac->pac_opaque_len;
913 WPA_PUT_BE16(pos, pac->pac_info_len);
914 pos += 2;
915 os_memcpy(pos, pac->pac_info, pac->pac_info_len);
916 pos += pac->pac_info_len;
917
918 pac = pac->next;
919 count++;
920 }
921
922 if (eap_teap_write_pac(sm, pac_file, (char *) buf, len)) {
923 os_free(buf);
924 return -1;
925 }
926
927 wpa_printf(MSG_DEBUG, "EAP-TEAP: Wrote %lu PAC entries into '%s' (bin)",
928 (unsigned long) count, pac_file);
929
930 return 0;
931 }
932
