1 /*
2 * EAP peer method: EAP-FAST PAC file processing
3 * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10 #include "os.h"
11
12 #include "utils/common.h"
13 #include "eap_peer/eap_config.h"
14 #include "eap_peer/eap_i.h"
15 #include "eap_peer/eap_fast_pac.h"
16
17 /* TODO: encrypt PAC-Key in the PAC file */
18
19
20 /* Text data format */
21 static const char *pac_file_hdr =
22 "wpa_supplicant EAP-FAST PAC file - version 1";
23
24 /*
25 * Binary data format
26 * 4-octet magic value: 6A E4 92 0C
27 * 2-octet version (big endian)
28 * <version specific data>
29 *
30 * version=0:
31 * Sequence of PAC entries:
32 * 2-octet PAC-Type (big endian)
33 * 32-octet PAC-Key
34 * 2-octet PAC-Opaque length (big endian)
35 * <variable len> PAC-Opaque data (length bytes)
36 * 2-octet PAC-Info length (big endian)
37 * <variable len> PAC-Info data (length bytes)
38 */
39
40 #define EAP_FAST_PAC_BINARY_MAGIC 0x6ae4920c
41 #define EAP_FAST_PAC_BINARY_FORMAT_VERSION 0
42
43
44 /**
45 * eap_fast_free_pac - Free PAC data
46 * @pac: Pointer to the PAC entry
47 *
48 * Note that the PAC entry must not be in a list since this function does not
49 * remove the list links.
50 */
eap_fast_free_pac(struct eap_fast_pac * pac)51 void eap_fast_free_pac(struct eap_fast_pac *pac)
52 {
53 os_free(pac->pac_opaque);
54 os_free(pac->pac_info);
55 os_free(pac->a_id);
56 os_free(pac->i_id);
57 os_free(pac->a_id_info);
58 os_free(pac);
59 }
60
61
62 /**
63 * eap_fast_get_pac - Get a PAC entry based on A-ID
64 * @pac_root: Pointer to root of the PAC list
65 * @a_id: A-ID to search for
66 * @a_id_len: Length of A-ID
67 * @pac_type: PAC-Type to search for
68 * Returns: Pointer to the PAC entry, or %NULL if A-ID not found
69 */
eap_fast_get_pac(struct eap_fast_pac * pac_root,const u8 * a_id,size_t a_id_len,u16 pac_type)70 struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_pac *pac_root,
71 const u8 *a_id, size_t a_id_len,
72 u16 pac_type)
73 {
74 struct eap_fast_pac *pac = pac_root;
75
76 while (pac) {
77 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
78 os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
79 return pac;
80 }
81 pac = pac->next;
82 }
83 return NULL;
84 }
85
86
eap_fast_remove_pac(struct eap_fast_pac ** pac_root,struct eap_fast_pac ** pac_current,const u8 * a_id,size_t a_id_len,u16 pac_type)87 static void eap_fast_remove_pac(struct eap_fast_pac **pac_root,
88 struct eap_fast_pac **pac_current,
89 const u8 *a_id, size_t a_id_len, u16 pac_type)
90 {
91 struct eap_fast_pac *pac, *prev;
92
93 pac = *pac_root;
94 prev = NULL;
95
96 while (pac) {
97 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
98 os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
99 if (prev == NULL)
100 *pac_root = pac->next;
101 else
102 prev->next = pac->next;
103 if (*pac_current == pac)
104 *pac_current = NULL;
105 eap_fast_free_pac(pac);
106 break;
107 }
108 prev = pac;
109 pac = pac->next;
110 }
111 }
112
113
eap_fast_copy_buf(u8 ** dst,size_t * dst_len,const u8 * src,size_t src_len)114 static int eap_fast_copy_buf(u8 **dst, size_t *dst_len,
115 const u8 *src, size_t src_len)
116 {
117 if (src) {
118 *dst = os_memdup(src, src_len);
119 if (*dst == NULL)
120 return -1;
121 *dst_len = src_len;
122 }
123 return 0;
124 }
125
126
127 /**
128 * eap_fast_add_pac - Add a copy of a PAC entry to a list
129 * @pac_root: Pointer to PAC list root pointer
130 * @pac_current: Pointer to the current PAC pointer
131 * @entry: New entry to clone and add to the list
132 * Returns: 0 on success, -1 on failure
133 *
134 * This function makes a clone of the given PAC entry and adds this copied
135 * entry to the list (pac_root). If an old entry for the same A-ID is found,
136 * it will be removed from the PAC list and in this case, pac_current entry
137 * is set to %NULL if it was the removed entry.
138 */
eap_fast_add_pac(struct eap_fast_pac ** pac_root,struct eap_fast_pac ** pac_current,struct eap_fast_pac * entry)139 int eap_fast_add_pac(struct eap_fast_pac **pac_root,
140 struct eap_fast_pac **pac_current,
141 struct eap_fast_pac *entry)
142 {
143 struct eap_fast_pac *pac;
144
145 if (entry == NULL || entry->a_id == NULL)
146 return -1;
147
148 /* Remove a possible old entry for the matching A-ID. */
149 eap_fast_remove_pac(pac_root, pac_current,
150 entry->a_id, entry->a_id_len, entry->pac_type);
151
152 /* Allocate a new entry and add it to the list of PACs. */
153 pac = os_zalloc(sizeof(*pac));
154 if (pac == NULL)
155 return -1;
156
157 pac->pac_type = entry->pac_type;
158 os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN);
159 if (eap_fast_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len,
160 entry->pac_opaque, entry->pac_opaque_len) < 0 ||
161 eap_fast_copy_buf(&pac->pac_info, &pac->pac_info_len,
162 entry->pac_info, entry->pac_info_len) < 0 ||
163 eap_fast_copy_buf(&pac->a_id, &pac->a_id_len,
164 entry->a_id, entry->a_id_len) < 0 ||
165 eap_fast_copy_buf(&pac->i_id, &pac->i_id_len,
166 entry->i_id, entry->i_id_len) < 0 ||
167 eap_fast_copy_buf(&pac->a_id_info, &pac->a_id_info_len,
168 entry->a_id_info, entry->a_id_info_len) < 0) {
169 eap_fast_free_pac(pac);
170 return -1;
171 }
172
173 pac->next = *pac_root;
174 *pac_root = pac;
175
176 return 0;
177 }
178
179
180 struct eap_fast_read_ctx {
181 FILE *f;
182 const char *pos;
183 const char *end;
184 int line;
185 char *buf;
186 size_t buf_len;
187 };
188
eap_fast_read_line(struct eap_fast_read_ctx * rc,char ** value)189 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char **value)
190 {
191 char *pos;
192
193 rc->line++;
194 if (rc->f) {
195 if (fgets(rc->buf, rc->buf_len, rc->f) == NULL)
196 return -1;
197 } else {
198 const char *l_end;
199 size_t len;
200 if (rc->pos >= rc->end)
201 return -1;
202 l_end = rc->pos;
203 while (l_end < rc->end && *l_end != '\n')
204 l_end++;
205 len = l_end - rc->pos;
206 if (len >= rc->buf_len)
207 len = rc->buf_len - 1;
208 os_memcpy(rc->buf, rc->pos, len);
209 rc->buf[len] = '\0';
210 rc->pos = l_end + 1;
211 }
212
213 rc->buf[rc->buf_len - 1] = '\0';
214 pos = rc->buf;
215 while (*pos != '\0') {
216 if (*pos == '\n' || *pos == '\r') {
217 *pos = '\0';
218 break;
219 }
220 pos++;
221 }
222
223 pos = os_strchr(rc->buf, '=');
224 if (pos)
225 *pos++ = '\0';
226 *value = pos;
227
228 return 0;
229 }
230
231
eap_fast_parse_hex(const char * value,size_t * len)232 static u8 * eap_fast_parse_hex(const char *value, size_t *len)
233 {
234 int hlen;
235 u8 *buf;
236
237 if (value == NULL)
238 return NULL;
239 hlen = os_strlen(value);
240 if (hlen & 1)
241 return NULL;
242 *len = hlen / 2;
243 buf = os_malloc(*len);
244 if (buf == NULL)
245 return NULL;
246 if (hexstr2bin(value, buf, *len)) {
247 os_free(buf);
248 return NULL;
249 }
250 return buf;
251 }
252
253
eap_fast_init_pac_data(struct eap_sm * sm,const char * pac_file,struct eap_fast_read_ctx * rc)254 static int eap_fast_init_pac_data(struct eap_sm *sm, const char *pac_file,
255 struct eap_fast_read_ctx *rc)
256 {
257 os_memset(rc, 0, sizeof(*rc));
258
259 rc->buf_len = 2048;
260 rc->buf = os_malloc(rc->buf_len);
261 if (rc->buf == NULL)
262 return -1;
263
264 if (os_strncmp(pac_file, "blob://", 7) == 0) {
265 const struct wpa_config_blob *blob;
266 blob = eap_get_config_blob(sm, pac_file);
267 if (blob == NULL) {
268 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
269 "assume no PAC entries have been "
270 "provisioned", pac_file);
271 os_free(rc->buf);
272 return -1;
273 }
274 rc->pos = (char *) blob->data;
275 rc->end = (char *) blob->data + blob->len;
276 } else {
277 rc->f = fopen(pac_file, "rb");
278 if (rc->f == NULL) {
279 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
280 "assume no PAC entries have been "
281 "provisioned", pac_file);
282 os_free(rc->buf);
283 return -1;
284 }
285 }
286
287 return 0;
288 }
289
290
eap_fast_deinit_pac_data(struct eap_fast_read_ctx * rc)291 static void eap_fast_deinit_pac_data(struct eap_fast_read_ctx *rc)
292 {
293 os_free(rc->buf);
294 if (rc->f)
295 fclose(rc->f);
296 }
297
298
eap_fast_parse_start(struct eap_fast_pac ** pac)299 static const char * eap_fast_parse_start(struct eap_fast_pac **pac)
300 {
301 if (*pac)
302 return "START line without END";
303
304 *pac = os_zalloc(sizeof(struct eap_fast_pac));
305 if (*pac == NULL)
306 return "No memory for PAC entry";
307 (*pac)->pac_type = PAC_TYPE_TUNNEL_PAC;
308 return NULL;
309 }
310
311
eap_fast_parse_end(struct eap_fast_pac ** pac_root,struct eap_fast_pac ** pac)312 static const char * eap_fast_parse_end(struct eap_fast_pac **pac_root,
313 struct eap_fast_pac **pac)
314 {
315 if (*pac == NULL)
316 return "END line without START";
317 if (*pac_root) {
318 struct eap_fast_pac *end = *pac_root;
319 while (end->next)
320 end = end->next;
321 end->next = *pac;
322 } else
323 *pac_root = *pac;
324
325 *pac = NULL;
326 return NULL;
327 }
328
329
eap_fast_parse_pac_type(struct eap_fast_pac * pac,char * pos)330 static const char * eap_fast_parse_pac_type(struct eap_fast_pac *pac,
331 char *pos)
332 {
333 if (!pos)
334 return "Cannot parse pac type";
335 pac->pac_type = atoi(pos);
336 if (pac->pac_type != PAC_TYPE_TUNNEL_PAC &&
337 pac->pac_type != PAC_TYPE_USER_AUTHORIZATION &&
338 pac->pac_type != PAC_TYPE_MACHINE_AUTHENTICATION)
339 return "Unrecognized PAC-Type";
340
341 return NULL;
342 }
343
344
eap_fast_parse_pac_key(struct eap_fast_pac * pac,char * pos)345 static const char * eap_fast_parse_pac_key(struct eap_fast_pac *pac, char *pos)
346 {
347 u8 *key;
348 size_t key_len;
349
350 key = eap_fast_parse_hex(pos, &key_len);
351 if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) {
352 os_free(key);
353 return "Invalid PAC-Key";
354 }
355
356 os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN);
357 os_free(key);
358
359 return NULL;
360 }
361
362
eap_fast_parse_pac_opaque(struct eap_fast_pac * pac,char * pos)363 static const char * eap_fast_parse_pac_opaque(struct eap_fast_pac *pac,
364 char *pos)
365 {
366 os_free(pac->pac_opaque);
367 pac->pac_opaque = eap_fast_parse_hex(pos, &pac->pac_opaque_len);
368 if (pac->pac_opaque == NULL)
369 return "Invalid PAC-Opaque";
370 return NULL;
371 }
372
373
eap_fast_parse_a_id(struct eap_fast_pac * pac,char * pos)374 static const char * eap_fast_parse_a_id(struct eap_fast_pac *pac, char *pos)
375 {
376 os_free(pac->a_id);
377 pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len);
378 if (pac->a_id == NULL)
379 return "Invalid A-ID";
380 return NULL;
381 }
382
383
eap_fast_parse_i_id(struct eap_fast_pac * pac,char * pos)384 static const char * eap_fast_parse_i_id(struct eap_fast_pac *pac, char *pos)
385 {
386 os_free(pac->i_id);
387 pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len);
388 if (pac->i_id == NULL)
389 return "Invalid I-ID";
390 return NULL;
391 }
392
393
eap_fast_parse_a_id_info(struct eap_fast_pac * pac,char * pos)394 static const char * eap_fast_parse_a_id_info(struct eap_fast_pac *pac,
395 char *pos)
396 {
397 os_free(pac->a_id_info);
398 pac->a_id_info = eap_fast_parse_hex(pos, &pac->a_id_info_len);
399 if (pac->a_id_info == NULL)
400 return "Invalid A-ID-Info";
401 return NULL;
402 }
403
404
405 /**
406 * eap_fast_load_pac - Load PAC entries (text format)
407 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
408 * @pac_root: Pointer to root of the PAC list (to be filled)
409 * @pac_file: Name of the PAC file/blob to load
410 * Returns: 0 on success, -1 on failure
411 */
eap_fast_load_pac(struct eap_sm * sm,struct eap_fast_pac ** pac_root,const char * pac_file)412 int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_pac **pac_root,
413 const char *pac_file)
414 {
415 struct eap_fast_read_ctx rc;
416 struct eap_fast_pac *pac = NULL;
417 int count = 0;
418 char *pos;
419 const char *err = NULL;
420
421 if (pac_file == NULL)
422 return -1;
423
424 if (eap_fast_init_pac_data(sm, pac_file, &rc) < 0)
425 return 0;
426
427 if (eap_fast_read_line(&rc, &pos) < 0) {
428 /* empty file - assume it is fine to overwrite */
429 printf("\n\nassuming it is fine to overwrite... \n\n");
430 eap_fast_deinit_pac_data(&rc);
431 return 0;
432 }
433 printf("\n\nPAC FILE =\n%s", rc.pos);
434 if (os_strcmp(pac_file_hdr, rc.buf) != 0)
435 err = "Unrecognized header line";
436
437 while (!err && eap_fast_read_line(&rc, &pos) == 0) {
438 if (os_strcmp(rc.buf, "START") == 0)
439 err = eap_fast_parse_start(&pac);
440 else if (os_strcmp(rc.buf, "END") == 0) {
441 err = eap_fast_parse_end(pac_root, &pac);
442 count++;
443 } else if (!pac)
444 err = "Unexpected line outside START/END block";
445 else if (os_strcmp(rc.buf, "PAC-Type") == 0)
446 err = eap_fast_parse_pac_type(pac, pos);
447 else if (os_strcmp(rc.buf, "PAC-Key") == 0)
448 err = eap_fast_parse_pac_key(pac, pos);
449 else if (os_strcmp(rc.buf, "PAC-Opaque") == 0)
450 err = eap_fast_parse_pac_opaque(pac, pos);
451 else if (os_strcmp(rc.buf, "A-ID") == 0)
452 err = eap_fast_parse_a_id(pac, pos);
453 else if (os_strcmp(rc.buf, "I-ID") == 0)
454 err = eap_fast_parse_i_id(pac, pos);
455 else if (os_strcmp(rc.buf, "A-ID-Info") == 0)
456 err = eap_fast_parse_a_id_info(pac, pos);
457 }
458
459 if (pac) {
460 if (!err)
461 err = "PAC block not terminated with END";
462 eap_fast_free_pac(pac);
463 }
464
465 eap_fast_deinit_pac_data(&rc);
466
467 if (err) {
468 wpa_printf(MSG_INFO, "EAP-FAST: %s in '%s:%d'",
469 err, pac_file, rc.line);
470 return -1;
471 }
472
473 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %d PAC entries from '%s'",
474 count, pac_file);
475
476 return 0;
477 }
478
479
eap_fast_write(char ** buf,char ** pos,size_t * buf_len,const char * field,const u8 * data,size_t len,int txt)480 static void eap_fast_write(char **buf, char **pos, size_t *buf_len,
481 const char *field, const u8 *data,
482 size_t len, int txt)
483 {
484 size_t i, need;
485 int ret;
486 char *end;
487
488 if (data == NULL || buf == NULL || *buf == NULL ||
489 pos == NULL || *pos == NULL || *pos < *buf)
490 return;
491
492 need = os_strlen(field) + len * 2 + 30;
493 if (txt)
494 need += os_strlen(field) + len + 20;
495
496 if (*pos - *buf + need > *buf_len) {
497 char *nbuf = os_realloc(*buf, *buf_len + need);
498 if (nbuf == NULL) {
499 os_free(*buf);
500 *buf = NULL;
501 return;
502 }
503 *pos = nbuf + (*pos - *buf);
504 *buf = nbuf;
505 *buf_len += need;
506 }
507 end = *buf + *buf_len;
508
509 ret = os_snprintf(*pos, end - *pos, "%s=", field);
510 if (os_snprintf_error(end - *pos, ret))
511 return;
512 *pos += ret;
513 *pos += wpa_snprintf_hex(*pos, end - *pos, data, len);
514 ret = os_snprintf(*pos, end - *pos, "\n");
515 if (os_snprintf_error(end - *pos, ret))
516 return;
517 *pos += ret;
518
519 if (txt) {
520 ret = os_snprintf(*pos, end - *pos, "%s-txt=", field);
521 if (os_snprintf_error(end - *pos, ret))
522 return;
523 *pos += ret;
524 for (i = 0; i < len; i++) {
525 ret = os_snprintf(*pos, end - *pos, "%c", data[i]);
526 if (os_snprintf_error(end - *pos, ret))
527 return;
528 *pos += ret;
529 }
530 ret = os_snprintf(*pos, end - *pos, "\n");
531 if (os_snprintf_error(end - *pos, ret))
532 return;
533 *pos += ret;
534 }
535 }
536
537
eap_fast_write_pac(struct eap_sm * sm,const char * pac_file,char * buf,size_t len)538 static int eap_fast_write_pac(struct eap_sm *sm, const char *pac_file,
539 char *buf, size_t len)
540 {
541 if (os_strncmp(pac_file, "blob://", 7) == 0) {
542 struct wpa_config_blob *blob;
543 blob = os_zalloc(sizeof(*blob));
544 if (blob == NULL)
545 return -1;
546 blob->data = (u8 *) buf;
547 blob->len = len;
548 buf = NULL;
549 blob->name = os_strdup(pac_file + 7);
550 if (blob->name == NULL) {
551 os_free(blob);
552 return -1;
553 }
554 eap_set_config_blob(sm, blob);
555 } else {
556 FILE *f;
557 f = fopen(pac_file, "wb");
558 if (f == NULL) {
559 wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC "
560 "file '%s' for writing", pac_file);
561 return -1;
562 }
563 if (fwrite(buf, 1, len, f) != len) {
564 wpa_printf(MSG_INFO, "EAP-FAST: Failed to write all "
565 "PACs into '%s'", pac_file);
566 fclose(f);
567 return -1;
568 }
569 os_free(buf);
570 fclose(f);
571 }
572
573 return 0;
574 }
575
576
eap_fast_add_pac_data(struct eap_fast_pac * pac,char ** buf,char ** pos,size_t * buf_len)577 static int eap_fast_add_pac_data(struct eap_fast_pac *pac, char **buf,
578 char **pos, size_t *buf_len)
579 {
580 int ret;
581
582 ret = os_snprintf(*pos, *buf + *buf_len - *pos,
583 "START\nPAC-Type=%d\n", pac->pac_type);
584 if (os_snprintf_error(*buf + *buf_len - *pos, ret))
585 return -1;
586
587 *pos += ret;
588 eap_fast_write(buf, pos, buf_len, "PAC-Key",
589 pac->pac_key, EAP_FAST_PAC_KEY_LEN, 0);
590 eap_fast_write(buf, pos, buf_len, "PAC-Opaque",
591 pac->pac_opaque, pac->pac_opaque_len, 0);
592 eap_fast_write(buf, pos, buf_len, "PAC-Info",
593 pac->pac_info, pac->pac_info_len, 0);
594 eap_fast_write(buf, pos, buf_len, "A-ID",
595 pac->a_id, pac->a_id_len, 0);
596 eap_fast_write(buf, pos, buf_len, "I-ID",
597 pac->i_id, pac->i_id_len, 1);
598 eap_fast_write(buf, pos, buf_len, "A-ID-Info",
599 pac->a_id_info, pac->a_id_info_len, 1);
600 if (*buf == NULL) {
601 wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC "
602 "data");
603 return -1;
604 }
605 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n");
606 if (os_snprintf_error(*buf + *buf_len - *pos, ret))
607 return -1;
608 *pos += ret;
609
610 return 0;
611 }
612
613
614 /**
615 * eap_fast_save_pac - Save PAC entries (text format)
616 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
617 * @pac_root: Root of the PAC list
618 * @pac_file: Name of the PAC file/blob
619 * Returns: 0 on success, -1 on failure
620 */
eap_fast_save_pac(struct eap_sm * sm,struct eap_fast_pac * pac_root,const char * pac_file)621 int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_pac *pac_root,
622 const char *pac_file)
623 {
624 struct eap_fast_pac *pac;
625 int ret, count = 0;
626 char *buf, *pos;
627 size_t buf_len;
628
629 if (pac_file == NULL)
630 return -1;
631
632 buf_len = 1024;
633 pos = buf = os_malloc(buf_len);
634 if (buf == NULL)
635 return -1;
636
637 ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);
638 if (os_snprintf_error(buf + buf_len - pos, ret)) {
639 os_free(buf);
640 return -1;
641 }
642 pos += ret;
643
644 pac = pac_root;
645 while (pac) {
646 if (eap_fast_add_pac_data(pac, &buf, &pos, &buf_len)) {
647 os_free(buf);
648 return -1;
649 }
650 count++;
651 pac = pac->next;
652 }
653
654 if (eap_fast_write_pac(sm, pac_file, buf, pos - buf)) {
655 os_free(buf);
656 return -1;
657 }
658
659 wpa_printf(MSG_DEBUG, "PAC file: %s", (sm->blob[3].data));
660 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %d PAC entries into '%s'",
661 count, pac_file);
662
663 return 0;
664 }
665
666
667 /**
668 * eap_fast_pac_list_truncate - Truncate a PAC list to the given length
669 * @pac_root: Root of the PAC list
670 * @max_len: Maximum length of the list (>= 1)
671 * Returns: Number of PAC entries removed
672 */
eap_fast_pac_list_truncate(struct eap_fast_pac * pac_root,size_t max_len)673 size_t eap_fast_pac_list_truncate(struct eap_fast_pac *pac_root,
674 size_t max_len)
675 {
676 struct eap_fast_pac *pac, *prev;
677 size_t count;
678
679 pac = pac_root;
680 prev = NULL;
681 count = 0;
682
683 while (pac) {
684 count++;
685 if (count > max_len)
686 break;
687 prev = pac;
688 pac = pac->next;
689 }
690
691 if (count <= max_len || prev == NULL)
692 return 0;
693
694 count = 0;
695 prev->next = NULL;
696
697 while (pac) {
698 prev = pac;
699 pac = pac->next;
700 eap_fast_free_pac(prev);
701 count++;
702 }
703
704 return count;
705 }
706
707
eap_fast_pac_get_a_id(struct eap_fast_pac * pac)708 static void eap_fast_pac_get_a_id(struct eap_fast_pac *pac)
709 {
710 u8 *pos, *end;
711 u16 type, len;
712
713 pos = pac->pac_info;
714 end = pos + pac->pac_info_len;
715
716 while (end - pos > 4) {
717 type = WPA_GET_BE16(pos);
718 pos += 2;
719 len = WPA_GET_BE16(pos);
720 pos += 2;
721 if (len > (unsigned int) (end - pos))
722 break;
723
724 if (type == PAC_TYPE_A_ID) {
725 os_free(pac->a_id);
726 pac->a_id = os_memdup(pos, len);
727 if (pac->a_id == NULL)
728 break;
729 pac->a_id_len = len;
730 }
731
732 if (type == PAC_TYPE_A_ID_INFO) {
733 os_free(pac->a_id_info);
734 pac->a_id_info = os_memdup(pos, len);
735 if (pac->a_id_info == NULL)
736 break;
737 pac->a_id_info_len = len;
738 }
739
740 pos += len;
741 }
742 }
743
744
745 /**
746 * eap_fast_load_pac_bin - Load PAC entries (binary format)
747 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
748 * @pac_root: Pointer to root of the PAC list (to be filled)
749 * @pac_file: Name of the PAC file/blob to load
750 * Returns: 0 on success, -1 on failure
751 */
eap_fast_load_pac_bin(struct eap_sm * sm,struct eap_fast_pac ** pac_root,const char * pac_file)752 int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root,
753 const char *pac_file)
754 {
755 const struct wpa_config_blob *blob = NULL;
756 u8 *buf, *end, *pos;
757 size_t len = 0;
758 size_t count = 0;
759 struct eap_fast_pac *pac, *prev;
760
761 *pac_root = NULL;
762
763 if (pac_file == NULL)
764 return -1;
765
766 if (sm->config.pac_file != NULL) { //if (os_strncmp(pac_file, "blob://", 7) == 0) {
767 blob = eap_get_config_blob(sm, PAC_FILE_NAME);
768 if (blob == NULL) {
769 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
770 "assume no PAC entries have been "
771 "provisioned", pac_file);
772 return 0;
773 }
774 buf = (u8 *) blob->data;
775 len = blob->len;
776 } else {
777 buf = (u8 *) sm->blob[3].data; //(u8 *) os_readfile(pac_file, &len);
778 if (buf == NULL) {
779 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
780 "assume no PAC entries have been "
781 "provisioned", pac_file);
782 return 0;
783 }
784 }
785
786 if (len == 0) {
787 if (blob == NULL)
788 os_free(buf);
789 return 0;
790 }
791
792 if (len < 6 || WPA_GET_BE32(buf) != EAP_FAST_PAC_BINARY_MAGIC ||
793 WPA_GET_BE16(buf + 4) != EAP_FAST_PAC_BINARY_FORMAT_VERSION) {
794 wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC file '%s' (bin)",
795 pac_file);
796 if (blob == NULL)
797 os_free(buf);
798 return -1;
799 }
800
801 pac = prev = NULL;
802 pos = buf + 6;
803 end = buf + len;
804 while (pos < end) {
805 u16 val;
806
807 if (end - pos < 2 + EAP_FAST_PAC_KEY_LEN + 2 + 2) {
808 pac = NULL;
809 goto parse_fail;
810 }
811
812 pac = os_zalloc(sizeof(*pac));
813 if (pac == NULL)
814 goto parse_fail;
815
816 pac->pac_type = WPA_GET_BE16(pos);
817 pos += 2;
818 os_memcpy(pac->pac_key, pos, EAP_FAST_PAC_KEY_LEN);
819 pos += EAP_FAST_PAC_KEY_LEN;
820 val = WPA_GET_BE16(pos);
821 pos += 2;
822 if (val > end - pos)
823 goto parse_fail;
824 pac->pac_opaque_len = val;
825 pac->pac_opaque = os_memdup(pos, pac->pac_opaque_len);
826 if (pac->pac_opaque == NULL)
827 goto parse_fail;
828 pos += pac->pac_opaque_len;
829 if (2 > end - pos)
830 goto parse_fail;
831 val = WPA_GET_BE16(pos);
832 pos += 2;
833 if (val > end - pos)
834 goto parse_fail;
835 pac->pac_info_len = val;
836 pac->pac_info = os_memdup(pos, pac->pac_info_len);
837 if (pac->pac_info == NULL)
838 goto parse_fail;
839 pos += pac->pac_info_len;
840 eap_fast_pac_get_a_id(pac);
841
842 count++;
843 if (prev)
844 prev->next = pac;
845 else
846 *pac_root = pac;
847 prev = pac;
848 }
849
850 if (blob == NULL)
851 os_free(buf);
852
853 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %lu PAC entries from '%s' (bin)",
854 (unsigned long) count, pac_file);
855
856 return 0;
857
858 parse_fail:
859 wpa_printf(MSG_INFO, "EAP-FAST: Failed to parse PAC file '%s' (bin)",
860 pac_file);
861 if (blob == NULL)
862 os_free(buf);
863 if (pac)
864 eap_fast_free_pac(pac);
865 return -1;
866 }
867
868
869 /**
870 * eap_fast_save_pac_bin - Save PAC entries (binary format)
871 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
872 * @pac_root: Root of the PAC list
873 * @pac_file: Name of the PAC file/blob
874 * Returns: 0 on success, -1 on failure
875 */
eap_fast_save_pac_bin(struct eap_sm * sm,struct eap_fast_pac * pac_root,const char * pac_file)876 int eap_fast_save_pac_bin(struct eap_sm *sm, struct eap_fast_pac *pac_root,
877 const char *pac_file)
878 {
879 size_t len, count = 0;
880 struct eap_fast_pac *pac;
881 u8 *buf, *pos;
882
883 len = 6;
884 pac = pac_root;
885 while (pac) {
886 if (pac->pac_opaque_len > 65535 ||
887 pac->pac_info_len > 65535)
888 return -1;
889 len += 2 + EAP_FAST_PAC_KEY_LEN + 2 + pac->pac_opaque_len +
890 2 + pac->pac_info_len;
891 pac = pac->next;
892 }
893
894 buf = os_malloc(len);
895 if (buf == NULL)
896 return -1;
897
898 pos = buf;
899 WPA_PUT_BE32(pos, EAP_FAST_PAC_BINARY_MAGIC);
900 pos += 4;
901 WPA_PUT_BE16(pos, EAP_FAST_PAC_BINARY_FORMAT_VERSION);
902 pos += 2;
903
904 pac = pac_root;
905 while (pac) {
906 WPA_PUT_BE16(pos, pac->pac_type);
907 pos += 2;
908 os_memcpy(pos, pac->pac_key, EAP_FAST_PAC_KEY_LEN);
909 pos += EAP_FAST_PAC_KEY_LEN;
910 WPA_PUT_BE16(pos, pac->pac_opaque_len);
911 pos += 2;
912 os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len);
913 pos += pac->pac_opaque_len;
914 WPA_PUT_BE16(pos, pac->pac_info_len);
915 pos += 2;
916 os_memcpy(pos, pac->pac_info, pac->pac_info_len);
917 pos += pac->pac_info_len;
918
919 pac = pac->next;
920 count++;
921 }
922
923 if (eap_fast_write_pac(sm, pac_file, (char *) buf, len)) {
924 os_free(buf);
925 return -1;
926 }
927
928 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %lu PAC entries into '%s' "
929 "(bin)", (unsigned long) count, pac_file);
930
931 return 0;
932 }
933
