1 /* 2 * Hotspot 2.0 OSU client - EST client 3 * Copyright (c) 2012-2014, Qualcomm Atheros, Inc. 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 #include <openssl/err.h> 11 #include <openssl/evp.h> 12 #include <openssl/pem.h> 13 #include <openssl/pkcs7.h> 14 #include <openssl/rsa.h> 15 #include <openssl/asn1.h> 16 #include <openssl/asn1t.h> 17 #include <openssl/x509.h> 18 #include <openssl/x509v3.h> 19 #include <openssl/opensslv.h> 20 #ifdef OPENSSL_IS_BORINGSSL 21 #include <openssl/buf.h> 22 #endif /* OPENSSL_IS_BORINGSSL */ 23 24 #include "common.h" 25 #include "utils/base64.h" 26 #include "utils/xml-utils.h" 27 #include "utils/http-utils.h" 28 #include "osu_client.h" 29 30 31 static int pkcs7_to_cert(struct hs20_osu_client *ctx, const u8 *pkcs7, 32 size_t len, char *pem_file, char *der_file) 33 { 34 #ifdef OPENSSL_IS_BORINGSSL 35 CBS pkcs7_cbs; 36 #else /* OPENSSL_IS_BORINGSSL */ 37 PKCS7 *p7 = NULL; 38 const unsigned char *p = pkcs7; 39 #endif /* OPENSSL_IS_BORINGSSL */ 40 STACK_OF(X509) *certs; 41 int i, num, ret = -1; 42 BIO *out = NULL; 43 44 #ifdef OPENSSL_IS_BORINGSSL 45 certs = sk_X509_new_null(); 46 if (!certs) 47 goto fail; 48 CBS_init(&pkcs7_cbs, pkcs7, len); 49 if (!PKCS7_get_certificates(certs, &pkcs7_cbs)) { 50 wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s", 51 ERR_error_string(ERR_get_error(), NULL)); 52 write_result(ctx, "Could not parse PKCS#7 object from EST"); 53 goto fail; 54 } 55 #else /* OPENSSL_IS_BORINGSSL */ 56 p7 = d2i_PKCS7(NULL, &p, len); 57 if (p7 == NULL) { 58 wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s", 59 ERR_error_string(ERR_get_error(), NULL)); 60 write_result(ctx, "Could not parse PKCS#7 object from EST"); 61 goto fail; 62 } 63 64 switch (OBJ_obj2nid(p7->type)) { 65 case NID_pkcs7_signed: 66 certs = p7->d.sign->cert; 67 break; 68 case NID_pkcs7_signedAndEnveloped: 69 certs = p7->d.signed_and_enveloped->cert; 70 break; 71 default: 72 certs = NULL; 73 break; 74 } 75 #endif /* OPENSSL_IS_BORINGSSL */ 76 77 if (!certs || ((num = sk_X509_num(certs)) == 0)) { 78 wpa_printf(MSG_INFO, "No certificates found in PKCS#7 object"); 79 write_result(ctx, "No certificates found in PKCS#7 object"); 80 goto fail; 81 } 82 83 if (der_file) { 84 FILE *f = fopen(der_file, "wb"); 85 if (f == NULL) 86 goto fail; 87 i2d_X509_fp(f, sk_X509_value(certs, 0)); 88 fclose(f); 89 } 90 91 if (pem_file) { 92 out = BIO_new(BIO_s_file()); 93 if (out == NULL || 94 BIO_write_filename(out, pem_file) <= 0) 95 goto fail; 96 97 for (i = 0; i < num; i++) { 98 X509 *cert = sk_X509_value(certs, i); 99 X509_print(out, cert); 100 PEM_write_bio_X509(out, cert); 101 BIO_puts(out, "\n"); 102 } 103 } 104 105 ret = 0; 106 107 fail: 108 #ifdef OPENSSL_IS_BORINGSSL 109 if (certs) 110 sk_X509_pop_free(certs, X509_free); 111 #else /* OPENSSL_IS_BORINGSSL */ 112 PKCS7_free(p7); 113 #endif /* OPENSSL_IS_BORINGSSL */ 114 if (out) 115 BIO_free_all(out); 116 117 return ret; 118 } 119 120 121 int est_load_cacerts(struct hs20_osu_client *ctx, const char *url) 122 { 123 char *buf, *resp; 124 size_t buflen; 125 unsigned char *pkcs7; 126 size_t pkcs7_len, resp_len; 127 int res; 128 129 buflen = os_strlen(url) + 100; 130 buf = os_malloc(buflen); 131 if (buf == NULL) 132 return -1; 133 134 os_snprintf(buf, buflen, "%s/cacerts", url); 135 wpa_printf(MSG_INFO, "Download EST cacerts from %s", buf); 136 write_summary(ctx, "Download EST cacerts from %s", buf); 137 ctx->no_osu_cert_validation = 1; 138 http_ocsp_set(ctx->http, 1); 139 res = http_download_file(ctx->http, buf, "Cert/est-cacerts.txt", 140 ctx->ca_fname); 141 http_ocsp_set(ctx->http, 142 (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2); 143 ctx->no_osu_cert_validation = 0; 144 if (res < 0) { 145 wpa_printf(MSG_INFO, "Failed to download EST cacerts from %s", 146 buf); 147 write_result(ctx, "Failed to download EST cacerts from %s", 148 buf); 149 os_free(buf); 150 return -1; 151 } 152 os_free(buf); 153 154 resp = os_readfile("Cert/est-cacerts.txt", &resp_len); 155 if (resp == NULL) { 156 wpa_printf(MSG_INFO, "Could not read Cert/est-cacerts.txt"); 157 write_result(ctx, "Could not read EST cacerts"); 158 return -1; 159 } 160 161 pkcs7 = base64_decode(resp, resp_len, &pkcs7_len); 162 if (pkcs7 && pkcs7_len < resp_len / 2) { 163 wpa_printf(MSG_INFO, "Too short base64 decode (%u bytes; downloaded %u bytes) - assume this was binary", 164 (unsigned int) pkcs7_len, (unsigned int) resp_len); 165 os_free(pkcs7); 166 pkcs7 = NULL; 167 } 168 if (pkcs7 == NULL) { 169 wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7"); 170 pkcs7 = os_malloc(resp_len); 171 if (pkcs7) { 172 os_memcpy(pkcs7, resp, resp_len); 173 pkcs7_len = resp_len; 174 } 175 } 176 os_free(resp); 177 178 if (pkcs7 == NULL) { 179 wpa_printf(MSG_INFO, "Could not fetch PKCS7 cacerts"); 180 write_result(ctx, "Could not fetch EST PKCS#7 cacerts"); 181 return -1; 182 } 183 184 res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est-cacerts.pem", 185 NULL); 186 os_free(pkcs7); 187 if (res < 0) { 188 wpa_printf(MSG_INFO, "Could not parse CA certs from PKCS#7 cacerts response"); 189 write_result(ctx, "Could not parse CA certs from EST PKCS#7 cacerts response"); 190 return -1; 191 } 192 unlink("Cert/est-cacerts.txt"); 193 194 return 0; 195 } 196 197 198 /* 199 * CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID 200 * 201 * AttrOrOID ::= CHOICE { 202 * oid OBJECT IDENTIFIER, 203 * attribute Attribute } 204 * 205 * Attribute ::= SEQUENCE { 206 * type OBJECT IDENTIFIER, 207 * values SET SIZE(1..MAX) OF OBJECT IDENTIFIER } 208 */ 209 210 typedef struct { 211 ASN1_OBJECT *type; 212 STACK_OF(ASN1_OBJECT) *values; 213 } Attribute; 214 215 typedef struct { 216 int type; 217 union { 218 ASN1_OBJECT *oid; 219 Attribute *attribute; 220 } d; 221 } AttrOrOID; 222 223 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL) 224 DEFINE_STACK_OF(AttrOrOID) 225 #endif 226 227 typedef struct { 228 int type; 229 STACK_OF(AttrOrOID) *attrs; 230 } CsrAttrs; 231 232 ASN1_SEQUENCE(Attribute) = { 233 ASN1_SIMPLE(Attribute, type, ASN1_OBJECT), 234 ASN1_SET_OF(Attribute, values, ASN1_OBJECT) 235 } ASN1_SEQUENCE_END(Attribute); 236 237 ASN1_CHOICE(AttrOrOID) = { 238 ASN1_SIMPLE(AttrOrOID, d.oid, ASN1_OBJECT), 239 ASN1_SIMPLE(AttrOrOID, d.attribute, Attribute) 240 } ASN1_CHOICE_END(AttrOrOID); 241 242 ASN1_CHOICE(CsrAttrs) = { 243 ASN1_SEQUENCE_OF(CsrAttrs, attrs, AttrOrOID) 244 } ASN1_CHOICE_END(CsrAttrs); 245 246 IMPLEMENT_ASN1_FUNCTIONS(CsrAttrs); 247 248 249 static void add_csrattrs_oid(struct hs20_osu_client *ctx, ASN1_OBJECT *oid, 250 STACK_OF(X509_EXTENSION) *exts) 251 { 252 char txt[100]; 253 int res; 254 255 if (!oid) 256 return; 257 258 res = OBJ_obj2txt(txt, sizeof(txt), oid, 1); 259 if (res < 0 || res >= (int) sizeof(txt)) 260 return; 261 262 if (os_strcmp(txt, "1.2.840.113549.1.9.7") == 0) { 263 wpa_printf(MSG_INFO, "TODO: csrattr challengePassword"); 264 } else if (os_strcmp(txt, "1.2.840.113549.1.1.11") == 0) { 265 wpa_printf(MSG_INFO, "csrattr sha256WithRSAEncryption"); 266 } else { 267 wpa_printf(MSG_INFO, "Ignore unsupported csrattr oid %s", txt); 268 } 269 } 270 271 272 static void add_csrattrs_ext_req(struct hs20_osu_client *ctx, 273 STACK_OF(ASN1_OBJECT) *values, 274 STACK_OF(X509_EXTENSION) *exts) 275 { 276 char txt[100]; 277 int i, num, res; 278 279 num = sk_ASN1_OBJECT_num(values); 280 for (i = 0; i < num; i++) { 281 ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(values, i); 282 283 res = OBJ_obj2txt(txt, sizeof(txt), oid, 1); 284 if (res < 0 || res >= (int) sizeof(txt)) 285 continue; 286 287 if (os_strcmp(txt, "1.3.6.1.1.1.1.22") == 0) { 288 wpa_printf(MSG_INFO, "TODO: extReq macAddress"); 289 } else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.3") == 0) { 290 wpa_printf(MSG_INFO, "TODO: extReq imei"); 291 } else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.4") == 0) { 292 wpa_printf(MSG_INFO, "TODO: extReq meid"); 293 } else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.5") == 0) { 294 wpa_printf(MSG_INFO, "TODO: extReq DevId"); 295 } else { 296 wpa_printf(MSG_INFO, "Ignore unsupported cstattr extensionsRequest %s", 297 txt); 298 } 299 } 300 } 301 302 303 static void add_csrattrs_attr(struct hs20_osu_client *ctx, Attribute *attr, 304 STACK_OF(X509_EXTENSION) *exts) 305 { 306 char txt[100], txt2[100]; 307 int i, num, res; 308 309 if (!attr || !attr->type || !attr->values) 310 return; 311 312 res = OBJ_obj2txt(txt, sizeof(txt), attr->type, 1); 313 if (res < 0 || res >= (int) sizeof(txt)) 314 return; 315 316 if (os_strcmp(txt, "1.2.840.113549.1.9.14") == 0) { 317 add_csrattrs_ext_req(ctx, attr->values, exts); 318 return; 319 } 320 321 num = sk_ASN1_OBJECT_num(attr->values); 322 for (i = 0; i < num; i++) { 323 ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(attr->values, i); 324 325 res = OBJ_obj2txt(txt2, sizeof(txt2), oid, 1); 326 if (res < 0 || res >= (int) sizeof(txt2)) 327 continue; 328 329 wpa_printf(MSG_INFO, "Ignore unsupported cstattr::attr %s oid %s", 330 txt, txt2); 331 } 332 } 333 334 335 static void add_csrattrs(struct hs20_osu_client *ctx, CsrAttrs *csrattrs, 336 STACK_OF(X509_EXTENSION) *exts) 337 { 338 int i, num; 339 340 if (!csrattrs || ! csrattrs->attrs) 341 return; 342 343 #ifdef OPENSSL_IS_BORINGSSL 344 num = sk_num(CHECKED_CAST(_STACK *, STACK_OF(AttrOrOID) *, 345 csrattrs->attrs)); 346 for (i = 0; i < num; i++) { 347 AttrOrOID *ao = sk_value( 348 CHECKED_CAST(_STACK *, const STACK_OF(AttrOrOID) *, 349 csrattrs->attrs), i); 350 switch (ao->type) { 351 case 0: 352 add_csrattrs_oid(ctx, ao->d.oid, exts); 353 break; 354 case 1: 355 add_csrattrs_attr(ctx, ao->d.attribute, exts); 356 break; 357 } 358 } 359 #else /* OPENSSL_IS_BORINGSSL */ 360 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL) 361 num = sk_AttrOrOID_num(csrattrs->attrs); 362 #else 363 num = SKM_sk_num(AttrOrOID, csrattrs->attrs); 364 #endif 365 for (i = 0; i < num; i++) { 366 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL) 367 AttrOrOID *ao = sk_AttrOrOID_value(csrattrs->attrs, i); 368 #else 369 AttrOrOID *ao = SKM_sk_value(AttrOrOID, csrattrs->attrs, i); 370 #endif 371 switch (ao->type) { 372 case 0: 373 add_csrattrs_oid(ctx, ao->d.oid, exts); 374 break; 375 case 1: 376 add_csrattrs_attr(ctx, ao->d.attribute, exts); 377 break; 378 } 379 } 380 #endif /* OPENSSL_IS_BORINGSSL */ 381 } 382 383 384 static int generate_csr(struct hs20_osu_client *ctx, char *key_pem, 385 char *csr_pem, char *est_req, char *old_cert, 386 CsrAttrs *csrattrs) 387 { 388 EVP_PKEY_CTX *pctx = NULL; 389 EVP_PKEY *pkey = NULL; 390 RSA *rsa; 391 X509_REQ *req = NULL; 392 int ret = -1; 393 unsigned int val; 394 X509_NAME *subj = NULL; 395 char name[100]; 396 STACK_OF(X509_EXTENSION) *exts = NULL; 397 X509_EXTENSION *ex; 398 BIO *out; 399 CONF *ctmp = NULL; 400 401 wpa_printf(MSG_INFO, "Generate RSA private key"); 402 write_summary(ctx, "Generate RSA private key"); 403 pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL); 404 if (!pctx) 405 return -1; 406 407 if (EVP_PKEY_keygen_init(pctx) <= 0) 408 goto fail; 409 410 if (EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, 2048) <= 0) 411 goto fail; 412 413 if (EVP_PKEY_keygen(pctx, &pkey) <= 0) 414 goto fail; 415 EVP_PKEY_CTX_free(pctx); 416 pctx = NULL; 417 418 rsa = EVP_PKEY_get1_RSA(pkey); 419 if (rsa == NULL) 420 goto fail; 421 422 if (key_pem) { 423 FILE *f = fopen(key_pem, "wb"); 424 if (f == NULL) 425 goto fail; 426 if (!PEM_write_RSAPrivateKey(f, rsa, NULL, NULL, 0, NULL, 427 NULL)) { 428 wpa_printf(MSG_INFO, "Could not write private key: %s", 429 ERR_error_string(ERR_get_error(), NULL)); 430 fclose(f); 431 goto fail; 432 } 433 fclose(f); 434 } 435 436 wpa_printf(MSG_INFO, "Generate CSR"); 437 write_summary(ctx, "Generate CSR"); 438 req = X509_REQ_new(); 439 if (req == NULL) 440 goto fail; 441 442 if (old_cert) { 443 FILE *f; 444 X509 *cert; 445 int res; 446 447 f = fopen(old_cert, "r"); 448 if (f == NULL) 449 goto fail; 450 cert = PEM_read_X509(f, NULL, NULL, NULL); 451 fclose(f); 452 453 if (cert == NULL) 454 goto fail; 455 res = X509_REQ_set_subject_name(req, 456 X509_get_subject_name(cert)); 457 X509_free(cert); 458 if (!res) 459 goto fail; 460 } else { 461 os_get_random((u8 *) &val, sizeof(val)); 462 os_snprintf(name, sizeof(name), "cert-user-%u", val); 463 subj = X509_NAME_new(); 464 if (subj == NULL || 465 !X509_NAME_add_entry_by_txt(subj, "CN", MBSTRING_ASC, 466 (unsigned char *) name, 467 -1, -1, 0) || 468 !X509_REQ_set_subject_name(req, subj)) 469 goto fail; 470 X509_NAME_free(subj); 471 subj = NULL; 472 } 473 474 if (!X509_REQ_set_pubkey(req, pkey)) 475 goto fail; 476 477 exts = sk_X509_EXTENSION_new_null(); 478 if (!exts) 479 goto fail; 480 481 ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_basic_constraints, 482 "CA:FALSE"); 483 if (ex == NULL || 484 !sk_X509_EXTENSION_push(exts, ex)) 485 goto fail; 486 487 ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_key_usage, 488 "nonRepudiation,digitalSignature,keyEncipherment"); 489 if (ex == NULL || 490 !sk_X509_EXTENSION_push(exts, ex)) 491 goto fail; 492 493 ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_ext_key_usage, 494 "1.3.6.1.4.1.40808.1.1.2"); 495 if (ex == NULL || 496 !sk_X509_EXTENSION_push(exts, ex)) 497 goto fail; 498 499 add_csrattrs(ctx, csrattrs, exts); 500 501 if (!X509_REQ_add_extensions(req, exts)) 502 goto fail; 503 sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free); 504 exts = NULL; 505 506 if (!X509_REQ_sign(req, pkey, EVP_sha256())) 507 goto fail; 508 509 out = BIO_new(BIO_s_mem()); 510 if (out) { 511 char *txt; 512 size_t rlen; 513 514 #if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL) 515 X509_REQ_print(out, req); 516 #endif 517 rlen = BIO_ctrl_pending(out); 518 txt = os_malloc(rlen + 1); 519 if (txt) { 520 int res = BIO_read(out, txt, rlen); 521 if (res > 0) { 522 txt[res] = '\0'; 523 wpa_printf(MSG_MSGDUMP, "OpenSSL: Certificate request:\n%s", 524 txt); 525 } 526 os_free(txt); 527 } 528 BIO_free(out); 529 } 530 531 if (csr_pem) { 532 FILE *f = fopen(csr_pem, "w"); 533 if (f == NULL) 534 goto fail; 535 #if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL) 536 X509_REQ_print_fp(f, req); 537 #endif 538 if (!PEM_write_X509_REQ(f, req)) { 539 fclose(f); 540 goto fail; 541 } 542 fclose(f); 543 } 544 545 if (est_req) { 546 BIO *mem = BIO_new(BIO_s_mem()); 547 BUF_MEM *ptr; 548 char *pos, *end, *buf_end; 549 FILE *f; 550 551 if (mem == NULL) 552 goto fail; 553 if (!PEM_write_bio_X509_REQ(mem, req)) { 554 BIO_free(mem); 555 goto fail; 556 } 557 558 BIO_get_mem_ptr(mem, &ptr); 559 pos = ptr->data; 560 buf_end = pos + ptr->length; 561 562 /* Remove START/END lines */ 563 while (pos < buf_end && *pos != '\n') 564 pos++; 565 if (pos == buf_end) { 566 BIO_free(mem); 567 goto fail; 568 } 569 pos++; 570 571 end = pos; 572 while (end < buf_end && *end != '-') 573 end++; 574 575 f = fopen(est_req, "w"); 576 if (f == NULL) { 577 BIO_free(mem); 578 goto fail; 579 } 580 fwrite(pos, end - pos, 1, f); 581 fclose(f); 582 583 BIO_free(mem); 584 } 585 586 ret = 0; 587 fail: 588 if (exts) 589 sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free); 590 if (subj) 591 X509_NAME_free(subj); 592 if (req) 593 X509_REQ_free(req); 594 if (pkey) 595 EVP_PKEY_free(pkey); 596 if (pctx) 597 EVP_PKEY_CTX_free(pctx); 598 return ret; 599 } 600 601 602 int est_build_csr(struct hs20_osu_client *ctx, const char *url) 603 { 604 char *buf; 605 size_t buflen; 606 int res; 607 char old_cert_buf[200]; 608 char *old_cert = NULL; 609 CsrAttrs *csrattrs = NULL; 610 611 buflen = os_strlen(url) + 100; 612 buf = os_malloc(buflen); 613 if (buf == NULL) 614 return -1; 615 616 os_snprintf(buf, buflen, "%s/csrattrs", url); 617 wpa_printf(MSG_INFO, "Download csrattrs from %s", buf); 618 write_summary(ctx, "Download EST csrattrs from %s", buf); 619 ctx->no_osu_cert_validation = 1; 620 http_ocsp_set(ctx->http, 1); 621 res = http_download_file(ctx->http, buf, "Cert/est-csrattrs.txt", 622 ctx->ca_fname); 623 http_ocsp_set(ctx->http, 624 (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2); 625 ctx->no_osu_cert_validation = 0; 626 os_free(buf); 627 if (res < 0) { 628 wpa_printf(MSG_INFO, "Failed to download EST csrattrs - assume no extra attributes are needed"); 629 } else { 630 size_t resp_len; 631 char *resp; 632 unsigned char *attrs; 633 const unsigned char *pos; 634 size_t attrs_len; 635 636 resp = os_readfile("Cert/est-csrattrs.txt", &resp_len); 637 if (resp == NULL) { 638 wpa_printf(MSG_INFO, "Could not read csrattrs"); 639 return -1; 640 } 641 642 attrs = base64_decode(resp, resp_len, &attrs_len); 643 os_free(resp); 644 645 if (attrs == NULL) { 646 wpa_printf(MSG_INFO, "Could not base64 decode csrattrs"); 647 return -1; 648 } 649 unlink("Cert/est-csrattrs.txt"); 650 651 pos = attrs; 652 csrattrs = d2i_CsrAttrs(NULL, &pos, attrs_len); 653 os_free(attrs); 654 if (csrattrs == NULL) { 655 wpa_printf(MSG_INFO, "Failed to parse csrattrs ASN.1"); 656 /* Continue assuming no additional requirements */ 657 } 658 } 659 660 if (ctx->client_cert_present) { 661 os_snprintf(old_cert_buf, sizeof(old_cert_buf), 662 "SP/%s/client-cert.pem", ctx->fqdn); 663 old_cert = old_cert_buf; 664 } 665 666 res = generate_csr(ctx, "Cert/privkey-plain.pem", "Cert/est-req.pem", 667 "Cert/est-req.b64", old_cert, csrattrs); 668 if (csrattrs) 669 CsrAttrs_free(csrattrs); 670 671 return res; 672 } 673 674 675 int est_simple_enroll(struct hs20_osu_client *ctx, const char *url, 676 const char *user, const char *pw) 677 { 678 char *buf, *resp, *req, *req2; 679 size_t buflen, resp_len, len, pkcs7_len; 680 unsigned char *pkcs7; 681 char client_cert_buf[200]; 682 char client_key_buf[200]; 683 const char *client_cert = NULL, *client_key = NULL; 684 int res; 685 686 req = os_readfile("Cert/est-req.b64", &len); 687 if (req == NULL) { 688 wpa_printf(MSG_INFO, "Could not read Cert/req.b64"); 689 return -1; 690 } 691 req2 = os_realloc(req, len + 1); 692 if (req2 == NULL) { 693 os_free(req); 694 return -1; 695 } 696 req2[len] = '\0'; 697 req = req2; 698 wpa_printf(MSG_DEBUG, "EST simpleenroll request: %s", req); 699 700 buflen = os_strlen(url) + 100; 701 buf = os_malloc(buflen); 702 if (buf == NULL) { 703 os_free(req); 704 return -1; 705 } 706 707 if (ctx->client_cert_present) { 708 os_snprintf(buf, buflen, "%s/simplereenroll", url); 709 os_snprintf(client_cert_buf, sizeof(client_cert_buf), 710 "SP/%s/client-cert.pem", ctx->fqdn); 711 client_cert = client_cert_buf; 712 os_snprintf(client_key_buf, sizeof(client_key_buf), 713 "SP/%s/client-key.pem", ctx->fqdn); 714 client_key = client_key_buf; 715 } else 716 os_snprintf(buf, buflen, "%s/simpleenroll", url); 717 wpa_printf(MSG_INFO, "EST simpleenroll URL: %s", buf); 718 write_summary(ctx, "EST simpleenroll URL: %s", buf); 719 ctx->no_osu_cert_validation = 1; 720 http_ocsp_set(ctx->http, 1); 721 resp = http_post(ctx->http, buf, req, "application/pkcs10", 722 "Content-Transfer-Encoding: base64", 723 ctx->ca_fname, user, pw, client_cert, client_key, 724 &resp_len); 725 http_ocsp_set(ctx->http, 726 (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2); 727 ctx->no_osu_cert_validation = 0; 728 os_free(buf); 729 if (resp == NULL) { 730 wpa_printf(MSG_INFO, "EST certificate enrollment failed"); 731 write_result(ctx, "EST certificate enrollment failed"); 732 return -1; 733 } 734 wpa_printf(MSG_DEBUG, "EST simpleenroll response: %s", resp); 735 736 pkcs7 = base64_decode(resp, resp_len, &pkcs7_len); 737 if (pkcs7 == NULL) { 738 wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7"); 739 pkcs7 = os_malloc(resp_len); 740 if (pkcs7) { 741 os_memcpy(pkcs7, resp, resp_len); 742 pkcs7_len = resp_len; 743 } 744 } 745 os_free(resp); 746 747 if (pkcs7 == NULL) { 748 wpa_printf(MSG_INFO, "Failed to parse simpleenroll base64 response"); 749 write_result(ctx, "Failed to parse EST simpleenroll base64 response"); 750 return -1; 751 } 752 753 res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est_cert.pem", 754 "Cert/est_cert.der"); 755 os_free(pkcs7); 756 757 if (res < 0) { 758 wpa_printf(MSG_INFO, "EST: Failed to extract certificate from PKCS7 file"); 759 write_result(ctx, "EST: Failed to extract certificate from EST PKCS7 file"); 760 return -1; 761 } 762 763 wpa_printf(MSG_INFO, "EST simple%senroll completed successfully", 764 ctx->client_cert_present ? "re" : ""); 765 write_summary(ctx, "EST simple%senroll completed successfully", 766 ctx->client_cert_present ? "re" : ""); 767 768 return 0; 769 } 770