1 /*
2  * EAP peer method: EAP-FAST PAC file processing
3  * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 #include "os.h"
11 
12 #include "utils/common.h"
13 #include "eap_peer/eap_config.h"
14 #include "eap_peer/eap_i.h"
15 #include "eap_peer/eap_fast_pac.h"
16 
17 /* TODO: encrypt PAC-Key in the PAC file */
18 
19 
20 /* Text data format */
21 static const char *pac_file_hdr =
22 	"wpa_supplicant EAP-FAST PAC file - version 1";
23 
24 /*
25  * Binary data format
26  * 4-octet magic value: 6A E4 92 0C
27  * 2-octet version (big endian)
28  * <version specific data>
29  *
30  * version=0:
31  * Sequence of PAC entries:
32  *   2-octet PAC-Type (big endian)
33  *   32-octet PAC-Key
34  *   2-octet PAC-Opaque length (big endian)
35  *   <variable len> PAC-Opaque data (length bytes)
36  *   2-octet PAC-Info length (big endian)
37  *   <variable len> PAC-Info data (length bytes)
38  */
39 
40 #define EAP_FAST_PAC_BINARY_MAGIC 0x6ae4920c
41 #define EAP_FAST_PAC_BINARY_FORMAT_VERSION 0
42 
43 
44 /**
45  * eap_fast_free_pac - Free PAC data
46  * @pac: Pointer to the PAC entry
47  *
48  * Note that the PAC entry must not be in a list since this function does not
49  * remove the list links.
50  */
eap_fast_free_pac(struct eap_fast_pac * pac)51 void eap_fast_free_pac(struct eap_fast_pac *pac)
52 {
53 	os_free(pac->pac_opaque);
54 	os_free(pac->pac_info);
55 	os_free(pac->a_id);
56 	os_free(pac->i_id);
57 	os_free(pac->a_id_info);
58 	os_free(pac);
59 }
60 
61 
62 /**
63  * eap_fast_get_pac - Get a PAC entry based on A-ID
64  * @pac_root: Pointer to root of the PAC list
65  * @a_id: A-ID to search for
66  * @a_id_len: Length of A-ID
67  * @pac_type: PAC-Type to search for
68  * Returns: Pointer to the PAC entry, or %NULL if A-ID not found
69  */
eap_fast_get_pac(struct eap_fast_pac * pac_root,const u8 * a_id,size_t a_id_len,u16 pac_type)70 struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_pac *pac_root,
71 				       const u8 *a_id, size_t a_id_len,
72 				       u16 pac_type)
73 {
74 	struct eap_fast_pac *pac = pac_root;
75 
76 	while (pac) {
77 		if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
78 		    os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
79 			return pac;
80 		}
81 		pac = pac->next;
82 	}
83 	return NULL;
84 }
85 
86 
eap_fast_remove_pac(struct eap_fast_pac ** pac_root,struct eap_fast_pac ** pac_current,const u8 * a_id,size_t a_id_len,u16 pac_type)87 static void eap_fast_remove_pac(struct eap_fast_pac **pac_root,
88 				struct eap_fast_pac **pac_current,
89 				const u8 *a_id, size_t a_id_len, u16 pac_type)
90 {
91 	struct eap_fast_pac *pac, *prev;
92 
93 	pac = *pac_root;
94 	prev = NULL;
95 
96 	while (pac) {
97 		if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
98 		    os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
99 			if (prev == NULL)
100 				*pac_root = pac->next;
101 			else
102 				prev->next = pac->next;
103 			if (*pac_current == pac)
104 				*pac_current = NULL;
105 			eap_fast_free_pac(pac);
106 			break;
107 		}
108 		prev = pac;
109 		pac = pac->next;
110 	}
111 }
112 
113 
eap_fast_copy_buf(u8 ** dst,size_t * dst_len,const u8 * src,size_t src_len)114 static int eap_fast_copy_buf(u8 **dst, size_t *dst_len,
115 			     const u8 *src, size_t src_len)
116 {
117 	if (src) {
118 		*dst = os_memdup(src, src_len);
119 		if (*dst == NULL)
120 			return -1;
121 		*dst_len = src_len;
122 	}
123 	return 0;
124 }
125 
126 
127 /**
128  * eap_fast_add_pac - Add a copy of a PAC entry to a list
129  * @pac_root: Pointer to PAC list root pointer
130  * @pac_current: Pointer to the current PAC pointer
131  * @entry: New entry to clone and add to the list
132  * Returns: 0 on success, -1 on failure
133  *
134  * This function makes a clone of the given PAC entry and adds this copied
135  * entry to the list (pac_root). If an old entry for the same A-ID is found,
136  * it will be removed from the PAC list and in this case, pac_current entry
137  * is set to %NULL if it was the removed entry.
138  */
eap_fast_add_pac(struct eap_fast_pac ** pac_root,struct eap_fast_pac ** pac_current,struct eap_fast_pac * entry)139 int eap_fast_add_pac(struct eap_fast_pac **pac_root,
140 		     struct eap_fast_pac **pac_current,
141 		     struct eap_fast_pac *entry)
142 {
143 	struct eap_fast_pac *pac;
144 
145 	if (entry == NULL || entry->a_id == NULL)
146 		return -1;
147 
148 	/* Remove a possible old entry for the matching A-ID. */
149 	eap_fast_remove_pac(pac_root, pac_current,
150 			    entry->a_id, entry->a_id_len, entry->pac_type);
151 
152 	/* Allocate a new entry and add it to the list of PACs. */
153 	pac = os_zalloc(sizeof(*pac));
154 	if (pac == NULL)
155 		return -1;
156 
157 	pac->pac_type = entry->pac_type;
158 	os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN);
159 	if (eap_fast_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len,
160 			      entry->pac_opaque, entry->pac_opaque_len) < 0 ||
161 	    eap_fast_copy_buf(&pac->pac_info, &pac->pac_info_len,
162 			      entry->pac_info, entry->pac_info_len) < 0 ||
163 	    eap_fast_copy_buf(&pac->a_id, &pac->a_id_len,
164 			      entry->a_id, entry->a_id_len) < 0 ||
165 	    eap_fast_copy_buf(&pac->i_id, &pac->i_id_len,
166 			      entry->i_id, entry->i_id_len) < 0 ||
167 	    eap_fast_copy_buf(&pac->a_id_info, &pac->a_id_info_len,
168 			      entry->a_id_info, entry->a_id_info_len) < 0) {
169 		eap_fast_free_pac(pac);
170 		return -1;
171 	}
172 
173 	pac->next = *pac_root;
174 	*pac_root = pac;
175 
176 	return 0;
177 }
178 
179 
180 struct eap_fast_read_ctx {
181 	FILE *f;
182 	const char *pos;
183 	const char *end;
184 	int line;
185 	char *buf;
186 	size_t buf_len;
187 };
188 
eap_fast_read_line(struct eap_fast_read_ctx * rc,char ** value)189 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char **value)
190 {
191 	char *pos;
192 
193 	rc->line++;
194 	if (rc->f) {
195 		if (fgets(rc->buf, rc->buf_len, rc->f) == NULL)
196 			return -1;
197 	} else {
198 		const char *l_end;
199 		size_t len;
200 		if (rc->pos >= rc->end)
201 			return -1;
202 		l_end = rc->pos;
203 		while (l_end < rc->end && *l_end != '\n')
204 			l_end++;
205 		len = l_end - rc->pos;
206 		if (len >= rc->buf_len)
207 			len = rc->buf_len - 1;
208 		os_memcpy(rc->buf, rc->pos, len);
209 		rc->buf[len] = '\0';
210 		rc->pos = l_end + 1;
211 	}
212 
213 	rc->buf[rc->buf_len - 1] = '\0';
214 	pos = rc->buf;
215 	while (*pos != '\0') {
216 		if (*pos == '\n' || *pos == '\r') {
217 			*pos = '\0';
218 			break;
219 		}
220 		pos++;
221 	}
222 
223 	pos = os_strchr(rc->buf, '=');
224 	if (pos)
225 		*pos++ = '\0';
226 	*value = pos;
227 
228 	return 0;
229 }
230 
231 
eap_fast_parse_hex(const char * value,size_t * len)232 static u8 * eap_fast_parse_hex(const char *value, size_t *len)
233 {
234 	int hlen;
235 	u8 *buf;
236 
237 	if (value == NULL)
238 		return NULL;
239 	hlen = os_strlen(value);
240 	if (hlen & 1)
241 		return NULL;
242 	*len = hlen / 2;
243 	buf = os_malloc(*len);
244 	if (buf == NULL)
245 		return NULL;
246 	if (hexstr2bin(value, buf, *len)) {
247 		os_free(buf);
248 		return NULL;
249 	}
250 	return buf;
251 }
252 
253 
eap_fast_init_pac_data(struct eap_sm * sm,const char * pac_file,struct eap_fast_read_ctx * rc)254 static int eap_fast_init_pac_data(struct eap_sm *sm, const char *pac_file,
255 				  struct eap_fast_read_ctx *rc)
256 {
257 	os_memset(rc, 0, sizeof(*rc));
258 
259 	rc->buf_len = 2048;
260 	rc->buf = os_malloc(rc->buf_len);
261 	if (rc->buf == NULL)
262 		return -1;
263 
264 	if (os_strncmp(pac_file, "blob://", 7) == 0) {
265 		const struct wpa_config_blob *blob;
266 		blob = eap_get_config_blob(sm, pac_file);
267 		if (blob == NULL) {
268 			wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
269 				   "assume no PAC entries have been "
270 				   "provisioned", pac_file);
271 			os_free(rc->buf);
272 			return -1;
273 		}
274 		rc->pos = (char *) blob->data;
275 		rc->end = (char *) blob->data + blob->len;
276 	} else {
277 		rc->f = fopen(pac_file, "rb");
278 		if (rc->f == NULL) {
279 			wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
280 				   "assume no PAC entries have been "
281 				   "provisioned", pac_file);
282 			os_free(rc->buf);
283 			return -1;
284 		}
285 	}
286 
287 	return 0;
288 }
289 
290 
eap_fast_deinit_pac_data(struct eap_fast_read_ctx * rc)291 static void eap_fast_deinit_pac_data(struct eap_fast_read_ctx *rc)
292 {
293 	os_free(rc->buf);
294 	if (rc->f)
295 		fclose(rc->f);
296 }
297 
298 
eap_fast_parse_start(struct eap_fast_pac ** pac)299 static const char * eap_fast_parse_start(struct eap_fast_pac **pac)
300 {
301 	if (*pac)
302 		return "START line without END";
303 
304 	*pac = os_zalloc(sizeof(struct eap_fast_pac));
305 	if (*pac == NULL)
306 		return "No memory for PAC entry";
307 	(*pac)->pac_type = PAC_TYPE_TUNNEL_PAC;
308 	return NULL;
309 }
310 
311 
eap_fast_parse_end(struct eap_fast_pac ** pac_root,struct eap_fast_pac ** pac)312 static const char * eap_fast_parse_end(struct eap_fast_pac **pac_root,
313 				       struct eap_fast_pac **pac)
314 {
315 	if (*pac == NULL)
316 		return "END line without START";
317 	if (*pac_root) {
318 		struct eap_fast_pac *end = *pac_root;
319 		while (end->next)
320 			end = end->next;
321 		end->next = *pac;
322 	} else
323 		*pac_root = *pac;
324 
325 	*pac = NULL;
326 	return NULL;
327 }
328 
329 
eap_fast_parse_pac_type(struct eap_fast_pac * pac,char * pos)330 static const char * eap_fast_parse_pac_type(struct eap_fast_pac *pac,
331 					    char *pos)
332 {
333 	if (!pos)
334 		return "Cannot parse pac type";
335 	pac->pac_type = atoi(pos);
336 	if (pac->pac_type != PAC_TYPE_TUNNEL_PAC &&
337 	    pac->pac_type != PAC_TYPE_USER_AUTHORIZATION &&
338 	    pac->pac_type != PAC_TYPE_MACHINE_AUTHENTICATION)
339 		return "Unrecognized PAC-Type";
340 
341 	return NULL;
342 }
343 
344 
eap_fast_parse_pac_key(struct eap_fast_pac * pac,char * pos)345 static const char * eap_fast_parse_pac_key(struct eap_fast_pac *pac, char *pos)
346 {
347 	u8 *key;
348 	size_t key_len;
349 
350 	key = eap_fast_parse_hex(pos, &key_len);
351 	if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) {
352 		os_free(key);
353 		return "Invalid PAC-Key";
354 	}
355 
356 	os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN);
357 	os_free(key);
358 
359 	return NULL;
360 }
361 
362 
eap_fast_parse_pac_opaque(struct eap_fast_pac * pac,char * pos)363 static const char * eap_fast_parse_pac_opaque(struct eap_fast_pac *pac,
364 					      char *pos)
365 {
366 	os_free(pac->pac_opaque);
367 	pac->pac_opaque = eap_fast_parse_hex(pos, &pac->pac_opaque_len);
368 	if (pac->pac_opaque == NULL)
369 		return "Invalid PAC-Opaque";
370 	return NULL;
371 }
372 
373 
eap_fast_parse_a_id(struct eap_fast_pac * pac,char * pos)374 static const char * eap_fast_parse_a_id(struct eap_fast_pac *pac, char *pos)
375 {
376 	os_free(pac->a_id);
377 	pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len);
378 	if (pac->a_id == NULL)
379 		return "Invalid A-ID";
380 	return NULL;
381 }
382 
383 
eap_fast_parse_i_id(struct eap_fast_pac * pac,char * pos)384 static const char * eap_fast_parse_i_id(struct eap_fast_pac *pac, char *pos)
385 {
386 	os_free(pac->i_id);
387 	pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len);
388 	if (pac->i_id == NULL)
389 		return "Invalid I-ID";
390 	return NULL;
391 }
392 
393 
eap_fast_parse_a_id_info(struct eap_fast_pac * pac,char * pos)394 static const char * eap_fast_parse_a_id_info(struct eap_fast_pac *pac,
395 					     char *pos)
396 {
397 	os_free(pac->a_id_info);
398 	pac->a_id_info = eap_fast_parse_hex(pos, &pac->a_id_info_len);
399 	if (pac->a_id_info == NULL)
400 		return "Invalid A-ID-Info";
401 	return NULL;
402 }
403 
404 
405 /**
406  * eap_fast_load_pac - Load PAC entries (text format)
407  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
408  * @pac_root: Pointer to root of the PAC list (to be filled)
409  * @pac_file: Name of the PAC file/blob to load
410  * Returns: 0 on success, -1 on failure
411  */
eap_fast_load_pac(struct eap_sm * sm,struct eap_fast_pac ** pac_root,const char * pac_file)412 int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_pac **pac_root,
413 		      const char *pac_file)
414 {
415 	struct eap_fast_read_ctx rc;
416 	struct eap_fast_pac *pac = NULL;
417 	int count = 0;
418 	char *pos;
419 	const char *err = NULL;
420 
421 	if (pac_file == NULL)
422 		return -1;
423 
424 	if (eap_fast_init_pac_data(sm, pac_file, &rc) < 0)
425 		return 0;
426 
427 	if (eap_fast_read_line(&rc, &pos) < 0) {
428 		/* empty file - assume it is fine to overwrite */
429         printf("\n\nassuming it is fine to overwrite... \n\n");
430 		eap_fast_deinit_pac_data(&rc);
431 		return 0;
432 	}
433     printf("\n\nPAC FILE =\n%s", rc.pos);
434 	if (os_strcmp(pac_file_hdr, rc.buf) != 0)
435 		err = "Unrecognized header line";
436 
437 	while (!err && eap_fast_read_line(&rc, &pos) == 0) {
438 		if (os_strcmp(rc.buf, "START") == 0)
439 			err = eap_fast_parse_start(&pac);
440 		else if (os_strcmp(rc.buf, "END") == 0) {
441 			err = eap_fast_parse_end(pac_root, &pac);
442 			count++;
443 		} else if (!pac)
444 			err = "Unexpected line outside START/END block";
445 		else if (os_strcmp(rc.buf, "PAC-Type") == 0)
446 			err = eap_fast_parse_pac_type(pac, pos);
447 		else if (os_strcmp(rc.buf, "PAC-Key") == 0)
448 			err = eap_fast_parse_pac_key(pac, pos);
449 		else if (os_strcmp(rc.buf, "PAC-Opaque") == 0)
450 			err = eap_fast_parse_pac_opaque(pac, pos);
451 		else if (os_strcmp(rc.buf, "A-ID") == 0)
452 			err = eap_fast_parse_a_id(pac, pos);
453 		else if (os_strcmp(rc.buf, "I-ID") == 0)
454 			err = eap_fast_parse_i_id(pac, pos);
455 		else if (os_strcmp(rc.buf, "A-ID-Info") == 0)
456 			err = eap_fast_parse_a_id_info(pac, pos);
457 	}
458 
459 	if (pac) {
460 		if (!err)
461 			err = "PAC block not terminated with END";
462 		eap_fast_free_pac(pac);
463 	}
464 
465 	eap_fast_deinit_pac_data(&rc);
466 
467 	if (err) {
468 		wpa_printf(MSG_INFO, "EAP-FAST: %s in '%s:%d'",
469 			   err, pac_file, rc.line);
470 		return -1;
471 	}
472 
473 	wpa_printf(MSG_DEBUG, "EAP-FAST: Read %d PAC entries from '%s'",
474 		   count, pac_file);
475 
476 	return 0;
477 }
478 
479 
eap_fast_write(char ** buf,char ** pos,size_t * buf_len,const char * field,const u8 * data,size_t len,int txt)480 static void eap_fast_write(char **buf, char **pos, size_t *buf_len,
481 			   const char *field, const u8 *data,
482 			   size_t len, int txt)
483 {
484 	size_t i, need;
485 	int ret;
486 	char *end;
487 
488 	if (data == NULL || buf == NULL || *buf == NULL ||
489 	    pos == NULL || *pos == NULL || *pos < *buf)
490 		return;
491 
492 	need = os_strlen(field) + len * 2 + 30;
493 	if (txt)
494 		need += os_strlen(field) + len + 20;
495 
496 	if (*pos - *buf + need > *buf_len) {
497 		char *nbuf = os_realloc(*buf, *buf_len + need);
498 		if (nbuf == NULL) {
499 			os_free(*buf);
500 			*buf = NULL;
501 			return;
502 		}
503 		*pos = nbuf + (*pos - *buf);
504 		*buf = nbuf;
505 		*buf_len += need;
506 	}
507 	end = *buf + *buf_len;
508 
509 	ret = os_snprintf(*pos, end - *pos, "%s=", field);
510 	if (os_snprintf_error(end - *pos, ret))
511 		return;
512 	*pos += ret;
513 	*pos += wpa_snprintf_hex(*pos, end - *pos, data, len);
514 	ret = os_snprintf(*pos, end - *pos, "\n");
515 	if (os_snprintf_error(end - *pos, ret))
516 		return;
517 	*pos += ret;
518 
519 	if (txt) {
520 		ret = os_snprintf(*pos, end - *pos, "%s-txt=", field);
521 		if (os_snprintf_error(end - *pos, ret))
522 			return;
523 		*pos += ret;
524 		for (i = 0; i < len; i++) {
525 			ret = os_snprintf(*pos, end - *pos, "%c", data[i]);
526 			if (os_snprintf_error(end - *pos, ret))
527 				return;
528 			*pos += ret;
529 		}
530 		ret = os_snprintf(*pos, end - *pos, "\n");
531 		if (os_snprintf_error(end - *pos, ret))
532 			return;
533 		*pos += ret;
534 	}
535 }
536 
537 
eap_fast_write_pac(struct eap_sm * sm,const char * pac_file,char * buf,size_t len)538 static int eap_fast_write_pac(struct eap_sm *sm, const char *pac_file,
539 			      char *buf, size_t len)
540 {
541 	if (os_strncmp(pac_file, "blob://", 7) == 0) {
542 		struct wpa_config_blob *blob;
543 		blob = os_zalloc(sizeof(*blob));
544 		if (blob == NULL)
545 			return -1;
546 		blob->data = (u8 *) buf;
547 		blob->len = len;
548 		buf = NULL;
549 		blob->name = os_strdup(pac_file + 7);
550 		if (blob->name == NULL) {
551 			os_free(blob);
552 			return -1;
553 		}
554 		eap_set_config_blob(sm, blob);
555 		os_free(blob);
556 	} else {
557 		FILE *f;
558 		f = fopen(pac_file, "wb");
559 		if (f == NULL) {
560 			wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC "
561 				   "file '%s' for writing", pac_file);
562 			return -1;
563 		}
564 		if (fwrite(buf, 1, len, f) != len) {
565 			wpa_printf(MSG_INFO, "EAP-FAST: Failed to write all "
566 				   "PACs into '%s'", pac_file);
567 			fclose(f);
568 			return -1;
569 		}
570 		os_free(buf);
571 		fclose(f);
572 	}
573 
574 	return 0;
575 }
576 
577 
eap_fast_add_pac_data(struct eap_fast_pac * pac,char ** buf,char ** pos,size_t * buf_len)578 static int eap_fast_add_pac_data(struct eap_fast_pac *pac, char **buf,
579 				 char **pos, size_t *buf_len)
580 {
581 	int ret;
582 
583 	ret = os_snprintf(*pos, *buf + *buf_len - *pos,
584 			  "START\nPAC-Type=%d\n", pac->pac_type);
585 	if (os_snprintf_error(*buf + *buf_len - *pos, ret))
586 		return -1;
587 
588 	*pos += ret;
589 	eap_fast_write(buf, pos, buf_len, "PAC-Key",
590 		       pac->pac_key, EAP_FAST_PAC_KEY_LEN, 0);
591 	eap_fast_write(buf, pos, buf_len, "PAC-Opaque",
592 		       pac->pac_opaque, pac->pac_opaque_len, 0);
593 	eap_fast_write(buf, pos, buf_len, "PAC-Info",
594 		       pac->pac_info, pac->pac_info_len, 0);
595 	eap_fast_write(buf, pos, buf_len, "A-ID",
596 		       pac->a_id, pac->a_id_len, 0);
597 	eap_fast_write(buf, pos, buf_len, "I-ID",
598 		       pac->i_id, pac->i_id_len, 1);
599 	eap_fast_write(buf, pos, buf_len, "A-ID-Info",
600 		       pac->a_id_info, pac->a_id_info_len, 1);
601 	if (*buf == NULL) {
602 		wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC "
603 			   "data");
604 		return -1;
605 	}
606 	ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n");
607 	if (os_snprintf_error(*buf + *buf_len - *pos, ret))
608 		return -1;
609 	*pos += ret;
610 
611 	return 0;
612 }
613 
614 
615 /**
616  * eap_fast_save_pac - Save PAC entries (text format)
617  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
618  * @pac_root: Root of the PAC list
619  * @pac_file: Name of the PAC file/blob
620  * Returns: 0 on success, -1 on failure
621  */
eap_fast_save_pac(struct eap_sm * sm,struct eap_fast_pac * pac_root,const char * pac_file)622 int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_pac *pac_root,
623 		      const char *pac_file)
624 {
625 	struct eap_fast_pac *pac;
626 	int ret, count = 0;
627 	char *buf, *pos;
628 	size_t buf_len;
629 
630 	if (pac_file == NULL)
631 		return -1;
632 
633 	buf_len = 1024;
634 	pos = buf = os_malloc(buf_len);
635 	if (buf == NULL)
636 		return -1;
637 
638 	ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);
639 	if (os_snprintf_error(buf + buf_len - pos, ret)) {
640 		os_free(buf);
641 		return -1;
642 	}
643 	pos += ret;
644 
645 	pac = pac_root;
646 	while (pac) {
647 		if (eap_fast_add_pac_data(pac, &buf, &pos, &buf_len)) {
648 			os_free(buf);
649 			return -1;
650 		}
651 		count++;
652 		pac = pac->next;
653 	}
654 
655 	if (eap_fast_write_pac(sm, pac_file, buf, pos - buf)) {
656 		os_free(buf);
657 		return -1;
658 	}
659 
660     wpa_printf(MSG_DEBUG, "PAC file: %s", (sm->blob[3].data));
661 	wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %d PAC entries into '%s'",
662 		   count, pac_file);
663 
664 	return 0;
665 }
666 
667 
668 /**
669  * eap_fast_pac_list_truncate - Truncate a PAC list to the given length
670  * @pac_root: Root of the PAC list
671  * @max_len: Maximum length of the list (>= 1)
672  * Returns: Number of PAC entries removed
673  */
eap_fast_pac_list_truncate(struct eap_fast_pac * pac_root,size_t max_len)674 size_t eap_fast_pac_list_truncate(struct eap_fast_pac *pac_root,
675 				  size_t max_len)
676 {
677 	struct eap_fast_pac *pac, *prev;
678 	size_t count;
679 
680 	pac = pac_root;
681 	prev = NULL;
682 	count = 0;
683 
684 	while (pac) {
685 		count++;
686 		if (count > max_len)
687 			break;
688 		prev = pac;
689 		pac = pac->next;
690 	}
691 
692 	if (count <= max_len || prev == NULL)
693 		return 0;
694 
695 	count = 0;
696 	prev->next = NULL;
697 
698 	while (pac) {
699 		prev = pac;
700 		pac = pac->next;
701 		eap_fast_free_pac(prev);
702 		count++;
703 	}
704 
705 	return count;
706 }
707 
708 
eap_fast_pac_get_a_id(struct eap_fast_pac * pac)709 static void eap_fast_pac_get_a_id(struct eap_fast_pac *pac)
710 {
711 	u8 *pos, *end;
712 	u16 type, len;
713 
714 	pos = pac->pac_info;
715 	end = pos + pac->pac_info_len;
716 
717 	while (end - pos > 4) {
718 		type = WPA_GET_BE16(pos);
719 		pos += 2;
720 		len = WPA_GET_BE16(pos);
721 		pos += 2;
722 		if (len > (unsigned int) (end - pos))
723 			break;
724 
725 		if (type == PAC_TYPE_A_ID) {
726 			os_free(pac->a_id);
727 			pac->a_id = os_memdup(pos, len);
728 			if (pac->a_id == NULL)
729 				break;
730 			pac->a_id_len = len;
731 		}
732 
733 		if (type == PAC_TYPE_A_ID_INFO) {
734 			os_free(pac->a_id_info);
735 			pac->a_id_info = os_memdup(pos, len);
736 			if (pac->a_id_info == NULL)
737 				break;
738 			pac->a_id_info_len = len;
739 		}
740 
741 		pos += len;
742 	}
743 }
744 
745 
746 /**
747  * eap_fast_load_pac_bin - Load PAC entries (binary format)
748  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
749  * @pac_root: Pointer to root of the PAC list (to be filled)
750  * @pac_file: Name of the PAC file/blob to load
751  * Returns: 0 on success, -1 on failure
752  */
eap_fast_load_pac_bin(struct eap_sm * sm,struct eap_fast_pac ** pac_root,const char * pac_file)753 int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root,
754 			  const char *pac_file)
755 {
756 	const struct wpa_config_blob *blob = NULL;
757 	u8 *buf, *end, *pos;
758 	size_t len = 0;
759     size_t count = 0;
760 	struct eap_fast_pac *pac, *prev;
761 
762 	*pac_root = NULL;
763 
764 	if (pac_file == NULL)
765 		return -1;
766 
767 	if (sm->config.pac_file != NULL) { //if (os_strncmp(pac_file, "blob://", 7) == 0) {
768 		blob = eap_get_config_blob(sm, PAC_FILE_NAME);
769 		if (blob == NULL) {
770 			wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
771 				   "assume no PAC entries have been "
772 				   "provisioned", pac_file);
773 			return 0;
774 		}
775 		buf = (u8 *) blob->data;
776 		len = blob->len;
777 	} else {
778 		buf = (u8 *) sm->blob[3].data; //(u8 *) os_readfile(pac_file, &len);
779 		if (buf == NULL) {
780 			wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
781 				   "assume no PAC entries have been "
782 				   "provisioned", pac_file);
783 			return 0;
784 		}
785 	}
786 
787 	if (len == 0) {
788 		if (blob == NULL)
789 			os_free(buf);
790 		return 0;
791 	}
792 
793 	if (len < 6 || WPA_GET_BE32(buf) != EAP_FAST_PAC_BINARY_MAGIC ||
794 	    WPA_GET_BE16(buf + 4) != EAP_FAST_PAC_BINARY_FORMAT_VERSION) {
795 		wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC file '%s' (bin)",
796 			   pac_file);
797 		if (blob == NULL)
798 			os_free(buf);
799 		return -1;
800 	}
801 
802 	pac = prev = NULL;
803 	pos = buf + 6;
804 	end = buf + len;
805 	while (pos < end) {
806 		u16 val;
807 
808 		if (end - pos < 2 + EAP_FAST_PAC_KEY_LEN + 2 + 2) {
809 			pac = NULL;
810 			goto parse_fail;
811 		}
812 
813 		pac = os_zalloc(sizeof(*pac));
814 		if (pac == NULL)
815 			goto parse_fail;
816 
817 		pac->pac_type = WPA_GET_BE16(pos);
818 		pos += 2;
819 		os_memcpy(pac->pac_key, pos, EAP_FAST_PAC_KEY_LEN);
820 		pos += EAP_FAST_PAC_KEY_LEN;
821 		val = WPA_GET_BE16(pos);
822 		pos += 2;
823 		if (val > end - pos)
824 			goto parse_fail;
825 		pac->pac_opaque_len = val;
826 		pac->pac_opaque = os_memdup(pos, pac->pac_opaque_len);
827 		if (pac->pac_opaque == NULL)
828 			goto parse_fail;
829 		pos += pac->pac_opaque_len;
830 		if (2 > end - pos)
831 			goto parse_fail;
832 		val = WPA_GET_BE16(pos);
833 		pos += 2;
834 		if (val > end - pos)
835 			goto parse_fail;
836 		pac->pac_info_len = val;
837 		pac->pac_info = os_memdup(pos, pac->pac_info_len);
838 		if (pac->pac_info == NULL)
839 			goto parse_fail;
840 		pos += pac->pac_info_len;
841 		eap_fast_pac_get_a_id(pac);
842 
843 		count++;
844 		if (prev)
845 			prev->next = pac;
846 		else
847 			*pac_root = pac;
848 		prev = pac;
849 	}
850 
851 	if (blob == NULL)
852 		os_free(buf);
853 
854 	wpa_printf(MSG_DEBUG, "EAP-FAST: Read %lu PAC entries from '%s' (bin)",
855 		   (unsigned long) count, pac_file);
856 
857 	return 0;
858 
859 parse_fail:
860 	wpa_printf(MSG_INFO, "EAP-FAST: Failed to parse PAC file '%s' (bin)",
861 		   pac_file);
862 	if (blob == NULL)
863 		os_free(buf);
864 	if (pac)
865 		eap_fast_free_pac(pac);
866 	return -1;
867 }
868 
869 
870 /**
871  * eap_fast_save_pac_bin - Save PAC entries (binary format)
872  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
873  * @pac_root: Root of the PAC list
874  * @pac_file: Name of the PAC file/blob
875  * Returns: 0 on success, -1 on failure
876  */
eap_fast_save_pac_bin(struct eap_sm * sm,struct eap_fast_pac * pac_root,const char * pac_file)877 int eap_fast_save_pac_bin(struct eap_sm *sm, struct eap_fast_pac *pac_root,
878 			  const char *pac_file)
879 {
880 	size_t len, count = 0;
881 	struct eap_fast_pac *pac;
882 	u8 *buf, *pos;
883 
884 	len = 6;
885 	pac = pac_root;
886 	while (pac) {
887 		if (pac->pac_opaque_len > 65535 ||
888 		    pac->pac_info_len > 65535)
889 			return -1;
890 		len += 2 + EAP_FAST_PAC_KEY_LEN + 2 + pac->pac_opaque_len +
891 			2 + pac->pac_info_len;
892 		pac = pac->next;
893 	}
894 
895 	buf = os_malloc(len);
896 	if (buf == NULL)
897 		return -1;
898 
899 	pos = buf;
900 	WPA_PUT_BE32(pos, EAP_FAST_PAC_BINARY_MAGIC);
901 	pos += 4;
902 	WPA_PUT_BE16(pos, EAP_FAST_PAC_BINARY_FORMAT_VERSION);
903 	pos += 2;
904 
905 	pac = pac_root;
906 	while (pac) {
907 		WPA_PUT_BE16(pos, pac->pac_type);
908 		pos += 2;
909 		os_memcpy(pos, pac->pac_key, EAP_FAST_PAC_KEY_LEN);
910 		pos += EAP_FAST_PAC_KEY_LEN;
911 		WPA_PUT_BE16(pos, pac->pac_opaque_len);
912 		pos += 2;
913 		os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len);
914 		pos += pac->pac_opaque_len;
915 		WPA_PUT_BE16(pos, pac->pac_info_len);
916 		pos += 2;
917 		os_memcpy(pos, pac->pac_info, pac->pac_info_len);
918 		pos += pac->pac_info_len;
919 
920 		pac = pac->next;
921 		count++;
922 	}
923 
924 	if (eap_fast_write_pac(sm, pac_file, (char *) buf, len)) {
925 		os_free(buf);
926 		return -1;
927 	}
928 
929 	wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %lu PAC entries into '%s' "
930 		   "(bin)", (unsigned long) count, pac_file);
931 
932 	return 0;
933 }
934