1 /* 2 * EAP peer method: EAP-FAST PAC file processing 3 * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #include "includes.h" 16 17 #include "common.h" 18 #include "eap_config.h" 19 #include "eap_i.h" 20 #include "eap_fast_pac.h" 21 22 /* TODO: encrypt PAC-Key in the PAC file */ 23 24 25 /* Text data format */ 26 static const char *pac_file_hdr = 27 "wpa_supplicant EAP-FAST PAC file - version 1"; 28 29 /* 30 * Binary data format 31 * 4-octet magic value: 6A E4 92 0C 32 * 2-octet version (big endian) 33 * <version specific data> 34 * 35 * version=0: 36 * Sequence of PAC entries: 37 * 2-octet PAC-Type (big endian) 38 * 32-octet PAC-Key 39 * 2-octet PAC-Opaque length (big endian) 40 * <variable len> PAC-Opaque data (length bytes) 41 * 2-octet PAC-Info length (big endian) 42 * <variable len> PAC-Info data (length bytes) 43 */ 44 45 #define EAP_FAST_PAC_BINARY_MAGIC 0x6ae4920c 46 #define EAP_FAST_PAC_BINARY_FORMAT_VERSION 0 47 48 49 /** 50 * eap_fast_free_pac - Free PAC data 51 * @pac: Pointer to the PAC entry 52 * 53 * Note that the PAC entry must not be in a list since this function does not 54 * remove the list links. 55 */ 56 void eap_fast_free_pac(struct eap_fast_pac *pac) 57 { 58 os_free(pac->pac_opaque); 59 os_free(pac->pac_info); 60 os_free(pac->a_id); 61 os_free(pac->i_id); 62 os_free(pac->a_id_info); 63 os_free(pac); 64 } 65 66 67 /** 68 * eap_fast_get_pac - Get a PAC entry based on A-ID 69 * @pac_root: Pointer to root of the PAC list 70 * @a_id: A-ID to search for 71 * @a_id_len: Length of A-ID 72 * @pac_type: PAC-Type to search for 73 * Returns: Pointer to the PAC entry, or %NULL if A-ID not found 74 */ 75 struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_pac *pac_root, 76 const u8 *a_id, size_t a_id_len, 77 u16 pac_type) 78 { 79 struct eap_fast_pac *pac = pac_root; 80 81 while (pac) { 82 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len && 83 os_memcmp(pac->a_id, a_id, a_id_len) == 0) { 84 return pac; 85 } 86 pac = pac->next; 87 } 88 return NULL; 89 } 90 91 92 static void eap_fast_remove_pac(struct eap_fast_pac **pac_root, 93 struct eap_fast_pac **pac_current, 94 const u8 *a_id, size_t a_id_len, u16 pac_type) 95 { 96 struct eap_fast_pac *pac, *prev; 97 98 pac = *pac_root; 99 prev = NULL; 100 101 while (pac) { 102 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len && 103 os_memcmp(pac->a_id, a_id, a_id_len) == 0) { 104 if (prev == NULL) 105 *pac_root = pac->next; 106 else 107 prev->next = pac->next; 108 if (*pac_current == pac) 109 *pac_current = NULL; 110 eap_fast_free_pac(pac); 111 break; 112 } 113 prev = pac; 114 pac = pac->next; 115 } 116 } 117 118 119 static int eap_fast_copy_buf(u8 **dst, size_t *dst_len, 120 const u8 *src, size_t src_len) 121 { 122 if (src) { 123 *dst = os_malloc(src_len); 124 if (*dst == NULL) 125 return -1; 126 os_memcpy(*dst, src, src_len); 127 *dst_len = src_len; 128 } 129 return 0; 130 } 131 132 133 /** 134 * eap_fast_add_pac - Add a copy of a PAC entry to a list 135 * @pac_root: Pointer to PAC list root pointer 136 * @pac_current: Pointer to the current PAC pointer 137 * @entry: New entry to clone and add to the list 138 * Returns: 0 on success, -1 on failure 139 * 140 * This function makes a clone of the given PAC entry and adds this copied 141 * entry to the list (pac_root). If an old entry for the same A-ID is found, 142 * it will be removed from the PAC list and in this case, pac_current entry 143 * is set to %NULL if it was the removed entry. 144 */ 145 int eap_fast_add_pac(struct eap_fast_pac **pac_root, 146 struct eap_fast_pac **pac_current, 147 struct eap_fast_pac *entry) 148 { 149 struct eap_fast_pac *pac; 150 151 if (entry == NULL || entry->a_id == NULL) 152 return -1; 153 154 /* Remove a possible old entry for the matching A-ID. */ 155 eap_fast_remove_pac(pac_root, pac_current, 156 entry->a_id, entry->a_id_len, entry->pac_type); 157 158 /* Allocate a new entry and add it to the list of PACs. */ 159 pac = os_zalloc(sizeof(*pac)); 160 if (pac == NULL) 161 return -1; 162 163 pac->pac_type = entry->pac_type; 164 os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN); 165 if (eap_fast_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len, 166 entry->pac_opaque, entry->pac_opaque_len) < 0 || 167 eap_fast_copy_buf(&pac->pac_info, &pac->pac_info_len, 168 entry->pac_info, entry->pac_info_len) < 0 || 169 eap_fast_copy_buf(&pac->a_id, &pac->a_id_len, 170 entry->a_id, entry->a_id_len) < 0 || 171 eap_fast_copy_buf(&pac->i_id, &pac->i_id_len, 172 entry->i_id, entry->i_id_len) < 0 || 173 eap_fast_copy_buf(&pac->a_id_info, &pac->a_id_info_len, 174 entry->a_id_info, entry->a_id_info_len) < 0) { 175 eap_fast_free_pac(pac); 176 return -1; 177 } 178 179 pac->next = *pac_root; 180 *pac_root = pac; 181 182 return 0; 183 } 184 185 186 struct eap_fast_read_ctx { 187 FILE *f; 188 const char *pos; 189 const char *end; 190 int line; 191 char *buf; 192 size_t buf_len; 193 }; 194 195 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char **value) 196 { 197 char *pos; 198 199 rc->line++; 200 if (rc->f) { 201 if (fgets(rc->buf, rc->buf_len, rc->f) == NULL) 202 return -1; 203 } else { 204 const char *l_end; 205 size_t len; 206 if (rc->pos >= rc->end) 207 return -1; 208 l_end = rc->pos; 209 while (l_end < rc->end && *l_end != '\n') 210 l_end++; 211 len = l_end - rc->pos; 212 if (len >= rc->buf_len) 213 len = rc->buf_len - 1; 214 os_memcpy(rc->buf, rc->pos, len); 215 rc->buf[len] = '\0'; 216 rc->pos = l_end + 1; 217 } 218 219 rc->buf[rc->buf_len - 1] = '\0'; 220 pos = rc->buf; 221 while (*pos != '\0') { 222 if (*pos == '\n' || *pos == '\r') { 223 *pos = '\0'; 224 break; 225 } 226 pos++; 227 } 228 229 pos = os_strchr(rc->buf, '='); 230 if (pos) 231 *pos++ = '\0'; 232 *value = pos; 233 234 return 0; 235 } 236 237 238 static u8 * eap_fast_parse_hex(const char *value, size_t *len) 239 { 240 int hlen; 241 u8 *buf; 242 243 if (value == NULL) 244 return NULL; 245 hlen = os_strlen(value); 246 if (hlen & 1) 247 return NULL; 248 *len = hlen / 2; 249 buf = os_malloc(*len); 250 if (buf == NULL) 251 return NULL; 252 if (hexstr2bin(value, buf, *len)) { 253 os_free(buf); 254 return NULL; 255 } 256 return buf; 257 } 258 259 260 static int eap_fast_init_pac_data(struct eap_sm *sm, const char *pac_file, 261 struct eap_fast_read_ctx *rc) 262 { 263 os_memset(rc, 0, sizeof(*rc)); 264 265 rc->buf_len = 2048; 266 rc->buf = os_malloc(rc->buf_len); 267 if (rc->buf == NULL) 268 return -1; 269 270 if (os_strncmp(pac_file, "blob://", 7) == 0) { 271 const struct wpa_config_blob *blob; 272 blob = eap_get_config_blob(sm, pac_file + 7); 273 if (blob == NULL) { 274 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - " 275 "assume no PAC entries have been " 276 "provisioned", pac_file + 7); 277 os_free(rc->buf); 278 return -1; 279 } 280 rc->pos = (char *) blob->data; 281 rc->end = (char *) blob->data + blob->len; 282 } else { 283 rc->f = fopen(pac_file, "rb"); 284 if (rc->f == NULL) { 285 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - " 286 "assume no PAC entries have been " 287 "provisioned", pac_file); 288 os_free(rc->buf); 289 return -1; 290 } 291 } 292 293 return 0; 294 } 295 296 297 static void eap_fast_deinit_pac_data(struct eap_fast_read_ctx *rc) 298 { 299 os_free(rc->buf); 300 if (rc->f) 301 fclose(rc->f); 302 } 303 304 305 static const char * eap_fast_parse_start(struct eap_fast_pac **pac) 306 { 307 if (*pac) 308 return "START line without END"; 309 310 *pac = os_zalloc(sizeof(struct eap_fast_pac)); 311 if (*pac == NULL) 312 return "No memory for PAC entry"; 313 (*pac)->pac_type = PAC_TYPE_TUNNEL_PAC; 314 return NULL; 315 } 316 317 318 static const char * eap_fast_parse_end(struct eap_fast_pac **pac_root, 319 struct eap_fast_pac **pac) 320 { 321 if (*pac == NULL) 322 return "END line without START"; 323 if (*pac_root) { 324 struct eap_fast_pac *end = *pac_root; 325 while (end->next) 326 end = end->next; 327 end->next = *pac; 328 } else 329 *pac_root = *pac; 330 331 *pac = NULL; 332 return NULL; 333 } 334 335 336 static const char * eap_fast_parse_pac_type(struct eap_fast_pac *pac, 337 char *pos) 338 { 339 pac->pac_type = atoi(pos); 340 if (pac->pac_type != PAC_TYPE_TUNNEL_PAC && 341 pac->pac_type != PAC_TYPE_USER_AUTHORIZATION && 342 pac->pac_type != PAC_TYPE_MACHINE_AUTHENTICATION) 343 return "Unrecognized PAC-Type"; 344 345 return NULL; 346 } 347 348 349 static const char * eap_fast_parse_pac_key(struct eap_fast_pac *pac, char *pos) 350 { 351 u8 *key; 352 size_t key_len; 353 354 key = eap_fast_parse_hex(pos, &key_len); 355 if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) { 356 os_free(key); 357 return "Invalid PAC-Key"; 358 } 359 360 os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN); 361 os_free(key); 362 363 return NULL; 364 } 365 366 367 static const char * eap_fast_parse_pac_opaque(struct eap_fast_pac *pac, 368 char *pos) 369 { 370 os_free(pac->pac_opaque); 371 pac->pac_opaque = eap_fast_parse_hex(pos, &pac->pac_opaque_len); 372 if (pac->pac_opaque == NULL) 373 return "Invalid PAC-Opaque"; 374 return NULL; 375 } 376 377 378 static const char * eap_fast_parse_a_id(struct eap_fast_pac *pac, char *pos) 379 { 380 os_free(pac->a_id); 381 pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len); 382 if (pac->a_id == NULL) 383 return "Invalid A-ID"; 384 return NULL; 385 } 386 387 388 static const char * eap_fast_parse_i_id(struct eap_fast_pac *pac, char *pos) 389 { 390 os_free(pac->i_id); 391 pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len); 392 if (pac->i_id == NULL) 393 return "Invalid I-ID"; 394 return NULL; 395 } 396 397 398 static const char * eap_fast_parse_a_id_info(struct eap_fast_pac *pac, 399 char *pos) 400 { 401 os_free(pac->a_id_info); 402 pac->a_id_info = eap_fast_parse_hex(pos, &pac->a_id_info_len); 403 if (pac->a_id_info == NULL) 404 return "Invalid A-ID-Info"; 405 return NULL; 406 } 407 408 409 /** 410 * eap_fast_load_pac - Load PAC entries (text format) 411 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 412 * @pac_root: Pointer to root of the PAC list (to be filled) 413 * @pac_file: Name of the PAC file/blob to load 414 * Returns: 0 on success, -1 on failure 415 */ 416 int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_pac **pac_root, 417 const char *pac_file) 418 { 419 struct eap_fast_read_ctx rc; 420 struct eap_fast_pac *pac = NULL; 421 int count = 0; 422 char *pos; 423 const char *err = NULL; 424 425 if (pac_file == NULL) 426 return -1; 427 428 if (eap_fast_init_pac_data(sm, pac_file, &rc) < 0) 429 return 0; 430 431 if (eap_fast_read_line(&rc, &pos) < 0 || 432 os_strcmp(pac_file_hdr, rc.buf) != 0) 433 err = "Unrecognized header line"; 434 435 while (!err && eap_fast_read_line(&rc, &pos) == 0) { 436 if (os_strcmp(rc.buf, "START") == 0) 437 err = eap_fast_parse_start(&pac); 438 else if (os_strcmp(rc.buf, "END") == 0) { 439 err = eap_fast_parse_end(pac_root, &pac); 440 count++; 441 } else if (!pac) 442 err = "Unexpected line outside START/END block"; 443 else if (os_strcmp(rc.buf, "PAC-Type") == 0) 444 err = eap_fast_parse_pac_type(pac, pos); 445 else if (os_strcmp(rc.buf, "PAC-Key") == 0) 446 err = eap_fast_parse_pac_key(pac, pos); 447 else if (os_strcmp(rc.buf, "PAC-Opaque") == 0) 448 err = eap_fast_parse_pac_opaque(pac, pos); 449 else if (os_strcmp(rc.buf, "A-ID") == 0) 450 err = eap_fast_parse_a_id(pac, pos); 451 else if (os_strcmp(rc.buf, "I-ID") == 0) 452 err = eap_fast_parse_i_id(pac, pos); 453 else if (os_strcmp(rc.buf, "A-ID-Info") == 0) 454 err = eap_fast_parse_a_id_info(pac, pos); 455 } 456 457 if (pac) { 458 err = "PAC block not terminated with END"; 459 eap_fast_free_pac(pac); 460 } 461 462 eap_fast_deinit_pac_data(&rc); 463 464 if (err) { 465 wpa_printf(MSG_INFO, "EAP-FAST: %s in '%s:%d'", 466 err, pac_file, rc.line); 467 return -1; 468 } 469 470 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %d PAC entries from '%s'", 471 count, pac_file); 472 473 return 0; 474 } 475 476 477 static void eap_fast_write(char **buf, char **pos, size_t *buf_len, 478 const char *field, const u8 *data, 479 size_t len, int txt) 480 { 481 size_t i, need; 482 int ret; 483 char *end; 484 485 if (data == NULL || buf == NULL || *buf == NULL || 486 pos == NULL || *pos == NULL || *pos < *buf) 487 return; 488 489 need = os_strlen(field) + len * 2 + 30; 490 if (txt) 491 need += os_strlen(field) + len + 20; 492 493 if (*pos - *buf + need > *buf_len) { 494 char *nbuf = os_realloc(*buf, *buf_len + need); 495 if (nbuf == NULL) { 496 os_free(*buf); 497 *buf = NULL; 498 return; 499 } 500 *buf = nbuf; 501 *buf_len += need; 502 } 503 end = *buf + *buf_len; 504 505 ret = os_snprintf(*pos, end - *pos, "%s=", field); 506 if (ret < 0 || ret >= end - *pos) 507 return; 508 *pos += ret; 509 *pos += wpa_snprintf_hex(*pos, end - *pos, data, len); 510 ret = os_snprintf(*pos, end - *pos, "\n"); 511 if (ret < 0 || ret >= end - *pos) 512 return; 513 *pos += ret; 514 515 if (txt) { 516 ret = os_snprintf(*pos, end - *pos, "%s-txt=", field); 517 if (ret < 0 || ret >= end - *pos) 518 return; 519 *pos += ret; 520 for (i = 0; i < len; i++) { 521 ret = os_snprintf(*pos, end - *pos, "%c", data[i]); 522 if (ret < 0 || ret >= end - *pos) 523 return; 524 *pos += ret; 525 } 526 ret = os_snprintf(*pos, end - *pos, "\n"); 527 if (ret < 0 || ret >= end - *pos) 528 return; 529 *pos += ret; 530 } 531 } 532 533 534 static int eap_fast_write_pac(struct eap_sm *sm, const char *pac_file, 535 char *buf, size_t len) 536 { 537 if (os_strncmp(pac_file, "blob://", 7) == 0) { 538 struct wpa_config_blob *blob; 539 blob = os_zalloc(sizeof(*blob)); 540 if (blob == NULL) 541 return -1; 542 blob->data = (u8 *) buf; 543 blob->len = len; 544 buf = NULL; 545 blob->name = os_strdup(pac_file + 7); 546 if (blob->name == NULL) { 547 os_free(blob); 548 return -1; 549 } 550 eap_set_config_blob(sm, blob); 551 } else { 552 FILE *f; 553 f = fopen(pac_file, "wb"); 554 if (f == NULL) { 555 wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC " 556 "file '%s' for writing", pac_file); 557 return -1; 558 } 559 if (fwrite(buf, 1, len, f) != len) { 560 wpa_printf(MSG_INFO, "EAP-FAST: Failed to write all " 561 "PACs into '%s'", pac_file); 562 fclose(f); 563 return -1; 564 } 565 os_free(buf); 566 fclose(f); 567 } 568 569 return 0; 570 } 571 572 573 static int eap_fast_add_pac_data(struct eap_fast_pac *pac, char **buf, 574 char **pos, size_t *buf_len) 575 { 576 int ret; 577 578 ret = os_snprintf(*pos, *buf + *buf_len - *pos, 579 "START\nPAC-Type=%d\n", pac->pac_type); 580 if (ret < 0 || ret >= *buf + *buf_len - *pos) 581 return -1; 582 583 *pos += ret; 584 eap_fast_write(buf, pos, buf_len, "PAC-Key", 585 pac->pac_key, EAP_FAST_PAC_KEY_LEN, 0); 586 eap_fast_write(buf, pos, buf_len, "PAC-Opaque", 587 pac->pac_opaque, pac->pac_opaque_len, 0); 588 eap_fast_write(buf, pos, buf_len, "PAC-Info", 589 pac->pac_info, pac->pac_info_len, 0); 590 eap_fast_write(buf, pos, buf_len, "A-ID", 591 pac->a_id, pac->a_id_len, 0); 592 eap_fast_write(buf, pos, buf_len, "I-ID", 593 pac->i_id, pac->i_id_len, 1); 594 eap_fast_write(buf, pos, buf_len, "A-ID-Info", 595 pac->a_id_info, pac->a_id_info_len, 1); 596 if (*buf == NULL) { 597 wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC " 598 "data"); 599 return -1; 600 } 601 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n"); 602 if (ret < 0 || ret >= *buf + *buf_len - *pos) 603 return -1; 604 *pos += ret; 605 606 return 0; 607 } 608 609 610 /** 611 * eap_fast_save_pac - Save PAC entries (text format) 612 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 613 * @pac_root: Root of the PAC list 614 * @pac_file: Name of the PAC file/blob 615 * Returns: 0 on success, -1 on failure 616 */ 617 int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_pac *pac_root, 618 const char *pac_file) 619 { 620 struct eap_fast_pac *pac; 621 int ret, count = 0; 622 char *buf, *pos; 623 size_t buf_len; 624 625 if (pac_file == NULL) 626 return -1; 627 628 buf_len = 1024; 629 pos = buf = os_malloc(buf_len); 630 if (buf == NULL) 631 return -1; 632 633 ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr); 634 if (ret < 0 || ret >= buf + buf_len - pos) { 635 os_free(buf); 636 return -1; 637 } 638 pos += ret; 639 640 pac = pac_root; 641 while (pac) { 642 if (eap_fast_add_pac_data(pac, &buf, &pos, &buf_len)) { 643 os_free(buf); 644 return -1; 645 } 646 count++; 647 pac = pac->next; 648 } 649 650 if (eap_fast_write_pac(sm, pac_file, buf, pos - buf)) { 651 os_free(buf); 652 return -1; 653 } 654 655 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %d PAC entries into '%s'", 656 count, pac_file); 657 658 return 0; 659 } 660 661 662 /** 663 * eap_fast_pac_list_truncate - Truncate a PAC list to the given length 664 * @pac_root: Root of the PAC list 665 * @max_len: Maximum length of the list (>= 1) 666 * Returns: Number of PAC entries removed 667 */ 668 size_t eap_fast_pac_list_truncate(struct eap_fast_pac *pac_root, 669 size_t max_len) 670 { 671 struct eap_fast_pac *pac, *prev; 672 size_t count; 673 674 pac = pac_root; 675 prev = NULL; 676 count = 0; 677 678 while (pac) { 679 count++; 680 if (count > max_len) 681 break; 682 prev = pac; 683 pac = pac->next; 684 } 685 686 if (count <= max_len || prev == NULL) 687 return 0; 688 689 count = 0; 690 prev->next = NULL; 691 692 while (pac) { 693 prev = pac; 694 pac = pac->next; 695 eap_fast_free_pac(prev); 696 count++; 697 } 698 699 return count; 700 } 701 702 703 static void eap_fast_pac_get_a_id(struct eap_fast_pac *pac) 704 { 705 u8 *pos, *end; 706 u16 type, len; 707 708 pos = pac->pac_info; 709 end = pos + pac->pac_info_len; 710 711 while (pos + 4 < end) { 712 type = WPA_GET_BE16(pos); 713 pos += 2; 714 len = WPA_GET_BE16(pos); 715 pos += 2; 716 if (pos + len > end) 717 break; 718 719 if (type == PAC_TYPE_A_ID) { 720 os_free(pac->a_id); 721 pac->a_id = os_malloc(len); 722 if (pac->a_id == NULL) 723 break; 724 os_memcpy(pac->a_id, pos, len); 725 pac->a_id_len = len; 726 } 727 728 if (type == PAC_TYPE_A_ID_INFO) { 729 os_free(pac->a_id_info); 730 pac->a_id_info = os_malloc(len); 731 if (pac->a_id_info == NULL) 732 break; 733 os_memcpy(pac->a_id_info, pos, len); 734 pac->a_id_info_len = len; 735 } 736 737 pos += len; 738 } 739 } 740 741 742 /** 743 * eap_fast_load_pac_bin - Load PAC entries (binary format) 744 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 745 * @pac_root: Pointer to root of the PAC list (to be filled) 746 * @pac_file: Name of the PAC file/blob to load 747 * Returns: 0 on success, -1 on failure 748 */ 749 int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root, 750 const char *pac_file) 751 { 752 const struct wpa_config_blob *blob = NULL; 753 u8 *buf, *end, *pos; 754 size_t len, count = 0; 755 struct eap_fast_pac *pac, *prev; 756 757 *pac_root = NULL; 758 759 if (pac_file == NULL) 760 return -1; 761 762 if (os_strncmp(pac_file, "blob://", 7) == 0) { 763 blob = eap_get_config_blob(sm, pac_file + 7); 764 if (blob == NULL) { 765 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - " 766 "assume no PAC entries have been " 767 "provisioned", pac_file + 7); 768 return 0; 769 } 770 buf = blob->data; 771 len = blob->len; 772 } else { 773 buf = (u8 *) os_readfile(pac_file, &len); 774 if (buf == NULL) { 775 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - " 776 "assume no PAC entries have been " 777 "provisioned", pac_file); 778 return 0; 779 } 780 } 781 782 if (len == 0) { 783 if (blob == NULL) 784 os_free(buf); 785 return 0; 786 } 787 788 if (len < 6 || WPA_GET_BE32(buf) != EAP_FAST_PAC_BINARY_MAGIC || 789 WPA_GET_BE16(buf + 4) != EAP_FAST_PAC_BINARY_FORMAT_VERSION) { 790 wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC file '%s' (bin)", 791 pac_file); 792 if (blob == NULL) 793 os_free(buf); 794 return -1; 795 } 796 797 pac = prev = NULL; 798 pos = buf + 6; 799 end = buf + len; 800 while (pos < end) { 801 if (end - pos < 2 + 32 + 2 + 2) 802 goto parse_fail; 803 804 pac = os_zalloc(sizeof(*pac)); 805 if (pac == NULL) 806 goto parse_fail; 807 808 pac->pac_type = WPA_GET_BE16(pos); 809 pos += 2; 810 os_memcpy(pac->pac_key, pos, EAP_FAST_PAC_KEY_LEN); 811 pos += EAP_FAST_PAC_KEY_LEN; 812 pac->pac_opaque_len = WPA_GET_BE16(pos); 813 pos += 2; 814 if (pos + pac->pac_opaque_len + 2 > end) 815 goto parse_fail; 816 pac->pac_opaque = os_malloc(pac->pac_opaque_len); 817 if (pac->pac_opaque == NULL) 818 goto parse_fail; 819 os_memcpy(pac->pac_opaque, pos, pac->pac_opaque_len); 820 pos += pac->pac_opaque_len; 821 pac->pac_info_len = WPA_GET_BE16(pos); 822 pos += 2; 823 if (pos + pac->pac_info_len > end) 824 goto parse_fail; 825 pac->pac_info = os_malloc(pac->pac_info_len); 826 if (pac->pac_info == NULL) 827 goto parse_fail; 828 os_memcpy(pac->pac_info, pos, pac->pac_info_len); 829 pos += pac->pac_info_len; 830 eap_fast_pac_get_a_id(pac); 831 832 count++; 833 if (prev) 834 prev->next = pac; 835 else 836 *pac_root = pac; 837 prev = pac; 838 } 839 840 if (blob == NULL) 841 os_free(buf); 842 843 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %lu PAC entries from '%s' (bin)", 844 (unsigned long) count, pac_file); 845 846 return 0; 847 848 parse_fail: 849 wpa_printf(MSG_INFO, "EAP-FAST: Failed to parse PAC file '%s' (bin)", 850 pac_file); 851 if (blob == NULL) 852 os_free(buf); 853 if (pac) 854 eap_fast_free_pac(pac); 855 return -1; 856 } 857 858 859 /** 860 * eap_fast_save_pac_bin - Save PAC entries (binary format) 861 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 862 * @pac_root: Root of the PAC list 863 * @pac_file: Name of the PAC file/blob 864 * Returns: 0 on success, -1 on failure 865 */ 866 int eap_fast_save_pac_bin(struct eap_sm *sm, struct eap_fast_pac *pac_root, 867 const char *pac_file) 868 { 869 size_t len, count = 0; 870 struct eap_fast_pac *pac; 871 u8 *buf, *pos; 872 873 len = 6; 874 pac = pac_root; 875 while (pac) { 876 if (pac->pac_opaque_len > 65535 || 877 pac->pac_info_len > 65535) 878 return -1; 879 len += 2 + EAP_FAST_PAC_KEY_LEN + 2 + pac->pac_opaque_len + 880 2 + pac->pac_info_len; 881 pac = pac->next; 882 } 883 884 buf = os_malloc(len); 885 if (buf == NULL) 886 return -1; 887 888 pos = buf; 889 WPA_PUT_BE32(pos, EAP_FAST_PAC_BINARY_MAGIC); 890 pos += 4; 891 WPA_PUT_BE16(pos, EAP_FAST_PAC_BINARY_FORMAT_VERSION); 892 pos += 2; 893 894 pac = pac_root; 895 while (pac) { 896 WPA_PUT_BE16(pos, pac->pac_type); 897 pos += 2; 898 os_memcpy(pos, pac->pac_key, EAP_FAST_PAC_KEY_LEN); 899 pos += EAP_FAST_PAC_KEY_LEN; 900 WPA_PUT_BE16(pos, pac->pac_opaque_len); 901 pos += 2; 902 os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len); 903 pos += pac->pac_opaque_len; 904 WPA_PUT_BE16(pos, pac->pac_info_len); 905 pos += 2; 906 os_memcpy(pos, pac->pac_info, pac->pac_info_len); 907 pos += pac->pac_info_len; 908 909 pac = pac->next; 910 count++; 911 } 912 913 if (eap_fast_write_pac(sm, pac_file, (char *) buf, len)) { 914 os_free(buf); 915 return -1; 916 } 917 918 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %lu PAC entries into '%s' " 919 "(bin)", (unsigned long) count, pac_file); 920 921 return 0; 922 } 923