1 /* 2 * EAP peer method: EAP-TEAP PAC file processing 3 * Copyright (c) 2004-2019, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "eap_config.h" 13 #include "eap_i.h" 14 #include "eap_teap_pac.h" 15 16 /* TODO: encrypt PAC-Key in the PAC file */ 17 18 19 /* Text data format */ 20 static const char *pac_file_hdr = 21 "wpa_supplicant EAP-TEAP PAC file - version 1"; 22 23 /* 24 * Binary data format 25 * 4-octet magic value: 6A E4 92 1C 26 * 2-octet version (big endian) 27 * <version specific data> 28 * 29 * version=0: 30 * Sequence of PAC entries: 31 * 2-octet PAC-Type (big endian) 32 * 32-octet PAC-Key 33 * 2-octet PAC-Opaque length (big endian) 34 * <variable len> PAC-Opaque data (length bytes) 35 * 2-octet PAC-Info length (big endian) 36 * <variable len> PAC-Info data (length bytes) 37 */ 38 39 #define EAP_TEAP_PAC_BINARY_MAGIC 0x6ae4921c 40 #define EAP_TEAP_PAC_BINARY_FORMAT_VERSION 0 41 42 43 /** 44 * eap_teap_free_pac - Free PAC data 45 * @pac: Pointer to the PAC entry 46 * 47 * Note that the PAC entry must not be in a list since this function does not 48 * remove the list links. 49 */ 50 void eap_teap_free_pac(struct eap_teap_pac *pac) 51 { 52 os_free(pac->pac_opaque); 53 os_free(pac->pac_info); 54 os_free(pac->a_id); 55 os_free(pac->i_id); 56 os_free(pac->a_id_info); 57 os_free(pac); 58 } 59 60 61 /** 62 * eap_teap_get_pac - Get a PAC entry based on A-ID 63 * @pac_root: Pointer to root of the PAC list 64 * @a_id: A-ID to search for 65 * @a_id_len: Length of A-ID 66 * @pac_type: PAC-Type to search for 67 * Returns: Pointer to the PAC entry, or %NULL if A-ID not found 68 */ 69 struct eap_teap_pac * eap_teap_get_pac(struct eap_teap_pac *pac_root, 70 const u8 *a_id, size_t a_id_len, 71 u16 pac_type) 72 { 73 struct eap_teap_pac *pac = pac_root; 74 75 while (pac) { 76 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len && 77 os_memcmp(pac->a_id, a_id, a_id_len) == 0) { 78 return pac; 79 } 80 pac = pac->next; 81 } 82 return NULL; 83 } 84 85 86 static void eap_teap_remove_pac(struct eap_teap_pac **pac_root, 87 struct eap_teap_pac **pac_current, 88 const u8 *a_id, size_t a_id_len, u16 pac_type) 89 { 90 struct eap_teap_pac *pac, *prev; 91 92 pac = *pac_root; 93 prev = NULL; 94 95 while (pac) { 96 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len && 97 os_memcmp(pac->a_id, a_id, a_id_len) == 0) { 98 if (!prev) 99 *pac_root = pac->next; 100 else 101 prev->next = pac->next; 102 if (*pac_current == pac) 103 *pac_current = NULL; 104 eap_teap_free_pac(pac); 105 break; 106 } 107 prev = pac; 108 pac = pac->next; 109 } 110 } 111 112 113 static int eap_teap_copy_buf(u8 **dst, size_t *dst_len, 114 const u8 *src, size_t src_len) 115 { 116 if (src) { 117 *dst = os_memdup(src, src_len); 118 if (!(*dst)) 119 return -1; 120 *dst_len = src_len; 121 } 122 return 0; 123 } 124 125 126 /** 127 * eap_teap_add_pac - Add a copy of a PAC entry to a list 128 * @pac_root: Pointer to PAC list root pointer 129 * @pac_current: Pointer to the current PAC pointer 130 * @entry: New entry to clone and add to the list 131 * Returns: 0 on success, -1 on failure 132 * 133 * This function makes a clone of the given PAC entry and adds this copied 134 * entry to the list (pac_root). If an old entry for the same A-ID is found, 135 * it will be removed from the PAC list and in this case, pac_current entry 136 * is set to %NULL if it was the removed entry. 137 */ 138 int eap_teap_add_pac(struct eap_teap_pac **pac_root, 139 struct eap_teap_pac **pac_current, 140 struct eap_teap_pac *entry) 141 { 142 struct eap_teap_pac *pac; 143 144 if (!entry || !entry->a_id) 145 return -1; 146 147 /* Remove a possible old entry for the matching A-ID. */ 148 eap_teap_remove_pac(pac_root, pac_current, 149 entry->a_id, entry->a_id_len, entry->pac_type); 150 151 /* Allocate a new entry and add it to the list of PACs. */ 152 pac = os_zalloc(sizeof(*pac)); 153 if (!pac) 154 return -1; 155 156 pac->pac_type = entry->pac_type; 157 os_memcpy(pac->pac_key, entry->pac_key, EAP_TEAP_PAC_KEY_LEN); 158 if (eap_teap_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len, 159 entry->pac_opaque, entry->pac_opaque_len) < 0 || 160 eap_teap_copy_buf(&pac->pac_info, &pac->pac_info_len, 161 entry->pac_info, entry->pac_info_len) < 0 || 162 eap_teap_copy_buf(&pac->a_id, &pac->a_id_len, 163 entry->a_id, entry->a_id_len) < 0 || 164 eap_teap_copy_buf(&pac->i_id, &pac->i_id_len, 165 entry->i_id, entry->i_id_len) < 0 || 166 eap_teap_copy_buf(&pac->a_id_info, &pac->a_id_info_len, 167 entry->a_id_info, entry->a_id_info_len) < 0) { 168 eap_teap_free_pac(pac); 169 return -1; 170 } 171 172 pac->next = *pac_root; 173 *pac_root = pac; 174 175 return 0; 176 } 177 178 179 struct eap_teap_read_ctx { 180 FILE *f; 181 const char *pos; 182 const char *end; 183 int line; 184 char *buf; 185 size_t buf_len; 186 }; 187 188 static int eap_teap_read_line(struct eap_teap_read_ctx *rc, char **value) 189 { 190 char *pos; 191 192 rc->line++; 193 if (rc->f) { 194 if (fgets(rc->buf, rc->buf_len, rc->f) == NULL) 195 return -1; 196 } else { 197 const char *l_end; 198 size_t len; 199 200 if (rc->pos >= rc->end) 201 return -1; 202 l_end = rc->pos; 203 while (l_end < rc->end && *l_end != '\n') 204 l_end++; 205 len = l_end - rc->pos; 206 if (len >= rc->buf_len) 207 len = rc->buf_len - 1; 208 os_memcpy(rc->buf, rc->pos, len); 209 rc->buf[len] = '\0'; 210 rc->pos = l_end + 1; 211 } 212 213 rc->buf[rc->buf_len - 1] = '\0'; 214 pos = rc->buf; 215 while (*pos != '\0') { 216 if (*pos == '\n' || *pos == '\r') { 217 *pos = '\0'; 218 break; 219 } 220 pos++; 221 } 222 223 pos = os_strchr(rc->buf, '='); 224 if (pos) 225 *pos++ = '\0'; 226 *value = pos; 227 228 return 0; 229 } 230 231 232 static u8 * eap_teap_parse_hex(const char *value, size_t *len) 233 { 234 int hlen; 235 u8 *buf; 236 237 if (!value) 238 return NULL; 239 hlen = os_strlen(value); 240 if (hlen & 1) 241 return NULL; 242 *len = hlen / 2; 243 buf = os_malloc(*len); 244 if (!buf) 245 return NULL; 246 if (hexstr2bin(value, buf, *len)) { 247 os_free(buf); 248 return NULL; 249 } 250 return buf; 251 } 252 253 254 static int eap_teap_init_pac_data(struct eap_sm *sm, const char *pac_file, 255 struct eap_teap_read_ctx *rc) 256 { 257 os_memset(rc, 0, sizeof(*rc)); 258 259 rc->buf_len = 2048; 260 rc->buf = os_malloc(rc->buf_len); 261 if (!rc->buf) 262 return -1; 263 264 if (os_strncmp(pac_file, "blob://", 7) == 0) { 265 const struct wpa_config_blob *blob; 266 267 blob = eap_get_config_blob(sm, pac_file + 7); 268 if (!blob) { 269 wpa_printf(MSG_INFO, 270 "EAP-TEAP: No PAC blob '%s' - assume no PAC entries have been provisioned", 271 pac_file + 7); 272 os_free(rc->buf); 273 return -1; 274 } 275 rc->pos = (char *) blob->data; 276 rc->end = (char *) blob->data + blob->len; 277 } else { 278 rc->f = fopen(pac_file, "rb"); 279 if (!rc->f) { 280 wpa_printf(MSG_INFO, 281 "EAP-TEAP: No PAC file '%s' - assume no PAC entries have been provisioned", 282 pac_file); 283 os_free(rc->buf); 284 return -1; 285 } 286 } 287 288 return 0; 289 } 290 291 292 static void eap_teap_deinit_pac_data(struct eap_teap_read_ctx *rc) 293 { 294 os_free(rc->buf); 295 if (rc->f) 296 fclose(rc->f); 297 } 298 299 300 static const char * eap_teap_parse_start(struct eap_teap_pac **pac) 301 { 302 if (*pac) 303 return "START line without END"; 304 305 *pac = os_zalloc(sizeof(struct eap_teap_pac)); 306 if (!(*pac)) 307 return "No memory for PAC entry"; 308 (*pac)->pac_type = PAC_TYPE_TUNNEL_PAC; 309 return NULL; 310 } 311 312 313 static const char * eap_teap_parse_end(struct eap_teap_pac **pac_root, 314 struct eap_teap_pac **pac) 315 { 316 if (!(*pac)) 317 return "END line without START"; 318 if (*pac_root) { 319 struct eap_teap_pac *end = *pac_root; 320 321 while (end->next) 322 end = end->next; 323 end->next = *pac; 324 } else 325 *pac_root = *pac; 326 327 *pac = NULL; 328 return NULL; 329 } 330 331 332 static const char * eap_teap_parse_pac_type(struct eap_teap_pac *pac, 333 char *pos) 334 { 335 if (!pos) 336 return "Cannot parse pac type"; 337 pac->pac_type = atoi(pos); 338 if (pac->pac_type != PAC_TYPE_TUNNEL_PAC) 339 return "Unrecognized PAC-Type"; 340 341 return NULL; 342 } 343 344 345 static const char * eap_teap_parse_pac_key(struct eap_teap_pac *pac, char *pos) 346 { 347 u8 *key; 348 size_t key_len; 349 350 key = eap_teap_parse_hex(pos, &key_len); 351 if (!key || key_len != EAP_TEAP_PAC_KEY_LEN) { 352 os_free(key); 353 return "Invalid PAC-Key"; 354 } 355 356 os_memcpy(pac->pac_key, key, EAP_TEAP_PAC_KEY_LEN); 357 os_free(key); 358 359 return NULL; 360 } 361 362 363 static const char * eap_teap_parse_pac_opaque(struct eap_teap_pac *pac, 364 char *pos) 365 { 366 os_free(pac->pac_opaque); 367 pac->pac_opaque = eap_teap_parse_hex(pos, &pac->pac_opaque_len); 368 if (!pac->pac_opaque) 369 return "Invalid PAC-Opaque"; 370 return NULL; 371 } 372 373 374 static const char * eap_teap_parse_a_id(struct eap_teap_pac *pac, char *pos) 375 { 376 os_free(pac->a_id); 377 pac->a_id = eap_teap_parse_hex(pos, &pac->a_id_len); 378 if (!pac->a_id) 379 return "Invalid A-ID"; 380 return NULL; 381 } 382 383 384 static const char * eap_teap_parse_i_id(struct eap_teap_pac *pac, char *pos) 385 { 386 os_free(pac->i_id); 387 pac->i_id = eap_teap_parse_hex(pos, &pac->i_id_len); 388 if (!pac->i_id) 389 return "Invalid I-ID"; 390 return NULL; 391 } 392 393 394 static const char * eap_teap_parse_a_id_info(struct eap_teap_pac *pac, 395 char *pos) 396 { 397 os_free(pac->a_id_info); 398 pac->a_id_info = eap_teap_parse_hex(pos, &pac->a_id_info_len); 399 if (!pac->a_id_info) 400 return "Invalid A-ID-Info"; 401 return NULL; 402 } 403 404 405 /** 406 * eap_teap_load_pac - Load PAC entries (text format) 407 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 408 * @pac_root: Pointer to root of the PAC list (to be filled) 409 * @pac_file: Name of the PAC file/blob to load 410 * Returns: 0 on success, -1 on failure 411 */ 412 int eap_teap_load_pac(struct eap_sm *sm, struct eap_teap_pac **pac_root, 413 const char *pac_file) 414 { 415 struct eap_teap_read_ctx rc; 416 struct eap_teap_pac *pac = NULL; 417 int count = 0; 418 char *pos; 419 const char *err = NULL; 420 421 if (!pac_file) 422 return -1; 423 424 if (eap_teap_init_pac_data(sm, pac_file, &rc) < 0) 425 return 0; 426 427 if (eap_teap_read_line(&rc, &pos) < 0) { 428 /* empty file - assume it is fine to overwrite */ 429 eap_teap_deinit_pac_data(&rc); 430 return 0; 431 } 432 if (os_strcmp(pac_file_hdr, rc.buf) != 0) 433 err = "Unrecognized header line"; 434 435 while (!err && eap_teap_read_line(&rc, &pos) == 0) { 436 if (os_strcmp(rc.buf, "START") == 0) 437 err = eap_teap_parse_start(&pac); 438 else if (os_strcmp(rc.buf, "END") == 0) { 439 err = eap_teap_parse_end(pac_root, &pac); 440 count++; 441 } else if (!pac) 442 err = "Unexpected line outside START/END block"; 443 else if (os_strcmp(rc.buf, "PAC-Type") == 0) 444 err = eap_teap_parse_pac_type(pac, pos); 445 else if (os_strcmp(rc.buf, "PAC-Key") == 0) 446 err = eap_teap_parse_pac_key(pac, pos); 447 else if (os_strcmp(rc.buf, "PAC-Opaque") == 0) 448 err = eap_teap_parse_pac_opaque(pac, pos); 449 else if (os_strcmp(rc.buf, "A-ID") == 0) 450 err = eap_teap_parse_a_id(pac, pos); 451 else if (os_strcmp(rc.buf, "I-ID") == 0) 452 err = eap_teap_parse_i_id(pac, pos); 453 else if (os_strcmp(rc.buf, "A-ID-Info") == 0) 454 err = eap_teap_parse_a_id_info(pac, pos); 455 } 456 457 if (pac) { 458 if (!err) 459 err = "PAC block not terminated with END"; 460 eap_teap_free_pac(pac); 461 } 462 463 eap_teap_deinit_pac_data(&rc); 464 465 if (err) { 466 wpa_printf(MSG_INFO, "EAP-TEAP: %s in '%s:%d'", 467 err, pac_file, rc.line); 468 return -1; 469 } 470 471 wpa_printf(MSG_DEBUG, "EAP-TEAP: Read %d PAC entries from '%s'", 472 count, pac_file); 473 474 return 0; 475 } 476 477 478 static void eap_teap_write(char **buf, char **pos, size_t *buf_len, 479 const char *field, const u8 *data, 480 size_t len, int txt) 481 { 482 size_t i, need; 483 int ret; 484 char *end; 485 486 if (!data || !buf || !(*buf) || !pos || !(*pos) || *pos < *buf) 487 return; 488 489 need = os_strlen(field) + len * 2 + 30; 490 if (txt) 491 need += os_strlen(field) + len + 20; 492 493 if (*pos - *buf + need > *buf_len) { 494 char *nbuf = os_realloc(*buf, *buf_len + need); 495 496 if (!nbuf) { 497 os_free(*buf); 498 *buf = NULL; 499 return; 500 } 501 *pos = nbuf + (*pos - *buf); 502 *buf = nbuf; 503 *buf_len += need; 504 } 505 end = *buf + *buf_len; 506 507 ret = os_snprintf(*pos, end - *pos, "%s=", field); 508 if (os_snprintf_error(end - *pos, ret)) 509 return; 510 *pos += ret; 511 *pos += wpa_snprintf_hex(*pos, end - *pos, data, len); 512 ret = os_snprintf(*pos, end - *pos, "\n"); 513 if (os_snprintf_error(end - *pos, ret)) 514 return; 515 *pos += ret; 516 517 if (txt) { 518 ret = os_snprintf(*pos, end - *pos, "%s-txt=", field); 519 if (os_snprintf_error(end - *pos, ret)) 520 return; 521 *pos += ret; 522 for (i = 0; i < len; i++) { 523 ret = os_snprintf(*pos, end - *pos, "%c", data[i]); 524 if (os_snprintf_error(end - *pos, ret)) 525 return; 526 *pos += ret; 527 } 528 ret = os_snprintf(*pos, end - *pos, "\n"); 529 if (os_snprintf_error(end - *pos, ret)) 530 return; 531 *pos += ret; 532 } 533 } 534 535 536 static int eap_teap_write_pac(struct eap_sm *sm, const char *pac_file, 537 char *buf, size_t len) 538 { 539 if (os_strncmp(pac_file, "blob://", 7) == 0) { 540 struct wpa_config_blob *blob; 541 542 blob = os_zalloc(sizeof(*blob)); 543 if (!blob) 544 return -1; 545 blob->data = (u8 *) buf; 546 blob->len = len; 547 buf = NULL; 548 blob->name = os_strdup(pac_file + 7); 549 if (!blob->name) { 550 os_free(blob); 551 return -1; 552 } 553 eap_set_config_blob(sm, blob); 554 } else { 555 FILE *f; 556 557 f = fopen(pac_file, "wb"); 558 if (!f) { 559 wpa_printf(MSG_INFO, 560 "EAP-TEAP: Failed to open PAC file '%s' for writing", 561 pac_file); 562 return -1; 563 } 564 if (fwrite(buf, 1, len, f) != len) { 565 wpa_printf(MSG_INFO, 566 "EAP-TEAP: Failed to write all PACs into '%s'", 567 pac_file); 568 fclose(f); 569 return -1; 570 } 571 os_free(buf); 572 fclose(f); 573 } 574 575 return 0; 576 } 577 578 579 static int eap_teap_add_pac_data(struct eap_teap_pac *pac, char **buf, 580 char **pos, size_t *buf_len) 581 { 582 int ret; 583 584 ret = os_snprintf(*pos, *buf + *buf_len - *pos, 585 "START\nPAC-Type=%d\n", pac->pac_type); 586 if (os_snprintf_error(*buf + *buf_len - *pos, ret)) 587 return -1; 588 589 *pos += ret; 590 eap_teap_write(buf, pos, buf_len, "PAC-Key", 591 pac->pac_key, EAP_TEAP_PAC_KEY_LEN, 0); 592 eap_teap_write(buf, pos, buf_len, "PAC-Opaque", 593 pac->pac_opaque, pac->pac_opaque_len, 0); 594 eap_teap_write(buf, pos, buf_len, "PAC-Info", 595 pac->pac_info, pac->pac_info_len, 0); 596 eap_teap_write(buf, pos, buf_len, "A-ID", 597 pac->a_id, pac->a_id_len, 0); 598 eap_teap_write(buf, pos, buf_len, "I-ID", 599 pac->i_id, pac->i_id_len, 1); 600 eap_teap_write(buf, pos, buf_len, "A-ID-Info", 601 pac->a_id_info, pac->a_id_info_len, 1); 602 if (!(*buf)) { 603 wpa_printf(MSG_DEBUG, "EAP-TEAP: No memory for PAC data"); 604 return -1; 605 } 606 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n"); 607 if (os_snprintf_error(*buf + *buf_len - *pos, ret)) 608 return -1; 609 *pos += ret; 610 611 return 0; 612 } 613 614 615 /** 616 * eap_teap_save_pac - Save PAC entries (text format) 617 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 618 * @pac_root: Root of the PAC list 619 * @pac_file: Name of the PAC file/blob 620 * Returns: 0 on success, -1 on failure 621 */ 622 int eap_teap_save_pac(struct eap_sm *sm, struct eap_teap_pac *pac_root, 623 const char *pac_file) 624 { 625 struct eap_teap_pac *pac; 626 int ret, count = 0; 627 char *buf, *pos; 628 size_t buf_len; 629 630 if (!pac_file) 631 return -1; 632 633 buf_len = 1024; 634 pos = buf = os_malloc(buf_len); 635 if (!buf) 636 return -1; 637 638 ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr); 639 if (os_snprintf_error(buf + buf_len - pos, ret)) { 640 os_free(buf); 641 return -1; 642 } 643 pos += ret; 644 645 pac = pac_root; 646 while (pac) { 647 if (eap_teap_add_pac_data(pac, &buf, &pos, &buf_len)) { 648 os_free(buf); 649 return -1; 650 } 651 count++; 652 pac = pac->next; 653 } 654 655 if (eap_teap_write_pac(sm, pac_file, buf, pos - buf)) { 656 os_free(buf); 657 return -1; 658 } 659 660 wpa_printf(MSG_DEBUG, "EAP-TEAP: Wrote %d PAC entries into '%s'", 661 count, pac_file); 662 663 return 0; 664 } 665 666 667 /** 668 * eap_teap_pac_list_truncate - Truncate a PAC list to the given length 669 * @pac_root: Root of the PAC list 670 * @max_len: Maximum length of the list (>= 1) 671 * Returns: Number of PAC entries removed 672 */ 673 size_t eap_teap_pac_list_truncate(struct eap_teap_pac *pac_root, 674 size_t max_len) 675 { 676 struct eap_teap_pac *pac, *prev; 677 size_t count; 678 679 pac = pac_root; 680 prev = NULL; 681 count = 0; 682 683 while (pac) { 684 count++; 685 if (count > max_len) 686 break; 687 prev = pac; 688 pac = pac->next; 689 } 690 691 if (count <= max_len || !prev) 692 return 0; 693 694 count = 0; 695 prev->next = NULL; 696 697 while (pac) { 698 prev = pac; 699 pac = pac->next; 700 eap_teap_free_pac(prev); 701 count++; 702 } 703 704 return count; 705 } 706 707 708 static void eap_teap_pac_get_a_id(struct eap_teap_pac *pac) 709 { 710 u8 *pos, *end; 711 u16 type, len; 712 713 pos = pac->pac_info; 714 end = pos + pac->pac_info_len; 715 716 while (end - pos > 4) { 717 type = WPA_GET_BE16(pos); 718 pos += 2; 719 len = WPA_GET_BE16(pos); 720 pos += 2; 721 if (len > (unsigned int) (end - pos)) 722 break; 723 724 if (type == PAC_TYPE_A_ID) { 725 os_free(pac->a_id); 726 pac->a_id = os_memdup(pos, len); 727 if (!pac->a_id) 728 break; 729 pac->a_id_len = len; 730 } 731 732 if (type == PAC_TYPE_A_ID_INFO) { 733 os_free(pac->a_id_info); 734 pac->a_id_info = os_memdup(pos, len); 735 if (!pac->a_id_info) 736 break; 737 pac->a_id_info_len = len; 738 } 739 740 pos += len; 741 } 742 } 743 744 745 /** 746 * eap_teap_load_pac_bin - Load PAC entries (binary format) 747 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 748 * @pac_root: Pointer to root of the PAC list (to be filled) 749 * @pac_file: Name of the PAC file/blob to load 750 * Returns: 0 on success, -1 on failure 751 */ 752 int eap_teap_load_pac_bin(struct eap_sm *sm, struct eap_teap_pac **pac_root, 753 const char *pac_file) 754 { 755 const struct wpa_config_blob *blob = NULL; 756 u8 *buf, *end, *pos; 757 size_t len, count = 0; 758 struct eap_teap_pac *pac, *prev; 759 760 *pac_root = NULL; 761 762 if (!pac_file) 763 return -1; 764 765 if (os_strncmp(pac_file, "blob://", 7) == 0) { 766 blob = eap_get_config_blob(sm, pac_file + 7); 767 if (!blob) { 768 wpa_printf(MSG_INFO, 769 "EAP-TEAP: No PAC blob '%s' - assume no PAC entries have been provisioned", 770 pac_file + 7); 771 return 0; 772 } 773 buf = blob->data; 774 len = blob->len; 775 } else { 776 buf = (u8 *) os_readfile(pac_file, &len); 777 if (!buf) { 778 wpa_printf(MSG_INFO, 779 "EAP-TEAP: No PAC file '%s' - assume no PAC entries have been provisioned", 780 pac_file); 781 return 0; 782 } 783 } 784 785 if (len == 0) { 786 if (!blob) 787 os_free(buf); 788 return 0; 789 } 790 791 if (len < 6 || WPA_GET_BE32(buf) != EAP_TEAP_PAC_BINARY_MAGIC || 792 WPA_GET_BE16(buf + 4) != EAP_TEAP_PAC_BINARY_FORMAT_VERSION) { 793 wpa_printf(MSG_INFO, "EAP-TEAP: Invalid PAC file '%s' (bin)", 794 pac_file); 795 if (!blob) 796 os_free(buf); 797 return -1; 798 } 799 800 pac = prev = NULL; 801 pos = buf + 6; 802 end = buf + len; 803 while (pos < end) { 804 u16 val; 805 806 if (end - pos < 2 + EAP_TEAP_PAC_KEY_LEN + 2 + 2) { 807 pac = NULL; 808 goto parse_fail; 809 } 810 811 pac = os_zalloc(sizeof(*pac)); 812 if (!pac) 813 goto parse_fail; 814 815 pac->pac_type = WPA_GET_BE16(pos); 816 pos += 2; 817 os_memcpy(pac->pac_key, pos, EAP_TEAP_PAC_KEY_LEN); 818 pos += EAP_TEAP_PAC_KEY_LEN; 819 val = WPA_GET_BE16(pos); 820 pos += 2; 821 if (val > end - pos) 822 goto parse_fail; 823 pac->pac_opaque_len = val; 824 pac->pac_opaque = os_memdup(pos, pac->pac_opaque_len); 825 if (!pac->pac_opaque) 826 goto parse_fail; 827 pos += pac->pac_opaque_len; 828 if (end - pos < 2) 829 goto parse_fail; 830 val = WPA_GET_BE16(pos); 831 pos += 2; 832 if (val > end - pos) 833 goto parse_fail; 834 pac->pac_info_len = val; 835 pac->pac_info = os_memdup(pos, pac->pac_info_len); 836 if (!pac->pac_info) 837 goto parse_fail; 838 pos += pac->pac_info_len; 839 eap_teap_pac_get_a_id(pac); 840 841 count++; 842 if (prev) 843 prev->next = pac; 844 else 845 *pac_root = pac; 846 prev = pac; 847 } 848 849 if (!blob) 850 os_free(buf); 851 852 wpa_printf(MSG_DEBUG, "EAP-TEAP: Read %lu PAC entries from '%s' (bin)", 853 (unsigned long) count, pac_file); 854 855 return 0; 856 857 parse_fail: 858 wpa_printf(MSG_INFO, "EAP-TEAP: Failed to parse PAC file '%s' (bin)", 859 pac_file); 860 if (!blob) 861 os_free(buf); 862 if (pac) 863 eap_teap_free_pac(pac); 864 return -1; 865 } 866 867 868 /** 869 * eap_teap_save_pac_bin - Save PAC entries (binary format) 870 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 871 * @pac_root: Root of the PAC list 872 * @pac_file: Name of the PAC file/blob 873 * Returns: 0 on success, -1 on failure 874 */ 875 int eap_teap_save_pac_bin(struct eap_sm *sm, struct eap_teap_pac *pac_root, 876 const char *pac_file) 877 { 878 size_t len, count = 0; 879 struct eap_teap_pac *pac; 880 u8 *buf, *pos; 881 882 len = 6; 883 pac = pac_root; 884 while (pac) { 885 if (pac->pac_opaque_len > 65535 || 886 pac->pac_info_len > 65535) 887 return -1; 888 len += 2 + EAP_TEAP_PAC_KEY_LEN + 2 + pac->pac_opaque_len + 889 2 + pac->pac_info_len; 890 pac = pac->next; 891 } 892 893 buf = os_malloc(len); 894 if (!buf) 895 return -1; 896 897 pos = buf; 898 WPA_PUT_BE32(pos, EAP_TEAP_PAC_BINARY_MAGIC); 899 pos += 4; 900 WPA_PUT_BE16(pos, EAP_TEAP_PAC_BINARY_FORMAT_VERSION); 901 pos += 2; 902 903 pac = pac_root; 904 while (pac) { 905 WPA_PUT_BE16(pos, pac->pac_type); 906 pos += 2; 907 os_memcpy(pos, pac->pac_key, EAP_TEAP_PAC_KEY_LEN); 908 pos += EAP_TEAP_PAC_KEY_LEN; 909 WPA_PUT_BE16(pos, pac->pac_opaque_len); 910 pos += 2; 911 os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len); 912 pos += pac->pac_opaque_len; 913 WPA_PUT_BE16(pos, pac->pac_info_len); 914 pos += 2; 915 os_memcpy(pos, pac->pac_info, pac->pac_info_len); 916 pos += pac->pac_info_len; 917 918 pac = pac->next; 919 count++; 920 } 921 922 if (eap_teap_write_pac(sm, pac_file, (char *) buf, len)) { 923 os_free(buf); 924 return -1; 925 } 926 927 wpa_printf(MSG_DEBUG, "EAP-TEAP: Wrote %lu PAC entries into '%s' (bin)", 928 (unsigned long) count, pac_file); 929 930 return 0; 931 } 932