contrib/wpa/hs20/client/est.c

   1 /*
   2  * Hotspot 2.0 OSU client - EST client
   3  * Copyright (c) 2012-2014, Qualcomm Atheros, Inc.
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10 #include <openssl/err.h>
  11 #include <openssl/evp.h>
  12 #include <openssl/pem.h>
  13 #include <openssl/pkcs7.h>
  14 #include <openssl/rsa.h>
  15 #include <openssl/asn1.h>
  16 #include <openssl/asn1t.h>
  17 #include <openssl/x509.h>
  18 #include <openssl/x509v3.h>
  19 #include <openssl/opensslv.h>
  20 #ifdef OPENSSL_IS_BORINGSSL
  21 #include <openssl/buf.h>
  22 #endif /* OPENSSL_IS_BORINGSSL */
  23
  24 #include "common.h"
  25 #include "utils/base64.h"
  26 #include "utils/xml-utils.h"
  27 #include "utils/http-utils.h"
  28 #include "osu_client.h"
  29
  30
  31 static int pkcs7_to_cert(struct hs20_osu_client *ctx, const u8 *pkcs7,
  32                          size_t len, char *pem_file, char *der_file)
  33 {
  34 #ifdef OPENSSL_IS_BORINGSSL
  35         CBS pkcs7_cbs;
  36 #else /* OPENSSL_IS_BORINGSSL */
  37         PKCS7 *p7 = NULL;
  38         const unsigned char *p = pkcs7;
  39 #endif /* OPENSSL_IS_BORINGSSL */
  40         STACK_OF(X509) *certs;
  41         int i, num, ret = -1;
  42         BIO *out = NULL;
  43
  44 #ifdef OPENSSL_IS_BORINGSSL
  45         certs = sk_X509_new_null();
  46         if (!certs)
  47                 goto fail;
  48         CBS_init(&pkcs7_cbs, pkcs7, len);
  49         if (!PKCS7_get_certificates(certs, &pkcs7_cbs)) {
  50                 wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s",
  51                            ERR_error_string(ERR_get_error(), NULL));
  52                 write_result(ctx, "Could not parse PKCS#7 object from EST");
  53                 goto fail;
  54         }
  55 #else /* OPENSSL_IS_BORINGSSL */
  56         p7 = d2i_PKCS7(NULL, &p, len);
  57         if (p7 == NULL) {
  58                 wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s",
  59                            ERR_error_string(ERR_get_error(), NULL));
  60                 write_result(ctx, "Could not parse PKCS#7 object from EST");
  61                 goto fail;
  62         }
  63
  64         switch (OBJ_obj2nid(p7->type)) {
  65         case NID_pkcs7_signed:
  66                 certs = p7->d.sign->cert;
  67                 break;
  68         case NID_pkcs7_signedAndEnveloped:
  69                 certs = p7->d.signed_and_enveloped->cert;
  70                 break;
  71         default:
  72                 certs = NULL;
  73                 break;
  74         }
  75 #endif /* OPENSSL_IS_BORINGSSL */
  76
  77         if (!certs || ((num = sk_X509_num(certs)) == 0)) {
  78                 wpa_printf(MSG_INFO, "No certificates found in PKCS#7 object");
  79                 write_result(ctx, "No certificates found in PKCS#7 object");
  80                 goto fail;
  81         }
  82
  83         if (der_file) {
  84                 FILE *f = fopen(der_file, "wb");
  85                 if (f == NULL)
  86                         goto fail;
  87                 i2d_X509_fp(f, sk_X509_value(certs, 0));
  88                 fclose(f);
  89         }
  90
  91         if (pem_file) {
  92                 out = BIO_new(BIO_s_file());
  93                 if (out == NULL ||
  94                     BIO_write_filename(out, pem_file) <= 0)
  95                         goto fail;
  96
  97                 for (i = 0; i < num; i++) {
  98                         X509 *cert = sk_X509_value(certs, i);
  99                         X509_print(out, cert);
 100                         PEM_write_bio_X509(out, cert);
 101                         BIO_puts(out, "\n");
 102                 }
 103         }
 104
 105         ret = 0;
 106
 107 fail:
 108 #ifdef OPENSSL_IS_BORINGSSL
 109         if (certs)
 110                 sk_X509_pop_free(certs, X509_free);
 111 #else /* OPENSSL_IS_BORINGSSL */
 112         PKCS7_free(p7);
 113 #endif /* OPENSSL_IS_BORINGSSL */
 114         if (out)
 115                 BIO_free_all(out);
 116
 117         return ret;
 118 }
 119
 120
 121 int est_load_cacerts(struct hs20_osu_client *ctx, const char *url)
 122 {
 123         char *buf, *resp;
 124         size_t buflen;
 125         unsigned char *pkcs7;
 126         size_t pkcs7_len, resp_len;
 127         int res;
 128
 129         buflen = os_strlen(url) + 100;
 130         buf = os_malloc(buflen);
 131         if (buf == NULL)
 132                 return -1;
 133
 134         os_snprintf(buf, buflen, "%s/cacerts", url);
 135         wpa_printf(MSG_INFO, "Download EST cacerts from %s", buf);
 136         write_summary(ctx, "Download EST cacerts from %s", buf);
 137         ctx->no_osu_cert_validation = 1;
 138         http_ocsp_set(ctx->http, 1);
 139         res = http_download_file(ctx->http, buf, "Cert/est-cacerts.txt",
 140                                  ctx->ca_fname);
 141         http_ocsp_set(ctx->http,
 142                       (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
 143         ctx->no_osu_cert_validation = 0;
 144         if (res < 0) {
 145                 wpa_printf(MSG_INFO, "Failed to download EST cacerts from %s",
 146                            buf);
 147                 write_result(ctx, "Failed to download EST cacerts from %s",
 148                              buf);
 149                 os_free(buf);
 150                 return -1;
 151         }
 152         os_free(buf);
 153
 154         resp = os_readfile("Cert/est-cacerts.txt", &resp_len);
 155         if (resp == NULL) {
 156                 wpa_printf(MSG_INFO, "Could not read Cert/est-cacerts.txt");
 157                 write_result(ctx, "Could not read EST cacerts");
 158                 return -1;
 159         }
 160
 161         pkcs7 = base64_decode((unsigned char *) resp, resp_len, &pkcs7_len);
 162         if (pkcs7 && pkcs7_len < resp_len / 2) {
 163                 wpa_printf(MSG_INFO, "Too short base64 decode (%u bytes; downloaded %u bytes) - assume this was binary",
 164                            (unsigned int) pkcs7_len, (unsigned int) resp_len);
 165                 os_free(pkcs7);
 166                 pkcs7 = NULL;
 167         }
 168         if (pkcs7 == NULL) {
 169                 wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
 170                 pkcs7 = os_malloc(resp_len);
 171                 if (pkcs7) {
 172                         os_memcpy(pkcs7, resp, resp_len);
 173                         pkcs7_len = resp_len;
 174                 }
 175         }
 176         os_free(resp);
 177
 178         if (pkcs7 == NULL) {
 179                 wpa_printf(MSG_INFO, "Could not fetch PKCS7 cacerts");
 180                 write_result(ctx, "Could not fetch EST PKCS#7 cacerts");
 181                 return -1;
 182         }
 183
 184         res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est-cacerts.pem",
 185                             NULL);
 186         os_free(pkcs7);
 187         if (res < 0) {
 188                 wpa_printf(MSG_INFO, "Could not parse CA certs from PKCS#7 cacerts response");
 189                 write_result(ctx, "Could not parse CA certs from EST PKCS#7 cacerts response");
 190                 return -1;
 191         }
 192         unlink("Cert/est-cacerts.txt");
 193
 194         return 0;
 195 }
 196
 197
 198 /*
 199  * CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
 200  *
 201  * AttrOrOID ::= CHOICE {
 202  *   oid OBJECT IDENTIFIER,
 203  *   attribute Attribute }
 204  *
 205  * Attribute ::= SEQUENCE {
 206  *   type OBJECT IDENTIFIER,
 207  *   values SET SIZE(1..MAX) OF OBJECT IDENTIFIER }
 208  */
 209
 210 typedef struct {
 211         ASN1_OBJECT *type;
 212         STACK_OF(ASN1_OBJECT) *values;
 213 } Attribute;
 214
 215 typedef struct {
 216         int type;
 217         union {
 218                 ASN1_OBJECT *oid;
 219                 Attribute *attribute;
 220         } d;
 221 } AttrOrOID;
 222
 223 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
 224 DEFINE_STACK_OF(AttrOrOID)
 225 #endif
 226
 227 typedef struct {
 228         int type;
 229         STACK_OF(AttrOrOID) *attrs;
 230 } CsrAttrs;
 231
 232 ASN1_SEQUENCE(Attribute) = {
 233         ASN1_SIMPLE(Attribute, type, ASN1_OBJECT),
 234         ASN1_SET_OF(Attribute, values, ASN1_OBJECT)
 235 } ASN1_SEQUENCE_END(Attribute);
 236
 237 ASN1_CHOICE(AttrOrOID) = {
 238         ASN1_SIMPLE(AttrOrOID, d.oid, ASN1_OBJECT),
 239         ASN1_SIMPLE(AttrOrOID, d.attribute, Attribute)
 240 } ASN1_CHOICE_END(AttrOrOID);
 241
 242 ASN1_CHOICE(CsrAttrs) = {
 243         ASN1_SEQUENCE_OF(CsrAttrs, attrs, AttrOrOID)
 244 } ASN1_CHOICE_END(CsrAttrs);
 245
 246 IMPLEMENT_ASN1_FUNCTIONS(CsrAttrs);
 247
 248
 249 static void add_csrattrs_oid(struct hs20_osu_client *ctx, ASN1_OBJECT *oid,
 250                              STACK_OF(X509_EXTENSION) *exts)
 251 {
 252         char txt[100];
 253         int res;
 254
 255         if (!oid)
 256                 return;
 257
 258         res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
 259         if (res < 0 || res >= (int) sizeof(txt))
 260                 return;
 261
 262         if (os_strcmp(txt, "1.2.840.113549.1.9.7") == 0) {
 263                 wpa_printf(MSG_INFO, "TODO: csrattr challengePassword");
 264         } else if (os_strcmp(txt, "1.2.840.113549.1.1.11") == 0) {
 265                 wpa_printf(MSG_INFO, "csrattr sha256WithRSAEncryption");
 266         } else {
 267                 wpa_printf(MSG_INFO, "Ignore unsupported csrattr oid %s", txt);
 268         }
 269 }
 270
 271
 272 static void add_csrattrs_ext_req(struct hs20_osu_client *ctx,
 273                                  STACK_OF(ASN1_OBJECT) *values,
 274                                  STACK_OF(X509_EXTENSION) *exts)
 275 {
 276         char txt[100];
 277         int i, num, res;
 278
 279         num = sk_ASN1_OBJECT_num(values);
 280         for (i = 0; i < num; i++) {
 281                 ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(values, i);
 282
 283                 res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
 284                 if (res < 0 || res >= (int) sizeof(txt))
 285                         continue;
 286
 287                 if (os_strcmp(txt, "1.3.6.1.1.1.1.22") == 0) {
 288                         wpa_printf(MSG_INFO, "TODO: extReq macAddress");
 289                 } else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.3") == 0) {
 290                         wpa_printf(MSG_INFO, "TODO: extReq imei");
 291                 } else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.4") == 0) {
 292                         wpa_printf(MSG_INFO, "TODO: extReq meid");
 293                 } else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.5") == 0) {
 294                         wpa_printf(MSG_INFO, "TODO: extReq DevId");
 295                 } else {
 296                         wpa_printf(MSG_INFO, "Ignore unsupported cstattr extensionsRequest %s",
 297                                    txt);
 298                 }
 299         }
 300 }
 301
 302
 303 static void add_csrattrs_attr(struct hs20_osu_client *ctx, Attribute *attr,
 304                               STACK_OF(X509_EXTENSION) *exts)
 305 {
 306         char txt[100], txt2[100];
 307         int i, num, res;
 308
 309         if (!attr || !attr->type || !attr->values)
 310                 return;
 311
 312         res = OBJ_obj2txt(txt, sizeof(txt), attr->type, 1);
 313         if (res < 0 || res >= (int) sizeof(txt))
 314                 return;
 315
 316         if (os_strcmp(txt, "1.2.840.113549.1.9.14") == 0) {
 317                 add_csrattrs_ext_req(ctx, attr->values, exts);
 318                 return;
 319         }
 320
 321         num = sk_ASN1_OBJECT_num(attr->values);
 322         for (i = 0; i < num; i++) {
 323                 ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(attr->values, i);
 324
 325                 res = OBJ_obj2txt(txt2, sizeof(txt2), oid, 1);
 326                 if (res < 0 || res >= (int) sizeof(txt2))
 327                         continue;
 328
 329                 wpa_printf(MSG_INFO, "Ignore unsupported cstattr::attr %s oid %s",
 330                            txt, txt2);
 331         }
 332 }
 333
 334
 335 static void add_csrattrs(struct hs20_osu_client *ctx, CsrAttrs *csrattrs,
 336                          STACK_OF(X509_EXTENSION) *exts)
 337 {
 338         int i, num;
 339
 340         if (!csrattrs || ! csrattrs->attrs)
 341                 return;
 342
 343 #ifdef OPENSSL_IS_BORINGSSL
 344         num = sk_num(CHECKED_CAST(_STACK *, STACK_OF(AttrOrOID) *,
 345                                   csrattrs->attrs));
 346         for (i = 0; i < num; i++) {
 347                 AttrOrOID *ao = sk_value(
 348                         CHECKED_CAST(_STACK *, const STACK_OF(AttrOrOID) *,
 349                                      csrattrs->attrs), i);
 350                 switch (ao->type) {
 351                 case 0:
 352                         add_csrattrs_oid(ctx, ao->d.oid, exts);
 353                         break;
 354                 case 1:
 355                         add_csrattrs_attr(ctx, ao->d.attribute, exts);
 356                         break;
 357                 }
 358         }
 359 #else /* OPENSSL_IS_BORINGSSL */
 360 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
 361         num = sk_AttrOrOID_num(csrattrs->attrs);
 362 #else
 363         num = SKM_sk_num(AttrOrOID, csrattrs->attrs);
 364 #endif
 365         for (i = 0; i < num; i++) {
 366 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
 367                 AttrOrOID *ao = sk_AttrOrOID_value(csrattrs->attrs, i);
 368 #else
 369                 AttrOrOID *ao = SKM_sk_value(AttrOrOID, csrattrs->attrs, i);
 370 #endif
 371                 switch (ao->type) {
 372                 case 0:
 373                         add_csrattrs_oid(ctx, ao->d.oid, exts);
 374                         break;
 375                 case 1:
 376                         add_csrattrs_attr(ctx, ao->d.attribute, exts);
 377                         break;
 378                 }
 379         }
 380 #endif /* OPENSSL_IS_BORINGSSL */
 381 }
 382
 383
 384 static int generate_csr(struct hs20_osu_client *ctx, char *key_pem,
 385                         char *csr_pem, char *est_req, char *old_cert,
 386                         CsrAttrs *csrattrs)
 387 {
 388         EVP_PKEY_CTX *pctx = NULL;
 389         EVP_PKEY *pkey = NULL;
 390         RSA *rsa;
 391         X509_REQ *req = NULL;
 392         int ret = -1;
 393         unsigned int val;
 394         X509_NAME *subj = NULL;
 395         char name[100];
 396         STACK_OF(X509_EXTENSION) *exts = NULL;
 397         X509_EXTENSION *ex;
 398         BIO *out;
 399         CONF *ctmp = NULL;
 400
 401         wpa_printf(MSG_INFO, "Generate RSA private key");
 402         write_summary(ctx, "Generate RSA private key");
 403         pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
 404         if (!pctx)
 405                 return -1;
 406
 407         if (EVP_PKEY_keygen_init(pctx) <= 0)
 408                 goto fail;
 409
 410         if (EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, 2048) <= 0)
 411                 goto fail;
 412
 413         if (EVP_PKEY_keygen(pctx, &pkey) <= 0)
 414                 goto fail;
 415         EVP_PKEY_CTX_free(pctx);
 416         pctx = NULL;
 417
 418         rsa = EVP_PKEY_get1_RSA(pkey);
 419         if (rsa == NULL)
 420                 goto fail;
 421
 422         if (key_pem) {
 423                 FILE *f = fopen(key_pem, "wb");
 424                 if (f == NULL)
 425                         goto fail;
 426                 if (!PEM_write_RSAPrivateKey(f, rsa, NULL, NULL, 0, NULL,
 427                                              NULL)) {
 428                         wpa_printf(MSG_INFO, "Could not write private key: %s",
 429                                    ERR_error_string(ERR_get_error(), NULL));
 430                         fclose(f);
 431                         goto fail;
 432                 }
 433                 fclose(f);
 434         }
 435
 436         wpa_printf(MSG_INFO, "Generate CSR");
 437         write_summary(ctx, "Generate CSR");
 438         req = X509_REQ_new();
 439         if (req == NULL)
 440                 goto fail;
 441
 442         if (old_cert) {
 443                 FILE *f;
 444                 X509 *cert;
 445                 int res;
 446
 447                 f = fopen(old_cert, "r");
 448                 if (f == NULL)
 449                         goto fail;
 450                 cert = PEM_read_X509(f, NULL, NULL, NULL);
 451                 fclose(f);
 452
 453                 if (cert == NULL)
 454                         goto fail;
 455                 res = X509_REQ_set_subject_name(req,
 456                                                 X509_get_subject_name(cert));
 457                 X509_free(cert);
 458                 if (!res)
 459                         goto fail;
 460         } else {
 461                 os_get_random((u8 *) &val, sizeof(val));
 462                 os_snprintf(name, sizeof(name), "cert-user-%u", val);
 463                 subj = X509_NAME_new();
 464                 if (subj == NULL ||
 465                     !X509_NAME_add_entry_by_txt(subj, "CN", MBSTRING_ASC,
 466                                                 (unsigned char *) name,
 467                                                 -1, -1, 0) ||
 468                     !X509_REQ_set_subject_name(req, subj))
 469                         goto fail;
 470                 X509_NAME_free(subj);
 471                 subj = NULL;
 472         }
 473
 474         if (!X509_REQ_set_pubkey(req, pkey))
 475                 goto fail;
 476
 477         exts = sk_X509_EXTENSION_new_null();
 478         if (!exts)
 479                 goto fail;
 480
 481         ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_basic_constraints,
 482                                   "CA:FALSE");
 483         if (ex == NULL ||
 484             !sk_X509_EXTENSION_push(exts, ex))
 485                 goto fail;
 486
 487         ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_key_usage,
 488                                   "nonRepudiation,digitalSignature,keyEncipherment");
 489         if (ex == NULL ||
 490             !sk_X509_EXTENSION_push(exts, ex))
 491                 goto fail;
 492
 493         ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_ext_key_usage,
 494                                   "1.3.6.1.4.1.40808.1.1.2");
 495         if (ex == NULL ||
 496             !sk_X509_EXTENSION_push(exts, ex))
 497                 goto fail;
 498
 499         add_csrattrs(ctx, csrattrs, exts);
 500
 501         if (!X509_REQ_add_extensions(req, exts))
 502                 goto fail;
 503         sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
 504         exts = NULL;
 505
 506         if (!X509_REQ_sign(req, pkey, EVP_sha256()))
 507                 goto fail;
 508
 509         out = BIO_new(BIO_s_mem());
 510         if (out) {
 511                 char *txt;
 512                 size_t rlen;
 513
 514 #if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL)
 515                 X509_REQ_print(out, req);
 516 #endif
 517                 rlen = BIO_ctrl_pending(out);
 518                 txt = os_malloc(rlen + 1);
 519                 if (txt) {
 520                         int res = BIO_read(out, txt, rlen);
 521                         if (res > 0) {
 522                                 txt[res] = '\0';
 523                                 wpa_printf(MSG_MSGDUMP, "OpenSSL: Certificate request:\n%s",
 524                                            txt);
 525                         }
 526                         os_free(txt);
 527                 }
 528                 BIO_free(out);
 529         }
 530
 531         if (csr_pem) {
 532                 FILE *f = fopen(csr_pem, "w");
 533                 if (f == NULL)
 534                         goto fail;
 535 #if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL)
 536                 X509_REQ_print_fp(f, req);
 537 #endif
 538                 if (!PEM_write_X509_REQ(f, req)) {
 539                         fclose(f);
 540                         goto fail;
 541                 }
 542                 fclose(f);
 543         }
 544
 545         if (est_req) {
 546                 BIO *mem = BIO_new(BIO_s_mem());
 547                 BUF_MEM *ptr;
 548                 char *pos, *end, *buf_end;
 549                 FILE *f;
 550
 551                 if (mem == NULL)
 552                         goto fail;
 553                 if (!PEM_write_bio_X509_REQ(mem, req)) {
 554                         BIO_free(mem);
 555                         goto fail;
 556                 }
 557
 558                 BIO_get_mem_ptr(mem, &ptr);
 559                 pos = ptr->data;
 560                 buf_end = pos + ptr->length;
 561
 562                 /* Remove START/END lines */
 563                 while (pos < buf_end && *pos != '\n')
 564                         pos++;
 565                 if (pos == buf_end) {
 566                         BIO_free(mem);
 567                         goto fail;
 568                 }
 569                 pos++;
 570
 571                 end = pos;
 572                 while (end < buf_end && *end != '-')
 573                         end++;
 574
 575                 f = fopen(est_req, "w");
 576                 if (f == NULL) {
 577                         BIO_free(mem);
 578                         goto fail;
 579                 }
 580                 fwrite(pos, end - pos, 1, f);
 581                 fclose(f);
 582
 583                 BIO_free(mem);
 584         }
 585
 586         ret = 0;
 587 fail:
 588         if (exts)
 589                 sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
 590         if (subj)
 591                 X509_NAME_free(subj);
 592         if (req)
 593                 X509_REQ_free(req);
 594         if (pkey)
 595                 EVP_PKEY_free(pkey);
 596         if (pctx)
 597                 EVP_PKEY_CTX_free(pctx);
 598         return ret;
 599 }
 600
 601
 602 int est_build_csr(struct hs20_osu_client *ctx, const char *url)
 603 {
 604         char *buf;
 605         size_t buflen;
 606         int res;
 607         char old_cert_buf[200];
 608         char *old_cert = NULL;
 609         CsrAttrs *csrattrs = NULL;
 610
 611         buflen = os_strlen(url) + 100;
 612         buf = os_malloc(buflen);
 613         if (buf == NULL)
 614                 return -1;
 615
 616         os_snprintf(buf, buflen, "%s/csrattrs", url);
 617         wpa_printf(MSG_INFO, "Download csrattrs from %s", buf);
 618         write_summary(ctx, "Download EST csrattrs from %s", buf);
 619         ctx->no_osu_cert_validation = 1;
 620         http_ocsp_set(ctx->http, 1);
 621         res = http_download_file(ctx->http, buf, "Cert/est-csrattrs.txt",
 622                                  ctx->ca_fname);
 623         http_ocsp_set(ctx->http,
 624                       (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
 625         ctx->no_osu_cert_validation = 0;
 626         os_free(buf);
 627         if (res < 0) {
 628                 wpa_printf(MSG_INFO, "Failed to download EST csrattrs - assume no extra attributes are needed");
 629         } else {
 630                 size_t resp_len;
 631                 char *resp;
 632                 unsigned char *attrs;
 633                 const unsigned char *pos;
 634                 size_t attrs_len;
 635
 636                 resp = os_readfile("Cert/est-csrattrs.txt", &resp_len);
 637                 if (resp == NULL) {
 638                         wpa_printf(MSG_INFO, "Could not read csrattrs");
 639                         return -1;
 640                 }
 641
 642                 attrs = base64_decode((unsigned char *) resp, resp_len,
 643                                       &attrs_len);
 644                 os_free(resp);
 645
 646                 if (attrs == NULL) {
 647                         wpa_printf(MSG_INFO, "Could not base64 decode csrattrs");
 648                         return -1;
 649                 }
 650                 unlink("Cert/est-csrattrs.txt");
 651
 652                 pos = attrs;
 653                 csrattrs = d2i_CsrAttrs(NULL, &pos, attrs_len);
 654                 os_free(attrs);
 655                 if (csrattrs == NULL) {
 656                         wpa_printf(MSG_INFO, "Failed to parse csrattrs ASN.1");
 657                         /* Continue assuming no additional requirements */
 658                 }
 659         }
 660
 661         if (ctx->client_cert_present) {
 662                 os_snprintf(old_cert_buf, sizeof(old_cert_buf),
 663                             "SP/%s/client-cert.pem", ctx->fqdn);
 664                 old_cert = old_cert_buf;
 665         }
 666
 667         res = generate_csr(ctx, "Cert/privkey-plain.pem", "Cert/est-req.pem",
 668                            "Cert/est-req.b64", old_cert, csrattrs);
 669         if (csrattrs)
 670                 CsrAttrs_free(csrattrs);
 671
 672         return res;
 673 }
 674
 675
 676 int est_simple_enroll(struct hs20_osu_client *ctx, const char *url,
 677                       const char *user, const char *pw)
 678 {
 679         char *buf, *resp, *req, *req2;
 680         size_t buflen, resp_len, len, pkcs7_len;
 681         unsigned char *pkcs7;
 682         char client_cert_buf[200];
 683         char client_key_buf[200];
 684         const char *client_cert = NULL, *client_key = NULL;
 685         int res;
 686
 687         req = os_readfile("Cert/est-req.b64", &len);
 688         if (req == NULL) {
 689                 wpa_printf(MSG_INFO, "Could not read Cert/req.b64");
 690                 return -1;
 691         }
 692         req2 = os_realloc(req, len + 1);
 693         if (req2 == NULL) {
 694                 os_free(req);
 695                 return -1;
 696         }
 697         req2[len] = '\0';
 698         req = req2;
 699         wpa_printf(MSG_DEBUG, "EST simpleenroll request: %s", req);
 700
 701         buflen = os_strlen(url) + 100;
 702         buf = os_malloc(buflen);
 703         if (buf == NULL) {
 704                 os_free(req);
 705                 return -1;
 706         }
 707
 708         if (ctx->client_cert_present) {
 709                 os_snprintf(buf, buflen, "%s/simplereenroll", url);
 710                 os_snprintf(client_cert_buf, sizeof(client_cert_buf),
 711                             "SP/%s/client-cert.pem", ctx->fqdn);
 712                 client_cert = client_cert_buf;
 713                 os_snprintf(client_key_buf, sizeof(client_key_buf),
 714                             "SP/%s/client-key.pem", ctx->fqdn);
 715                 client_key = client_key_buf;
 716         } else
 717                 os_snprintf(buf, buflen, "%s/simpleenroll", url);
 718         wpa_printf(MSG_INFO, "EST simpleenroll URL: %s", buf);
 719         write_summary(ctx, "EST simpleenroll URL: %s", buf);
 720         ctx->no_osu_cert_validation = 1;
 721         http_ocsp_set(ctx->http, 1);
 722         resp = http_post(ctx->http, buf, req, "application/pkcs10",
 723                          "Content-Transfer-Encoding: base64",
 724                          ctx->ca_fname, user, pw, client_cert, client_key,
 725                          &resp_len);
 726         http_ocsp_set(ctx->http,
 727                       (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
 728         ctx->no_osu_cert_validation = 0;
 729         os_free(buf);
 730         if (resp == NULL) {
 731                 wpa_printf(MSG_INFO, "EST certificate enrollment failed");
 732                 write_result(ctx, "EST certificate enrollment failed");
 733                 return -1;
 734         }
 735         wpa_printf(MSG_DEBUG, "EST simpleenroll response: %s", resp);
 736
 737         pkcs7 = base64_decode((unsigned char *) resp, resp_len, &pkcs7_len);
 738         if (pkcs7 == NULL) {
 739                 wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
 740                 pkcs7 = os_malloc(resp_len);
 741                 if (pkcs7) {
 742                         os_memcpy(pkcs7, resp, resp_len);
 743                         pkcs7_len = resp_len;
 744                 }
 745         }
 746         os_free(resp);
 747
 748         if (pkcs7 == NULL) {
 749                 wpa_printf(MSG_INFO, "Failed to parse simpleenroll base64 response");
 750                 write_result(ctx, "Failed to parse EST simpleenroll base64 response");
 751                 return -1;
 752         }
 753
 754         res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est_cert.pem",
 755                             "Cert/est_cert.der");
 756         os_free(pkcs7);
 757
 758         if (res < 0) {
 759                 wpa_printf(MSG_INFO, "EST: Failed to extract certificate from PKCS7 file");
 760                 write_result(ctx, "EST: Failed to extract certificate from EST PKCS7 file");
 761                 return -1;
 762         }
 763
 764         wpa_printf(MSG_INFO, "EST simple%senroll completed successfully",
 765                    ctx->client_cert_present ? "re" : "");
 766         write_summary(ctx, "EST simple%senroll completed successfully",
 767                       ctx->client_cert_present ? "re" : "");
 768
 769         return 0;
 770 }