workbench/network/WirelessManager/src/eap_peer/eap_fast_pac.c

   1 /*
   2  * EAP peer method: EAP-FAST PAC file processing
   3  * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_config.h"
  19 #include "eap_i.h"
  20 #include "eap_fast_pac.h"
  21
  22 /* TODO: encrypt PAC-Key in the PAC file */
  23
  24
  25 /* Text data format */
  26 static const char *pac_file_hdr =
  27         "wpa_supplicant EAP-FAST PAC file - version 1";
  28
  29 /*
  30  * Binary data format
  31  * 4-octet magic value: 6A E4 92 0C
  32  * 2-octet version (big endian)
  33  * <version specific data>
  34  *
  35  * version=0:
  36  * Sequence of PAC entries:
  37  *   2-octet PAC-Type (big endian)
  38  *   32-octet PAC-Key
  39  *   2-octet PAC-Opaque length (big endian)
  40  *   <variable len> PAC-Opaque data (length bytes)
  41  *   2-octet PAC-Info length (big endian)
  42  *   <variable len> PAC-Info data (length bytes)
  43  */
  44
  45 #define EAP_FAST_PAC_BINARY_MAGIC 0x6ae4920c
  46 #define EAP_FAST_PAC_BINARY_FORMAT_VERSION 0
  47
  48
  49 /**
  50  * eap_fast_free_pac - Free PAC data
  51  * @pac: Pointer to the PAC entry
  52  *
  53  * Note that the PAC entry must not be in a list since this function does not
  54  * remove the list links.
  55  */
  56 void eap_fast_free_pac(struct eap_fast_pac *pac)
  57 {
  58         os_free(pac->pac_opaque);
  59         os_free(pac->pac_info);
  60         os_free(pac->a_id);
  61         os_free(pac->i_id);
  62         os_free(pac->a_id_info);
  63         os_free(pac);
  64 }
  65
  66
  67 /**
  68  * eap_fast_get_pac - Get a PAC entry based on A-ID
  69  * @pac_root: Pointer to root of the PAC list
  70  * @a_id: A-ID to search for
  71  * @a_id_len: Length of A-ID
  72  * @pac_type: PAC-Type to search for
  73  * Returns: Pointer to the PAC entry, or %NULL if A-ID not found
  74  */
  75 struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_pac *pac_root,
  76                                        const u8 *a_id, size_t a_id_len,
  77                                        u16 pac_type)
  78 {
  79         struct eap_fast_pac *pac = pac_root;
  80
  81         while (pac) {
  82                 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
  83                     os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
  84                         return pac;
  85                 }
  86                 pac = pac->next;
  87         }
  88         return NULL;
  89 }
  90
  91
  92 static void eap_fast_remove_pac(struct eap_fast_pac **pac_root,
  93                                 struct eap_fast_pac **pac_current,
  94                                 const u8 *a_id, size_t a_id_len, u16 pac_type)
  95 {
  96         struct eap_fast_pac *pac, *prev;
  97
  98         pac = *pac_root;
  99         prev = NULL;
 100
 101         while (pac) {
 102                 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
 103                     os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
 104                         if (prev == NULL)
 105                                 *pac_root = pac->next;
 106                         else
 107                                 prev->next = pac->next;
 108                         if (*pac_current == pac)
 109                                 *pac_current = NULL;
 110                         eap_fast_free_pac(pac);
 111                         break;
 112                 }
 113                 prev = pac;
 114                 pac = pac->next;
 115         }
 116 }
 117
 118
 119 static int eap_fast_copy_buf(u8 **dst, size_t *dst_len,
 120                              const u8 *src, size_t src_len)
 121 {
 122         if (src) {
 123                 *dst = os_malloc(src_len);
 124                 if (*dst == NULL)
 125                         return -1;
 126                 os_memcpy(*dst, src, src_len);
 127                 *dst_len = src_len;
 128         }
 129         return 0;
 130 }
 131
 132
 133 /**
 134  * eap_fast_add_pac - Add a copy of a PAC entry to a list
 135  * @pac_root: Pointer to PAC list root pointer
 136  * @pac_current: Pointer to the current PAC pointer
 137  * @entry: New entry to clone and add to the list
 138  * Returns: 0 on success, -1 on failure
 139  *
 140  * This function makes a clone of the given PAC entry and adds this copied
 141  * entry to the list (pac_root). If an old entry for the same A-ID is found,
 142  * it will be removed from the PAC list and in this case, pac_current entry
 143  * is set to %NULL if it was the removed entry.
 144  */
 145 int eap_fast_add_pac(struct eap_fast_pac **pac_root,
 146                      struct eap_fast_pac **pac_current,
 147                      struct eap_fast_pac *entry)
 148 {
 149         struct eap_fast_pac *pac;
 150
 151         if (entry == NULL || entry->a_id == NULL)
 152                 return -1;
 153
 154         /* Remove a possible old entry for the matching A-ID. */
 155         eap_fast_remove_pac(pac_root, pac_current,
 156                             entry->a_id, entry->a_id_len, entry->pac_type);
 157
 158         /* Allocate a new entry and add it to the list of PACs. */
 159         pac = os_zalloc(sizeof(*pac));
 160         if (pac == NULL)
 161                 return -1;
 162
 163         pac->pac_type = entry->pac_type;
 164         os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN);
 165         if (eap_fast_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len,
 166                               entry->pac_opaque, entry->pac_opaque_len) < 0 ||
 167             eap_fast_copy_buf(&pac->pac_info, &pac->pac_info_len,
 168                               entry->pac_info, entry->pac_info_len) < 0 ||
 169             eap_fast_copy_buf(&pac->a_id, &pac->a_id_len,
 170                               entry->a_id, entry->a_id_len) < 0 ||
 171             eap_fast_copy_buf(&pac->i_id, &pac->i_id_len,
 172                               entry->i_id, entry->i_id_len) < 0 ||
 173             eap_fast_copy_buf(&pac->a_id_info, &pac->a_id_info_len,
 174                               entry->a_id_info, entry->a_id_info_len) < 0) {
 175                 eap_fast_free_pac(pac);
 176                 return -1;
 177         }
 178
 179         pac->next = *pac_root;
 180         *pac_root = pac;
 181
 182         return 0;
 183 }
 184
 185
 186 struct eap_fast_read_ctx {
 187         FILE *f;
 188         const char *pos;
 189         const char *end;
 190         int line;
 191         char *buf;
 192         size_t buf_len;
 193 };
 194
 195 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char **value)
 196 {
 197         char *pos;
 198
 199         rc->line++;
 200         if (rc->f) {
 201                 if (fgets(rc->buf, rc->buf_len, rc->f) == NULL)
 202                         return -1;
 203         } else {
 204                 const char *l_end;
 205                 size_t len;
 206                 if (rc->pos >= rc->end)
 207                         return -1;
 208                 l_end = rc->pos;
 209                 while (l_end < rc->end && *l_end != '\n')
 210                         l_end++;
 211                 len = l_end - rc->pos;
 212                 if (len >= rc->buf_len)
 213                         len = rc->buf_len - 1;
 214                 os_memcpy(rc->buf, rc->pos, len);
 215                 rc->buf[len] = '\0';
 216                 rc->pos = l_end + 1;
 217         }
 218
 219         rc->buf[rc->buf_len - 1] = '\0';
 220         pos = rc->buf;
 221         while (*pos != '\0') {
 222                 if (*pos == '\n' || *pos == '\r') {
 223                         *pos = '\0';
 224                         break;
 225                 }
 226                 pos++;
 227         }
 228
 229         pos = os_strchr(rc->buf, '=');
 230         if (pos)
 231                 *pos++ = '\0';
 232         *value = pos;
 233
 234         return 0;
 235 }
 236
 237
 238 static u8 * eap_fast_parse_hex(const char *value, size_t *len)
 239 {
 240         int hlen;
 241         u8 *buf;
 242
 243         if (value == NULL)
 244                 return NULL;
 245         hlen = os_strlen(value);
 246         if (hlen & 1)
 247                 return NULL;
 248         *len = hlen / 2;
 249         buf = os_malloc(*len);
 250         if (buf == NULL)
 251                 return NULL;
 252         if (hexstr2bin(value, buf, *len)) {
 253                 os_free(buf);
 254                 return NULL;
 255         }
 256         return buf;
 257 }
 258
 259
 260 static int eap_fast_init_pac_data(struct eap_sm *sm, const char *pac_file,
 261                                   struct eap_fast_read_ctx *rc)
 262 {
 263         os_memset(rc, 0, sizeof(*rc));
 264
 265         rc->buf_len = 2048;
 266         rc->buf = os_malloc(rc->buf_len);
 267         if (rc->buf == NULL)
 268                 return -1;
 269
 270         if (os_strncmp(pac_file, "blob://", 7) == 0) {
 271                 const struct wpa_config_blob *blob;
 272                 blob = eap_get_config_blob(sm, pac_file + 7);
 273                 if (blob == NULL) {
 274                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
 275                                    "assume no PAC entries have been "
 276                                    "provisioned", pac_file + 7);
 277                         os_free(rc->buf);
 278                         return -1;
 279                 }
 280                 rc->pos = (char *) blob->data;
 281                 rc->end = (char *) blob->data + blob->len;
 282         } else {
 283                 rc->f = fopen(pac_file, "rb");
 284                 if (rc->f == NULL) {
 285                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
 286                                    "assume no PAC entries have been "
 287                                    "provisioned", pac_file);
 288                         os_free(rc->buf);
 289                         return -1;
 290                 }
 291         }
 292
 293         return 0;
 294 }
 295
 296
 297 static void eap_fast_deinit_pac_data(struct eap_fast_read_ctx *rc)
 298 {
 299         os_free(rc->buf);
 300         if (rc->f)
 301                 fclose(rc->f);
 302 }
 303
 304
 305 static const char * eap_fast_parse_start(struct eap_fast_pac **pac)
 306 {
 307         if (*pac)
 308                 return "START line without END";
 309
 310         *pac = os_zalloc(sizeof(struct eap_fast_pac));
 311         if (*pac == NULL)
 312                 return "No memory for PAC entry";
 313         (*pac)->pac_type = PAC_TYPE_TUNNEL_PAC;
 314         return NULL;
 315 }
 316
 317
 318 static const char * eap_fast_parse_end(struct eap_fast_pac **pac_root,
 319                                        struct eap_fast_pac **pac)
 320 {
 321         if (*pac == NULL)
 322                 return "END line without START";
 323         if (*pac_root) {
 324                 struct eap_fast_pac *end = *pac_root;
 325                 while (end->next)
 326                         end = end->next;
 327                 end->next = *pac;
 328         } else
 329                 *pac_root = *pac;
 330
 331         *pac = NULL;
 332         return NULL;
 333 }
 334
 335
 336 static const char * eap_fast_parse_pac_type(struct eap_fast_pac *pac,
 337                                             char *pos)
 338 {
 339         pac->pac_type = atoi(pos);
 340         if (pac->pac_type != PAC_TYPE_TUNNEL_PAC &&
 341             pac->pac_type != PAC_TYPE_USER_AUTHORIZATION &&
 342             pac->pac_type != PAC_TYPE_MACHINE_AUTHENTICATION)
 343                 return "Unrecognized PAC-Type";
 344
 345         return NULL;
 346 }
 347
 348
 349 static const char * eap_fast_parse_pac_key(struct eap_fast_pac *pac, char *pos)
 350 {
 351         u8 *key;
 352         size_t key_len;
 353
 354         key = eap_fast_parse_hex(pos, &key_len);
 355         if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) {
 356                 os_free(key);
 357                 return "Invalid PAC-Key";
 358         }
 359
 360         os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN);
 361         os_free(key);
 362
 363         return NULL;
 364 }
 365
 366
 367 static const char * eap_fast_parse_pac_opaque(struct eap_fast_pac *pac,
 368                                               char *pos)
 369 {
 370         os_free(pac->pac_opaque);
 371         pac->pac_opaque = eap_fast_parse_hex(pos, &pac->pac_opaque_len);
 372         if (pac->pac_opaque == NULL)
 373                 return "Invalid PAC-Opaque";
 374         return NULL;
 375 }
 376
 377
 378 static const char * eap_fast_parse_a_id(struct eap_fast_pac *pac, char *pos)
 379 {
 380         os_free(pac->a_id);
 381         pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len);
 382         if (pac->a_id == NULL)
 383                 return "Invalid A-ID";
 384         return NULL;
 385 }
 386
 387
 388 static const char * eap_fast_parse_i_id(struct eap_fast_pac *pac, char *pos)
 389 {
 390         os_free(pac->i_id);
 391         pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len);
 392         if (pac->i_id == NULL)
 393                 return "Invalid I-ID";
 394         return NULL;
 395 }
 396
 397
 398 static const char * eap_fast_parse_a_id_info(struct eap_fast_pac *pac,
 399                                              char *pos)
 400 {
 401         os_free(pac->a_id_info);
 402         pac->a_id_info = eap_fast_parse_hex(pos, &pac->a_id_info_len);
 403         if (pac->a_id_info == NULL)
 404                 return "Invalid A-ID-Info";
 405         return NULL;
 406 }
 407
 408
 409 /**
 410  * eap_fast_load_pac - Load PAC entries (text format)
 411  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 412  * @pac_root: Pointer to root of the PAC list (to be filled)
 413  * @pac_file: Name of the PAC file/blob to load
 414  * Returns: 0 on success, -1 on failure
 415  */
 416 int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_pac **pac_root,
 417                       const char *pac_file)
 418 {
 419         struct eap_fast_read_ctx rc;
 420         struct eap_fast_pac *pac = NULL;
 421         int count = 0;
 422         char *pos;
 423         const char *err = NULL;
 424
 425         if (pac_file == NULL)
 426                 return -1;
 427
 428         if (eap_fast_init_pac_data(sm, pac_file, &rc) < 0)
 429                 return 0;
 430
 431         if (eap_fast_read_line(&rc, &pos) < 0 ||
 432             os_strcmp(pac_file_hdr, rc.buf) != 0)
 433                 err = "Unrecognized header line";
 434
 435         while (!err && eap_fast_read_line(&rc, &pos) == 0) {
 436                 if (os_strcmp(rc.buf, "START") == 0)
 437                         err = eap_fast_parse_start(&pac);
 438                 else if (os_strcmp(rc.buf, "END") == 0) {
 439                         err = eap_fast_parse_end(pac_root, &pac);
 440                         count++;
 441                 } else if (!pac)
 442                         err = "Unexpected line outside START/END block";
 443                 else if (os_strcmp(rc.buf, "PAC-Type") == 0)
 444                         err = eap_fast_parse_pac_type(pac, pos);
 445                 else if (os_strcmp(rc.buf, "PAC-Key") == 0)
 446                         err = eap_fast_parse_pac_key(pac, pos);
 447                 else if (os_strcmp(rc.buf, "PAC-Opaque") == 0)
 448                         err = eap_fast_parse_pac_opaque(pac, pos);
 449                 else if (os_strcmp(rc.buf, "A-ID") == 0)
 450                         err = eap_fast_parse_a_id(pac, pos);
 451                 else if (os_strcmp(rc.buf, "I-ID") == 0)
 452                         err = eap_fast_parse_i_id(pac, pos);
 453                 else if (os_strcmp(rc.buf, "A-ID-Info") == 0)
 454                         err = eap_fast_parse_a_id_info(pac, pos);
 455         }
 456
 457         if (pac) {
 458                 err = "PAC block not terminated with END";
 459                 eap_fast_free_pac(pac);
 460         }
 461
 462         eap_fast_deinit_pac_data(&rc);
 463
 464         if (err) {
 465                 wpa_printf(MSG_INFO, "EAP-FAST: %s in '%s:%d'",
 466                            err, pac_file, rc.line);
 467                 return -1;
 468         }
 469
 470         wpa_printf(MSG_DEBUG, "EAP-FAST: Read %d PAC entries from '%s'",
 471                    count, pac_file);
 472
 473         return 0;
 474 }
 475
 476
 477 static void eap_fast_write(char **buf, char **pos, size_t *buf_len,
 478                            const char *field, const u8 *data,
 479                            size_t len, int txt)
 480 {
 481         size_t i, need;
 482         int ret;
 483         char *end;
 484
 485         if (data == NULL || buf == NULL || *buf == NULL ||
 486             pos == NULL || *pos == NULL || *pos < *buf)
 487                 return;
 488
 489         need = os_strlen(field) + len * 2 + 30;
 490         if (txt)
 491                 need += os_strlen(field) + len + 20;
 492
 493         if (*pos - *buf + need > *buf_len) {
 494                 char *nbuf = os_realloc(*buf, *buf_len + need);
 495                 if (nbuf == NULL) {
 496                         os_free(*buf);
 497                         *buf = NULL;
 498                         return;
 499                 }
 500                 *buf = nbuf;
 501                 *buf_len += need;
 502         }
 503         end = *buf + *buf_len;
 504
 505         ret = os_snprintf(*pos, end - *pos, "%s=", field);
 506         if (ret < 0 || ret >= end - *pos)
 507                 return;
 508         *pos += ret;
 509         *pos += wpa_snprintf_hex(*pos, end - *pos, data, len);
 510         ret = os_snprintf(*pos, end - *pos, "\n");
 511         if (ret < 0 || ret >= end - *pos)
 512                 return;
 513         *pos += ret;
 514
 515         if (txt) {
 516                 ret = os_snprintf(*pos, end - *pos, "%s-txt=", field);
 517                 if (ret < 0 || ret >= end - *pos)
 518                         return;
 519                 *pos += ret;
 520                 for (i = 0; i < len; i++) {
 521                         ret = os_snprintf(*pos, end - *pos, "%c", data[i]);
 522                         if (ret < 0 || ret >= end - *pos)
 523                                 return;
 524                         *pos += ret;
 525                 }
 526                 ret = os_snprintf(*pos, end - *pos, "\n");
 527                 if (ret < 0 || ret >= end - *pos)
 528                         return;
 529                 *pos += ret;
 530         }
 531 }
 532
 533
 534 static int eap_fast_write_pac(struct eap_sm *sm, const char *pac_file,
 535                               char *buf, size_t len)
 536 {
 537         if (os_strncmp(pac_file, "blob://", 7) == 0) {
 538                 struct wpa_config_blob *blob;
 539                 blob = os_zalloc(sizeof(*blob));
 540                 if (blob == NULL)
 541                         return -1;
 542                 blob->data = (u8 *) buf;
 543                 blob->len = len;
 544                 buf = NULL;
 545                 blob->name = os_strdup(pac_file + 7);
 546                 if (blob->name == NULL) {
 547                         os_free(blob);
 548                         return -1;
 549                 }
 550                 eap_set_config_blob(sm, blob);
 551         } else {
 552                 FILE *f;
 553                 f = fopen(pac_file, "wb");
 554                 if (f == NULL) {
 555                         wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC "
 556                                    "file '%s' for writing", pac_file);
 557                         return -1;
 558                 }
 559                 if (fwrite(buf, 1, len, f) != len) {
 560                         wpa_printf(MSG_INFO, "EAP-FAST: Failed to write all "
 561                                    "PACs into '%s'", pac_file);
 562                         fclose(f);
 563                         return -1;
 564                 }
 565                 os_free(buf);
 566                 fclose(f);
 567         }
 568
 569         return 0;
 570 }
 571
 572
 573 static int eap_fast_add_pac_data(struct eap_fast_pac *pac, char **buf,
 574                                  char **pos, size_t *buf_len)
 575 {
 576         int ret;
 577
 578         ret = os_snprintf(*pos, *buf + *buf_len - *pos,
 579                           "START\nPAC-Type=%d\n", pac->pac_type);
 580         if (ret < 0 || ret >= *buf + *buf_len - *pos)
 581                 return -1;
 582
 583         *pos += ret;
 584         eap_fast_write(buf, pos, buf_len, "PAC-Key",
 585                        pac->pac_key, EAP_FAST_PAC_KEY_LEN, 0);
 586         eap_fast_write(buf, pos, buf_len, "PAC-Opaque",
 587                        pac->pac_opaque, pac->pac_opaque_len, 0);
 588         eap_fast_write(buf, pos, buf_len, "PAC-Info",
 589                        pac->pac_info, pac->pac_info_len, 0);
 590         eap_fast_write(buf, pos, buf_len, "A-ID",
 591                        pac->a_id, pac->a_id_len, 0);
 592         eap_fast_write(buf, pos, buf_len, "I-ID",
 593                        pac->i_id, pac->i_id_len, 1);
 594         eap_fast_write(buf, pos, buf_len, "A-ID-Info",
 595                        pac->a_id_info, pac->a_id_info_len, 1);
 596         if (*buf == NULL) {
 597                 wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC "
 598                            "data");
 599                 return -1;
 600         }
 601         ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n");
 602         if (ret < 0 || ret >= *buf + *buf_len - *pos)
 603                 return -1;
 604         *pos += ret;
 605
 606         return 0;
 607 }
 608
 609
 610 /**
 611  * eap_fast_save_pac - Save PAC entries (text format)
 612  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 613  * @pac_root: Root of the PAC list
 614  * @pac_file: Name of the PAC file/blob
 615  * Returns: 0 on success, -1 on failure
 616  */
 617 int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_pac *pac_root,
 618                       const char *pac_file)
 619 {
 620         struct eap_fast_pac *pac;
 621         int ret, count = 0;
 622         char *buf, *pos;
 623         size_t buf_len;
 624
 625         if (pac_file == NULL)
 626                 return -1;
 627
 628         buf_len = 1024;
 629         pos = buf = os_malloc(buf_len);
 630         if (buf == NULL)
 631                 return -1;
 632
 633         ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);
 634         if (ret < 0 || ret >= buf + buf_len - pos) {
 635                 os_free(buf);
 636                 return -1;
 637         }
 638         pos += ret;
 639
 640         pac = pac_root;
 641         while (pac) {
 642                 if (eap_fast_add_pac_data(pac, &buf, &pos, &buf_len)) {
 643                         os_free(buf);
 644                         return -1;
 645                 }
 646                 count++;
 647                 pac = pac->next;
 648         }
 649
 650         if (eap_fast_write_pac(sm, pac_file, buf, pos - buf)) {
 651                 os_free(buf);
 652                 return -1;
 653         }
 654
 655         wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %d PAC entries into '%s'",
 656                    count, pac_file);
 657
 658         return 0;
 659 }
 660
 661
 662 /**
 663  * eap_fast_pac_list_truncate - Truncate a PAC list to the given length
 664  * @pac_root: Root of the PAC list
 665  * @max_len: Maximum length of the list (>= 1)
 666  * Returns: Number of PAC entries removed
 667  */
 668 size_t eap_fast_pac_list_truncate(struct eap_fast_pac *pac_root,
 669                                   size_t max_len)
 670 {
 671         struct eap_fast_pac *pac, *prev;
 672         size_t count;
 673
 674         pac = pac_root;
 675         prev = NULL;
 676         count = 0;
 677
 678         while (pac) {
 679                 count++;
 680                 if (count > max_len)
 681                         break;
 682                 prev = pac;
 683                 pac = pac->next;
 684         }
 685
 686         if (count <= max_len || prev == NULL)
 687                 return 0;
 688
 689         count = 0;
 690         prev->next = NULL;
 691
 692         while (pac) {
 693                 prev = pac;
 694                 pac = pac->next;
 695                 eap_fast_free_pac(prev);
 696                 count++;
 697         }
 698
 699         return count;
 700 }
 701
 702
 703 static void eap_fast_pac_get_a_id(struct eap_fast_pac *pac)
 704 {
 705         u8 *pos, *end;
 706         u16 type, len;
 707
 708         pos = pac->pac_info;
 709         end = pos + pac->pac_info_len;
 710
 711         while (pos + 4 < end) {
 712                 type = WPA_GET_BE16(pos);
 713                 pos += 2;
 714                 len = WPA_GET_BE16(pos);
 715                 pos += 2;
 716                 if (pos + len > end)
 717                         break;
 718
 719                 if (type == PAC_TYPE_A_ID) {
 720                         os_free(pac->a_id);
 721                         pac->a_id = os_malloc(len);
 722                         if (pac->a_id == NULL)
 723                                 break;
 724                         os_memcpy(pac->a_id, pos, len);
 725                         pac->a_id_len = len;
 726                 }
 727
 728                 if (type == PAC_TYPE_A_ID_INFO) {
 729                         os_free(pac->a_id_info);
 730                         pac->a_id_info = os_malloc(len);
 731                         if (pac->a_id_info == NULL)
 732                                 break;
 733                         os_memcpy(pac->a_id_info, pos, len);
 734                         pac->a_id_info_len = len;
 735                 }
 736
 737                 pos += len;
 738         }
 739 }
 740
 741
 742 /**
 743  * eap_fast_load_pac_bin - Load PAC entries (binary format)
 744  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 745  * @pac_root: Pointer to root of the PAC list (to be filled)
 746  * @pac_file: Name of the PAC file/blob to load
 747  * Returns: 0 on success, -1 on failure
 748  */
 749 int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root,
 750                           const char *pac_file)
 751 {
 752         const struct wpa_config_blob *blob = NULL;
 753         u8 *buf, *end, *pos;
 754         size_t len, count = 0;
 755         struct eap_fast_pac *pac, *prev;
 756
 757         *pac_root = NULL;
 758
 759         if (pac_file == NULL)
 760                 return -1;
 761
 762         if (os_strncmp(pac_file, "blob://", 7) == 0) {
 763                 blob = eap_get_config_blob(sm, pac_file + 7);
 764                 if (blob == NULL) {
 765                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
 766                                    "assume no PAC entries have been "
 767                                    "provisioned", pac_file + 7);
 768                         return 0;
 769                 }
 770                 buf = blob->data;
 771                 len = blob->len;
 772         } else {
 773                 buf = (u8 *) os_readfile(pac_file, &len);
 774                 if (buf == NULL) {
 775                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
 776                                    "assume no PAC entries have been "
 777                                    "provisioned", pac_file);
 778                         return 0;
 779                 }
 780         }
 781
 782         if (len == 0) {
 783                 if (blob == NULL)
 784                         os_free(buf);
 785                 return 0;
 786         }
 787
 788         if (len < 6 || WPA_GET_BE32(buf) != EAP_FAST_PAC_BINARY_MAGIC ||
 789             WPA_GET_BE16(buf + 4) != EAP_FAST_PAC_BINARY_FORMAT_VERSION) {
 790                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC file '%s' (bin)",
 791                            pac_file);
 792                 if (blob == NULL)
 793                         os_free(buf);
 794                 return -1;
 795         }
 796
 797         pac = prev = NULL;
 798         pos = buf + 6;
 799         end = buf + len;
 800         while (pos < end) {
 801                 if (end - pos < 2 + 32 + 2 + 2)
 802                         goto parse_fail;
 803
 804                 pac = os_zalloc(sizeof(*pac));
 805                 if (pac == NULL)
 806                         goto parse_fail;
 807
 808                 pac->pac_type = WPA_GET_BE16(pos);
 809                 pos += 2;
 810                 os_memcpy(pac->pac_key, pos, EAP_FAST_PAC_KEY_LEN);
 811                 pos += EAP_FAST_PAC_KEY_LEN;
 812                 pac->pac_opaque_len = WPA_GET_BE16(pos);
 813                 pos += 2;
 814                 if (pos + pac->pac_opaque_len + 2 > end)
 815                         goto parse_fail;
 816                 pac->pac_opaque = os_malloc(pac->pac_opaque_len);
 817                 if (pac->pac_opaque == NULL)
 818                         goto parse_fail;
 819                 os_memcpy(pac->pac_opaque, pos, pac->pac_opaque_len);
 820                 pos += pac->pac_opaque_len;
 821                 pac->pac_info_len = WPA_GET_BE16(pos);
 822                 pos += 2;
 823                 if (pos + pac->pac_info_len > end)
 824                         goto parse_fail;
 825                 pac->pac_info = os_malloc(pac->pac_info_len);
 826                 if (pac->pac_info == NULL)
 827                         goto parse_fail;
 828                 os_memcpy(pac->pac_info, pos, pac->pac_info_len);
 829                 pos += pac->pac_info_len;
 830                 eap_fast_pac_get_a_id(pac);
 831
 832                 count++;
 833                 if (prev)
 834                         prev->next = pac;
 835                 else
 836                         *pac_root = pac;
 837                 prev = pac;
 838         }
 839
 840         if (blob == NULL)
 841                 os_free(buf);
 842
 843         wpa_printf(MSG_DEBUG, "EAP-FAST: Read %lu PAC entries from '%s' (bin)",
 844                    (unsigned long) count, pac_file);
 845
 846         return 0;
 847
 848 parse_fail:
 849         wpa_printf(MSG_INFO, "EAP-FAST: Failed to parse PAC file '%s' (bin)",
 850                    pac_file);
 851         if (blob == NULL)
 852                 os_free(buf);
 853         if (pac)
 854                 eap_fast_free_pac(pac);
 855         return -1;
 856 }
 857
 858
 859 /**
 860  * eap_fast_save_pac_bin - Save PAC entries (binary format)
 861  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 862  * @pac_root: Root of the PAC list
 863  * @pac_file: Name of the PAC file/blob
 864  * Returns: 0 on success, -1 on failure
 865  */
 866 int eap_fast_save_pac_bin(struct eap_sm *sm, struct eap_fast_pac *pac_root,
 867                           const char *pac_file)
 868 {
 869         size_t len, count = 0;
 870         struct eap_fast_pac *pac;
 871         u8 *buf, *pos;
 872
 873         len = 6;
 874         pac = pac_root;
 875         while (pac) {
 876                 if (pac->pac_opaque_len > 65535 ||
 877                     pac->pac_info_len > 65535)
 878                         return -1;
 879                 len += 2 + EAP_FAST_PAC_KEY_LEN + 2 + pac->pac_opaque_len +
 880                         2 + pac->pac_info_len;
 881                 pac = pac->next;
 882         }
 883
 884         buf = os_malloc(len);
 885         if (buf == NULL)
 886                 return -1;
 887
 888         pos = buf;
 889         WPA_PUT_BE32(pos, EAP_FAST_PAC_BINARY_MAGIC);
 890         pos += 4;
 891         WPA_PUT_BE16(pos, EAP_FAST_PAC_BINARY_FORMAT_VERSION);
 892         pos += 2;
 893
 894         pac = pac_root;
 895         while (pac) {
 896                 WPA_PUT_BE16(pos, pac->pac_type);
 897                 pos += 2;
 898                 os_memcpy(pos, pac->pac_key, EAP_FAST_PAC_KEY_LEN);
 899                 pos += EAP_FAST_PAC_KEY_LEN;
 900                 WPA_PUT_BE16(pos, pac->pac_opaque_len);
 901                 pos += 2;
 902                 os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len);
 903                 pos += pac->pac_opaque_len;
 904                 WPA_PUT_BE16(pos, pac->pac_info_len);
 905                 pos += 2;
 906                 os_memcpy(pos, pac->pac_info, pac->pac_info_len);
 907                 pos += pac->pac_info_len;
 908
 909                 pac = pac->next;
 910                 count++;
 911         }
 912
 913         if (eap_fast_write_pac(sm, pac_file, (char *) buf, len)) {
 914                 os_free(buf);
 915                 return -1;
 916         }
 917
 918         wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %lu PAC entries into '%s' "
 919                    "(bin)", (unsigned long) count, pac_file);
 920
 921         return 0;
 922 }