1/*
2 * Hotspot 2.0 OSU client - EST client
3 * Copyright (c) 2012-2014, Qualcomm Atheros, Inc.
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9#include "includes.h"
10#include <openssl/err.h>
11#include <openssl/evp.h>
12#include <openssl/pem.h>
13#include <openssl/pkcs7.h>
14#include <openssl/rsa.h>
15#include <openssl/asn1.h>
16#include <openssl/asn1t.h>
17#include <openssl/x509.h>
18#include <openssl/x509v3.h>
19#include <openssl/opensslv.h>
20#ifdef OPENSSL_IS_BORINGSSL
21#include <openssl/buf.h>
22#endif /* OPENSSL_IS_BORINGSSL */
23
24#include "common.h"
25#include "utils/base64.h"
26#include "utils/xml-utils.h"
27#include "utils/http-utils.h"
28#include "osu_client.h"
29
30
31static int pkcs7_to_cert(struct hs20_osu_client *ctx, const u8 *pkcs7,
32			 size_t len, char *pem_file, char *der_file)
33{
34#ifdef OPENSSL_IS_BORINGSSL
35	CBS pkcs7_cbs;
36#else /* OPENSSL_IS_BORINGSSL */
37	PKCS7 *p7 = NULL;
38	const unsigned char *p = pkcs7;
39#endif /* OPENSSL_IS_BORINGSSL */
40	STACK_OF(X509) *certs;
41	int i, num, ret = -1;
42	BIO *out = NULL;
43
44#ifdef OPENSSL_IS_BORINGSSL
45	certs = sk_X509_new_null();
46	if (!certs)
47		goto fail;
48	CBS_init(&pkcs7_cbs, pkcs7, len);
49	if (!PKCS7_get_certificates(certs, &pkcs7_cbs)) {
50		wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s",
51			   ERR_error_string(ERR_get_error(), NULL));
52		write_result(ctx, "Could not parse PKCS#7 object from EST");
53		goto fail;
54	}
55#else /* OPENSSL_IS_BORINGSSL */
56	p7 = d2i_PKCS7(NULL, &p, len);
57	if (p7 == NULL) {
58		wpa_printf(MSG_INFO, "Could not parse PKCS#7 object: %s",
59			   ERR_error_string(ERR_get_error(), NULL));
60		write_result(ctx, "Could not parse PKCS#7 object from EST");
61		goto fail;
62	}
63
64	switch (OBJ_obj2nid(p7->type)) {
65	case NID_pkcs7_signed:
66		certs = p7->d.sign->cert;
67		break;
68	case NID_pkcs7_signedAndEnveloped:
69		certs = p7->d.signed_and_enveloped->cert;
70		break;
71	default:
72		certs = NULL;
73		break;
74	}
75#endif /* OPENSSL_IS_BORINGSSL */
76
77	if (!certs || ((num = sk_X509_num(certs)) == 0)) {
78		wpa_printf(MSG_INFO, "No certificates found in PKCS#7 object");
79		write_result(ctx, "No certificates found in PKCS#7 object");
80		goto fail;
81	}
82
83	if (der_file) {
84		FILE *f = fopen(der_file, "wb");
85		if (f == NULL)
86			goto fail;
87		i2d_X509_fp(f, sk_X509_value(certs, 0));
88		fclose(f);
89	}
90
91	if (pem_file) {
92		out = BIO_new(BIO_s_file());
93		if (out == NULL ||
94		    BIO_write_filename(out, pem_file) <= 0)
95			goto fail;
96
97		for (i = 0; i < num; i++) {
98			X509 *cert = sk_X509_value(certs, i);
99			X509_print(out, cert);
100			PEM_write_bio_X509(out, cert);
101			BIO_puts(out, "\n");
102		}
103	}
104
105	ret = 0;
106
107fail:
108#ifdef OPENSSL_IS_BORINGSSL
109	if (certs)
110		sk_X509_pop_free(certs, X509_free);
111#else /* OPENSSL_IS_BORINGSSL */
112	PKCS7_free(p7);
113#endif /* OPENSSL_IS_BORINGSSL */
114	if (out)
115		BIO_free_all(out);
116
117	return ret;
118}
119
120
121int est_load_cacerts(struct hs20_osu_client *ctx, const char *url)
122{
123	char *buf, *resp;
124	size_t buflen;
125	unsigned char *pkcs7;
126	size_t pkcs7_len, resp_len;
127	int res;
128
129	buflen = os_strlen(url) + 100;
130	buf = os_malloc(buflen);
131	if (buf == NULL)
132		return -1;
133
134	os_snprintf(buf, buflen, "%s/cacerts", url);
135	wpa_printf(MSG_INFO, "Download EST cacerts from %s", buf);
136	write_summary(ctx, "Download EST cacerts from %s", buf);
137	ctx->no_osu_cert_validation = 1;
138	http_ocsp_set(ctx->http, 1);
139	res = http_download_file(ctx->http, buf, "Cert/est-cacerts.txt",
140				 ctx->ca_fname);
141	http_ocsp_set(ctx->http,
142		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
143	ctx->no_osu_cert_validation = 0;
144	if (res < 0) {
145		wpa_printf(MSG_INFO, "Failed to download EST cacerts from %s",
146			   buf);
147		write_result(ctx, "Failed to download EST cacerts from %s",
148			     buf);
149		os_free(buf);
150		return -1;
151	}
152	os_free(buf);
153
154	resp = os_readfile("Cert/est-cacerts.txt", &resp_len);
155	if (resp == NULL) {
156		wpa_printf(MSG_INFO, "Could not read Cert/est-cacerts.txt");
157		write_result(ctx, "Could not read EST cacerts");
158		return -1;
159	}
160
161	pkcs7 = base64_decode(resp, resp_len, &pkcs7_len);
162	if (pkcs7 && pkcs7_len < resp_len / 2) {
163		wpa_printf(MSG_INFO, "Too short base64 decode (%u bytes; downloaded %u bytes) - assume this was binary",
164			   (unsigned int) pkcs7_len, (unsigned int) resp_len);
165		os_free(pkcs7);
166		pkcs7 = NULL;
167	}
168	if (pkcs7 == NULL) {
169		wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
170		pkcs7 = os_malloc(resp_len);
171		if (pkcs7) {
172			os_memcpy(pkcs7, resp, resp_len);
173			pkcs7_len = resp_len;
174		}
175	}
176	os_free(resp);
177
178	if (pkcs7 == NULL) {
179		wpa_printf(MSG_INFO, "Could not fetch PKCS7 cacerts");
180		write_result(ctx, "Could not fetch EST PKCS#7 cacerts");
181		return -1;
182	}
183
184	res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est-cacerts.pem",
185			    NULL);
186	os_free(pkcs7);
187	if (res < 0) {
188		wpa_printf(MSG_INFO, "Could not parse CA certs from PKCS#7 cacerts response");
189		write_result(ctx, "Could not parse CA certs from EST PKCS#7 cacerts response");
190		return -1;
191	}
192	unlink("Cert/est-cacerts.txt");
193
194	return 0;
195}
196
197
198/*
199 * CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
200 *
201 * AttrOrOID ::= CHOICE {
202 *   oid OBJECT IDENTIFIER,
203 *   attribute Attribute }
204 *
205 * Attribute ::= SEQUENCE {
206 *   type OBJECT IDENTIFIER,
207 *   values SET SIZE(1..MAX) OF OBJECT IDENTIFIER }
208 */
209
210typedef struct {
211	ASN1_OBJECT *type;
212	STACK_OF(ASN1_OBJECT) *values;
213} Attribute;
214
215typedef struct {
216	int type;
217	union {
218		ASN1_OBJECT *oid;
219		Attribute *attribute;
220	} d;
221} AttrOrOID;
222
223#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
224DEFINE_STACK_OF(AttrOrOID)
225#endif
226
227typedef struct {
228	int type;
229	STACK_OF(AttrOrOID) *attrs;
230} CsrAttrs;
231
232ASN1_SEQUENCE(Attribute) = {
233	ASN1_SIMPLE(Attribute, type, ASN1_OBJECT),
234	ASN1_SET_OF(Attribute, values, ASN1_OBJECT)
235} ASN1_SEQUENCE_END(Attribute);
236
237ASN1_CHOICE(AttrOrOID) = {
238	ASN1_SIMPLE(AttrOrOID, d.oid, ASN1_OBJECT),
239	ASN1_SIMPLE(AttrOrOID, d.attribute, Attribute)
240} ASN1_CHOICE_END(AttrOrOID);
241
242ASN1_CHOICE(CsrAttrs) = {
243	ASN1_SEQUENCE_OF(CsrAttrs, attrs, AttrOrOID)
244} ASN1_CHOICE_END(CsrAttrs);
245
246IMPLEMENT_ASN1_FUNCTIONS(CsrAttrs);
247
248
249static void add_csrattrs_oid(struct hs20_osu_client *ctx, ASN1_OBJECT *oid,
250			     STACK_OF(X509_EXTENSION) *exts)
251{
252	char txt[100];
253	int res;
254
255	if (!oid)
256		return;
257
258	res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
259	if (res < 0 || res >= (int) sizeof(txt))
260		return;
261
262	if (os_strcmp(txt, "1.2.840.113549.1.9.7") == 0) {
263		wpa_printf(MSG_INFO, "TODO: csrattr challengePassword");
264	} else if (os_strcmp(txt, "1.2.840.113549.1.1.11") == 0) {
265		wpa_printf(MSG_INFO, "csrattr sha256WithRSAEncryption");
266	} else {
267		wpa_printf(MSG_INFO, "Ignore unsupported csrattr oid %s", txt);
268	}
269}
270
271
272static void add_csrattrs_ext_req(struct hs20_osu_client *ctx,
273				 STACK_OF(ASN1_OBJECT) *values,
274				 STACK_OF(X509_EXTENSION) *exts)
275{
276	char txt[100];
277	int i, num, res;
278
279	num = sk_ASN1_OBJECT_num(values);
280	for (i = 0; i < num; i++) {
281		ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(values, i);
282
283		res = OBJ_obj2txt(txt, sizeof(txt), oid, 1);
284		if (res < 0 || res >= (int) sizeof(txt))
285			continue;
286
287		if (os_strcmp(txt, "1.3.6.1.1.1.1.22") == 0) {
288			wpa_printf(MSG_INFO, "TODO: extReq macAddress");
289		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.3") == 0) {
290			wpa_printf(MSG_INFO, "TODO: extReq imei");
291		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.4") == 0) {
292			wpa_printf(MSG_INFO, "TODO: extReq meid");
293		} else if (os_strcmp(txt, "1.3.6.1.4.1.40808.1.1.5") == 0) {
294			wpa_printf(MSG_INFO, "TODO: extReq DevId");
295		} else {
296			wpa_printf(MSG_INFO, "Ignore unsupported cstattr extensionsRequest %s",
297				   txt);
298		}
299	}
300}
301
302
303static void add_csrattrs_attr(struct hs20_osu_client *ctx, Attribute *attr,
304			      STACK_OF(X509_EXTENSION) *exts)
305{
306	char txt[100], txt2[100];
307	int i, num, res;
308
309	if (!attr || !attr->type || !attr->values)
310		return;
311
312	res = OBJ_obj2txt(txt, sizeof(txt), attr->type, 1);
313	if (res < 0 || res >= (int) sizeof(txt))
314		return;
315
316	if (os_strcmp(txt, "1.2.840.113549.1.9.14") == 0) {
317		add_csrattrs_ext_req(ctx, attr->values, exts);
318		return;
319	}
320
321	num = sk_ASN1_OBJECT_num(attr->values);
322	for (i = 0; i < num; i++) {
323		ASN1_OBJECT *oid = sk_ASN1_OBJECT_value(attr->values, i);
324
325		res = OBJ_obj2txt(txt2, sizeof(txt2), oid, 1);
326		if (res < 0 || res >= (int) sizeof(txt2))
327			continue;
328
329		wpa_printf(MSG_INFO, "Ignore unsupported cstattr::attr %s oid %s",
330			   txt, txt2);
331	}
332}
333
334
335static void add_csrattrs(struct hs20_osu_client *ctx, CsrAttrs *csrattrs,
336			 STACK_OF(X509_EXTENSION) *exts)
337{
338	int i, num;
339
340	if (!csrattrs || ! csrattrs->attrs)
341		return;
342
343#ifdef OPENSSL_IS_BORINGSSL
344	num = sk_num(CHECKED_CAST(_STACK *, STACK_OF(AttrOrOID) *,
345				  csrattrs->attrs));
346	for (i = 0; i < num; i++) {
347		AttrOrOID *ao = sk_value(
348			CHECKED_CAST(_STACK *, const STACK_OF(AttrOrOID) *,
349				     csrattrs->attrs), i);
350		switch (ao->type) {
351		case 0:
352			add_csrattrs_oid(ctx, ao->d.oid, exts);
353			break;
354		case 1:
355			add_csrattrs_attr(ctx, ao->d.attribute, exts);
356			break;
357		}
358	}
359#else /* OPENSSL_IS_BORINGSSL */
360#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
361	num = sk_AttrOrOID_num(csrattrs->attrs);
362#else
363	num = SKM_sk_num(AttrOrOID, csrattrs->attrs);
364#endif
365	for (i = 0; i < num; i++) {
366#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
367		AttrOrOID *ao = sk_AttrOrOID_value(csrattrs->attrs, i);
368#else
369		AttrOrOID *ao = SKM_sk_value(AttrOrOID, csrattrs->attrs, i);
370#endif
371		switch (ao->type) {
372		case 0:
373			add_csrattrs_oid(ctx, ao->d.oid, exts);
374			break;
375		case 1:
376			add_csrattrs_attr(ctx, ao->d.attribute, exts);
377			break;
378		}
379	}
380#endif /* OPENSSL_IS_BORINGSSL */
381}
382
383
384static int generate_csr(struct hs20_osu_client *ctx, char *key_pem,
385			char *csr_pem, char *est_req, char *old_cert,
386			CsrAttrs *csrattrs)
387{
388	EVP_PKEY_CTX *pctx = NULL;
389	EVP_PKEY *pkey = NULL;
390	RSA *rsa;
391	X509_REQ *req = NULL;
392	int ret = -1;
393	unsigned int val;
394	X509_NAME *subj = NULL;
395	char name[100];
396	STACK_OF(X509_EXTENSION) *exts = NULL;
397	X509_EXTENSION *ex;
398	BIO *out;
399	CONF *ctmp = NULL;
400
401	wpa_printf(MSG_INFO, "Generate RSA private key");
402	write_summary(ctx, "Generate RSA private key");
403	pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
404	if (!pctx)
405		return -1;
406
407	if (EVP_PKEY_keygen_init(pctx) <= 0)
408		goto fail;
409
410	if (EVP_PKEY_CTX_set_rsa_keygen_bits(pctx, 2048) <= 0)
411		goto fail;
412
413	if (EVP_PKEY_keygen(pctx, &pkey) <= 0)
414		goto fail;
415	EVP_PKEY_CTX_free(pctx);
416	pctx = NULL;
417
418	rsa = EVP_PKEY_get1_RSA(pkey);
419	if (rsa == NULL)
420		goto fail;
421
422	if (key_pem) {
423		FILE *f = fopen(key_pem, "wb");
424		if (f == NULL)
425			goto fail;
426		if (!PEM_write_RSAPrivateKey(f, rsa, NULL, NULL, 0, NULL,
427					     NULL)) {
428			wpa_printf(MSG_INFO, "Could not write private key: %s",
429				   ERR_error_string(ERR_get_error(), NULL));
430			fclose(f);
431			goto fail;
432		}
433		fclose(f);
434	}
435
436	wpa_printf(MSG_INFO, "Generate CSR");
437	write_summary(ctx, "Generate CSR");
438	req = X509_REQ_new();
439	if (req == NULL)
440		goto fail;
441
442	if (old_cert) {
443		FILE *f;
444		X509 *cert;
445		int res;
446
447		f = fopen(old_cert, "r");
448		if (f == NULL)
449			goto fail;
450		cert = PEM_read_X509(f, NULL, NULL, NULL);
451		fclose(f);
452
453		if (cert == NULL)
454			goto fail;
455		res = X509_REQ_set_subject_name(req,
456						X509_get_subject_name(cert));
457		X509_free(cert);
458		if (!res)
459			goto fail;
460	} else {
461		os_get_random((u8 *) &val, sizeof(val));
462		os_snprintf(name, sizeof(name), "cert-user-%u", val);
463		subj = X509_NAME_new();
464		if (subj == NULL ||
465		    !X509_NAME_add_entry_by_txt(subj, "CN", MBSTRING_ASC,
466						(unsigned char *) name,
467						-1, -1, 0) ||
468		    !X509_REQ_set_subject_name(req, subj))
469			goto fail;
470		X509_NAME_free(subj);
471		subj = NULL;
472	}
473
474	if (!X509_REQ_set_pubkey(req, pkey))
475		goto fail;
476
477	exts = sk_X509_EXTENSION_new_null();
478	if (!exts)
479		goto fail;
480
481	ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_basic_constraints,
482				  "CA:FALSE");
483	if (ex == NULL ||
484	    !sk_X509_EXTENSION_push(exts, ex))
485		goto fail;
486
487	ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_key_usage,
488				  "nonRepudiation,digitalSignature,keyEncipherment");
489	if (ex == NULL ||
490	    !sk_X509_EXTENSION_push(exts, ex))
491		goto fail;
492
493	ex = X509V3_EXT_nconf_nid(ctmp, NULL, NID_ext_key_usage,
494				  "1.3.6.1.4.1.40808.1.1.2");
495	if (ex == NULL ||
496	    !sk_X509_EXTENSION_push(exts, ex))
497		goto fail;
498
499	add_csrattrs(ctx, csrattrs, exts);
500
501	if (!X509_REQ_add_extensions(req, exts))
502		goto fail;
503	sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
504	exts = NULL;
505
506	if (!X509_REQ_sign(req, pkey, EVP_sha256()))
507		goto fail;
508
509	out = BIO_new(BIO_s_mem());
510	if (out) {
511		char *txt;
512		size_t rlen;
513
514#if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL)
515		X509_REQ_print(out, req);
516#endif
517		rlen = BIO_ctrl_pending(out);
518		txt = os_malloc(rlen + 1);
519		if (txt) {
520			int res = BIO_read(out, txt, rlen);
521			if (res > 0) {
522				txt[res] = '\0';
523				wpa_printf(MSG_MSGDUMP, "OpenSSL: Certificate request:\n%s",
524					   txt);
525			}
526			os_free(txt);
527		}
528		BIO_free(out);
529	}
530
531	if (csr_pem) {
532		FILE *f = fopen(csr_pem, "w");
533		if (f == NULL)
534			goto fail;
535#if !defined(ANDROID) || !defined(OPENSSL_IS_BORINGSSL)
536		X509_REQ_print_fp(f, req);
537#endif
538		if (!PEM_write_X509_REQ(f, req)) {
539			fclose(f);
540			goto fail;
541		}
542		fclose(f);
543	}
544
545	if (est_req) {
546		BIO *mem = BIO_new(BIO_s_mem());
547		BUF_MEM *ptr;
548		char *pos, *end, *buf_end;
549		FILE *f;
550
551		if (mem == NULL)
552			goto fail;
553		if (!PEM_write_bio_X509_REQ(mem, req)) {
554			BIO_free(mem);
555			goto fail;
556		}
557
558		BIO_get_mem_ptr(mem, &ptr);
559		pos = ptr->data;
560		buf_end = pos + ptr->length;
561
562		/* Remove START/END lines */
563		while (pos < buf_end && *pos != '\n')
564			pos++;
565		if (pos == buf_end) {
566			BIO_free(mem);
567			goto fail;
568		}
569		pos++;
570
571		end = pos;
572		while (end < buf_end && *end != '-')
573			end++;
574
575		f = fopen(est_req, "w");
576		if (f == NULL) {
577			BIO_free(mem);
578			goto fail;
579		}
580		fwrite(pos, end - pos, 1, f);
581		fclose(f);
582
583		BIO_free(mem);
584	}
585
586	ret = 0;
587fail:
588	if (exts)
589		sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
590	if (subj)
591		X509_NAME_free(subj);
592	if (req)
593		X509_REQ_free(req);
594	if (pkey)
595		EVP_PKEY_free(pkey);
596	if (pctx)
597		EVP_PKEY_CTX_free(pctx);
598	return ret;
599}
600
601
602int est_build_csr(struct hs20_osu_client *ctx, const char *url)
603{
604	char *buf;
605	size_t buflen;
606	int res;
607	char old_cert_buf[200];
608	char *old_cert = NULL;
609	CsrAttrs *csrattrs = NULL;
610
611	buflen = os_strlen(url) + 100;
612	buf = os_malloc(buflen);
613	if (buf == NULL)
614		return -1;
615
616	os_snprintf(buf, buflen, "%s/csrattrs", url);
617	wpa_printf(MSG_INFO, "Download csrattrs from %s", buf);
618	write_summary(ctx, "Download EST csrattrs from %s", buf);
619	ctx->no_osu_cert_validation = 1;
620	http_ocsp_set(ctx->http, 1);
621	res = http_download_file(ctx->http, buf, "Cert/est-csrattrs.txt",
622				 ctx->ca_fname);
623	http_ocsp_set(ctx->http,
624		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
625	ctx->no_osu_cert_validation = 0;
626	os_free(buf);
627	if (res < 0) {
628		wpa_printf(MSG_INFO, "Failed to download EST csrattrs - assume no extra attributes are needed");
629	} else {
630		size_t resp_len;
631		char *resp;
632		unsigned char *attrs;
633		const unsigned char *pos;
634		size_t attrs_len;
635
636		resp = os_readfile("Cert/est-csrattrs.txt", &resp_len);
637		if (resp == NULL) {
638			wpa_printf(MSG_INFO, "Could not read csrattrs");
639			return -1;
640		}
641
642		attrs = base64_decode(resp, resp_len, &attrs_len);
643		os_free(resp);
644
645		if (attrs == NULL) {
646			wpa_printf(MSG_INFO, "Could not base64 decode csrattrs");
647			return -1;
648		}
649		unlink("Cert/est-csrattrs.txt");
650
651		pos = attrs;
652		csrattrs = d2i_CsrAttrs(NULL, &pos, attrs_len);
653		os_free(attrs);
654		if (csrattrs == NULL) {
655			wpa_printf(MSG_INFO, "Failed to parse csrattrs ASN.1");
656			/* Continue assuming no additional requirements */
657		}
658	}
659
660	if (ctx->client_cert_present) {
661		os_snprintf(old_cert_buf, sizeof(old_cert_buf),
662			    "SP/%s/client-cert.pem", ctx->fqdn);
663		old_cert = old_cert_buf;
664	}
665
666	res = generate_csr(ctx, "Cert/privkey-plain.pem", "Cert/est-req.pem",
667			   "Cert/est-req.b64", old_cert, csrattrs);
668	if (csrattrs)
669		CsrAttrs_free(csrattrs);
670
671	return res;
672}
673
674
675int est_simple_enroll(struct hs20_osu_client *ctx, const char *url,
676		      const char *user, const char *pw)
677{
678	char *buf, *resp, *req, *req2;
679	size_t buflen, resp_len, len, pkcs7_len;
680	unsigned char *pkcs7;
681	char client_cert_buf[200];
682	char client_key_buf[200];
683	const char *client_cert = NULL, *client_key = NULL;
684	int res;
685
686	req = os_readfile("Cert/est-req.b64", &len);
687	if (req == NULL) {
688		wpa_printf(MSG_INFO, "Could not read Cert/req.b64");
689		return -1;
690	}
691	req2 = os_realloc(req, len + 1);
692	if (req2 == NULL) {
693		os_free(req);
694		return -1;
695	}
696	req2[len] = '\0';
697	req = req2;
698	wpa_printf(MSG_DEBUG, "EST simpleenroll request: %s", req);
699
700	buflen = os_strlen(url) + 100;
701	buf = os_malloc(buflen);
702	if (buf == NULL) {
703		os_free(req);
704		return -1;
705	}
706
707	if (ctx->client_cert_present) {
708		os_snprintf(buf, buflen, "%s/simplereenroll", url);
709		os_snprintf(client_cert_buf, sizeof(client_cert_buf),
710			    "SP/%s/client-cert.pem", ctx->fqdn);
711		client_cert = client_cert_buf;
712		os_snprintf(client_key_buf, sizeof(client_key_buf),
713			    "SP/%s/client-key.pem", ctx->fqdn);
714		client_key = client_key_buf;
715	} else
716		os_snprintf(buf, buflen, "%s/simpleenroll", url);
717	wpa_printf(MSG_INFO, "EST simpleenroll URL: %s", buf);
718	write_summary(ctx, "EST simpleenroll URL: %s", buf);
719	ctx->no_osu_cert_validation = 1;
720	http_ocsp_set(ctx->http, 1);
721	resp = http_post(ctx->http, buf, req, "application/pkcs10",
722			 "Content-Transfer-Encoding: base64",
723			 ctx->ca_fname, user, pw, client_cert, client_key,
724			 &resp_len);
725	http_ocsp_set(ctx->http,
726		      (ctx->workarounds & WORKAROUND_OCSP_OPTIONAL) ? 1 : 2);
727	ctx->no_osu_cert_validation = 0;
728	os_free(buf);
729	if (resp == NULL) {
730		wpa_printf(MSG_INFO, "EST certificate enrollment failed");
731		write_result(ctx, "EST certificate enrollment failed");
732		return -1;
733	}
734	wpa_printf(MSG_DEBUG, "EST simpleenroll response: %s", resp);
735
736	pkcs7 = base64_decode(resp, resp_len, &pkcs7_len);
737	if (pkcs7 == NULL) {
738		wpa_printf(MSG_INFO, "EST workaround - Could not decode base64, assume this is DER encoded PKCS7");
739		pkcs7 = os_malloc(resp_len);
740		if (pkcs7) {
741			os_memcpy(pkcs7, resp, resp_len);
742			pkcs7_len = resp_len;
743		}
744	}
745	os_free(resp);
746
747	if (pkcs7 == NULL) {
748		wpa_printf(MSG_INFO, "Failed to parse simpleenroll base64 response");
749		write_result(ctx, "Failed to parse EST simpleenroll base64 response");
750		return -1;
751	}
752
753	res = pkcs7_to_cert(ctx, pkcs7, pkcs7_len, "Cert/est_cert.pem",
754			    "Cert/est_cert.der");
755	os_free(pkcs7);
756
757	if (res < 0) {
758		wpa_printf(MSG_INFO, "EST: Failed to extract certificate from PKCS7 file");
759		write_result(ctx, "EST: Failed to extract certificate from EST PKCS7 file");
760		return -1;
761	}
762
763	wpa_printf(MSG_INFO, "EST simple%senroll completed successfully",
764		   ctx->client_cert_present ? "re" : "");
765	write_summary(ctx, "EST simple%senroll completed successfully",
766		      ctx->client_cert_present ? "re" : "");
767
768	return 0;
769}
770