1 /*
2  * Hotspot 2.0 OSU client - EST client
3  * Copyright (c) 2012-2014, Qualcomm Atheros, Inc.
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 #include <openssl/err.h>
11 #include <openssl/evp.h>
12 #include <openssl/pem.h>
13 #include <openssl/pkcs7.h>
14 #include <openssl/rsa.h>
15 #include <openssl/asn1.h>
16 #include <openssl/asn1t.h>
17 #include <openssl/x509.h>
18 #include <openssl/x509v3.h>
19 #include <openssl/opensslv.h>
20 #ifdef OPENSSL_IS_BORINGSSL
21 #include <openssl/buf.h>
22 #endif /* OPENSSL_IS_BORINGSSL */
23 
24 #include "common.h"
25 #include "utils/base64.h"
26 #include "utils/xml-utils.h"
27 #include "utils/http-utils.h"
28 #include "osu_client.h"
29 
30 
pkcs7_to_cert(struct hs20_osu_client * ctx,const u8 * pkcs7,size_t len,char * pem_file,char * der_file)31 static int pkcs7_to_cert(struct hs20_osu_client *ctx, const u8 *pkcs7,
32 			 size_t len, char *pem_file, char *der_file)
33 {
34 #ifdef OPENSSL_IS_BORINGSSL
35 	CBS pkcs7_cbs;
36 #else /* OPENSSL_IS_BORINGSSL */
37 	PKCS7 *p7 = NULL;
38 	const unsigned char *p = pkcs7;
39 #endif /* OPENSSL_IS_BORINGSSL */
40 	STACK_OF(X509) *certs;
41 	int i, num, ret = -1;
42 	BIO *out = NULL;
43 
44 #ifdef OPENSSL_IS_BORINGSSL
45 	certs = sk_X509_new_null();
46 	if (!certs)
47 		goto fail;
48 	CBS_init(&pkcs7_cbs, pkcs7, len);
49 	if (!PKCS7_get_certificates(certs, &pkcs7_cbs)) {
50 		wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s",
51 			   ERR_error_string(ERR_get_error(), NULL));
52 		write_result(ctx, "Could not parse PKCS#7 object from EST");
53 		goto fail;
54 	}
55 #else /* OPENSSL_IS_BORINGSSL */
56 	p7 = d2i_PKCS7(NULL, &p, len);
57 	if (p7 == NULL) {
58 		wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s",
59 			   ERR_error_string(ERR_get_error(), NULL));
60 		write_result(ctx, "Could not parse PKCS#7 object from EST");
61 		goto fail;
62 	}
63 
64 	switch (OBJ_obj2nid(p7->type)) {
65 	case NID_pkcs7_signed:
66 		certs = p7->d.sign->cert;
67 		break;
68 	case NID_pkcs7_signedAndEnveloped:
69 		certs = p7->d.signed_and_enveloped->cert;
70 		break;
71 	default:
72 		certs = NULL;
73 		break;
74 	}
75 #endif /* OPENSSL_IS_BORINGSSL */
76 
77 	if (!certs || ((num = sk_X509_num(certs)) == 0)) {
78 		wpa_printf(MSG_INFO, "No certificates found in PKCS#7 object");
79 		write_result(ctx, "No certificates found in PKCS#7 object");
80 		goto fail;
81 	}
82 
83 	if (der_file) {
84 		FILE *f = fopen(der_file, "wb");
85 		if (f == NULL)
86 			goto fail;
87 		i2d_X509_fp(f, sk_X509_value(certs, 0));
88 		fclose(f);
89 	}
90 
91 	if (pem_file) {
92 		out = BIO_new(BIO_s_file());
93 		if (out == NULL ||
94 		    BIO_write_filename(out, pem_file) <= 0)
95 			goto fail;
96 
97 		for (i = 0; i < num; i++) {
98 			X509 *cert = sk_X509_value(certs, i);
99 			X509_print(out, cert);
100 			PEM_write_bio_X509(out, cert);
101 			BIO_puts(out, "\n");
102 		}
103 	}
104 
105 	ret = 0;
106 
107 fail:
108 #ifdef OPENSSL_IS_BORINGSSL
109 	if (certs)
110 		sk_X509_pop_free(certs, X509_free);
111 #else /* OPENSSL_IS_BORINGSSL */
112 	PKCS7_free(p7);
113 #endif /* OPENSSL_IS_BORINGSSL */
114 	if (out)
115 		BIO_free_all(out);
116 
117 	return ret;
118 }
119 
120 
est_load_cacerts(struct hs20_osu_client * ctx,const char * url)121 int est_load_cacerts(struct hs20_osu_client *ctx, const char *url)
122 {
123 	char *buf, *resp;
124 	size_t buflen;
125 	unsigned char *pkcs7;
126 	size_t pkcs7_len, resp_len;
127 	int res;
128 
129 	buflen = os_strlen(url) + 100;
130 	buf = os_malloc(buflen);
131 	if (buf == NULL)
132 		return -1;
133 
134 	os_snprintf(buf, buflen, "%s/cacerts", url);
135 	wpa_printf(MSG_INFO, "Download EST cacerts from %s", buf);
136 	write_summary(ctx, "Download EST cacerts from %s", buf);
137 	ctx->no_osu_cert_validation = 1;
138 	http_ocsp_set(ctx->http, 1);
139 	res = http_download_file(ctx->http, buf, "Cert/est-cacerts.txt",
140 				 ctx->ca_fname);
141 	http_ocsp_set(ctx->http,
142 		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
143 	ctx->no_osu_cert_validation = 0;
144 	if (res < 0) {
145 		wpa_printf(MSG_INFO, "Failed to download EST cacerts from %s",
146 			   buf);
147 		write_result(ctx, "Failed to download EST cacerts from %s",
148 			     buf);
149 		os_free(buf);
150 		return -1;
151 	}
152 	os_free(buf);
153 
154 	resp = os_readfile("Cert/est-cacerts.txt", &resp_len);
155 	if (resp == NULL) {
156 		wpa_printf(MSG_INFO, "Could not read Cert/est-cacerts.txt");
157 		write_result(ctx, "Could not read EST cacerts");
158 		return -1;
159 	}
160 
161 	pkcs7 = base64_decode(resp, resp_len, &pkcs7_len);
162 	if (pkcs7 && pkcs7_len < resp_len / 2) {
163 		wpa_printf(MSG_INFO, "Too short base64 decode (%u bytes; downloaded %u bytes) - assume this was binary",
164 			   (unsigned int) pkcs7_len, (unsigned int) resp_len);
165 		os_free(pkcs7);
166 		pkcs7 = NULL;
167 	}
168 	if (pkcs7 == NULL) {
169 		wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
170 		pkcs7 = os_malloc(resp_len);
171 		if (pkcs7) {
172 			os_memcpy(pkcs7, resp, resp_len);
173 			pkcs7_len = resp_len;
174 		}
175 	}
176 	os_free(resp);
177 
178 	if (pkcs7 == NULL) {
179 		wpa_printf(MSG_INFO, "Could not fetch PKCS7 cacerts");
180 		write_result(ctx, "Could not fetch EST PKCS#7 cacerts");
181 		return -1;
182 	}
183 
184 	res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est-cacerts.pem",
185 			    NULL);
186 	os_free(pkcs7);
187 	if (res < 0) {
188 		wpa_printf(MSG_INFO, "Could not parse CA certs from PKCS#7 cacerts response");
189 		write_result(ctx, "Could not parse CA certs from EST PKCS#7 cacerts response");
190 		return -1;
191 	}
192 	unlink("Cert/est-cacerts.txt");
193 
194 	return 0;
195 }
196 
197 
198 /*
199  * CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
200  *
201  * AttrOrOID ::= CHOICE {
202  *   oid OBJECT IDENTIFIER,
203  *   attribute Attribute }
204  *
205  * Attribute ::= SEQUENCE {
206  *   type OBJECT IDENTIFIER,
207  *   values SET SIZE(1..MAX) OF OBJECT IDENTIFIER }
208  */
209 
210 typedef struct {
211 	ASN1_OBJECT *type;
212 	STACK_OF(ASN1_OBJECT) *values;
213 } Attribute;
214 
215 typedef struct {
216 	int type;
217 	union {
218 		ASN1_OBJECT *oid;
219 		Attribute *attribute;
220 	} d;
221 } AttrOrOID;
222 
223 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
224 DEFINE_STACK_OF(AttrOrOID)
225 #endif
226 
227 typedef struct {
228 	int type;
229 	STACK_OF(AttrOrOID) *attrs;
230 } CsrAttrs;
231 
232 ASN1_SEQUENCE(Attribute) = {
233 	ASN1_SIMPLE(Attribute, type, ASN1_OBJECT),
234 	ASN1_SET_OF(Attribute, values, ASN1_OBJECT)
235 } ASN1_SEQUENCE_END(Attribute);
236 
237 ASN1_CHOICE(AttrOrOID) = {
238 	ASN1_SIMPLE(AttrOrOID, d.oid, ASN1_OBJECT),
239 	ASN1_SIMPLE(AttrOrOID, d.attribute, Attribute)
240 } ASN1_CHOICE_END(AttrOrOID);
241 
242 ASN1_CHOICE(CsrAttrs) = {
243 	ASN1_SEQUENCE_OF(CsrAttrs, attrs, AttrOrOID)
244 } ASN1_CHOICE_END(CsrAttrs);
245 
246 IMPLEMENT_ASN1_FUNCTIONS(CsrAttrs);
247 
248 
add_csrattrs_oid(struct hs20_osu_client * ctx,ASN1_OBJECT * oid,STACK_OF (X509_EXTENSION)* exts)249 static void add_csrattrs_oid(struct hs20_osu_client *ctx, ASN1_OBJECT *oid,
250 			     STACK_OF(X509_EXTENSION) *exts)
251 {
252 	char txt[100];
253 	int res;
254 
255 	if (!oid)
256 		return;
257 
258 	res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
259 	if (res < 0 || res >= (int) sizeof(txt))
260 		return;
261 
262 	if (os_strcmp(txt, "1.2.840.113549.1.9.7") == 0) {
263 		wpa_printf(MSG_INFO, "TODO: csrattr challengePassword");
264 	} else if (os_strcmp(txt, "1.2.840.113549.1.1.11") == 0) {
265 		wpa_printf(MSG_INFO, "csrattr sha256WithRSAEncryption");
266 	} else {
267 		wpa_printf(MSG_INFO, "Ignore unsupported csrattr oid %s", txt);
268 	}
269 }
270 
271 
add_csrattrs_ext_req(struct hs20_osu_client * ctx,STACK_OF (ASN1_OBJECT)* values,STACK_OF (X509_EXTENSION)* exts)272 static void add_csrattrs_ext_req(struct hs20_osu_client *ctx,
273 				 STACK_OF(ASN1_OBJECT) *values,
274 				 STACK_OF(X509_EXTENSION) *exts)
275 {
276 	char txt[100];
277 	int i, num, res;
278 
279 	num = sk_ASN1_OBJECT_num(values);
280 	for (i = 0; i < num; i++) {
281 		ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(values, i);
282 
283 		res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
284 		if (res < 0 || res >= (int) sizeof(txt))
285 			continue;
286 
287 		if (os_strcmp(txt, "1.3.6.1.1.1.1.22") == 0) {
288 			wpa_printf(MSG_INFO, "TODO: extReq macAddress");
289 		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.3") == 0) {
290 			wpa_printf(MSG_INFO, "TODO: extReq imei");
291 		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.4") == 0) {
292 			wpa_printf(MSG_INFO, "TODO: extReq meid");
293 		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.5") == 0) {
294 			wpa_printf(MSG_INFO, "TODO: extReq DevId");
295 		} else {
296 			wpa_printf(MSG_INFO, "Ignore unsupported cstattr extensionsRequest %s",
297 				   txt);
298 		}
299 	}
300 }
301 
302 
add_csrattrs_attr(struct hs20_osu_client * ctx,Attribute * attr,STACK_OF (X509_EXTENSION)* exts)303 static void add_csrattrs_attr(struct hs20_osu_client *ctx, Attribute *attr,
304 			      STACK_OF(X509_EXTENSION) *exts)
305 {
306 	char txt[100], txt2[100];
307 	int i, num, res;
308 
309 	if (!attr || !attr->type || !attr->values)
310 		return;
311 
312 	res = OBJ_obj2txt(txt, sizeof(txt), attr->type, 1);
313 	if (res < 0 || res >= (int) sizeof(txt))
314 		return;
315 
316 	if (os_strcmp(txt, "1.2.840.113549.1.9.14") == 0) {
317 		add_csrattrs_ext_req(ctx, attr->values, exts);
318 		return;
319 	}
320 
321 	num = sk_ASN1_OBJECT_num(attr->values);
322 	for (i = 0; i < num; i++) {
323 		ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(attr->values, i);
324 
325 		res = OBJ_obj2txt(txt2, sizeof(txt2), oid, 1);
326 		if (res < 0 || res >= (int) sizeof(txt2))
327 			continue;
328 
329 		wpa_printf(MSG_INFO, "Ignore unsupported cstattr::attr %s oid %s",
330 			   txt, txt2);
331 	}
332 }
333 
334 
add_csrattrs(struct hs20_osu_client * ctx,CsrAttrs * csrattrs,STACK_OF (X509_EXTENSION)* exts)335 static void add_csrattrs(struct hs20_osu_client *ctx, CsrAttrs *csrattrs,
336 			 STACK_OF(X509_EXTENSION) *exts)
337 {
338 	int i, num;
339 
340 	if (!csrattrs || ! csrattrs->attrs)
341 		return;
342 
343 #ifdef OPENSSL_IS_BORINGSSL
344 	num = sk_num(CHECKED_CAST(_STACK *, STACK_OF(AttrOrOID) *,
345 				  csrattrs->attrs));
346 	for (i = 0; i < num; i++) {
347 		AttrOrOID *ao = sk_value(
348 			CHECKED_CAST(_STACK *, const STACK_OF(AttrOrOID) *,
349 				     csrattrs->attrs), i);
350 		switch (ao->type) {
351 		case 0:
352 			add_csrattrs_oid(ctx, ao->d.oid, exts);
353 			break;
354 		case 1:
355 			add_csrattrs_attr(ctx, ao->d.attribute, exts);
356 			break;
357 		}
358 	}
359 #else /* OPENSSL_IS_BORINGSSL */
360 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
361 	num = sk_AttrOrOID_num(csrattrs->attrs);
362 #else
363 	num = SKM_sk_num(AttrOrOID, csrattrs->attrs);
364 #endif
365 	for (i = 0; i < num; i++) {
366 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
367 		AttrOrOID *ao = sk_AttrOrOID_value(csrattrs->attrs, i);
368 #else
369 		AttrOrOID *ao = SKM_sk_value(AttrOrOID, csrattrs->attrs, i);
370 #endif
371 		switch (ao->type) {
372 		case 0:
373 			add_csrattrs_oid(ctx, ao->d.oid, exts);
374 			break;
375 		case 1:
376 			add_csrattrs_attr(ctx, ao->d.attribute, exts);
377 			break;
378 		}
379 	}
380 #endif /* OPENSSL_IS_BORINGSSL */
381 }
382 
383 
generate_csr(struct hs20_osu_client * ctx,char * key_pem,char * csr_pem,char * est_req,char * old_cert,CsrAttrs * csrattrs)384 static int generate_csr(struct hs20_osu_client *ctx, char *key_pem,
385 			char *csr_pem, char *est_req, char *old_cert,
386 			CsrAttrs *csrattrs)
387 {
388 	EVP_PKEY_CTX *pctx = NULL;
389 	EVP_PKEY *pkey = NULL;
390 	RSA *rsa;
391 	X509_REQ *req = NULL;
392 	int ret = -1;
393 	unsigned int val;
394 	X509_NAME *subj = NULL;
395 	char name[100];
396 	STACK_OF(X509_EXTENSION) *exts = NULL;
397 	X509_EXTENSION *ex;
398 	BIO *out;
399 	CONF *ctmp = NULL;
400 
401 	wpa_printf(MSG_INFO, "Generate RSA private key");
402 	write_summary(ctx, "Generate RSA private key");
403 	pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
404 	if (!pctx)
405 		return -1;
406 
407 	if (EVP_PKEY_keygen_init(pctx) <= 0)
408 		goto fail;
409 
410 	if (EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, 2048) <= 0)
411 		goto fail;
412 
413 	if (EVP_PKEY_keygen(pctx, &pkey) <= 0)
414 		goto fail;
415 	EVP_PKEY_CTX_free(pctx);
416 	pctx = NULL;
417 
418 	rsa = EVP_PKEY_get1_RSA(pkey);
419 	if (rsa == NULL)
420 		goto fail;
421 
422 	if (key_pem) {
423 		FILE *f = fopen(key_pem, "wb");
424 		if (f == NULL)
425 			goto fail;
426 		if (!PEM_write_RSAPrivateKey(f, rsa, NULL, NULL, 0, NULL,
427 					     NULL)) {
428 			wpa_printf(MSG_INFO, "Could not write private key: %s",
429 				   ERR_error_string(ERR_get_error(), NULL));
430 			fclose(f);
431 			goto fail;
432 		}
433 		fclose(f);
434 	}
435 
436 	wpa_printf(MSG_INFO, "Generate CSR");
437 	write_summary(ctx, "Generate CSR");
438 	req = X509_REQ_new();
439 	if (req == NULL)
440 		goto fail;
441 
442 	if (old_cert) {
443 		FILE *f;
444 		X509 *cert;
445 		int res;
446 
447 		f = fopen(old_cert, "r");
448 		if (f == NULL)
449 			goto fail;
450 		cert = PEM_read_X509(f, NULL, NULL, NULL);
451 		fclose(f);
452 
453 		if (cert == NULL)
454 			goto fail;
455 		res = X509_REQ_set_subject_name(req,
456 						X509_get_subject_name(cert));
457 		X509_free(cert);
458 		if (!res)
459 			goto fail;
460 	} else {
461 		os_get_random((u8 *) &val, sizeof(val));
462 		os_snprintf(name, sizeof(name), "cert-user-%u", val);
463 		subj = X509_NAME_new();
464 		if (subj == NULL ||
465 		    !X509_NAME_add_entry_by_txt(subj, "CN", MBSTRING_ASC,
466 						(unsigned char *) name,
467 						-1, -1, 0) ||
468 		    !X509_REQ_set_subject_name(req, subj))
469 			goto fail;
470 		X509_NAME_free(subj);
471 		subj = NULL;
472 	}
473 
474 	if (!X509_REQ_set_pubkey(req, pkey))
475 		goto fail;
476 
477 	exts = sk_X509_EXTENSION_new_null();
478 	if (!exts)
479 		goto fail;
480 
481 	ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_basic_constraints,
482 				  "CA:FALSE");
483 	if (ex == NULL ||
484 	    !sk_X509_EXTENSION_push(exts, ex))
485 		goto fail;
486 
487 	ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_key_usage,
488 				  "nonRepudiation,digitalSignature,keyEncipherment");
489 	if (ex == NULL ||
490 	    !sk_X509_EXTENSION_push(exts, ex))
491 		goto fail;
492 
493 	ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_ext_key_usage,
494 				  "1.3.6.1.4.1.40808.1.1.2");
495 	if (ex == NULL ||
496 	    !sk_X509_EXTENSION_push(exts, ex))
497 		goto fail;
498 
499 	add_csrattrs(ctx, csrattrs, exts);
500 
501 	if (!X509_REQ_add_extensions(req, exts))
502 		goto fail;
503 	sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
504 	exts = NULL;
505 
506 	if (!X509_REQ_sign(req, pkey, EVP_sha256()))
507 		goto fail;
508 
509 	out = BIO_new(BIO_s_mem());
510 	if (out) {
511 		char *txt;
512 		size_t rlen;
513 
514 #if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL)
515 		X509_REQ_print(out, req);
516 #endif
517 		rlen = BIO_ctrl_pending(out);
518 		txt = os_malloc(rlen + 1);
519 		if (txt) {
520 			int res = BIO_read(out, txt, rlen);
521 			if (res > 0) {
522 				txt[res] = '\0';
523 				wpa_printf(MSG_MSGDUMP, "OpenSSL: Certificate request:\n%s",
524 					   txt);
525 			}
526 			os_free(txt);
527 		}
528 		BIO_free(out);
529 	}
530 
531 	if (csr_pem) {
532 		FILE *f = fopen(csr_pem, "w");
533 		if (f == NULL)
534 			goto fail;
535 #if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL)
536 		X509_REQ_print_fp(f, req);
537 #endif
538 		if (!PEM_write_X509_REQ(f, req)) {
539 			fclose(f);
540 			goto fail;
541 		}
542 		fclose(f);
543 	}
544 
545 	if (est_req) {
546 		BIO *mem = BIO_new(BIO_s_mem());
547 		BUF_MEM *ptr;
548 		char *pos, *end, *buf_end;
549 		FILE *f;
550 
551 		if (mem == NULL)
552 			goto fail;
553 		if (!PEM_write_bio_X509_REQ(mem, req)) {
554 			BIO_free(mem);
555 			goto fail;
556 		}
557 
558 		BIO_get_mem_ptr(mem, &ptr);
559 		pos = ptr->data;
560 		buf_end = pos + ptr->length;
561 
562 		/* Remove START/END lines */
563 		while (pos < buf_end && *pos != '\n')
564 			pos++;
565 		if (pos == buf_end) {
566 			BIO_free(mem);
567 			goto fail;
568 		}
569 		pos++;
570 
571 		end = pos;
572 		while (end < buf_end && *end != '-')
573 			end++;
574 
575 		f = fopen(est_req, "w");
576 		if (f == NULL) {
577 			BIO_free(mem);
578 			goto fail;
579 		}
580 		fwrite(pos, end - pos, 1, f);
581 		fclose(f);
582 
583 		BIO_free(mem);
584 	}
585 
586 	ret = 0;
587 fail:
588 	if (exts)
589 		sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
590 	if (subj)
591 		X509_NAME_free(subj);
592 	if (req)
593 		X509_REQ_free(req);
594 	if (pkey)
595 		EVP_PKEY_free(pkey);
596 	if (pctx)
597 		EVP_PKEY_CTX_free(pctx);
598 	return ret;
599 }
600 
601 
est_build_csr(struct hs20_osu_client * ctx,const char * url)602 int est_build_csr(struct hs20_osu_client *ctx, const char *url)
603 {
604 	char *buf;
605 	size_t buflen;
606 	int res;
607 	char old_cert_buf[200];
608 	char *old_cert = NULL;
609 	CsrAttrs *csrattrs = NULL;
610 
611 	buflen = os_strlen(url) + 100;
612 	buf = os_malloc(buflen);
613 	if (buf == NULL)
614 		return -1;
615 
616 	os_snprintf(buf, buflen, "%s/csrattrs", url);
617 	wpa_printf(MSG_INFO, "Download csrattrs from %s", buf);
618 	write_summary(ctx, "Download EST csrattrs from %s", buf);
619 	ctx->no_osu_cert_validation = 1;
620 	http_ocsp_set(ctx->http, 1);
621 	res = http_download_file(ctx->http, buf, "Cert/est-csrattrs.txt",
622 				 ctx->ca_fname);
623 	http_ocsp_set(ctx->http,
624 		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
625 	ctx->no_osu_cert_validation = 0;
626 	os_free(buf);
627 	if (res < 0) {
628 		wpa_printf(MSG_INFO, "Failed to download EST csrattrs - assume no extra attributes are needed");
629 	} else {
630 		size_t resp_len;
631 		char *resp;
632 		unsigned char *attrs;
633 		const unsigned char *pos;
634 		size_t attrs_len;
635 
636 		resp = os_readfile("Cert/est-csrattrs.txt", &resp_len);
637 		if (resp == NULL) {
638 			wpa_printf(MSG_INFO, "Could not read csrattrs");
639 			return -1;
640 		}
641 
642 		attrs = base64_decode(resp, resp_len, &attrs_len);
643 		os_free(resp);
644 
645 		if (attrs == NULL) {
646 			wpa_printf(MSG_INFO, "Could not base64 decode csrattrs");
647 			return -1;
648 		}
649 		unlink("Cert/est-csrattrs.txt");
650 
651 		pos = attrs;
652 		csrattrs = d2i_CsrAttrs(NULL, &pos, attrs_len);
653 		os_free(attrs);
654 		if (csrattrs == NULL) {
655 			wpa_printf(MSG_INFO, "Failed to parse csrattrs ASN.1");
656 			/* Continue assuming no additional requirements */
657 		}
658 	}
659 
660 	if (ctx->client_cert_present) {
661 		os_snprintf(old_cert_buf, sizeof(old_cert_buf),
662 			    "SP/%s/client-cert.pem", ctx->fqdn);
663 		old_cert = old_cert_buf;
664 	}
665 
666 	res = generate_csr(ctx, "Cert/privkey-plain.pem", "Cert/est-req.pem",
667 			   "Cert/est-req.b64", old_cert, csrattrs);
668 	if (csrattrs)
669 		CsrAttrs_free(csrattrs);
670 
671 	return res;
672 }
673 
674 
est_simple_enroll(struct hs20_osu_client * ctx,const char * url,const char * user,const char * pw)675 int est_simple_enroll(struct hs20_osu_client *ctx, const char *url,
676 		      const char *user, const char *pw)
677 {
678 	char *buf, *resp, *req, *req2;
679 	size_t buflen, resp_len, len, pkcs7_len;
680 	unsigned char *pkcs7;
681 	char client_cert_buf[200];
682 	char client_key_buf[200];
683 	const char *client_cert = NULL, *client_key = NULL;
684 	int res;
685 
686 	req = os_readfile("Cert/est-req.b64", &len);
687 	if (req == NULL) {
688 		wpa_printf(MSG_INFO, "Could not read Cert/req.b64");
689 		return -1;
690 	}
691 	req2 = os_realloc(req, len + 1);
692 	if (req2 == NULL) {
693 		os_free(req);
694 		return -1;
695 	}
696 	req2[len] = '\0';
697 	req = req2;
698 	wpa_printf(MSG_DEBUG, "EST simpleenroll request: %s", req);
699 
700 	buflen = os_strlen(url) + 100;
701 	buf = os_malloc(buflen);
702 	if (buf == NULL) {
703 		os_free(req);
704 		return -1;
705 	}
706 
707 	if (ctx->client_cert_present) {
708 		os_snprintf(buf, buflen, "%s/simplereenroll", url);
709 		os_snprintf(client_cert_buf, sizeof(client_cert_buf),
710 			    "SP/%s/client-cert.pem", ctx->fqdn);
711 		client_cert = client_cert_buf;
712 		os_snprintf(client_key_buf, sizeof(client_key_buf),
713 			    "SP/%s/client-key.pem", ctx->fqdn);
714 		client_key = client_key_buf;
715 	} else
716 		os_snprintf(buf, buflen, "%s/simpleenroll", url);
717 	wpa_printf(MSG_INFO, "EST simpleenroll URL: %s", buf);
718 	write_summary(ctx, "EST simpleenroll URL: %s", buf);
719 	ctx->no_osu_cert_validation = 1;
720 	http_ocsp_set(ctx->http, 1);
721 	resp = http_post(ctx->http, buf, req, "application/pkcs10",
722 			 "Content-Transfer-Encoding: base64",
723 			 ctx->ca_fname, user, pw, client_cert, client_key,
724 			 &resp_len);
725 	http_ocsp_set(ctx->http,
726 		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
727 	ctx->no_osu_cert_validation = 0;
728 	os_free(buf);
729 	if (resp == NULL) {
730 		wpa_printf(MSG_INFO, "EST certificate enrollment failed");
731 		write_result(ctx, "EST certificate enrollment failed");
732 		return -1;
733 	}
734 	wpa_printf(MSG_DEBUG, "EST simpleenroll response: %s", resp);
735 
736 	pkcs7 = base64_decode(resp, resp_len, &pkcs7_len);
737 	if (pkcs7 == NULL) {
738 		wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
739 		pkcs7 = os_malloc(resp_len);
740 		if (pkcs7) {
741 			os_memcpy(pkcs7, resp, resp_len);
742 			pkcs7_len = resp_len;
743 		}
744 	}
745 	os_free(resp);
746 
747 	if (pkcs7 == NULL) {
748 		wpa_printf(MSG_INFO, "Failed to parse simpleenroll base64 response");
749 		write_result(ctx, "Failed to parse EST simpleenroll base64 response");
750 		return -1;
751 	}
752 
753 	res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est_cert.pem",
754 			    "Cert/est_cert.der");
755 	os_free(pkcs7);
756 
757 	if (res < 0) {
758 		wpa_printf(MSG_INFO, "EST: Failed to extract certificate from PKCS7 file");
759 		write_result(ctx, "EST: Failed to extract certificate from EST PKCS7 file");
760 		return -1;
761 	}
762 
763 	wpa_printf(MSG_INFO, "EST simple%senroll completed successfully",
764 		   ctx->client_cert_present ? "re" : "");
765 	write_summary(ctx, "EST simple%senroll completed successfully",
766 		      ctx->client_cert_present ? "re" : "");
767 
768 	return 0;
769 }
770