1/* 2 * EAP peer method: EAP-FAST PAC file processing 3 * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "includes.h" 10 11#include "common.h" 12#include "eap_config.h" 13#include "eap_i.h" 14#include "eap_fast_pac.h" 15 16/* TODO: encrypt PAC-Key in the PAC file */ 17 18 19/* Text data format */ 20static const char *pac_file_hdr = 21 "wpa_supplicant EAP-FAST PAC file - version 1"; 22 23/* 24 * Binary data format 25 * 4-octet magic value: 6A E4 92 0C 26 * 2-octet version (big endian) 27 * <version specific data> 28 * 29 * version=0: 30 * Sequence of PAC entries: 31 * 2-octet PAC-Type (big endian) 32 * 32-octet PAC-Key 33 * 2-octet PAC-Opaque length (big endian) 34 * <variable len> PAC-Opaque data (length bytes) 35 * 2-octet PAC-Info length (big endian) 36 * <variable len> PAC-Info data (length bytes) 37 */ 38 39#define EAP_FAST_PAC_BINARY_MAGIC 0x6ae4920c 40#define EAP_FAST_PAC_BINARY_FORMAT_VERSION 0 41 42 43/** 44 * eap_fast_free_pac - Free PAC data 45 * @pac: Pointer to the PAC entry 46 * 47 * Note that the PAC entry must not be in a list since this function does not 48 * remove the list links. 49 */ 50void eap_fast_free_pac(struct eap_fast_pac *pac) 51{ 52 os_free(pac->pac_opaque); 53 os_free(pac->pac_info); 54 os_free(pac->a_id); 55 os_free(pac->i_id); 56 os_free(pac->a_id_info); 57 os_free(pac); 58} 59 60 61/** 62 * eap_fast_get_pac - Get a PAC entry based on A-ID 63 * @pac_root: Pointer to root of the PAC list 64 * @a_id: A-ID to search for 65 * @a_id_len: Length of A-ID 66 * @pac_type: PAC-Type to search for 67 * Returns: Pointer to the PAC entry, or %NULL if A-ID not found 68 */ 69struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_pac *pac_root, 70 const u8 *a_id, size_t a_id_len, 71 u16 pac_type) 72{ 73 struct eap_fast_pac *pac = pac_root; 74 75 while (pac) { 76 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len && 77 os_memcmp(pac->a_id, a_id, a_id_len) == 0) { 78 return pac; 79 } 80 pac = pac->next; 81 } 82 return NULL; 83} 84 85 86static void eap_fast_remove_pac(struct eap_fast_pac **pac_root, 87 struct eap_fast_pac **pac_current, 88 const u8 *a_id, size_t a_id_len, u16 pac_type) 89{ 90 struct eap_fast_pac *pac, *prev; 91 92 pac = *pac_root; 93 prev = NULL; 94 95 while (pac) { 96 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len && 97 os_memcmp(pac->a_id, a_id, a_id_len) == 0) { 98 if (prev == NULL) 99 *pac_root = pac->next; 100 else 101 prev->next = pac->next; 102 if (*pac_current == pac) 103 *pac_current = NULL; 104 eap_fast_free_pac(pac); 105 break; 106 } 107 prev = pac; 108 pac = pac->next; 109 } 110} 111 112 113static int eap_fast_copy_buf(u8 **dst, size_t *dst_len, 114 const u8 *src, size_t src_len) 115{ 116 if (src) { 117 *dst = os_malloc(src_len); 118 if (*dst == NULL) 119 return -1; 120 os_memcpy(*dst, src, src_len); 121 *dst_len = src_len; 122 } 123 return 0; 124} 125 126 127/** 128 * eap_fast_add_pac - Add a copy of a PAC entry to a list 129 * @pac_root: Pointer to PAC list root pointer 130 * @pac_current: Pointer to the current PAC pointer 131 * @entry: New entry to clone and add to the list 132 * Returns: 0 on success, -1 on failure 133 * 134 * This function makes a clone of the given PAC entry and adds this copied 135 * entry to the list (pac_root). If an old entry for the same A-ID is found, 136 * it will be removed from the PAC list and in this case, pac_current entry 137 * is set to %NULL if it was the removed entry. 138 */ 139int eap_fast_add_pac(struct eap_fast_pac **pac_root, 140 struct eap_fast_pac **pac_current, 141 struct eap_fast_pac *entry) 142{ 143 struct eap_fast_pac *pac; 144 145 if (entry == NULL || entry->a_id == NULL) 146 return -1; 147 148 /* Remove a possible old entry for the matching A-ID. */ 149 eap_fast_remove_pac(pac_root, pac_current, 150 entry->a_id, entry->a_id_len, entry->pac_type); 151 152 /* Allocate a new entry and add it to the list of PACs. */ 153 pac = os_zalloc(sizeof(*pac)); 154 if (pac == NULL) 155 return -1; 156 157 pac->pac_type = entry->pac_type; 158 os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN); 159 if (eap_fast_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len, 160 entry->pac_opaque, entry->pac_opaque_len) < 0 || 161 eap_fast_copy_buf(&pac->pac_info, &pac->pac_info_len, 162 entry->pac_info, entry->pac_info_len) < 0 || 163 eap_fast_copy_buf(&pac->a_id, &pac->a_id_len, 164 entry->a_id, entry->a_id_len) < 0 || 165 eap_fast_copy_buf(&pac->i_id, &pac->i_id_len, 166 entry->i_id, entry->i_id_len) < 0 || 167 eap_fast_copy_buf(&pac->a_id_info, &pac->a_id_info_len, 168 entry->a_id_info, entry->a_id_info_len) < 0) { 169 eap_fast_free_pac(pac); 170 return -1; 171 } 172 173 pac->next = *pac_root; 174 *pac_root = pac; 175 176 return 0; 177} 178 179 180struct eap_fast_read_ctx { 181 FILE *f; 182 const char *pos; 183 const char *end; 184 int line; 185 char *buf; 186 size_t buf_len; 187}; 188 189static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char **value) 190{ 191 char *pos; 192 193 rc->line++; 194 if (rc->f) { 195 if (fgets(rc->buf, rc->buf_len, rc->f) == NULL) 196 return -1; 197 } else { 198 const char *l_end; 199 size_t len; 200 if (rc->pos >= rc->end) 201 return -1; 202 l_end = rc->pos; 203 while (l_end < rc->end && *l_end != '\n') 204 l_end++; 205 len = l_end - rc->pos; 206 if (len >= rc->buf_len) 207 len = rc->buf_len - 1; 208 os_memcpy(rc->buf, rc->pos, len); 209 rc->buf[len] = '\0'; 210 rc->pos = l_end + 1; 211 } 212 213 rc->buf[rc->buf_len - 1] = '\0'; 214 pos = rc->buf; 215 while (*pos != '\0') { 216 if (*pos == '\n' || *pos == '\r') { 217 *pos = '\0'; 218 break; 219 } 220 pos++; 221 } 222 223 pos = os_strchr(rc->buf, '='); 224 if (pos) 225 *pos++ = '\0'; 226 *value = pos; 227 228 return 0; 229} 230 231 232static u8 * eap_fast_parse_hex(const char *value, size_t *len) 233{ 234 int hlen; 235 u8 *buf; 236 237 if (value == NULL) 238 return NULL; 239 hlen = os_strlen(value); 240 if (hlen & 1) 241 return NULL; 242 *len = hlen / 2; 243 buf = os_malloc(*len); 244 if (buf == NULL) 245 return NULL; 246 if (hexstr2bin(value, buf, *len)) { 247 os_free(buf); 248 return NULL; 249 } 250 return buf; 251} 252 253 254static int eap_fast_init_pac_data(struct eap_sm *sm, const char *pac_file, 255 struct eap_fast_read_ctx *rc) 256{ 257 os_memset(rc, 0, sizeof(*rc)); 258 259 rc->buf_len = 2048; 260 rc->buf = os_malloc(rc->buf_len); 261 if (rc->buf == NULL) 262 return -1; 263 264 if (os_strncmp(pac_file, "blob://", 7) == 0) { 265 const struct wpa_config_blob *blob; 266 blob = eap_get_config_blob(sm, pac_file + 7); 267 if (blob == NULL) { 268 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - " 269 "assume no PAC entries have been " 270 "provisioned", pac_file + 7); 271 os_free(rc->buf); 272 return -1; 273 } 274 rc->pos = (char *) blob->data; 275 rc->end = (char *) blob->data + blob->len; 276 } else { 277 rc->f = fopen(pac_file, "rb"); 278 if (rc->f == NULL) { 279 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - " 280 "assume no PAC entries have been " 281 "provisioned", pac_file); 282 os_free(rc->buf); 283 return -1; 284 } 285 } 286 287 return 0; 288} 289 290 291static void eap_fast_deinit_pac_data(struct eap_fast_read_ctx *rc) 292{ 293 os_free(rc->buf); 294 if (rc->f) 295 fclose(rc->f); 296} 297 298 299static const char * eap_fast_parse_start(struct eap_fast_pac **pac) 300{ 301 if (*pac) 302 return "START line without END"; 303 304 *pac = os_zalloc(sizeof(struct eap_fast_pac)); 305 if (*pac == NULL) 306 return "No memory for PAC entry"; 307 (*pac)->pac_type = PAC_TYPE_TUNNEL_PAC; 308 return NULL; 309} 310 311 312static const char * eap_fast_parse_end(struct eap_fast_pac **pac_root, 313 struct eap_fast_pac **pac) 314{ 315 if (*pac == NULL) 316 return "END line without START"; 317 if (*pac_root) { 318 struct eap_fast_pac *end = *pac_root; 319 while (end->next) 320 end = end->next; 321 end->next = *pac; 322 } else 323 *pac_root = *pac; 324 325 *pac = NULL; 326 return NULL; 327} 328 329 330static const char * eap_fast_parse_pac_type(struct eap_fast_pac *pac, 331 char *pos) 332{ 333 if (!pos) 334 return "Cannot parse pac type"; 335 pac->pac_type = atoi(pos); 336 if (pac->pac_type != PAC_TYPE_TUNNEL_PAC && 337 pac->pac_type != PAC_TYPE_USER_AUTHORIZATION && 338 pac->pac_type != PAC_TYPE_MACHINE_AUTHENTICATION) 339 return "Unrecognized PAC-Type"; 340 341 return NULL; 342} 343 344 345static const char * eap_fast_parse_pac_key(struct eap_fast_pac *pac, char *pos) 346{ 347 u8 *key; 348 size_t key_len; 349 350 key = eap_fast_parse_hex(pos, &key_len); 351 if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) { 352 os_free(key); 353 return "Invalid PAC-Key"; 354 } 355 356 os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN); 357 os_free(key); 358 359 return NULL; 360} 361 362 363static const char * eap_fast_parse_pac_opaque(struct eap_fast_pac *pac, 364 char *pos) 365{ 366 os_free(pac->pac_opaque); 367 pac->pac_opaque = eap_fast_parse_hex(pos, &pac->pac_opaque_len); 368 if (pac->pac_opaque == NULL) 369 return "Invalid PAC-Opaque"; 370 return NULL; 371} 372 373 374static const char * eap_fast_parse_a_id(struct eap_fast_pac *pac, char *pos) 375{ 376 os_free(pac->a_id); 377 pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len); 378 if (pac->a_id == NULL) 379 return "Invalid A-ID"; 380 return NULL; 381} 382 383 384static const char * eap_fast_parse_i_id(struct eap_fast_pac *pac, char *pos) 385{ 386 os_free(pac->i_id); 387 pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len); 388 if (pac->i_id == NULL) 389 return "Invalid I-ID"; 390 return NULL; 391} 392 393 394static const char * eap_fast_parse_a_id_info(struct eap_fast_pac *pac, 395 char *pos) 396{ 397 os_free(pac->a_id_info); 398 pac->a_id_info = eap_fast_parse_hex(pos, &pac->a_id_info_len); 399 if (pac->a_id_info == NULL) 400 return "Invalid A-ID-Info"; 401 return NULL; 402} 403 404 405/** 406 * eap_fast_load_pac - Load PAC entries (text format) 407 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 408 * @pac_root: Pointer to root of the PAC list (to be filled) 409 * @pac_file: Name of the PAC file/blob to load 410 * Returns: 0 on success, -1 on failure 411 */ 412int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_pac **pac_root, 413 const char *pac_file) 414{ 415 struct eap_fast_read_ctx rc; 416 struct eap_fast_pac *pac = NULL; 417 int count = 0; 418 char *pos; 419 const char *err = NULL; 420 421 if (pac_file == NULL) 422 return -1; 423 424 if (eap_fast_init_pac_data(sm, pac_file, &rc) < 0) 425 return 0; 426 427 if (eap_fast_read_line(&rc, &pos) < 0) { 428 /* empty file - assume it is fine to overwrite */ 429 eap_fast_deinit_pac_data(&rc); 430 return 0; 431 } 432 if (os_strcmp(pac_file_hdr, rc.buf) != 0) 433 err = "Unrecognized header line"; 434 435 while (!err && eap_fast_read_line(&rc, &pos) == 0) { 436 if (os_strcmp(rc.buf, "START") == 0) 437 err = eap_fast_parse_start(&pac); 438 else if (os_strcmp(rc.buf, "END") == 0) { 439 err = eap_fast_parse_end(pac_root, &pac); 440 count++; 441 } else if (!pac) 442 err = "Unexpected line outside START/END block"; 443 else if (os_strcmp(rc.buf, "PAC-Type") == 0) 444 err = eap_fast_parse_pac_type(pac, pos); 445 else if (os_strcmp(rc.buf, "PAC-Key") == 0) 446 err = eap_fast_parse_pac_key(pac, pos); 447 else if (os_strcmp(rc.buf, "PAC-Opaque") == 0) 448 err = eap_fast_parse_pac_opaque(pac, pos); 449 else if (os_strcmp(rc.buf, "A-ID") == 0) 450 err = eap_fast_parse_a_id(pac, pos); 451 else if (os_strcmp(rc.buf, "I-ID") == 0) 452 err = eap_fast_parse_i_id(pac, pos); 453 else if (os_strcmp(rc.buf, "A-ID-Info") == 0) 454 err = eap_fast_parse_a_id_info(pac, pos); 455 } 456 457 if (pac) { 458 if (!err) 459 err = "PAC block not terminated with END"; 460 eap_fast_free_pac(pac); 461 } 462 463 eap_fast_deinit_pac_data(&rc); 464 465 if (err) { 466 wpa_printf(MSG_INFO, "EAP-FAST: %s in '%s:%d'", 467 err, pac_file, rc.line); 468 return -1; 469 } 470 471 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %d PAC entries from '%s'", 472 count, pac_file); 473 474 return 0; 475} 476 477 478static void eap_fast_write(char **buf, char **pos, size_t *buf_len, 479 const char *field, const u8 *data, 480 size_t len, int txt) 481{ 482 size_t i, need; 483 int ret; 484 char *end; 485 486 if (data == NULL || buf == NULL || *buf == NULL || 487 pos == NULL || *pos == NULL || *pos < *buf) 488 return; 489 490 need = os_strlen(field) + len * 2 + 30; 491 if (txt) 492 need += os_strlen(field) + len + 20; 493 494 if (*pos - *buf + need > *buf_len) { 495 char *nbuf = os_realloc(*buf, *buf_len + need); 496 if (nbuf == NULL) { 497 os_free(*buf); 498 *buf = NULL; 499 return; 500 } 501 *pos = nbuf + (*pos - *buf); 502 *buf = nbuf; 503 *buf_len += need; 504 } 505 end = *buf + *buf_len; 506 507 ret = os_snprintf(*pos, end - *pos, "%s=", field); 508 if (os_snprintf_error(end - *pos, ret)) 509 return; 510 *pos += ret; 511 *pos += wpa_snprintf_hex(*pos, end - *pos, data, len); 512 ret = os_snprintf(*pos, end - *pos, "\n"); 513 if (os_snprintf_error(end - *pos, ret)) 514 return; 515 *pos += ret; 516 517 if (txt) { 518 ret = os_snprintf(*pos, end - *pos, "%s-txt=", field); 519 if (os_snprintf_error(end - *pos, ret)) 520 return; 521 *pos += ret; 522 for (i = 0; i < len; i++) { 523 ret = os_snprintf(*pos, end - *pos, "%c", data[i]); 524 if (os_snprintf_error(end - *pos, ret)) 525 return; 526 *pos += ret; 527 } 528 ret = os_snprintf(*pos, end - *pos, "\n"); 529 if (os_snprintf_error(end - *pos, ret)) 530 return; 531 *pos += ret; 532 } 533} 534 535 536static int eap_fast_write_pac(struct eap_sm *sm, const char *pac_file, 537 char *buf, size_t len) 538{ 539 if (os_strncmp(pac_file, "blob://", 7) == 0) { 540 struct wpa_config_blob *blob; 541 blob = os_zalloc(sizeof(*blob)); 542 if (blob == NULL) 543 return -1; 544 blob->data = (u8 *) buf; 545 blob->len = len; 546 buf = NULL; 547 blob->name = os_strdup(pac_file + 7); 548 if (blob->name == NULL) { 549 os_free(blob); 550 return -1; 551 } 552 eap_set_config_blob(sm, blob); 553 } else { 554 FILE *f; 555 f = fopen(pac_file, "wb"); 556 if (f == NULL) { 557 wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC " 558 "file '%s' for writing", pac_file); 559 return -1; 560 } 561 if (fwrite(buf, 1, len, f) != len) { 562 wpa_printf(MSG_INFO, "EAP-FAST: Failed to write all " 563 "PACs into '%s'", pac_file); 564 fclose(f); 565 return -1; 566 } 567 os_free(buf); 568 fclose(f); 569 } 570 571 return 0; 572} 573 574 575static int eap_fast_add_pac_data(struct eap_fast_pac *pac, char **buf, 576 char **pos, size_t *buf_len) 577{ 578 int ret; 579 580 ret = os_snprintf(*pos, *buf + *buf_len - *pos, 581 "START\nPAC-Type=%d\n", pac->pac_type); 582 if (os_snprintf_error(*buf + *buf_len - *pos, ret)) 583 return -1; 584 585 *pos += ret; 586 eap_fast_write(buf, pos, buf_len, "PAC-Key", 587 pac->pac_key, EAP_FAST_PAC_KEY_LEN, 0); 588 eap_fast_write(buf, pos, buf_len, "PAC-Opaque", 589 pac->pac_opaque, pac->pac_opaque_len, 0); 590 eap_fast_write(buf, pos, buf_len, "PAC-Info", 591 pac->pac_info, pac->pac_info_len, 0); 592 eap_fast_write(buf, pos, buf_len, "A-ID", 593 pac->a_id, pac->a_id_len, 0); 594 eap_fast_write(buf, pos, buf_len, "I-ID", 595 pac->i_id, pac->i_id_len, 1); 596 eap_fast_write(buf, pos, buf_len, "A-ID-Info", 597 pac->a_id_info, pac->a_id_info_len, 1); 598 if (*buf == NULL) { 599 wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC " 600 "data"); 601 return -1; 602 } 603 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n"); 604 if (os_snprintf_error(*buf + *buf_len - *pos, ret)) 605 return -1; 606 *pos += ret; 607 608 return 0; 609} 610 611 612/** 613 * eap_fast_save_pac - Save PAC entries (text format) 614 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 615 * @pac_root: Root of the PAC list 616 * @pac_file: Name of the PAC file/blob 617 * Returns: 0 on success, -1 on failure 618 */ 619int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_pac *pac_root, 620 const char *pac_file) 621{ 622 struct eap_fast_pac *pac; 623 int ret, count = 0; 624 char *buf, *pos; 625 size_t buf_len; 626 627 if (pac_file == NULL) 628 return -1; 629 630 buf_len = 1024; 631 pos = buf = os_malloc(buf_len); 632 if (buf == NULL) 633 return -1; 634 635 ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr); 636 if (os_snprintf_error(buf + buf_len - pos, ret)) { 637 os_free(buf); 638 return -1; 639 } 640 pos += ret; 641 642 pac = pac_root; 643 while (pac) { 644 if (eap_fast_add_pac_data(pac, &buf, &pos, &buf_len)) { 645 os_free(buf); 646 return -1; 647 } 648 count++; 649 pac = pac->next; 650 } 651 652 if (eap_fast_write_pac(sm, pac_file, buf, pos - buf)) { 653 os_free(buf); 654 return -1; 655 } 656 657 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %d PAC entries into '%s'", 658 count, pac_file); 659 660 return 0; 661} 662 663 664/** 665 * eap_fast_pac_list_truncate - Truncate a PAC list to the given length 666 * @pac_root: Root of the PAC list 667 * @max_len: Maximum length of the list (>= 1) 668 * Returns: Number of PAC entries removed 669 */ 670size_t eap_fast_pac_list_truncate(struct eap_fast_pac *pac_root, 671 size_t max_len) 672{ 673 struct eap_fast_pac *pac, *prev; 674 size_t count; 675 676 pac = pac_root; 677 prev = NULL; 678 count = 0; 679 680 while (pac) { 681 count++; 682 if (count > max_len) 683 break; 684 prev = pac; 685 pac = pac->next; 686 } 687 688 if (count <= max_len || prev == NULL) 689 return 0; 690 691 count = 0; 692 prev->next = NULL; 693 694 while (pac) { 695 prev = pac; 696 pac = pac->next; 697 eap_fast_free_pac(prev); 698 count++; 699 } 700 701 return count; 702} 703 704 705static void eap_fast_pac_get_a_id(struct eap_fast_pac *pac) 706{ 707 u8 *pos, *end; 708 u16 type, len; 709 710 pos = pac->pac_info; 711 end = pos + pac->pac_info_len; 712 713 while (end - pos > 4) { 714 type = WPA_GET_BE16(pos); 715 pos += 2; 716 len = WPA_GET_BE16(pos); 717 pos += 2; 718 if (len > (unsigned int) (end - pos)) 719 break; 720 721 if (type == PAC_TYPE_A_ID) { 722 os_free(pac->a_id); 723 pac->a_id = os_malloc(len); 724 if (pac->a_id == NULL) 725 break; 726 os_memcpy(pac->a_id, pos, len); 727 pac->a_id_len = len; 728 } 729 730 if (type == PAC_TYPE_A_ID_INFO) { 731 os_free(pac->a_id_info); 732 pac->a_id_info = os_malloc(len); 733 if (pac->a_id_info == NULL) 734 break; 735 os_memcpy(pac->a_id_info, pos, len); 736 pac->a_id_info_len = len; 737 } 738 739 pos += len; 740 } 741} 742 743 744/** 745 * eap_fast_load_pac_bin - Load PAC entries (binary format) 746 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 747 * @pac_root: Pointer to root of the PAC list (to be filled) 748 * @pac_file: Name of the PAC file/blob to load 749 * Returns: 0 on success, -1 on failure 750 */ 751int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root, 752 const char *pac_file) 753{ 754 const struct wpa_config_blob *blob = NULL; 755 u8 *buf, *end, *pos; 756 size_t len, count = 0; 757 struct eap_fast_pac *pac, *prev; 758 759 *pac_root = NULL; 760 761 if (pac_file == NULL) 762 return -1; 763 764 if (os_strncmp(pac_file, "blob://", 7) == 0) { 765 blob = eap_get_config_blob(sm, pac_file + 7); 766 if (blob == NULL) { 767 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - " 768 "assume no PAC entries have been " 769 "provisioned", pac_file + 7); 770 return 0; 771 } 772 buf = blob->data; 773 len = blob->len; 774 } else { 775 buf = (u8 *) os_readfile(pac_file, &len); 776 if (buf == NULL) { 777 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - " 778 "assume no PAC entries have been " 779 "provisioned", pac_file); 780 return 0; 781 } 782 } 783 784 if (len == 0) { 785 if (blob == NULL) 786 os_free(buf); 787 return 0; 788 } 789 790 if (len < 6 || WPA_GET_BE32(buf) != EAP_FAST_PAC_BINARY_MAGIC || 791 WPA_GET_BE16(buf + 4) != EAP_FAST_PAC_BINARY_FORMAT_VERSION) { 792 wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC file '%s' (bin)", 793 pac_file); 794 if (blob == NULL) 795 os_free(buf); 796 return -1; 797 } 798 799 pac = prev = NULL; 800 pos = buf + 6; 801 end = buf + len; 802 while (pos < end) { 803 u16 val; 804 805 if (end - pos < 2 + EAP_FAST_PAC_KEY_LEN + 2 + 2) { 806 pac = NULL; 807 goto parse_fail; 808 } 809 810 pac = os_zalloc(sizeof(*pac)); 811 if (pac == NULL) 812 goto parse_fail; 813 814 pac->pac_type = WPA_GET_BE16(pos); 815 pos += 2; 816 os_memcpy(pac->pac_key, pos, EAP_FAST_PAC_KEY_LEN); 817 pos += EAP_FAST_PAC_KEY_LEN; 818 val = WPA_GET_BE16(pos); 819 pos += 2; 820 if (val > end - pos) 821 goto parse_fail; 822 pac->pac_opaque_len = val; 823 pac->pac_opaque = os_malloc(pac->pac_opaque_len); 824 if (pac->pac_opaque == NULL) 825 goto parse_fail; 826 os_memcpy(pac->pac_opaque, pos, pac->pac_opaque_len); 827 pos += pac->pac_opaque_len; 828 if (2 > end - pos) 829 goto parse_fail; 830 val = WPA_GET_BE16(pos); 831 pos += 2; 832 if (val > end - pos) 833 goto parse_fail; 834 pac->pac_info_len = val; 835 pac->pac_info = os_malloc(pac->pac_info_len); 836 if (pac->pac_info == NULL) 837 goto parse_fail; 838 os_memcpy(pac->pac_info, pos, pac->pac_info_len); 839 pos += pac->pac_info_len; 840 eap_fast_pac_get_a_id(pac); 841 842 count++; 843 if (prev) 844 prev->next = pac; 845 else 846 *pac_root = pac; 847 prev = pac; 848 } 849 850 if (blob == NULL) 851 os_free(buf); 852 853 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %lu PAC entries from '%s' (bin)", 854 (unsigned long) count, pac_file); 855 856 return 0; 857 858parse_fail: 859 wpa_printf(MSG_INFO, "EAP-FAST: Failed to parse PAC file '%s' (bin)", 860 pac_file); 861 if (blob == NULL) 862 os_free(buf); 863 if (pac) 864 eap_fast_free_pac(pac); 865 return -1; 866} 867 868 869/** 870 * eap_fast_save_pac_bin - Save PAC entries (binary format) 871 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 872 * @pac_root: Root of the PAC list 873 * @pac_file: Name of the PAC file/blob 874 * Returns: 0 on success, -1 on failure 875 */ 876int eap_fast_save_pac_bin(struct eap_sm *sm, struct eap_fast_pac *pac_root, 877 const char *pac_file) 878{ 879 size_t len, count = 0; 880 struct eap_fast_pac *pac; 881 u8 *buf, *pos; 882 883 len = 6; 884 pac = pac_root; 885 while (pac) { 886 if (pac->pac_opaque_len > 65535 || 887 pac->pac_info_len > 65535) 888 return -1; 889 len += 2 + EAP_FAST_PAC_KEY_LEN + 2 + pac->pac_opaque_len + 890 2 + pac->pac_info_len; 891 pac = pac->next; 892 } 893 894 buf = os_malloc(len); 895 if (buf == NULL) 896 return -1; 897 898 pos = buf; 899 WPA_PUT_BE32(pos, EAP_FAST_PAC_BINARY_MAGIC); 900 pos += 4; 901 WPA_PUT_BE16(pos, EAP_FAST_PAC_BINARY_FORMAT_VERSION); 902 pos += 2; 903 904 pac = pac_root; 905 while (pac) { 906 WPA_PUT_BE16(pos, pac->pac_type); 907 pos += 2; 908 os_memcpy(pos, pac->pac_key, EAP_FAST_PAC_KEY_LEN); 909 pos += EAP_FAST_PAC_KEY_LEN; 910 WPA_PUT_BE16(pos, pac->pac_opaque_len); 911 pos += 2; 912 os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len); 913 pos += pac->pac_opaque_len; 914 WPA_PUT_BE16(pos, pac->pac_info_len); 915 pos += 2; 916 os_memcpy(pos, pac->pac_info, pac->pac_info_len); 917 pos += pac->pac_info_len; 918 919 pac = pac->next; 920 count++; 921 } 922 923 if (eap_fast_write_pac(sm, pac_file, (char *) buf, len)) { 924 os_free(buf); 925 return -1; 926 } 927 928 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %lu PAC entries into '%s' " 929 "(bin)", (unsigned long) count, pac_file); 930 931 return 0; 932} 933