xref: /freebsd/contrib/wpa/hs20/client/est.c (revision b2d48be1bc7df45ddd13b143a160d0acb5a383c5)
1 /*
2  * Hotspot 2.0 OSU client - EST client
3  * Copyright (c) 2012-2014, Qualcomm Atheros, Inc.
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 #include <openssl/err.h>
11 #include <openssl/evp.h>
12 #include <openssl/pem.h>
13 #include <openssl/pkcs7.h>
14 #include <openssl/rsa.h>
15 #include <openssl/asn1.h>
16 #include <openssl/asn1t.h>
17 #include <openssl/x509.h>
18 #include <openssl/x509v3.h>
19 
20 #include "common.h"
21 #include "utils/base64.h"
22 #include "utils/xml-utils.h"
23 #include "utils/http-utils.h"
24 #include "osu_client.h"
25 
26 
27 static int pkcs7_to_cert(struct hs20_osu_client *ctx, const u8 *pkcs7,
28 			 size_t len, char *pem_file, char *der_file)
29 {
30 	PKCS7 *p7 = NULL;
31 	const unsigned char *p = pkcs7;
32 	STACK_OF(X509) *certs;
33 	int i, num, ret = -1;
34 	BIO *out = NULL;
35 
36 	p7 = d2i_PKCS7(NULL, &p, len);
37 	if (p7 == NULL) {
38 		wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s",
39 			   ERR_error_string(ERR_get_error(), NULL));
40 		write_result(ctx, "Could not parse PKCS#7 object from EST");
41 		goto fail;
42 	}
43 
44 	switch (OBJ_obj2nid(p7->type)) {
45 	case NID_pkcs7_signed:
46 		certs = p7->d.sign->cert;
47 		break;
48 	case NID_pkcs7_signedAndEnveloped:
49 		certs = p7->d.signed_and_enveloped->cert;
50 		break;
51 	default:
52 		certs = NULL;
53 		break;
54 	}
55 
56 	if (!certs || ((num = sk_X509_num(certs)) == 0)) {
57 		wpa_printf(MSG_INFO, "No certificates found in PKCS#7 object");
58 		write_result(ctx, "No certificates found in PKCS#7 object");
59 		goto fail;
60 	}
61 
62 	if (der_file) {
63 		FILE *f = fopen(der_file, "wb");
64 		if (f == NULL)
65 			goto fail;
66 		i2d_X509_fp(f, sk_X509_value(certs, 0));
67 		fclose(f);
68 	}
69 
70 	if (pem_file) {
71 		out = BIO_new(BIO_s_file());
72 		if (out == NULL ||
73 		    BIO_write_filename(out, pem_file) <= 0)
74 			goto fail;
75 
76 		for (i = 0; i < num; i++) {
77 			X509 *cert = sk_X509_value(certs, i);
78 			X509_print(out, cert);
79 			PEM_write_bio_X509(out, cert);
80 			BIO_puts(out, "\n");
81 		}
82 	}
83 
84 	ret = 0;
85 
86 fail:
87 	PKCS7_free(p7);
88 	if (out)
89 		BIO_free_all(out);
90 
91 	return ret;
92 }
93 
94 
95 int est_load_cacerts(struct hs20_osu_client *ctx, const char *url)
96 {
97 	char *buf, *resp;
98 	size_t buflen;
99 	unsigned char *pkcs7;
100 	size_t pkcs7_len, resp_len;
101 	int res;
102 
103 	buflen = os_strlen(url) + 100;
104 	buf = os_malloc(buflen);
105 	if (buf == NULL)
106 		return -1;
107 
108 	os_snprintf(buf, buflen, "%s/cacerts", url);
109 	wpa_printf(MSG_INFO, "Download EST cacerts from %s", buf);
110 	write_summary(ctx, "Download EST cacerts from %s", buf);
111 	ctx->no_osu_cert_validation = 1;
112 	http_ocsp_set(ctx->http, 1);
113 	res = http_download_file(ctx->http, buf, "Cert/est-cacerts.txt",
114 				 ctx->ca_fname);
115 	http_ocsp_set(ctx->http,
116 		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
117 	ctx->no_osu_cert_validation = 0;
118 	if (res < 0) {
119 		wpa_printf(MSG_INFO, "Failed to download EST cacerts from %s",
120 			   buf);
121 		write_result(ctx, "Failed to download EST cacerts from %s",
122 			     buf);
123 		os_free(buf);
124 		return -1;
125 	}
126 	os_free(buf);
127 
128 	resp = os_readfile("Cert/est-cacerts.txt", &resp_len);
129 	if (resp == NULL) {
130 		wpa_printf(MSG_INFO, "Could not read Cert/est-cacerts.txt");
131 		write_result(ctx, "Could not read EST cacerts");
132 		return -1;
133 	}
134 
135 	pkcs7 = base64_decode((unsigned char *) resp, resp_len, &pkcs7_len);
136 	if (pkcs7 && pkcs7_len < resp_len / 2) {
137 		wpa_printf(MSG_INFO, "Too short base64 decode (%u bytes; downloaded %u bytes) - assume this was binary",
138 			   (unsigned int) pkcs7_len, (unsigned int) resp_len);
139 		os_free(pkcs7);
140 		pkcs7 = NULL;
141 	}
142 	if (pkcs7 == NULL) {
143 		wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
144 		pkcs7 = os_malloc(resp_len);
145 		if (pkcs7) {
146 			os_memcpy(pkcs7, resp, resp_len);
147 			pkcs7_len = resp_len;
148 		}
149 	}
150 	os_free(resp);
151 
152 	if (pkcs7 == NULL) {
153 		wpa_printf(MSG_INFO, "Could not fetch PKCS7 cacerts");
154 		write_result(ctx, "Could not fetch EST PKCS#7 cacerts");
155 		return -1;
156 	}
157 
158 	res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est-cacerts.pem",
159 			    NULL);
160 	os_free(pkcs7);
161 	if (res < 0) {
162 		wpa_printf(MSG_INFO, "Could not parse CA certs from PKCS#7 cacerts response");
163 		write_result(ctx, "Could not parse CA certs from EST PKCS#7 cacerts response");
164 		return -1;
165 	}
166 	unlink("Cert/est-cacerts.txt");
167 
168 	return 0;
169 }
170 
171 
172 /*
173  * CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
174  *
175  * AttrOrOID ::= CHOICE {
176  *   oid OBJECT IDENTIFIER,
177  *   attribute Attribute }
178  *
179  * Attribute ::= SEQUENCE {
180  *   type OBJECT IDENTIFIER,
181  *   values SET SIZE(1..MAX) OF OBJECT IDENTIFIER }
182  */
183 
184 typedef struct {
185 	ASN1_OBJECT *type;
186 	STACK_OF(ASN1_OBJECT) *values;
187 } Attribute;
188 
189 typedef struct {
190 	int type;
191 	union {
192 		ASN1_OBJECT *oid;
193 		Attribute *attribute;
194 	} d;
195 } AttrOrOID;
196 
197 typedef struct {
198 	int type;
199 	STACK_OF(AttrOrOID) *attrs;
200 } CsrAttrs;
201 
202 ASN1_SEQUENCE(Attribute) = {
203 	ASN1_SIMPLE(Attribute, type, ASN1_OBJECT),
204 	ASN1_SET_OF(Attribute, values, ASN1_OBJECT)
205 } ASN1_SEQUENCE_END(Attribute);
206 
207 ASN1_CHOICE(AttrOrOID) = {
208 	ASN1_SIMPLE(AttrOrOID, d.oid, ASN1_OBJECT),
209 	ASN1_SIMPLE(AttrOrOID, d.attribute, Attribute)
210 } ASN1_CHOICE_END(AttrOrOID);
211 
212 ASN1_CHOICE(CsrAttrs) = {
213 	ASN1_SEQUENCE_OF(CsrAttrs, attrs, AttrOrOID)
214 } ASN1_CHOICE_END(CsrAttrs);
215 
216 IMPLEMENT_ASN1_FUNCTIONS(CsrAttrs);
217 
218 
219 static void add_csrattrs_oid(struct hs20_osu_client *ctx, ASN1_OBJECT *oid,
220 			     STACK_OF(X509_EXTENSION) *exts)
221 {
222 	char txt[100];
223 	int res;
224 
225 	if (!oid)
226 		return;
227 
228 	res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
229 	if (res < 0 || res >= (int) sizeof(txt))
230 		return;
231 
232 	if (os_strcmp(txt, "1.2.840.113549.1.9.7") == 0) {
233 		wpa_printf(MSG_INFO, "TODO: csrattr challengePassword");
234 	} else if (os_strcmp(txt, "1.2.840.113549.1.1.11") == 0) {
235 		wpa_printf(MSG_INFO, "csrattr sha256WithRSAEncryption");
236 	} else {
237 		wpa_printf(MSG_INFO, "Ignore unsupported csrattr oid %s", txt);
238 	}
239 }
240 
241 
242 static void add_csrattrs_ext_req(struct hs20_osu_client *ctx,
243 				 STACK_OF(ASN1_OBJECT) *values,
244 				 STACK_OF(X509_EXTENSION) *exts)
245 {
246 	char txt[100];
247 	int i, num, res;
248 
249 	num = sk_ASN1_OBJECT_num(values);
250 	for (i = 0; i < num; i++) {
251 		ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(values, i);
252 
253 		res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
254 		if (res < 0 || res >= (int) sizeof(txt))
255 			continue;
256 
257 		if (os_strcmp(txt, "1.3.6.1.1.1.1.22") == 0) {
258 			wpa_printf(MSG_INFO, "TODO: extReq macAddress");
259 		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.3") == 0) {
260 			wpa_printf(MSG_INFO, "TODO: extReq imei");
261 		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.4") == 0) {
262 			wpa_printf(MSG_INFO, "TODO: extReq meid");
263 		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.5") == 0) {
264 			wpa_printf(MSG_INFO, "TODO: extReq DevId");
265 		} else {
266 			wpa_printf(MSG_INFO, "Ignore unsupported cstattr extensionsRequest %s",
267 				   txt);
268 		}
269 	}
270 }
271 
272 
273 static void add_csrattrs_attr(struct hs20_osu_client *ctx, Attribute *attr,
274 			      STACK_OF(X509_EXTENSION) *exts)
275 {
276 	char txt[100], txt2[100];
277 	int i, num, res;
278 
279 	if (!attr || !attr->type || !attr->values)
280 		return;
281 
282 	res = OBJ_obj2txt(txt, sizeof(txt), attr->type, 1);
283 	if (res < 0 || res >= (int) sizeof(txt))
284 		return;
285 
286 	if (os_strcmp(txt, "1.2.840.113549.1.9.14") == 0) {
287 		add_csrattrs_ext_req(ctx, attr->values, exts);
288 		return;
289 	}
290 
291 	num = sk_ASN1_OBJECT_num(attr->values);
292 	for (i = 0; i < num; i++) {
293 		ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(attr->values, i);
294 
295 		res = OBJ_obj2txt(txt2, sizeof(txt2), oid, 1);
296 		if (res < 0 || res >= (int) sizeof(txt2))
297 			continue;
298 
299 		wpa_printf(MSG_INFO, "Ignore unsupported cstattr::attr %s oid %s",
300 			   txt, txt2);
301 	}
302 }
303 
304 
305 static void add_csrattrs(struct hs20_osu_client *ctx, CsrAttrs *csrattrs,
306 			 STACK_OF(X509_EXTENSION) *exts)
307 {
308 	int i, num;
309 
310 	if (!csrattrs || ! csrattrs->attrs)
311 		return;
312 
313 	num = SKM_sk_num(AttrOrOID, csrattrs->attrs);
314 	for (i = 0; i < num; i++) {
315 		AttrOrOID *ao = SKM_sk_value(AttrOrOID, csrattrs->attrs, i);
316 		switch (ao->type) {
317 		case 0:
318 			add_csrattrs_oid(ctx, ao->d.oid, exts);
319 			break;
320 		case 1:
321 			add_csrattrs_attr(ctx, ao->d.attribute, exts);
322 			break;
323 		}
324 	}
325 }
326 
327 
328 static int generate_csr(struct hs20_osu_client *ctx, char *key_pem,
329 			char *csr_pem, char *est_req, char *old_cert,
330 			CsrAttrs *csrattrs)
331 {
332 	EVP_PKEY_CTX *pctx = NULL;
333 	EVP_PKEY *pkey = NULL;
334 	RSA *rsa;
335 	X509_REQ *req = NULL;
336 	int ret = -1;
337 	unsigned int val;
338 	X509_NAME *subj = NULL;
339 	char name[100];
340 	STACK_OF(X509_EXTENSION) *exts = NULL;
341 	X509_EXTENSION *ex;
342 	BIO *out;
343 
344 	wpa_printf(MSG_INFO, "Generate RSA private key");
345 	write_summary(ctx, "Generate RSA private key");
346 	pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
347 	if (!pctx)
348 		return -1;
349 
350 	if (EVP_PKEY_keygen_init(pctx) <= 0)
351 		goto fail;
352 
353 	if (EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, 2048) <= 0)
354 		goto fail;
355 
356 	if (EVP_PKEY_keygen(pctx, &pkey) <= 0)
357 		goto fail;
358 	EVP_PKEY_CTX_free(pctx);
359 	pctx = NULL;
360 
361 	rsa = EVP_PKEY_get1_RSA(pkey);
362 	if (rsa == NULL)
363 		goto fail;
364 
365 	if (key_pem) {
366 		FILE *f = fopen(key_pem, "wb");
367 		if (f == NULL)
368 			goto fail;
369 		if (!PEM_write_RSAPrivateKey(f, rsa, NULL, NULL, 0, NULL,
370 					     NULL)) {
371 			wpa_printf(MSG_INFO, "Could not write private key: %s",
372 				   ERR_error_string(ERR_get_error(), NULL));
373 			fclose(f);
374 			goto fail;
375 		}
376 		fclose(f);
377 	}
378 
379 	wpa_printf(MSG_INFO, "Generate CSR");
380 	write_summary(ctx, "Generate CSR");
381 	req = X509_REQ_new();
382 	if (req == NULL)
383 		goto fail;
384 
385 	if (old_cert) {
386 		FILE *f;
387 		X509 *cert;
388 		int res;
389 
390 		f = fopen(old_cert, "r");
391 		if (f == NULL)
392 			goto fail;
393 		cert = PEM_read_X509(f, NULL, NULL, NULL);
394 		fclose(f);
395 
396 		if (cert == NULL)
397 			goto fail;
398 		res = X509_REQ_set_subject_name(req,
399 						X509_get_subject_name(cert));
400 		X509_free(cert);
401 		if (!res)
402 			goto fail;
403 	} else {
404 		os_get_random((u8 *) &val, sizeof(val));
405 		os_snprintf(name, sizeof(name), "cert-user-%u", val);
406 		subj = X509_NAME_new();
407 		if (subj == NULL ||
408 		    !X509_NAME_add_entry_by_txt(subj, "CN", MBSTRING_ASC,
409 						(unsigned char *) name,
410 						-1, -1, 0) ||
411 		    !X509_REQ_set_subject_name(req, subj))
412 			goto fail;
413 		X509_NAME_free(subj);
414 		subj = NULL;
415 	}
416 
417 	if (!X509_REQ_set_pubkey(req, pkey))
418 		goto fail;
419 
420 	exts = sk_X509_EXTENSION_new_null();
421 	if (!exts)
422 		goto fail;
423 
424 	ex = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints,
425 				 "CA:FALSE");
426 	if (ex == NULL ||
427 	    !sk_X509_EXTENSION_push(exts, ex))
428 		goto fail;
429 
430 	ex = X509V3_EXT_conf_nid(NULL, NULL, NID_key_usage,
431 				 "nonRepudiation,digitalSignature,keyEncipherment");
432 	if (ex == NULL ||
433 	    !sk_X509_EXTENSION_push(exts, ex))
434 		goto fail;
435 
436 	ex = X509V3_EXT_conf_nid(NULL, NULL, NID_ext_key_usage,
437 				 "1.3.6.1.4.1.40808.1.1.2");
438 	if (ex == NULL ||
439 	    !sk_X509_EXTENSION_push(exts, ex))
440 		goto fail;
441 
442 	add_csrattrs(ctx, csrattrs, exts);
443 
444 	if (!X509_REQ_add_extensions(req, exts))
445 		goto fail;
446 	sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
447 	exts = NULL;
448 
449 	if (!X509_REQ_sign(req, pkey, EVP_sha256()))
450 		goto fail;
451 
452 	out = BIO_new(BIO_s_mem());
453 	if (out) {
454 		char *txt;
455 		size_t rlen;
456 
457 		X509_REQ_print(out, req);
458 		rlen = BIO_ctrl_pending(out);
459 		txt = os_malloc(rlen + 1);
460 		if (txt) {
461 			int res = BIO_read(out, txt, rlen);
462 			if (res > 0) {
463 				txt[res] = '\0';
464 				wpa_printf(MSG_MSGDUMP, "OpenSSL: Certificate request:\n%s",
465 					   txt);
466 			}
467 			os_free(txt);
468 		}
469 		BIO_free(out);
470 	}
471 
472 	if (csr_pem) {
473 		FILE *f = fopen(csr_pem, "w");
474 		if (f == NULL)
475 			goto fail;
476 		X509_REQ_print_fp(f, req);
477 		if (!PEM_write_X509_REQ(f, req)) {
478 			fclose(f);
479 			goto fail;
480 		}
481 		fclose(f);
482 	}
483 
484 	if (est_req) {
485 		BIO *mem = BIO_new(BIO_s_mem());
486 		BUF_MEM *ptr;
487 		char *pos, *end, *buf_end;
488 		FILE *f;
489 
490 		if (mem == NULL)
491 			goto fail;
492 		if (!PEM_write_bio_X509_REQ(mem, req)) {
493 			BIO_free(mem);
494 			goto fail;
495 		}
496 
497 		BIO_get_mem_ptr(mem, &ptr);
498 		pos = ptr->data;
499 		buf_end = pos + ptr->length;
500 
501 		/* Remove START/END lines */
502 		while (pos < buf_end && *pos != '\n')
503 			pos++;
504 		if (pos == buf_end) {
505 			BIO_free(mem);
506 			goto fail;
507 		}
508 		pos++;
509 
510 		end = pos;
511 		while (end < buf_end && *end != '-')
512 			end++;
513 
514 		f = fopen(est_req, "w");
515 		if (f == NULL) {
516 			BIO_free(mem);
517 			goto fail;
518 		}
519 		fwrite(pos, end - pos, 1, f);
520 		fclose(f);
521 
522 		BIO_free(mem);
523 	}
524 
525 	ret = 0;
526 fail:
527 	if (exts)
528 		sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
529 	if (subj)
530 		X509_NAME_free(subj);
531 	if (req)
532 		X509_REQ_free(req);
533 	if (pkey)
534 		EVP_PKEY_free(pkey);
535 	if (pctx)
536 		EVP_PKEY_CTX_free(pctx);
537 	return ret;
538 }
539 
540 
541 int est_build_csr(struct hs20_osu_client *ctx, const char *url)
542 {
543 	char *buf;
544 	size_t buflen;
545 	int res;
546 	char old_cert_buf[200];
547 	char *old_cert = NULL;
548 	CsrAttrs *csrattrs = NULL;
549 
550 	buflen = os_strlen(url) + 100;
551 	buf = os_malloc(buflen);
552 	if (buf == NULL)
553 		return -1;
554 
555 	os_snprintf(buf, buflen, "%s/csrattrs", url);
556 	wpa_printf(MSG_INFO, "Download csrattrs from %s", buf);
557 	write_summary(ctx, "Download EST csrattrs from %s", buf);
558 	ctx->no_osu_cert_validation = 1;
559 	http_ocsp_set(ctx->http, 1);
560 	res = http_download_file(ctx->http, buf, "Cert/est-csrattrs.txt",
561 				 ctx->ca_fname);
562 	http_ocsp_set(ctx->http,
563 		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
564 	ctx->no_osu_cert_validation = 0;
565 	os_free(buf);
566 	if (res < 0) {
567 		wpa_printf(MSG_INFO, "Failed to download EST csrattrs - assume no extra attributes are needed");
568 	} else {
569 		size_t resp_len;
570 		char *resp;
571 		unsigned char *attrs;
572 		const unsigned char *pos;
573 		size_t attrs_len;
574 
575 		resp = os_readfile("Cert/est-csrattrs.txt", &resp_len);
576 		if (resp == NULL) {
577 			wpa_printf(MSG_INFO, "Could not read csrattrs");
578 			return -1;
579 		}
580 
581 		attrs = base64_decode((unsigned char *) resp, resp_len,
582 				      &attrs_len);
583 		os_free(resp);
584 
585 		if (attrs == NULL) {
586 			wpa_printf(MSG_INFO, "Could not base64 decode csrattrs");
587 			return -1;
588 		}
589 		unlink("Cert/est-csrattrs.txt");
590 
591 		pos = attrs;
592 		csrattrs = d2i_CsrAttrs(NULL, &pos, attrs_len);
593 		os_free(attrs);
594 		if (csrattrs == NULL) {
595 			wpa_printf(MSG_INFO, "Failed to parse csrattrs ASN.1");
596 			/* Continue assuming no additional requirements */
597 		}
598 	}
599 
600 	if (ctx->client_cert_present) {
601 		os_snprintf(old_cert_buf, sizeof(old_cert_buf),
602 			    "SP/%s/client-cert.pem", ctx->fqdn);
603 		old_cert = old_cert_buf;
604 	}
605 
606 	res = generate_csr(ctx, "Cert/privkey-plain.pem", "Cert/est-req.pem",
607 			   "Cert/est-req.b64", old_cert, csrattrs);
608 	if (csrattrs)
609 		CsrAttrs_free(csrattrs);
610 
611 	return res;
612 }
613 
614 
615 int est_simple_enroll(struct hs20_osu_client *ctx, const char *url,
616 		      const char *user, const char *pw)
617 {
618 	char *buf, *resp, *req, *req2;
619 	size_t buflen, resp_len, len, pkcs7_len;
620 	unsigned char *pkcs7;
621 	FILE *f;
622 	char client_cert_buf[200];
623 	char client_key_buf[200];
624 	const char *client_cert = NULL, *client_key = NULL;
625 	int res;
626 
627 	req = os_readfile("Cert/est-req.b64", &len);
628 	if (req == NULL) {
629 		wpa_printf(MSG_INFO, "Could not read Cert/req.b64");
630 		return -1;
631 	}
632 	req2 = os_realloc(req, len + 1);
633 	if (req2 == NULL) {
634 		os_free(req);
635 		return -1;
636 	}
637 	req2[len] = '\0';
638 	req = req2;
639 	wpa_printf(MSG_DEBUG, "EST simpleenroll request: %s", req);
640 
641 	buflen = os_strlen(url) + 100;
642 	buf = os_malloc(buflen);
643 	if (buf == NULL) {
644 		os_free(req);
645 		return -1;
646 	}
647 
648 	if (ctx->client_cert_present) {
649 		os_snprintf(buf, buflen, "%s/simplereenroll", url);
650 		os_snprintf(client_cert_buf, sizeof(client_cert_buf),
651 			    "SP/%s/client-cert.pem", ctx->fqdn);
652 		client_cert = client_cert_buf;
653 		os_snprintf(client_key_buf, sizeof(client_key_buf),
654 			    "SP/%s/client-key.pem", ctx->fqdn);
655 		client_key = client_key_buf;
656 	} else
657 		os_snprintf(buf, buflen, "%s/simpleenroll", url);
658 	wpa_printf(MSG_INFO, "EST simpleenroll URL: %s", buf);
659 	write_summary(ctx, "EST simpleenroll URL: %s", buf);
660 	ctx->no_osu_cert_validation = 1;
661 	http_ocsp_set(ctx->http, 1);
662 	resp = http_post(ctx->http, buf, req, "application/pkcs10",
663 			 "Content-Transfer-Encoding: base64",
664 			 ctx->ca_fname, user, pw, client_cert, client_key,
665 			 &resp_len);
666 	http_ocsp_set(ctx->http,
667 		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
668 	ctx->no_osu_cert_validation = 0;
669 	os_free(buf);
670 	if (resp == NULL) {
671 		wpa_printf(MSG_INFO, "EST certificate enrollment failed");
672 		write_result(ctx, "EST certificate enrollment failed");
673 		return -1;
674 	}
675 	wpa_printf(MSG_DEBUG, "EST simpleenroll response: %s", resp);
676 	f = fopen("Cert/est-resp.raw", "w");
677 	if (f) {
678 		fwrite(resp, resp_len, 1, f);
679 		fclose(f);
680 	}
681 
682 	pkcs7 = base64_decode((unsigned char *) resp, resp_len, &pkcs7_len);
683 	if (pkcs7 == NULL) {
684 		wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
685 		pkcs7 = os_malloc(resp_len);
686 		if (pkcs7) {
687 			os_memcpy(pkcs7, resp, resp_len);
688 			pkcs7_len = resp_len;
689 		}
690 	}
691 	os_free(resp);
692 
693 	if (pkcs7 == NULL) {
694 		wpa_printf(MSG_INFO, "Failed to parse simpleenroll base64 response");
695 		write_result(ctx, "Failed to parse EST simpleenroll base64 response");
696 		return -1;
697 	}
698 
699 	res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est_cert.pem",
700 			    "Cert/est_cert.der");
701 	os_free(pkcs7);
702 
703 	if (res < 0) {
704 		wpa_printf(MSG_INFO, "EST: Failed to extract certificate from PKCS7 file");
705 		write_result(ctx, "EST: Failed to extract certificate from EST PKCS7 file");
706 		return -1;
707 	}
708 
709 	wpa_printf(MSG_INFO, "EST simple%senroll completed successfully",
710 		   ctx->client_cert_present ? "re" : "");
711 	write_summary(ctx, "EST simple%senroll completed successfully",
712 		      ctx->client_cert_present ? "re" : "");
713 
714 	return 0;
715 }
716