2 * EAP peer method: EAP-FAST PAC file processing
3 * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
12 #include "eap_config.h"
14 #include "eap_fast_pac.h"
16 /* TODO: encrypt PAC-Key in the PAC file */
19 /* Text data format */
20 static const char *pac_file_hdr =
21 "wpa_supplicant EAP-FAST PAC file - version 1";
25 * 4-octet magic value: 6A E4 92 0C
26 * 2-octet version (big endian)
27 * <version specific data>
30 * Sequence of PAC entries:
31 * 2-octet PAC-Type (big endian)
33 * 2-octet PAC-Opaque length (big endian)
34 * <variable len> PAC-Opaque data (length bytes)
35 * 2-octet PAC-Info length (big endian)
36 * <variable len> PAC-Info data (length bytes)
39 #define EAP_FAST_PAC_BINARY_MAGIC 0x6ae4920c
40 #define EAP_FAST_PAC_BINARY_FORMAT_VERSION 0
44 * eap_fast_free_pac - Free PAC data
45 * @pac: Pointer to the PAC entry
47 * Note that the PAC entry must not be in a list since this function does not
48 * remove the list links.
50 void eap_fast_free_pac(struct eap_fast_pac *pac)
52 os_free(pac->pac_opaque);
53 os_free(pac->pac_info);
56 os_free(pac->a_id_info);
62 * eap_fast_get_pac - Get a PAC entry based on A-ID
63 * @pac_root: Pointer to root of the PAC list
64 * @a_id: A-ID to search for
65 * @a_id_len: Length of A-ID
66 * @pac_type: PAC-Type to search for
67 * Returns: Pointer to the PAC entry, or %NULL if A-ID not found
69 struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_pac *pac_root,
70 const u8 *a_id, size_t a_id_len,
73 struct eap_fast_pac *pac = pac_root;
76 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
77 os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
86 static void eap_fast_remove_pac(struct eap_fast_pac **pac_root,
87 struct eap_fast_pac **pac_current,
88 const u8 *a_id, size_t a_id_len, u16 pac_type)
90 struct eap_fast_pac *pac, *prev;
96 if (pac->pac_type == pac_type && pac->a_id_len == a_id_len &&
97 os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
99 *pac_root = pac->next;
101 prev->next = pac->next;
102 if (*pac_current == pac)
104 eap_fast_free_pac(pac);
113 static int eap_fast_copy_buf(u8 **dst, size_t *dst_len,
114 const u8 *src, size_t src_len)
117 *dst = os_malloc(src_len);
120 os_memcpy(*dst, src, src_len);
128 * eap_fast_add_pac - Add a copy of a PAC entry to a list
129 * @pac_root: Pointer to PAC list root pointer
130 * @pac_current: Pointer to the current PAC pointer
131 * @entry: New entry to clone and add to the list
132 * Returns: 0 on success, -1 on failure
134 * This function makes a clone of the given PAC entry and adds this copied
135 * entry to the list (pac_root). If an old entry for the same A-ID is found,
136 * it will be removed from the PAC list and in this case, pac_current entry
137 * is set to %NULL if it was the removed entry.
139 int eap_fast_add_pac(struct eap_fast_pac **pac_root,
140 struct eap_fast_pac **pac_current,
141 struct eap_fast_pac *entry)
143 struct eap_fast_pac *pac;
145 if (entry == NULL || entry->a_id == NULL)
148 /* Remove a possible old entry for the matching A-ID. */
149 eap_fast_remove_pac(pac_root, pac_current,
150 entry->a_id, entry->a_id_len, entry->pac_type);
152 /* Allocate a new entry and add it to the list of PACs. */
153 pac = os_zalloc(sizeof(*pac));
157 pac->pac_type = entry->pac_type;
158 os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN);
159 if (eap_fast_copy_buf(&pac->pac_opaque, &pac->pac_opaque_len,
160 entry->pac_opaque, entry->pac_opaque_len) < 0 ||
161 eap_fast_copy_buf(&pac->pac_info, &pac->pac_info_len,
162 entry->pac_info, entry->pac_info_len) < 0 ||
163 eap_fast_copy_buf(&pac->a_id, &pac->a_id_len,
164 entry->a_id, entry->a_id_len) < 0 ||
165 eap_fast_copy_buf(&pac->i_id, &pac->i_id_len,
166 entry->i_id, entry->i_id_len) < 0 ||
167 eap_fast_copy_buf(&pac->a_id_info, &pac->a_id_info_len,
168 entry->a_id_info, entry->a_id_info_len) < 0) {
169 eap_fast_free_pac(pac);
173 pac->next = *pac_root;
180 struct eap_fast_read_ctx {
189 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char **value)
195 if (fgets(rc->buf, rc->buf_len, rc->f) == NULL)
200 if (rc->pos >= rc->end)
203 while (l_end < rc->end && *l_end != '\n')
205 len = l_end - rc->pos;
206 if (len >= rc->buf_len)
207 len = rc->buf_len - 1;
208 os_memcpy(rc->buf, rc->pos, len);
213 rc->buf[rc->buf_len - 1] = '\0';
215 while (*pos != '\0') {
216 if (*pos == '\n' || *pos == '\r') {
223 pos = os_strchr(rc->buf, '=');
232 static u8 * eap_fast_parse_hex(const char *value, size_t *len)
239 hlen = os_strlen(value);
243 buf = os_malloc(*len);
246 if (hexstr2bin(value, buf, *len)) {
254 static int eap_fast_init_pac_data(struct eap_sm *sm, const char *pac_file,
255 struct eap_fast_read_ctx *rc)
257 os_memset(rc, 0, sizeof(*rc));
260 rc->buf = os_malloc(rc->buf_len);
264 if (os_strncmp(pac_file, "blob://", 7) == 0) {
265 const struct wpa_config_blob *blob;
266 blob = eap_get_config_blob(sm, pac_file + 7);
268 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
269 "assume no PAC entries have been "
270 "provisioned", pac_file + 7);
274 rc->pos = (char *) blob->data;
275 rc->end = (char *) blob->data + blob->len;
277 rc->f = fopen(pac_file, "rb");
279 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
280 "assume no PAC entries have been "
281 "provisioned", pac_file);
291 static void eap_fast_deinit_pac_data(struct eap_fast_read_ctx *rc)
299 static const char * eap_fast_parse_start(struct eap_fast_pac **pac)
302 return "START line without END";
304 *pac = os_zalloc(sizeof(struct eap_fast_pac));
306 return "No memory for PAC entry";
307 (*pac)->pac_type = PAC_TYPE_TUNNEL_PAC;
312 static const char * eap_fast_parse_end(struct eap_fast_pac **pac_root,
313 struct eap_fast_pac **pac)
316 return "END line without START";
318 struct eap_fast_pac *end = *pac_root;
330 static const char * eap_fast_parse_pac_type(struct eap_fast_pac *pac,
333 pac->pac_type = atoi(pos);
334 if (pac->pac_type != PAC_TYPE_TUNNEL_PAC &&
335 pac->pac_type != PAC_TYPE_USER_AUTHORIZATION &&
336 pac->pac_type != PAC_TYPE_MACHINE_AUTHENTICATION)
337 return "Unrecognized PAC-Type";
343 static const char * eap_fast_parse_pac_key(struct eap_fast_pac *pac, char *pos)
348 key = eap_fast_parse_hex(pos, &key_len);
349 if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) {
351 return "Invalid PAC-Key";
354 os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN);
361 static const char * eap_fast_parse_pac_opaque(struct eap_fast_pac *pac,
364 os_free(pac->pac_opaque);
365 pac->pac_opaque = eap_fast_parse_hex(pos, &pac->pac_opaque_len);
366 if (pac->pac_opaque == NULL)
367 return "Invalid PAC-Opaque";
372 static const char * eap_fast_parse_a_id(struct eap_fast_pac *pac, char *pos)
375 pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len);
376 if (pac->a_id == NULL)
377 return "Invalid A-ID";
382 static const char * eap_fast_parse_i_id(struct eap_fast_pac *pac, char *pos)
385 pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len);
386 if (pac->i_id == NULL)
387 return "Invalid I-ID";
392 static const char * eap_fast_parse_a_id_info(struct eap_fast_pac *pac,
395 os_free(pac->a_id_info);
396 pac->a_id_info = eap_fast_parse_hex(pos, &pac->a_id_info_len);
397 if (pac->a_id_info == NULL)
398 return "Invalid A-ID-Info";
404 * eap_fast_load_pac - Load PAC entries (text format)
405 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
406 * @pac_root: Pointer to root of the PAC list (to be filled)
407 * @pac_file: Name of the PAC file/blob to load
408 * Returns: 0 on success, -1 on failure
410 int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_pac **pac_root,
411 const char *pac_file)
413 struct eap_fast_read_ctx rc;
414 struct eap_fast_pac *pac = NULL;
417 const char *err = NULL;
419 if (pac_file == NULL)
422 if (eap_fast_init_pac_data(sm, pac_file, &rc) < 0)
425 if (eap_fast_read_line(&rc, &pos) < 0 ||
426 os_strcmp(pac_file_hdr, rc.buf) != 0)
427 err = "Unrecognized header line";
429 while (!err && eap_fast_read_line(&rc, &pos) == 0) {
430 if (os_strcmp(rc.buf, "START") == 0)
431 err = eap_fast_parse_start(&pac);
432 else if (os_strcmp(rc.buf, "END") == 0) {
433 err = eap_fast_parse_end(pac_root, &pac);
436 err = "Unexpected line outside START/END block";
437 else if (os_strcmp(rc.buf, "PAC-Type") == 0)
438 err = eap_fast_parse_pac_type(pac, pos);
439 else if (os_strcmp(rc.buf, "PAC-Key") == 0)
440 err = eap_fast_parse_pac_key(pac, pos);
441 else if (os_strcmp(rc.buf, "PAC-Opaque") == 0)
442 err = eap_fast_parse_pac_opaque(pac, pos);
443 else if (os_strcmp(rc.buf, "A-ID") == 0)
444 err = eap_fast_parse_a_id(pac, pos);
445 else if (os_strcmp(rc.buf, "I-ID") == 0)
446 err = eap_fast_parse_i_id(pac, pos);
447 else if (os_strcmp(rc.buf, "A-ID-Info") == 0)
448 err = eap_fast_parse_a_id_info(pac, pos);
452 err = "PAC block not terminated with END";
453 eap_fast_free_pac(pac);
456 eap_fast_deinit_pac_data(&rc);
459 wpa_printf(MSG_INFO, "EAP-FAST: %s in '%s:%d'",
460 err, pac_file, rc.line);
464 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %d PAC entries from '%s'",
471 static void eap_fast_write(char **buf, char **pos, size_t *buf_len,
472 const char *field, const u8 *data,
479 if (data == NULL || buf == NULL || *buf == NULL ||
480 pos == NULL || *pos == NULL || *pos < *buf)
483 need = os_strlen(field) + len * 2 + 30;
485 need += os_strlen(field) + len + 20;
487 if (*pos - *buf + need > *buf_len) {
488 char *nbuf = os_realloc(*buf, *buf_len + need);
494 *pos = nbuf + (*pos - *buf);
498 end = *buf + *buf_len;
500 ret = os_snprintf(*pos, end - *pos, "%s=", field);
501 if (ret < 0 || ret >= end - *pos)
504 *pos += wpa_snprintf_hex(*pos, end - *pos, data, len);
505 ret = os_snprintf(*pos, end - *pos, "\n");
506 if (ret < 0 || ret >= end - *pos)
511 ret = os_snprintf(*pos, end - *pos, "%s-txt=", field);
512 if (ret < 0 || ret >= end - *pos)
515 for (i = 0; i < len; i++) {
516 ret = os_snprintf(*pos, end - *pos, "%c", data[i]);
517 if (ret < 0 || ret >= end - *pos)
521 ret = os_snprintf(*pos, end - *pos, "\n");
522 if (ret < 0 || ret >= end - *pos)
529 static int eap_fast_write_pac(struct eap_sm *sm, const char *pac_file,
530 char *buf, size_t len)
532 if (os_strncmp(pac_file, "blob://", 7) == 0) {
533 struct wpa_config_blob *blob;
534 blob = os_zalloc(sizeof(*blob));
537 blob->data = (u8 *) buf;
540 blob->name = os_strdup(pac_file + 7);
541 if (blob->name == NULL) {
545 eap_set_config_blob(sm, blob);
548 f = fopen(pac_file, "wb");
550 wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC "
551 "file '%s' for writing", pac_file);
554 if (fwrite(buf, 1, len, f) != len) {
555 wpa_printf(MSG_INFO, "EAP-FAST: Failed to write all "
556 "PACs into '%s'", pac_file);
568 static int eap_fast_add_pac_data(struct eap_fast_pac *pac, char **buf,
569 char **pos, size_t *buf_len)
573 ret = os_snprintf(*pos, *buf + *buf_len - *pos,
574 "START\nPAC-Type=%d\n", pac->pac_type);
575 if (ret < 0 || ret >= *buf + *buf_len - *pos)
579 eap_fast_write(buf, pos, buf_len, "PAC-Key",
580 pac->pac_key, EAP_FAST_PAC_KEY_LEN, 0);
581 eap_fast_write(buf, pos, buf_len, "PAC-Opaque",
582 pac->pac_opaque, pac->pac_opaque_len, 0);
583 eap_fast_write(buf, pos, buf_len, "PAC-Info",
584 pac->pac_info, pac->pac_info_len, 0);
585 eap_fast_write(buf, pos, buf_len, "A-ID",
586 pac->a_id, pac->a_id_len, 0);
587 eap_fast_write(buf, pos, buf_len, "I-ID",
588 pac->i_id, pac->i_id_len, 1);
589 eap_fast_write(buf, pos, buf_len, "A-ID-Info",
590 pac->a_id_info, pac->a_id_info_len, 1);
592 wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC "
596 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n");
597 if (ret < 0 || ret >= *buf + *buf_len - *pos)
606 * eap_fast_save_pac - Save PAC entries (text format)
607 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
608 * @pac_root: Root of the PAC list
609 * @pac_file: Name of the PAC file/blob
610 * Returns: 0 on success, -1 on failure
612 int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_pac *pac_root,
613 const char *pac_file)
615 struct eap_fast_pac *pac;
620 if (pac_file == NULL)
624 pos = buf = os_malloc(buf_len);
628 ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);
629 if (ret < 0 || ret >= buf + buf_len - pos) {
637 if (eap_fast_add_pac_data(pac, &buf, &pos, &buf_len)) {
645 if (eap_fast_write_pac(sm, pac_file, buf, pos - buf)) {
650 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %d PAC entries into '%s'",
658 * eap_fast_pac_list_truncate - Truncate a PAC list to the given length
659 * @pac_root: Root of the PAC list
660 * @max_len: Maximum length of the list (>= 1)
661 * Returns: Number of PAC entries removed
663 size_t eap_fast_pac_list_truncate(struct eap_fast_pac *pac_root,
666 struct eap_fast_pac *pac, *prev;
681 if (count <= max_len || prev == NULL)
690 eap_fast_free_pac(prev);
698 static void eap_fast_pac_get_a_id(struct eap_fast_pac *pac)
704 end = pos + pac->pac_info_len;
706 while (pos + 4 < end) {
707 type = WPA_GET_BE16(pos);
709 len = WPA_GET_BE16(pos);
714 if (type == PAC_TYPE_A_ID) {
716 pac->a_id = os_malloc(len);
717 if (pac->a_id == NULL)
719 os_memcpy(pac->a_id, pos, len);
723 if (type == PAC_TYPE_A_ID_INFO) {
724 os_free(pac->a_id_info);
725 pac->a_id_info = os_malloc(len);
726 if (pac->a_id_info == NULL)
728 os_memcpy(pac->a_id_info, pos, len);
729 pac->a_id_info_len = len;
738 * eap_fast_load_pac_bin - Load PAC entries (binary format)
739 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
740 * @pac_root: Pointer to root of the PAC list (to be filled)
741 * @pac_file: Name of the PAC file/blob to load
742 * Returns: 0 on success, -1 on failure
744 int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root,
745 const char *pac_file)
747 const struct wpa_config_blob *blob = NULL;
749 size_t len, count = 0;
750 struct eap_fast_pac *pac, *prev;
754 if (pac_file == NULL)
757 if (os_strncmp(pac_file, "blob://", 7) == 0) {
758 blob = eap_get_config_blob(sm, pac_file + 7);
760 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
761 "assume no PAC entries have been "
762 "provisioned", pac_file + 7);
768 buf = (u8 *) os_readfile(pac_file, &len);
770 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
771 "assume no PAC entries have been "
772 "provisioned", pac_file);
783 if (len < 6 || WPA_GET_BE32(buf) != EAP_FAST_PAC_BINARY_MAGIC ||
784 WPA_GET_BE16(buf + 4) != EAP_FAST_PAC_BINARY_FORMAT_VERSION) {
785 wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC file '%s' (bin)",
796 if (end - pos < 2 + 32 + 2 + 2)
799 pac = os_zalloc(sizeof(*pac));
803 pac->pac_type = WPA_GET_BE16(pos);
805 os_memcpy(pac->pac_key, pos, EAP_FAST_PAC_KEY_LEN);
806 pos += EAP_FAST_PAC_KEY_LEN;
807 pac->pac_opaque_len = WPA_GET_BE16(pos);
809 if (pos + pac->pac_opaque_len + 2 > end)
811 pac->pac_opaque = os_malloc(pac->pac_opaque_len);
812 if (pac->pac_opaque == NULL)
814 os_memcpy(pac->pac_opaque, pos, pac->pac_opaque_len);
815 pos += pac->pac_opaque_len;
816 pac->pac_info_len = WPA_GET_BE16(pos);
818 if (pos + pac->pac_info_len > end)
820 pac->pac_info = os_malloc(pac->pac_info_len);
821 if (pac->pac_info == NULL)
823 os_memcpy(pac->pac_info, pos, pac->pac_info_len);
824 pos += pac->pac_info_len;
825 eap_fast_pac_get_a_id(pac);
838 wpa_printf(MSG_DEBUG, "EAP-FAST: Read %lu PAC entries from '%s' (bin)",
839 (unsigned long) count, pac_file);
844 wpa_printf(MSG_INFO, "EAP-FAST: Failed to parse PAC file '%s' (bin)",
849 eap_fast_free_pac(pac);
855 * eap_fast_save_pac_bin - Save PAC entries (binary format)
856 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
857 * @pac_root: Root of the PAC list
858 * @pac_file: Name of the PAC file/blob
859 * Returns: 0 on success, -1 on failure
861 int eap_fast_save_pac_bin(struct eap_sm *sm, struct eap_fast_pac *pac_root,
862 const char *pac_file)
864 size_t len, count = 0;
865 struct eap_fast_pac *pac;
871 if (pac->pac_opaque_len > 65535 ||
872 pac->pac_info_len > 65535)
874 len += 2 + EAP_FAST_PAC_KEY_LEN + 2 + pac->pac_opaque_len +
875 2 + pac->pac_info_len;
879 buf = os_malloc(len);
884 WPA_PUT_BE32(pos, EAP_FAST_PAC_BINARY_MAGIC);
886 WPA_PUT_BE16(pos, EAP_FAST_PAC_BINARY_FORMAT_VERSION);
891 WPA_PUT_BE16(pos, pac->pac_type);
893 os_memcpy(pos, pac->pac_key, EAP_FAST_PAC_KEY_LEN);
894 pos += EAP_FAST_PAC_KEY_LEN;
895 WPA_PUT_BE16(pos, pac->pac_opaque_len);
897 os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len);
898 pos += pac->pac_opaque_len;
899 WPA_PUT_BE16(pos, pac->pac_info_len);
901 os_memcpy(pos, pac->pac_info, pac->pac_info_len);
902 pos += pac->pac_info_len;
908 if (eap_fast_write_pac(sm, pac_file, (char *) buf, len)) {
913 wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %lu PAC entries into '%s' "
914 "(bin)", (unsigned long) count, pac_file);