libeap/src/eap_peer/eap_fast_pac.c

   1 /*
   2  * EAP peer method: EAP-FAST PAC file processing
   3  * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "eap_config.h"
  13 #include "eap_i.h"
  14 #include "eap_fast_pac.h"
  15
  16 /* TODO: encrypt PAC-Key in the PAC file */
  17
  18
  19 /* Text data format */
  20 static const char *pac_file_hdr =
  21         "wpa_supplicant EAP-FAST PAC file - version 1";
  22
  23 /*
  24  * Binary data format
  25  * 4-octet magic value: 6A E4 92 0C
  26  * 2-octet version (big endian)
  27  * <version specific data>
  28  *
  29  * version=0:
  30  * Sequence of PAC entries:
  31  *   2-octet PAC-Type (big endian)
  32  *   32-octet PAC-Key
  33  *   2-octet PAC-Opaque length (big endian)
  34  *   <variable len> PAC-Opaque data (length bytes)
  35  *   2-octet PAC-Info length (big endian)
  36  *   <variable len> PAC-Info data (length bytes)
  37  */
  38
  39 #define EAP_FAST_PAC_BINARY_MAGIC 0x6ae4920c
  40 #define EAP_FAST_PAC_BINARY_FORMAT_VERSION 0
  41
  42
  43 /**
  44  * eap_fast_free_pac - Free PAC data
  45  * @pac: Pointer to the PAC entry
  46  *
  47  * Note that the PAC entry must not be in a list since this function does not
  48  * remove the list links.
  49  */
  50 void eap_fast_free_pac(struct eap_fast_pac *pac)
  51 {
  52         os_free(pac->pac_opaque);
  53         os_free(pac->pac_info);
  54         os_free(pac->a_id);
  55         os_free(pac->i_id);
  56         os_free(pac->a_id_info);
  57         os_free(pac);
  58 }
  59
  60
  61 /**
  62  * eap_fast_get_pac - Get a PAC entry based on A-ID
  63  * @pac_root: Pointer to root of the PAC list
  64  * @a_id: A-ID to search for
  65  * @a_id_len: Length of A-ID
  66  * @pac_type: PAC-Type to search for
  67  * Returns: Pointer to the PAC entry, or %NULL if A-ID not found
  68  */
  69 struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_pac *pac_root,
  70                                        const u8 *a_id, size_t a_id_len,
  71                                        u16 pac_type)
  72 {
  73         struct eap_fast_pac *pac = pac_root;
  74
  75         while (pac) {
  76                 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
  77                     os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
  78                         return pac;
  79                 }
  80                 pac = pac->next;
  81         }
  82         return NULL;
  83 }
  84
  85
  86 static void eap_fast_remove_pac(struct eap_fast_pac **pac_root,
  87                                 struct eap_fast_pac **pac_current,
  88                                 const u8 *a_id, size_t a_id_len, u16 pac_type)
  89 {
  90         struct eap_fast_pac *pac, *prev;
  91
  92         pac = *pac_root;
  93         prev = NULL;
  94
  95         while (pac) {
  96                 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
  97                     os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
  98                         if (prev == NULL)
  99                                 *pac_root = pac->next;
 100                         else
 101                                 prev->next = pac->next;
 102                         if (*pac_current == pac)
 103                                 *pac_current = NULL;
 104                         eap_fast_free_pac(pac);
 105                         break;
 106                 }
 107                 prev = pac;
 108                 pac = pac->next;
 109         }
 110 }
 111
 112
 113 static int eap_fast_copy_buf(u8 **dst, size_t *dst_len,
 114                              const u8 *src, size_t src_len)
 115 {
 116         if (src) {
 117                 *dst = os_malloc(src_len);
 118                 if (*dst == NULL)
 119                         return -1;
 120                 os_memcpy(*dst, src, src_len);
 121                 *dst_len = src_len;
 122         }
 123         return 0;
 124 }
 125
 126
 127 /**
 128  * eap_fast_add_pac - Add a copy of a PAC entry to a list
 129  * @pac_root: Pointer to PAC list root pointer
 130  * @pac_current: Pointer to the current PAC pointer
 131  * @entry: New entry to clone and add to the list
 132  * Returns: 0 on success, -1 on failure
 133  *
 134  * This function makes a clone of the given PAC entry and adds this copied
 135  * entry to the list (pac_root). If an old entry for the same A-ID is found,
 136  * it will be removed from the PAC list and in this case, pac_current entry
 137  * is set to %NULL if it was the removed entry.
 138  */
 139 int eap_fast_add_pac(struct eap_fast_pac **pac_root,
 140                      struct eap_fast_pac **pac_current,
 141                      struct eap_fast_pac *entry)
 142 {
 143         struct eap_fast_pac *pac;
 144
 145         if (entry == NULL || entry->a_id == NULL)
 146                 return -1;
 147
 148         /* Remove a possible old entry for the matching A-ID. */
 149         eap_fast_remove_pac(pac_root, pac_current,
 150                             entry->a_id, entry->a_id_len, entry->pac_type);
 151
 152         /* Allocate a new entry and add it to the list of PACs. */
 153         pac = os_zalloc(sizeof(*pac));
 154         if (pac == NULL)
 155                 return -1;
 156
 157         pac->pac_type = entry->pac_type;
 158         os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN);
 159         if (eap_fast_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len,
 160                               entry->pac_opaque, entry->pac_opaque_len) < 0 ||
 161             eap_fast_copy_buf(&pac->pac_info, &pac->pac_info_len,
 162                               entry->pac_info, entry->pac_info_len) < 0 ||
 163             eap_fast_copy_buf(&pac->a_id, &pac->a_id_len,
 164                               entry->a_id, entry->a_id_len) < 0 ||
 165             eap_fast_copy_buf(&pac->i_id, &pac->i_id_len,
 166                               entry->i_id, entry->i_id_len) < 0 ||
 167             eap_fast_copy_buf(&pac->a_id_info, &pac->a_id_info_len,
 168                               entry->a_id_info, entry->a_id_info_len) < 0) {
 169                 eap_fast_free_pac(pac);
 170                 return -1;
 171         }
 172
 173         pac->next = *pac_root;
 174         *pac_root = pac;
 175
 176         return 0;
 177 }
 178
 179
 180 struct eap_fast_read_ctx {
 181         FILE *f;
 182         const char *pos;
 183         const char *end;
 184         int line;
 185         char *buf;
 186         size_t buf_len;
 187 };
 188
 189 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char **value)
 190 {
 191         char *pos;
 192
 193         rc->line++;
 194         if (rc->f) {
 195                 if (fgets(rc->buf, rc->buf_len, rc->f) == NULL)
 196                         return -1;
 197         } else {
 198                 const char *l_end;
 199                 size_t len;
 200                 if (rc->pos >= rc->end)
 201                         return -1;
 202                 l_end = rc->pos;
 203                 while (l_end < rc->end && *l_end != '\n')
 204                         l_end++;
 205                 len = l_end - rc->pos;
 206                 if (len >= rc->buf_len)
 207                         len = rc->buf_len - 1;
 208                 os_memcpy(rc->buf, rc->pos, len);
 209                 rc->buf[len] = '\0';
 210                 rc->pos = l_end + 1;
 211         }
 212
 213         rc->buf[rc->buf_len - 1] = '\0';
 214         pos = rc->buf;
 215         while (*pos != '\0') {
 216                 if (*pos == '\n' || *pos == '\r') {
 217                         *pos = '\0';
 218                         break;
 219                 }
 220                 pos++;
 221         }
 222
 223         pos = os_strchr(rc->buf, '=');
 224         if (pos)
 225                 *pos++ = '\0';
 226         *value = pos;
 227
 228         return 0;
 229 }
 230
 231
 232 static u8 * eap_fast_parse_hex(const char *value, size_t *len)
 233 {
 234         int hlen;
 235         u8 *buf;
 236
 237         if (value == NULL)
 238                 return NULL;
 239         hlen = os_strlen(value);
 240         if (hlen & 1)
 241                 return NULL;
 242         *len = hlen / 2;
 243         buf = os_malloc(*len);
 244         if (buf == NULL)
 245                 return NULL;
 246         if (hexstr2bin(value, buf, *len)) {
 247                 os_free(buf);
 248                 return NULL;
 249         }
 250         return buf;
 251 }
 252
 253
 254 static int eap_fast_init_pac_data(struct eap_sm *sm, const char *pac_file,
 255                                   struct eap_fast_read_ctx *rc)
 256 {
 257         os_memset(rc, 0, sizeof(*rc));
 258
 259         rc->buf_len = 2048;
 260         rc->buf = os_malloc(rc->buf_len);
 261         if (rc->buf == NULL)
 262                 return -1;
 263
 264         if (os_strncmp(pac_file, "blob://", 7) == 0) {
 265                 const struct wpa_config_blob *blob;
 266                 blob = eap_get_config_blob(sm, pac_file + 7);
 267                 if (blob == NULL) {
 268                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
 269                                    "assume no PAC entries have been "
 270                                    "provisioned", pac_file + 7);
 271                         os_free(rc->buf);
 272                         return -1;
 273                 }
 274                 rc->pos = (char *) blob->data;
 275                 rc->end = (char *) blob->data + blob->len;
 276         } else {
 277                 rc->f = fopen(pac_file, "rb");
 278                 if (rc->f == NULL) {
 279                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
 280                                    "assume no PAC entries have been "
 281                                    "provisioned", pac_file);
 282                         os_free(rc->buf);
 283                         return -1;
 284                 }
 285         }
 286
 287         return 0;
 288 }
 289
 290
 291 static void eap_fast_deinit_pac_data(struct eap_fast_read_ctx *rc)
 292 {
 293         os_free(rc->buf);
 294         if (rc->f)
 295                 fclose(rc->f);
 296 }
 297
 298
 299 static const char * eap_fast_parse_start(struct eap_fast_pac **pac)
 300 {
 301         if (*pac)
 302                 return "START line without END";
 303
 304         *pac = os_zalloc(sizeof(struct eap_fast_pac));
 305         if (*pac == NULL)
 306                 return "No memory for PAC entry";
 307         (*pac)->pac_type = PAC_TYPE_TUNNEL_PAC;
 308         return NULL;
 309 }
 310
 311
 312 static const char * eap_fast_parse_end(struct eap_fast_pac **pac_root,
 313                                        struct eap_fast_pac **pac)
 314 {
 315         if (*pac == NULL)
 316                 return "END line without START";
 317         if (*pac_root) {
 318                 struct eap_fast_pac *end = *pac_root;
 319                 while (end->next)
 320                         end = end->next;
 321                 end->next = *pac;
 322         } else
 323                 *pac_root = *pac;
 324
 325         *pac = NULL;
 326         return NULL;
 327 }
 328
 329
 330 static const char * eap_fast_parse_pac_type(struct eap_fast_pac *pac,
 331                                             char *pos)
 332 {
 333         if (!pos)
 334                 return "Cannot parse pac type";
 335         pac->pac_type = atoi(pos);
 336         if (pac->pac_type != PAC_TYPE_TUNNEL_PAC &&
 337             pac->pac_type != PAC_TYPE_USER_AUTHORIZATION &&
 338             pac->pac_type != PAC_TYPE_MACHINE_AUTHENTICATION)
 339                 return "Unrecognized PAC-Type";
 340
 341         return NULL;
 342 }
 343
 344
 345 static const char * eap_fast_parse_pac_key(struct eap_fast_pac *pac, char *pos)
 346 {
 347         u8 *key;
 348         size_t key_len;
 349
 350         key = eap_fast_parse_hex(pos, &key_len);
 351         if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) {
 352                 os_free(key);
 353                 return "Invalid PAC-Key";
 354         }
 355
 356         os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN);
 357         os_free(key);
 358
 359         return NULL;
 360 }
 361
 362
 363 static const char * eap_fast_parse_pac_opaque(struct eap_fast_pac *pac,
 364                                               char *pos)
 365 {
 366         os_free(pac->pac_opaque);
 367         pac->pac_opaque = eap_fast_parse_hex(pos, &pac->pac_opaque_len);
 368         if (pac->pac_opaque == NULL)
 369                 return "Invalid PAC-Opaque";
 370         return NULL;
 371 }
 372
 373
 374 static const char * eap_fast_parse_a_id(struct eap_fast_pac *pac, char *pos)
 375 {
 376         os_free(pac->a_id);
 377         pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len);
 378         if (pac->a_id == NULL)
 379                 return "Invalid A-ID";
 380         return NULL;
 381 }
 382
 383
 384 static const char * eap_fast_parse_i_id(struct eap_fast_pac *pac, char *pos)
 385 {
 386         os_free(pac->i_id);
 387         pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len);
 388         if (pac->i_id == NULL)
 389                 return "Invalid I-ID";
 390         return NULL;
 391 }
 392
 393
 394 static const char * eap_fast_parse_a_id_info(struct eap_fast_pac *pac,
 395                                              char *pos)
 396 {
 397         os_free(pac->a_id_info);
 398         pac->a_id_info = eap_fast_parse_hex(pos, &pac->a_id_info_len);
 399         if (pac->a_id_info == NULL)
 400                 return "Invalid A-ID-Info";
 401         return NULL;
 402 }
 403
 404
 405 /**
 406  * eap_fast_load_pac - Load PAC entries (text format)
 407  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 408  * @pac_root: Pointer to root of the PAC list (to be filled)
 409  * @pac_file: Name of the PAC file/blob to load
 410  * Returns: 0 on success, -1 on failure
 411  */
 412 int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_pac **pac_root,
 413                       const char *pac_file)
 414 {
 415         struct eap_fast_read_ctx rc;
 416         struct eap_fast_pac *pac = NULL;
 417         int count = 0;
 418         char *pos;
 419         const char *err = NULL;
 420
 421         if (pac_file == NULL)
 422                 return -1;
 423
 424         if (eap_fast_init_pac_data(sm, pac_file, &rc) < 0)
 425                 return 0;
 426
 427         if (eap_fast_read_line(&rc, &pos) < 0) {
 428                 /* empty file - assume it is fine to overwrite */
 429                 eap_fast_deinit_pac_data(&rc);
 430                 return 0;
 431         }
 432         if (os_strcmp(pac_file_hdr, rc.buf) != 0)
 433                 err = "Unrecognized header line";
 434
 435         while (!err && eap_fast_read_line(&rc, &pos) == 0) {
 436                 if (os_strcmp(rc.buf, "START") == 0)
 437                         err = eap_fast_parse_start(&pac);
 438                 else if (os_strcmp(rc.buf, "END") == 0) {
 439                         err = eap_fast_parse_end(pac_root, &pac);
 440                         count++;
 441                 } else if (!pac)
 442                         err = "Unexpected line outside START/END block";
 443                 else if (os_strcmp(rc.buf, "PAC-Type") == 0)
 444                         err = eap_fast_parse_pac_type(pac, pos);
 445                 else if (os_strcmp(rc.buf, "PAC-Key") == 0)
 446                         err = eap_fast_parse_pac_key(pac, pos);
 447                 else if (os_strcmp(rc.buf, "PAC-Opaque") == 0)
 448                         err = eap_fast_parse_pac_opaque(pac, pos);
 449                 else if (os_strcmp(rc.buf, "A-ID") == 0)
 450                         err = eap_fast_parse_a_id(pac, pos);
 451                 else if (os_strcmp(rc.buf, "I-ID") == 0)
 452                         err = eap_fast_parse_i_id(pac, pos);
 453                 else if (os_strcmp(rc.buf, "A-ID-Info") == 0)
 454                         err = eap_fast_parse_a_id_info(pac, pos);
 455         }
 456
 457         if (pac) {
 458                 if (!err)
 459                         err = "PAC block not terminated with END";
 460                 eap_fast_free_pac(pac);
 461         }
 462
 463         eap_fast_deinit_pac_data(&rc);
 464
 465         if (err) {
 466                 wpa_printf(MSG_INFO, "EAP-FAST: %s in '%s:%d'",
 467                            err, pac_file, rc.line);
 468                 return -1;
 469         }
 470
 471         wpa_printf(MSG_DEBUG, "EAP-FAST: Read %d PAC entries from '%s'",
 472                    count, pac_file);
 473
 474         return 0;
 475 }
 476
 477
 478 static void eap_fast_write(char **buf, char **pos, size_t *buf_len,
 479                            const char *field, const u8 *data,
 480                            size_t len, int txt)
 481 {
 482         size_t i, need;
 483         int ret;
 484         char *end;
 485
 486         if (data == NULL || buf == NULL || *buf == NULL ||
 487             pos == NULL || *pos == NULL || *pos < *buf)
 488                 return;
 489
 490         need = os_strlen(field) + len * 2 + 30;
 491         if (txt)
 492                 need += os_strlen(field) + len + 20;
 493
 494         if (*pos - *buf + need > *buf_len) {
 495                 char *nbuf = os_realloc(*buf, *buf_len + need);
 496                 if (nbuf == NULL) {
 497                         os_free(*buf);
 498                         *buf = NULL;
 499                         return;
 500                 }
 501                 *pos = nbuf + (*pos - *buf);
 502                 *buf = nbuf;
 503                 *buf_len += need;
 504         }
 505         end = *buf + *buf_len;
 506
 507         ret = os_snprintf(*pos, end - *pos, "%s=", field);
 508         if (os_snprintf_error(end - *pos, ret))
 509                 return;
 510         *pos += ret;
 511         *pos += wpa_snprintf_hex(*pos, end - *pos, data, len);
 512         ret = os_snprintf(*pos, end - *pos, "\n");
 513         if (os_snprintf_error(end - *pos, ret))
 514                 return;
 515         *pos += ret;
 516
 517         if (txt) {
 518                 ret = os_snprintf(*pos, end - *pos, "%s-txt=", field);
 519                 if (os_snprintf_error(end - *pos, ret))
 520                         return;
 521                 *pos += ret;
 522                 for (i = 0; i < len; i++) {
 523                         ret = os_snprintf(*pos, end - *pos, "%c", data[i]);
 524                         if (os_snprintf_error(end - *pos, ret))
 525                                 return;
 526                         *pos += ret;
 527                 }
 528                 ret = os_snprintf(*pos, end - *pos, "\n");
 529                 if (os_snprintf_error(end - *pos, ret))
 530                         return;
 531                 *pos += ret;
 532         }
 533 }
 534
 535
 536 static int eap_fast_write_pac(struct eap_sm *sm, const char *pac_file,
 537                               char *buf, size_t len)
 538 {
 539         if (os_strncmp(pac_file, "blob://", 7) == 0) {
 540                 struct wpa_config_blob *blob;
 541                 blob = os_zalloc(sizeof(*blob));
 542                 if (blob == NULL)
 543                         return -1;
 544                 blob->data = (u8 *) buf;
 545                 blob->len = len;
 546                 buf = NULL;
 547                 blob->name = os_strdup(pac_file + 7);
 548                 if (blob->name == NULL) {
 549                         os_free(blob);
 550                         return -1;
 551                 }
 552                 eap_set_config_blob(sm, blob);
 553         } else {
 554                 FILE *f;
 555                 f = fopen(pac_file, "wb");
 556                 if (f == NULL) {
 557                         wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC "
 558                                    "file '%s' for writing", pac_file);
 559                         return -1;
 560                 }
 561                 if (fwrite(buf, 1, len, f) != len) {
 562                         wpa_printf(MSG_INFO, "EAP-FAST: Failed to write all "
 563                                    "PACs into '%s'", pac_file);
 564                         fclose(f);
 565                         return -1;
 566                 }
 567                 os_free(buf);
 568                 fclose(f);
 569         }
 570
 571         return 0;
 572 }
 573
 574
 575 static int eap_fast_add_pac_data(struct eap_fast_pac *pac, char **buf,
 576                                  char **pos, size_t *buf_len)
 577 {
 578         int ret;
 579
 580         ret = os_snprintf(*pos, *buf + *buf_len - *pos,
 581                           "START\nPAC-Type=%d\n", pac->pac_type);
 582         if (os_snprintf_error(*buf + *buf_len - *pos, ret))
 583                 return -1;
 584
 585         *pos += ret;
 586         eap_fast_write(buf, pos, buf_len, "PAC-Key",
 587                        pac->pac_key, EAP_FAST_PAC_KEY_LEN, 0);
 588         eap_fast_write(buf, pos, buf_len, "PAC-Opaque",
 589                        pac->pac_opaque, pac->pac_opaque_len, 0);
 590         eap_fast_write(buf, pos, buf_len, "PAC-Info",
 591                        pac->pac_info, pac->pac_info_len, 0);
 592         eap_fast_write(buf, pos, buf_len, "A-ID",
 593                        pac->a_id, pac->a_id_len, 0);
 594         eap_fast_write(buf, pos, buf_len, "I-ID",
 595                        pac->i_id, pac->i_id_len, 1);
 596         eap_fast_write(buf, pos, buf_len, "A-ID-Info",
 597                        pac->a_id_info, pac->a_id_info_len, 1);
 598         if (*buf == NULL) {
 599                 wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC "
 600                            "data");
 601                 return -1;
 602         }
 603         ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n");
 604         if (os_snprintf_error(*buf + *buf_len - *pos, ret))
 605                 return -1;
 606         *pos += ret;
 607
 608         return 0;
 609 }
 610
 611
 612 /**
 613  * eap_fast_save_pac - Save PAC entries (text format)
 614  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 615  * @pac_root: Root of the PAC list
 616  * @pac_file: Name of the PAC file/blob
 617  * Returns: 0 on success, -1 on failure
 618  */
 619 int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_pac *pac_root,
 620                       const char *pac_file)
 621 {
 622         struct eap_fast_pac *pac;
 623         int ret, count = 0;
 624         char *buf, *pos;
 625         size_t buf_len;
 626
 627         if (pac_file == NULL)
 628                 return -1;
 629
 630         buf_len = 1024;
 631         pos = buf = os_malloc(buf_len);
 632         if (buf == NULL)
 633                 return -1;
 634
 635         ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);
 636         if (os_snprintf_error(buf + buf_len - pos, ret)) {
 637                 os_free(buf);
 638                 return -1;
 639         }
 640         pos += ret;
 641
 642         pac = pac_root;
 643         while (pac) {
 644                 if (eap_fast_add_pac_data(pac, &buf, &pos, &buf_len)) {
 645                         os_free(buf);
 646                         return -1;
 647                 }
 648                 count++;
 649                 pac = pac->next;
 650         }
 651
 652         if (eap_fast_write_pac(sm, pac_file, buf, pos - buf)) {
 653                 os_free(buf);
 654                 return -1;
 655         }
 656
 657         wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %d PAC entries into '%s'",
 658                    count, pac_file);
 659
 660         return 0;
 661 }
 662
 663
 664 /**
 665  * eap_fast_pac_list_truncate - Truncate a PAC list to the given length
 666  * @pac_root: Root of the PAC list
 667  * @max_len: Maximum length of the list (>= 1)
 668  * Returns: Number of PAC entries removed
 669  */
 670 size_t eap_fast_pac_list_truncate(struct eap_fast_pac *pac_root,
 671                                   size_t max_len)
 672 {
 673         struct eap_fast_pac *pac, *prev;
 674         size_t count;
 675
 676         pac = pac_root;
 677         prev = NULL;
 678         count = 0;
 679
 680         while (pac) {
 681                 count++;
 682                 if (count > max_len)
 683                         break;
 684                 prev = pac;
 685                 pac = pac->next;
 686         }
 687
 688         if (count <= max_len || prev == NULL)
 689                 return 0;
 690
 691         count = 0;
 692         prev->next = NULL;
 693
 694         while (pac) {
 695                 prev = pac;
 696                 pac = pac->next;
 697                 eap_fast_free_pac(prev);
 698                 count++;
 699         }
 700
 701         return count;
 702 }
 703
 704
 705 static void eap_fast_pac_get_a_id(struct eap_fast_pac *pac)
 706 {
 707         u8 *pos, *end;
 708         u16 type, len;
 709
 710         pos = pac->pac_info;
 711         end = pos + pac->pac_info_len;
 712
 713         while (end - pos > 4) {
 714                 type = WPA_GET_BE16(pos);
 715                 pos += 2;
 716                 len = WPA_GET_BE16(pos);
 717                 pos += 2;
 718                 if (len > (unsigned int) (end - pos))
 719                         break;
 720
 721                 if (type == PAC_TYPE_A_ID) {
 722                         os_free(pac->a_id);
 723                         pac->a_id = os_malloc(len);
 724                         if (pac->a_id == NULL)
 725                                 break;
 726                         os_memcpy(pac->a_id, pos, len);
 727                         pac->a_id_len = len;
 728                 }
 729
 730                 if (type == PAC_TYPE_A_ID_INFO) {
 731                         os_free(pac->a_id_info);
 732                         pac->a_id_info = os_malloc(len);
 733                         if (pac->a_id_info == NULL)
 734                                 break;
 735                         os_memcpy(pac->a_id_info, pos, len);
 736                         pac->a_id_info_len = len;
 737                 }
 738
 739                 pos += len;
 740         }
 741 }
 742
 743
 744 /**
 745  * eap_fast_load_pac_bin - Load PAC entries (binary format)
 746  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 747  * @pac_root: Pointer to root of the PAC list (to be filled)
 748  * @pac_file: Name of the PAC file/blob to load
 749  * Returns: 0 on success, -1 on failure
 750  */
 751 int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root,
 752                           const char *pac_file)
 753 {
 754         const struct wpa_config_blob *blob = NULL;
 755         u8 *buf, *end, *pos;
 756         size_t len, count = 0;
 757         struct eap_fast_pac *pac, *prev;
 758
 759         *pac_root = NULL;
 760
 761         if (pac_file == NULL)
 762                 return -1;
 763
 764         if (os_strncmp(pac_file, "blob://", 7) == 0) {
 765                 blob = eap_get_config_blob(sm, pac_file + 7);
 766                 if (blob == NULL) {
 767                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
 768                                    "assume no PAC entries have been "
 769                                    "provisioned", pac_file + 7);
 770                         return 0;
 771                 }
 772                 buf = blob->data;
 773                 len = blob->len;
 774         } else {
 775                 buf = (u8 *) os_readfile(pac_file, &len);
 776                 if (buf == NULL) {
 777                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
 778                                    "assume no PAC entries have been "
 779                                    "provisioned", pac_file);
 780                         return 0;
 781                 }
 782         }
 783
 784         if (len == 0) {
 785                 if (blob == NULL)
 786                         os_free(buf);
 787                 return 0;
 788         }
 789
 790         if (len < 6 || WPA_GET_BE32(buf) != EAP_FAST_PAC_BINARY_MAGIC ||
 791             WPA_GET_BE16(buf + 4) != EAP_FAST_PAC_BINARY_FORMAT_VERSION) {
 792                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC file '%s' (bin)",
 793                            pac_file);
 794                 if (blob == NULL)
 795                         os_free(buf);
 796                 return -1;
 797         }
 798
 799         pac = prev = NULL;
 800         pos = buf + 6;
 801         end = buf + len;
 802         while (pos < end) {
 803                 u16 val;
 804
 805                 if (end - pos < 2 + EAP_FAST_PAC_KEY_LEN + 2 + 2) {
 806                         pac = NULL;
 807                         goto parse_fail;
 808                 }
 809
 810                 pac = os_zalloc(sizeof(*pac));
 811                 if (pac == NULL)
 812                         goto parse_fail;
 813
 814                 pac->pac_type = WPA_GET_BE16(pos);
 815                 pos += 2;
 816                 os_memcpy(pac->pac_key, pos, EAP_FAST_PAC_KEY_LEN);
 817                 pos += EAP_FAST_PAC_KEY_LEN;
 818                 val = WPA_GET_BE16(pos);
 819                 pos += 2;
 820                 if (val > end - pos)
 821                         goto parse_fail;
 822                 pac->pac_opaque_len = val;
 823                 pac->pac_opaque = os_malloc(pac->pac_opaque_len);
 824                 if (pac->pac_opaque == NULL)
 825                         goto parse_fail;
 826                 os_memcpy(pac->pac_opaque, pos, pac->pac_opaque_len);
 827                 pos += pac->pac_opaque_len;
 828                 if (2 > end - pos)
 829                         goto parse_fail;
 830                 val = WPA_GET_BE16(pos);
 831                 pos += 2;
 832                 if (val > end - pos)
 833                         goto parse_fail;
 834                 pac->pac_info_len = val;
 835                 pac->pac_info = os_malloc(pac->pac_info_len);
 836                 if (pac->pac_info == NULL)
 837                         goto parse_fail;
 838                 os_memcpy(pac->pac_info, pos, pac->pac_info_len);
 839                 pos += pac->pac_info_len;
 840                 eap_fast_pac_get_a_id(pac);
 841
 842                 count++;
 843                 if (prev)
 844                         prev->next = pac;
 845                 else
 846                         *pac_root = pac;
 847                 prev = pac;
 848         }
 849
 850         if (blob == NULL)
 851                 os_free(buf);
 852
 853         wpa_printf(MSG_DEBUG, "EAP-FAST: Read %lu PAC entries from '%s' (bin)",
 854                    (unsigned long) count, pac_file);
 855
 856         return 0;
 857
 858 parse_fail:
 859         wpa_printf(MSG_INFO, "EAP-FAST: Failed to parse PAC file '%s' (bin)",
 860                    pac_file);
 861         if (blob == NULL)
 862                 os_free(buf);
 863         if (pac)
 864                 eap_fast_free_pac(pac);
 865         return -1;
 866 }
 867
 868
 869 /**
 870  * eap_fast_save_pac_bin - Save PAC entries (binary format)
 871  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 872  * @pac_root: Root of the PAC list
 873  * @pac_file: Name of the PAC file/blob
 874  * Returns: 0 on success, -1 on failure
 875  */
 876 int eap_fast_save_pac_bin(struct eap_sm *sm, struct eap_fast_pac *pac_root,
 877                           const char *pac_file)
 878 {
 879         size_t len, count = 0;
 880         struct eap_fast_pac *pac;
 881         u8 *buf, *pos;
 882
 883         len = 6;
 884         pac = pac_root;
 885         while (pac) {
 886                 if (pac->pac_opaque_len > 65535 ||
 887                     pac->pac_info_len > 65535)
 888                         return -1;
 889                 len += 2 + EAP_FAST_PAC_KEY_LEN + 2 + pac->pac_opaque_len +
 890                         2 + pac->pac_info_len;
 891                 pac = pac->next;
 892         }
 893
 894         buf = os_malloc(len);
 895         if (buf == NULL)
 896                 return -1;
 897
 898         pos = buf;
 899         WPA_PUT_BE32(pos, EAP_FAST_PAC_BINARY_MAGIC);
 900         pos += 4;
 901         WPA_PUT_BE16(pos, EAP_FAST_PAC_BINARY_FORMAT_VERSION);
 902         pos += 2;
 903
 904         pac = pac_root;
 905         while (pac) {
 906                 WPA_PUT_BE16(pos, pac->pac_type);
 907                 pos += 2;
 908                 os_memcpy(pos, pac->pac_key, EAP_FAST_PAC_KEY_LEN);
 909                 pos += EAP_FAST_PAC_KEY_LEN;
 910                 WPA_PUT_BE16(pos, pac->pac_opaque_len);
 911                 pos += 2;
 912                 os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len);
 913                 pos += pac->pac_opaque_len;
 914                 WPA_PUT_BE16(pos, pac->pac_info_len);
 915                 pos += 2;
 916                 os_memcpy(pos, pac->pac_info, pac->pac_info_len);
 917                 pos += pac->pac_info_len;
 918
 919                 pac = pac->next;
 920                 count++;
 921         }
 922
 923         if (eap_fast_write_pac(sm, pac_file, (char *) buf, len)) {
 924                 os_free(buf);
 925                 return -1;
 926         }
 927
 928         wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %lu PAC entries into '%s' "
 929                    "(bin)", (unsigned long) count, pac_file);
 930
 931         return 0;
 932 }