1 /* 2 * EAP peer method: EAP-FAST PAC file processing 3 * Copyright (c) 2004-2006, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "eap_config.h" 13 #include "eap_i.h" 14 #include "eap_fast_pac.h" 15 16 /* TODO: encrypt PAC-Key in the PAC file */ 17 18 19 /* Text data format */ 20 static const char *pac_file_hdr = 21 "wpa_supplicant EAP-FAST PAC file - version 1"; 22 23 /* 24 * Binary data format 25 * 4-octet magic value: 6A E4 92 0C 26 * 2-octet version (big endian) 27 * <version specific data> 28 * 29 * version=0: 30 * Sequence of PAC entries: 31 * 2-octet PAC-Type (big endian) 32 * 32-octet PAC-Key 33 * 2-octet PAC-Opaque length (big endian) 34 * <variable len> PAC-Opaque data (length bytes) 35 * 2-octet PAC-Info length (big endian) 36 * <variable len> PAC-Info data (length bytes) 37 */ 38 39 #define EAP_FAST_PAC_BINARY_MAGIC 0x6ae4920c 40 #define EAP_FAST_PAC_BINARY_FORMAT_VERSION 0 41 42 43 /** 44 * eap_fast_free_pac - Free PAC data 45 * @pac: Pointer to the PAC entry 46 * 47 * Note that the PAC entry must not be in a list since this function does not 48 * remove the list links. 49 */ 50 void eap_fast_free_pac(struct eap_fast_pac *pac) 51 { 52 os_free(pac->pac_opaque); 53 os_free(pac->pac_info); 54 os_free(pac->a_id); 55 os_free(pac->i_id); 56 os_free(pac->a_id_info); 57 os_free(pac); 58 } 59 60 61 /** 62 * eap_fast_get_pac - Get a PAC entry based on A-ID 63 * @pac_root: Pointer to root of the PAC list 64 * @a_id: A-ID to search for 65 * @a_id_len: Length of A-ID 66 * @pac_type: PAC-Type to search for 67 * Returns: Pointer to the PAC entry, or %NULL if A-ID not found 68 */ 69 struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_pac *pac_root, 70 const u8 *a_id, size_t a_id_len, 71 u16 pac_type) 72 { 73 struct eap_fast_pac *pac = pac_root; 74 75 while (pac) { 76 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len && 77 os_memcmp(pac->a_id, a_id, a_id_len) == 0) { 78 return pac; 79 } 80 pac = pac->next; 81 } 82 return NULL; 83 } 84 85 86 static void eap_fast_remove_pac(struct eap_fast_pac **pac_root, 87 struct eap_fast_pac **pac_current, 88 const u8 *a_id, size_t a_id_len, u16 pac_type) 89 { 90 struct eap_fast_pac *pac, *prev; 91 92 pac = *pac_root; 93 prev = NULL; 94 95 while (pac) { 96 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len && 97 os_memcmp(pac->a_id, a_id, a_id_len) == 0) { 98 if (prev == NULL) 99 *pac_root = pac->next; 100 else 101 prev->next = pac->next; 102 if (*pac_current == pac) 103 *pac_current = NULL; 104 eap_fast_free_pac(pac); 105 break; 106 } 107 prev = pac; 108 pac = pac->next; 109 } 110 } 111 112 113 static int eap_fast_copy_buf(u8 **dst, size_t *dst_len, 114 const u8 *src, size_t src_len) 115 { 116 if (src) { 117 *dst = os_memdup(src, src_len); 118 if (*dst == NULL) 119 return -1; 120 *dst_len = src_len; 121 } 122 return 0; 123 } 124 125 126 /** 127 * eap_fast_add_pac - Add a copy of a PAC entry to a list 128 * @pac_root: Pointer to PAC list root pointer 129 * @pac_current: Pointer to the current PAC pointer 130 * @entry: New entry to clone and add to the list 131 * Returns: 0 on success, -1 on failure 132 * 133 * This function makes a clone of the given PAC entry and adds this copied 134 * entry to the list (pac_root). If an old entry for the same A-ID is found, 135 * it will be removed from the PAC list and in this case, pac_current entry 136 * is set to %NULL if it was the removed entry. 137 */ 138 int eap_fast_add_pac(struct eap_fast_pac **pac_root, 139 struct eap_fast_pac **pac_current, 140 struct eap_fast_pac *entry) 141 { 142 struct eap_fast_pac *pac; 143 144 if (entry == NULL || entry->a_id == NULL) 145 return -1; 146 147 /* Remove a possible old entry for the matching A-ID. */ 148 eap_fast_remove_pac(pac_root, pac_current, 149 entry->a_id, entry->a_id_len, entry->pac_type); 150 151 /* Allocate a new entry and add it to the list of PACs. */ 152 pac = os_zalloc(sizeof(*pac)); 153 if (pac == NULL) 154 return -1; 155 156 pac->pac_type = entry->pac_type; 157 os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN); 158 if (eap_fast_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len, 159 entry->pac_opaque, entry->pac_opaque_len) < 0 || 160 eap_fast_copy_buf(&pac->pac_info, &pac->pac_info_len, 161 entry->pac_info, entry->pac_info_len) < 0 || 162 eap_fast_copy_buf(&pac->a_id, &pac->a_id_len, 163 entry->a_id, entry->a_id_len) < 0 || 164 eap_fast_copy_buf(&pac->i_id, &pac->i_id_len, 165 entry->i_id, entry->i_id_len) < 0 || 166 eap_fast_copy_buf(&pac->a_id_info, &pac->a_id_info_len, 167 entry->a_id_info, entry->a_id_info_len) < 0) { 168 eap_fast_free_pac(pac); 169 return -1; 170 } 171 172 pac->next = *pac_root; 173 *pac_root = pac; 174 175 return 0; 176 } 177 178 179 struct eap_fast_read_ctx { 180 FILE *f; 181 const char *pos; 182 const char *end; 183 int line; 184 char *buf; 185 size_t buf_len; 186 }; 187 188 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char **value) 189 { 190 char *pos; 191 192 rc->line++; 193 if (rc->f) { 194 if (fgets(rc->buf, rc->buf_len, rc->f) == NULL) 195 return -1; 196 } else { 197 const char *l_end; 198 size_t len; 199 if (rc->pos >= rc->end) 200 return -1; 201 l_end = rc->pos; 202 while (l_end < rc->end && *l_end != '\n') 203 l_end++; 204 len = l_end - rc->pos; 205 if (len >= rc->buf_len) 206 len = rc->buf_len - 1; 207 os_memcpy(rc->buf, rc->pos, len); 208 rc->buf[len] = '\0'; 209 rc->pos = l_end + 1; 210 } 211 212 rc->buf[rc->buf_len - 1] = '\0'; 213 pos = rc->buf; 214 while (*pos != '\0') { 215 if (*pos == '\n' || *pos == '\r') { 216 *pos = '\0'; 217 break; 218 } 219 pos++; 220 } 221 222 pos = os_strchr(rc->buf, '='); 223 if (pos) 224 *pos++ = '\0'; 225 *value = pos; 226 227 return 0; 228 } 229 230 231 static u8 * eap_fast_parse_hex(const char *value, size_t *len) 232 { 233 int hlen; 234 u8 *buf; 235 236 if (value == NULL) 237 return NULL; 238 hlen = os_strlen(value); 239 if (hlen & 1) 240 return NULL; 241 *len = hlen / 2; 242 buf = os_malloc(*len); 243 if (buf == NULL) 244 return NULL; 245 if (hexstr2bin(value, buf, *len)) { 246 os_free(buf); 247 return NULL; 248 } 249 return buf; 250 } 251 252 253 static int eap_fast_init_pac_data(struct eap_sm *sm, const char *pac_file, 254 struct eap_fast_read_ctx *rc) 255 { 256 os_memset(rc, 0, sizeof(*rc)); 257 258 rc->buf_len = 2048; 259 rc->buf = os_malloc(rc->buf_len); 260 if (rc->buf == NULL) 261 return -1; 262 263 if (os_strncmp(pac_file, "blob://", 7) == 0) { 264 const struct wpa_config_blob *blob; 265 blob = eap_get_config_blob(sm, pac_file + 7); 266 if (blob == NULL) { 267 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - " 268 "assume no PAC entries have been " 269 "provisioned", pac_file + 7); 270 os_free(rc->buf); 271 return -1; 272 } 273 rc->pos = (char *) blob->data; 274 rc->end = (char *) blob->data + blob->len; 275 } else { 276 rc->f = fopen(pac_file, "rb"); 277 if (rc->f == NULL) { 278 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - " 279 "assume no PAC entries have been " 280 "provisioned", pac_file); 281 os_free(rc->buf); 282 return -1; 283 } 284 } 285 286 return 0; 287 } 288 289 290 static void eap_fast_deinit_pac_data(struct eap_fast_read_ctx *rc) 291 { 292 os_free(rc->buf); 293 if (rc->f) 294 fclose(rc->f); 295 } 296 297 298 static const char * eap_fast_parse_start(struct eap_fast_pac **pac) 299 { 300 if (*pac) 301 return "START line without END"; 302 303 *pac = os_zalloc(sizeof(struct eap_fast_pac)); 304 if (*pac == NULL) 305 return "No memory for PAC entry"; 306 (*pac)->pac_type = PAC_TYPE_TUNNEL_PAC; 307 return NULL; 308 } 309 310 311 static const char * eap_fast_parse_end(struct eap_fast_pac **pac_root, 312 struct eap_fast_pac **pac) 313 { 314 if (*pac == NULL) 315 return "END line without START"; 316 if (*pac_root) { 317 struct eap_fast_pac *end = *pac_root; 318 while (end->next) 319 end = end->next; 320 end->next = *pac; 321 } else 322 *pac_root = *pac; 323 324 *pac = NULL; 325 return NULL; 326 } 327 328 329 static const char * eap_fast_parse_pac_type(struct eap_fast_pac *pac, 330 char *pos) 331 { 332 if (!pos) 333 return "Cannot parse pac type"; 334 pac->pac_type = atoi(pos); 335 if (pac->pac_type != PAC_TYPE_TUNNEL_PAC && 336 pac->pac_type != PAC_TYPE_USER_AUTHORIZATION && 337 pac->pac_type != PAC_TYPE_MACHINE_AUTHENTICATION) 338 return "Unrecognized PAC-Type"; 339 340 return NULL; 341 } 342 343 344 static const char * eap_fast_parse_pac_key(struct eap_fast_pac *pac, char *pos) 345 { 346 u8 *key; 347 size_t key_len; 348 349 key = eap_fast_parse_hex(pos, &key_len); 350 if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) { 351 os_free(key); 352 return "Invalid PAC-Key"; 353 } 354 355 os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN); 356 os_free(key); 357 358 return NULL; 359 } 360 361 362 static const char * eap_fast_parse_pac_opaque(struct eap_fast_pac *pac, 363 char *pos) 364 { 365 os_free(pac->pac_opaque); 366 pac->pac_opaque = eap_fast_parse_hex(pos, &pac->pac_opaque_len); 367 if (pac->pac_opaque == NULL) 368 return "Invalid PAC-Opaque"; 369 return NULL; 370 } 371 372 373 static const char * eap_fast_parse_a_id(struct eap_fast_pac *pac, char *pos) 374 { 375 os_free(pac->a_id); 376 pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len); 377 if (pac->a_id == NULL) 378 return "Invalid A-ID"; 379 return NULL; 380 } 381 382 383 static const char * eap_fast_parse_i_id(struct eap_fast_pac *pac, char *pos) 384 { 385 os_free(pac->i_id); 386 pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len); 387 if (pac->i_id == NULL) 388 return "Invalid I-ID"; 389 return NULL; 390 } 391 392 393 static const char * eap_fast_parse_a_id_info(struct eap_fast_pac *pac, 394 char *pos) 395 { 396 os_free(pac->a_id_info); 397 pac->a_id_info = eap_fast_parse_hex(pos, &pac->a_id_info_len); 398 if (pac->a_id_info == NULL) 399 return "Invalid A-ID-Info"; 400 return NULL; 401 } 402 403 404 /** 405 * eap_fast_load_pac - Load PAC entries (text format) 406 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 407 * @pac_root: Pointer to root of the PAC list (to be filled) 408 * @pac_file: Name of the PAC file/blob to load 409 * Returns: 0 on success, -1 on failure 410 */ 411 int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_pac **pac_root, 412 const char *pac_file) 413 { 414 struct eap_fast_read_ctx rc; 415 struct eap_fast_pac *pac = NULL; 416 int count = 0; 417 char *pos; 418 const char *err = NULL; 419 420 if (pac_file == NULL) 421 return -1; 422 423 if (eap_fast_init_pac_data(sm, pac_file, &rc) < 0) 424 return 0; 425 426 if (eap_fast_read_line(&rc, &pos) < 0) { 427 /* empty file - assume it is fine to overwrite */ 428 eap_fast_deinit_pac_data(&rc); 429 return 0; 430 } 431 if (os_strcmp(pac_file_hdr, rc.buf) != 0) 432 err = "Unrecognized header line"; 433 434 while (!err && eap_fast_read_line(&rc, &pos) == 0) { 435 if (os_strcmp(rc.buf, "START") == 0) 436 err = eap_fast_parse_start(&pac); 437 else if (os_strcmp(rc.buf, "END") == 0) { 438 err = eap_fast_parse_end(pac_root, &pac); 439 count++; 440 } else if (!pac) 441 err = "Unexpected line outside START/END block"; 442 else if (os_strcmp(rc.buf, "PAC-Type") == 0) 443 err = eap_fast_parse_pac_type(pac, pos); 444 else if (os_strcmp(rc.buf, "PAC-Key") == 0) 445 err = eap_fast_parse_pac_key(pac, pos); 446 else if (os_strcmp(rc.buf, "PAC-Opaque") == 0) 447 err = eap_fast_parse_pac_opaque(pac, pos); 448 else if (os_strcmp(rc.buf, "A-ID") == 0) 449 err = eap_fast_parse_a_id(pac, pos); 450 else if (os_strcmp(rc.buf, "I-ID") == 0) 451 err = eap_fast_parse_i_id(pac, pos); 452 else if (os_strcmp(rc.buf, "A-ID-Info") == 0) 453 err = eap_fast_parse_a_id_info(pac, pos); 454 } 455 456 if (pac) { 457 if (!err) 458 err = "PAC block not terminated with END"; 459 eap_fast_free_pac(pac); 460 } 461 462 eap_fast_deinit_pac_data(&rc); 463 464 if (err) { 465 wpa_printf(MSG_INFO, "EAP-FAST: %s in '%s:%d'", 466 err, pac_file, rc.line); 467 return -1; 468 } 469 470 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %d PAC entries from '%s'", 471 count, pac_file); 472 473 return 0; 474 } 475 476 477 static void eap_fast_write(char **buf, char **pos, size_t *buf_len, 478 const char *field, const u8 *data, 479 size_t len, int txt) 480 { 481 size_t i, need; 482 int ret; 483 char *end; 484 485 if (data == NULL || buf == NULL || *buf == NULL || 486 pos == NULL || *pos == NULL || *pos < *buf) 487 return; 488 489 need = os_strlen(field) + len * 2 + 30; 490 if (txt) 491 need += os_strlen(field) + len + 20; 492 493 if (*pos - *buf + need > *buf_len) { 494 char *nbuf = os_realloc(*buf, *buf_len + need); 495 if (nbuf == NULL) { 496 os_free(*buf); 497 *buf = NULL; 498 return; 499 } 500 *pos = nbuf + (*pos - *buf); 501 *buf = nbuf; 502 *buf_len += need; 503 } 504 end = *buf + *buf_len; 505 506 ret = os_snprintf(*pos, end - *pos, "%s=", field); 507 if (os_snprintf_error(end - *pos, ret)) 508 return; 509 *pos += ret; 510 *pos += wpa_snprintf_hex(*pos, end - *pos, data, len); 511 ret = os_snprintf(*pos, end - *pos, "\n"); 512 if (os_snprintf_error(end - *pos, ret)) 513 return; 514 *pos += ret; 515 516 if (txt) { 517 ret = os_snprintf(*pos, end - *pos, "%s-txt=", field); 518 if (os_snprintf_error(end - *pos, ret)) 519 return; 520 *pos += ret; 521 for (i = 0; i < len; i++) { 522 ret = os_snprintf(*pos, end - *pos, "%c", data[i]); 523 if (os_snprintf_error(end - *pos, ret)) 524 return; 525 *pos += ret; 526 } 527 ret = os_snprintf(*pos, end - *pos, "\n"); 528 if (os_snprintf_error(end - *pos, ret)) 529 return; 530 *pos += ret; 531 } 532 } 533 534 535 static int eap_fast_write_pac(struct eap_sm *sm, const char *pac_file, 536 char *buf, size_t len) 537 { 538 if (os_strncmp(pac_file, "blob://", 7) == 0) { 539 struct wpa_config_blob *blob; 540 blob = os_zalloc(sizeof(*blob)); 541 if (blob == NULL) 542 return -1; 543 blob->data = (u8 *) buf; 544 blob->len = len; 545 buf = NULL; 546 blob->name = os_strdup(pac_file + 7); 547 if (blob->name == NULL) { 548 os_free(blob); 549 return -1; 550 } 551 eap_set_config_blob(sm, blob); 552 } else { 553 FILE *f; 554 f = fopen(pac_file, "wb"); 555 if (f == NULL) { 556 wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC " 557 "file '%s' for writing", pac_file); 558 return -1; 559 } 560 if (fwrite(buf, 1, len, f) != len) { 561 wpa_printf(MSG_INFO, "EAP-FAST: Failed to write all " 562 "PACs into '%s'", pac_file); 563 fclose(f); 564 return -1; 565 } 566 os_free(buf); 567 fclose(f); 568 } 569 570 return 0; 571 } 572 573 574 static int eap_fast_add_pac_data(struct eap_fast_pac *pac, char **buf, 575 char **pos, size_t *buf_len) 576 { 577 int ret; 578 579 ret = os_snprintf(*pos, *buf + *buf_len - *pos, 580 "START\nPAC-Type=%d\n", pac->pac_type); 581 if (os_snprintf_error(*buf + *buf_len - *pos, ret)) 582 return -1; 583 584 *pos += ret; 585 eap_fast_write(buf, pos, buf_len, "PAC-Key", 586 pac->pac_key, EAP_FAST_PAC_KEY_LEN, 0); 587 eap_fast_write(buf, pos, buf_len, "PAC-Opaque", 588 pac->pac_opaque, pac->pac_opaque_len, 0); 589 eap_fast_write(buf, pos, buf_len, "PAC-Info", 590 pac->pac_info, pac->pac_info_len, 0); 591 eap_fast_write(buf, pos, buf_len, "A-ID", 592 pac->a_id, pac->a_id_len, 0); 593 eap_fast_write(buf, pos, buf_len, "I-ID", 594 pac->i_id, pac->i_id_len, 1); 595 eap_fast_write(buf, pos, buf_len, "A-ID-Info", 596 pac->a_id_info, pac->a_id_info_len, 1); 597 if (*buf == NULL) { 598 wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC " 599 "data"); 600 return -1; 601 } 602 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n"); 603 if (os_snprintf_error(*buf + *buf_len - *pos, ret)) 604 return -1; 605 *pos += ret; 606 607 return 0; 608 } 609 610 611 /** 612 * eap_fast_save_pac - Save PAC entries (text format) 613 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 614 * @pac_root: Root of the PAC list 615 * @pac_file: Name of the PAC file/blob 616 * Returns: 0 on success, -1 on failure 617 */ 618 int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_pac *pac_root, 619 const char *pac_file) 620 { 621 struct eap_fast_pac *pac; 622 int ret, count = 0; 623 char *buf, *pos; 624 size_t buf_len; 625 626 if (pac_file == NULL) 627 return -1; 628 629 buf_len = 1024; 630 pos = buf = os_malloc(buf_len); 631 if (buf == NULL) 632 return -1; 633 634 ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr); 635 if (os_snprintf_error(buf + buf_len - pos, ret)) { 636 os_free(buf); 637 return -1; 638 } 639 pos += ret; 640 641 pac = pac_root; 642 while (pac) { 643 if (eap_fast_add_pac_data(pac, &buf, &pos, &buf_len)) { 644 os_free(buf); 645 return -1; 646 } 647 count++; 648 pac = pac->next; 649 } 650 651 if (eap_fast_write_pac(sm, pac_file, buf, pos - buf)) { 652 os_free(buf); 653 return -1; 654 } 655 656 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %d PAC entries into '%s'", 657 count, pac_file); 658 659 return 0; 660 } 661 662 663 /** 664 * eap_fast_pac_list_truncate - Truncate a PAC list to the given length 665 * @pac_root: Root of the PAC list 666 * @max_len: Maximum length of the list (>= 1) 667 * Returns: Number of PAC entries removed 668 */ 669 size_t eap_fast_pac_list_truncate(struct eap_fast_pac *pac_root, 670 size_t max_len) 671 { 672 struct eap_fast_pac *pac, *prev; 673 size_t count; 674 675 pac = pac_root; 676 prev = NULL; 677 count = 0; 678 679 while (pac) { 680 count++; 681 if (count > max_len) 682 break; 683 prev = pac; 684 pac = pac->next; 685 } 686 687 if (count <= max_len || prev == NULL) 688 return 0; 689 690 count = 0; 691 prev->next = NULL; 692 693 while (pac) { 694 prev = pac; 695 pac = pac->next; 696 eap_fast_free_pac(prev); 697 count++; 698 } 699 700 return count; 701 } 702 703 704 static void eap_fast_pac_get_a_id(struct eap_fast_pac *pac) 705 { 706 u8 *pos, *end; 707 u16 type, len; 708 709 pos = pac->pac_info; 710 end = pos + pac->pac_info_len; 711 712 while (end - pos > 4) { 713 type = WPA_GET_BE16(pos); 714 pos += 2; 715 len = WPA_GET_BE16(pos); 716 pos += 2; 717 if (len > (unsigned int) (end - pos)) 718 break; 719 720 if (type == PAC_TYPE_A_ID) { 721 os_free(pac->a_id); 722 pac->a_id = os_memdup(pos, len); 723 if (pac->a_id == NULL) 724 break; 725 pac->a_id_len = len; 726 } 727 728 if (type == PAC_TYPE_A_ID_INFO) { 729 os_free(pac->a_id_info); 730 pac->a_id_info = os_memdup(pos, len); 731 if (pac->a_id_info == NULL) 732 break; 733 pac->a_id_info_len = len; 734 } 735 736 pos += len; 737 } 738 } 739 740 741 /** 742 * eap_fast_load_pac_bin - Load PAC entries (binary format) 743 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 744 * @pac_root: Pointer to root of the PAC list (to be filled) 745 * @pac_file: Name of the PAC file/blob to load 746 * Returns: 0 on success, -1 on failure 747 */ 748 int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root, 749 const char *pac_file) 750 { 751 const struct wpa_config_blob *blob = NULL; 752 u8 *buf, *end, *pos; 753 size_t len, count = 0; 754 struct eap_fast_pac *pac, *prev; 755 756 *pac_root = NULL; 757 758 if (pac_file == NULL) 759 return -1; 760 761 if (os_strncmp(pac_file, "blob://", 7) == 0) { 762 blob = eap_get_config_blob(sm, pac_file + 7); 763 if (blob == NULL) { 764 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - " 765 "assume no PAC entries have been " 766 "provisioned", pac_file + 7); 767 return 0; 768 } 769 buf = blob->data; 770 len = blob->len; 771 } else { 772 buf = (u8 *) os_readfile(pac_file, &len); 773 if (buf == NULL) { 774 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - " 775 "assume no PAC entries have been " 776 "provisioned", pac_file); 777 return 0; 778 } 779 } 780 781 if (len == 0) { 782 if (blob == NULL) 783 os_free(buf); 784 return 0; 785 } 786 787 if (len < 6 || WPA_GET_BE32(buf) != EAP_FAST_PAC_BINARY_MAGIC || 788 WPA_GET_BE16(buf + 4) != EAP_FAST_PAC_BINARY_FORMAT_VERSION) { 789 wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC file '%s' (bin)", 790 pac_file); 791 if (blob == NULL) 792 os_free(buf); 793 return -1; 794 } 795 796 pac = prev = NULL; 797 pos = buf + 6; 798 end = buf + len; 799 while (pos < end) { 800 u16 val; 801 802 if (end - pos < 2 + EAP_FAST_PAC_KEY_LEN + 2 + 2) { 803 pac = NULL; 804 goto parse_fail; 805 } 806 807 pac = os_zalloc(sizeof(*pac)); 808 if (pac == NULL) 809 goto parse_fail; 810 811 pac->pac_type = WPA_GET_BE16(pos); 812 pos += 2; 813 os_memcpy(pac->pac_key, pos, EAP_FAST_PAC_KEY_LEN); 814 pos += EAP_FAST_PAC_KEY_LEN; 815 val = WPA_GET_BE16(pos); 816 pos += 2; 817 if (val > end - pos) 818 goto parse_fail; 819 pac->pac_opaque_len = val; 820 pac->pac_opaque = os_memdup(pos, pac->pac_opaque_len); 821 if (pac->pac_opaque == NULL) 822 goto parse_fail; 823 pos += pac->pac_opaque_len; 824 if (2 > end - pos) 825 goto parse_fail; 826 val = WPA_GET_BE16(pos); 827 pos += 2; 828 if (val > end - pos) 829 goto parse_fail; 830 pac->pac_info_len = val; 831 pac->pac_info = os_memdup(pos, pac->pac_info_len); 832 if (pac->pac_info == NULL) 833 goto parse_fail; 834 pos += pac->pac_info_len; 835 eap_fast_pac_get_a_id(pac); 836 837 count++; 838 if (prev) 839 prev->next = pac; 840 else 841 *pac_root = pac; 842 prev = pac; 843 } 844 845 if (blob == NULL) 846 os_free(buf); 847 848 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %lu PAC entries from '%s' (bin)", 849 (unsigned long) count, pac_file); 850 851 return 0; 852 853 parse_fail: 854 wpa_printf(MSG_INFO, "EAP-FAST: Failed to parse PAC file '%s' (bin)", 855 pac_file); 856 if (blob == NULL) 857 os_free(buf); 858 if (pac) 859 eap_fast_free_pac(pac); 860 return -1; 861 } 862 863 864 /** 865 * eap_fast_save_pac_bin - Save PAC entries (binary format) 866 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 867 * @pac_root: Root of the PAC list 868 * @pac_file: Name of the PAC file/blob 869 * Returns: 0 on success, -1 on failure 870 */ 871 int eap_fast_save_pac_bin(struct eap_sm *sm, struct eap_fast_pac *pac_root, 872 const char *pac_file) 873 { 874 size_t len, count = 0; 875 struct eap_fast_pac *pac; 876 u8 *buf, *pos; 877 878 len = 6; 879 pac = pac_root; 880 while (pac) { 881 if (pac->pac_opaque_len > 65535 || 882 pac->pac_info_len > 65535) 883 return -1; 884 len += 2 + EAP_FAST_PAC_KEY_LEN + 2 + pac->pac_opaque_len + 885 2 + pac->pac_info_len; 886 pac = pac->next; 887 } 888 889 buf = os_malloc(len); 890 if (buf == NULL) 891 return -1; 892 893 pos = buf; 894 WPA_PUT_BE32(pos, EAP_FAST_PAC_BINARY_MAGIC); 895 pos += 4; 896 WPA_PUT_BE16(pos, EAP_FAST_PAC_BINARY_FORMAT_VERSION); 897 pos += 2; 898 899 pac = pac_root; 900 while (pac) { 901 WPA_PUT_BE16(pos, pac->pac_type); 902 pos += 2; 903 os_memcpy(pos, pac->pac_key, EAP_FAST_PAC_KEY_LEN); 904 pos += EAP_FAST_PAC_KEY_LEN; 905 WPA_PUT_BE16(pos, pac->pac_opaque_len); 906 pos += 2; 907 os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len); 908 pos += pac->pac_opaque_len; 909 WPA_PUT_BE16(pos, pac->pac_info_len); 910 pos += 2; 911 os_memcpy(pos, pac->pac_info, pac->pac_info_len); 912 pos += pac->pac_info_len; 913 914 pac = pac->next; 915 count++; 916 } 917 918 if (eap_fast_write_pac(sm, pac_file, (char *) buf, len)) { 919 os_free(buf); 920 return -1; 921 } 922 923 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %lu PAC entries into '%s' " 924 "(bin)", (unsigned long) count, pac_file); 925 926 return 0; 927 } 928
