eap_fast_deinit_pac_data(&rc);	if (err) {		wpa_printf(MSG_INFO, "EAP-FAST: %s in '%s:%d'",			   err, pac_file, rc.line);		return -1;	}	wpa_printf(MSG_DEBUG, "EAP-FAST: Read %d PAC entries from '%s'",		   count, pac_file);	return 0;}static void eap_fast_write(char **buf, char **pos, size_t *buf_len,			   const char *field, const u8 *data,			   size_t len, int txt){	size_t i, need;	int ret;	if (data == NULL || *buf == NULL)		return;	need = os_strlen(field) + len * 2 + 30;	if (txt)		need += os_strlen(field) + len + 20;	if (*pos - *buf + need > *buf_len) {		char *nbuf = os_realloc(*buf, *buf_len + need);		if (nbuf == NULL) {			os_free(*buf);			*buf = NULL;			return;		}		*buf = nbuf;		*buf_len += need;	}	ret = os_snprintf(*pos, *buf + *buf_len - *pos, "%s=", field);	if (ret < 0 || ret >= *buf + *buf_len - *pos)		return;	*pos += ret;	*pos += wpa_snprintf_hex(*pos, *buf + *buf_len - *pos, data, len);	ret = os_snprintf(*pos, *buf + *buf_len - *pos, "\n");	if (ret < 0 || ret >= *buf + *buf_len - *pos)		return;	*pos += ret;	if (txt) {		ret = os_snprintf(*pos, *buf + *buf_len - *pos,				  "%s-txt=", field);		if (ret < 0 || ret >= *buf + *buf_len - *pos)			return;		*pos += ret;		for (i = 0; i < len; i++) {			ret = os_snprintf(*pos, *buf + *buf_len - *pos,					  "%c", data[i]);			if (ret < 0 || ret >= *buf + *buf_len - *pos)				return;			*pos += ret;		}		ret = os_snprintf(*pos, *buf + *buf_len - *pos, "\n");		if (ret < 0 || ret >= *buf + *buf_len - *pos)			return;		*pos += ret;	}}static int eap_fast_write_pac(struct eap_sm *sm, const char *pac_file,			      char *buf, size_t len){	if (os_strncmp(pac_file, "blob://", 7) == 0) {		struct wpa_config_blob *blob;		blob = os_zalloc(sizeof(*blob));		if (blob == NULL)			return -1;		blob->data = (u8 *) buf;		blob->len = len;		buf = NULL;		blob->name = os_strdup(pac_file + 7);		if (blob->name == NULL) {			os_free(blob);			return -1;		}		eap_set_config_blob(sm, blob);	} else {		FILE *f;		f = fopen(pac_file, "wb");		if (f == NULL) {			wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC "				   "file '%s' for writing", pac_file);			return -1;		}		if (fwrite(buf, 1, len, f) != len) {			wpa_printf(MSG_INFO, "EAP-FAST: Failed to write all "				   "PACs into '%s'", pac_file);			fclose(f);			return -1;		}		os_free(buf);		fclose(f);	}	return 0;}static int eap_fast_add_pac_data(struct eap_fast_pac *pac, char **buf,				 char **pos, size_t *buf_len){	int ret;	ret = os_snprintf(*pos, *buf + *buf_len - *pos,			  "START\nPAC-Type=%d\n", pac->pac_type);	if (ret < 0 || ret >= *buf + *buf_len - *pos)		return -1;	*pos += ret;	eap_fast_write(buf, pos, buf_len, "PAC-Key",		       pac->pac_key, EAP_FAST_PAC_KEY_LEN, 0);	eap_fast_write(buf, pos, buf_len, "PAC-Opaque",		       pac->pac_opaque, pac->pac_opaque_len, 0);	eap_fast_write(buf, pos, buf_len, "PAC-Info",		       pac->pac_info, pac->pac_info_len, 0);	eap_fast_write(buf, pos, buf_len, "A-ID",		       pac->a_id, pac->a_id_len, 0);	eap_fast_write(buf, pos, buf_len, "I-ID",		       pac->i_id, pac->i_id_len, 1);	eap_fast_write(buf, pos, buf_len, "A-ID-Info",		       pac->a_id_info, pac->a_id_info_len, 1);	if (*buf == NULL) {		wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC "			   "data");		return -1;	}	ret = os_snprintf(*pos, *buf + *buf_len - *pos, "END\n");	if (ret < 0 || ret >= *buf + *buf_len - *pos)		return -1;	*pos += ret;	return 0;}/** * eap_fast_save_pac - Save PAC entries (text format) * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() * @pac_root: Root of the PAC list * @pac_file: Name of the PAC file/blob * Returns: 0 on success, -1 on failure */int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_pac *pac_root,		      const char *pac_file){	struct eap_fast_pac *pac;	int ret, count = 0;	char *buf, *pos;	size_t buf_len;	if (pac_file == NULL)		return -1;	buf_len = 1024;	pos = buf = os_malloc(buf_len);	if (buf == NULL)		return -1;	ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);	if (ret < 0 || ret >= buf + buf_len - pos) {		os_free(buf);		return -1;	}	pos += ret;	pac = pac_root;	while (pac) {		if (eap_fast_add_pac_data(pac, &buf, &pos, &buf_len)) {			os_free(buf);			return -1;		}		count++;		pac = pac->next;	}	if (eap_fast_write_pac(sm, pac_file, buf, pos - buf)) {		os_free(buf);		return -1;	}	wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %d PAC entries into '%s'",		   count, pac_file);	return 0;}/** * eap_fast_pac_list_truncate - Truncate a PAC list to the given length * @pac_root: Root of the PAC list * @max_len: Maximum length of the list (>= 1) * Returns: Number of PAC entries removed */size_t eap_fast_pac_list_truncate(struct eap_fast_pac *pac_root,				  size_t max_len){	struct eap_fast_pac *pac, *prev;	size_t count;	pac = pac_root;	prev = NULL;	count = 0;	while (pac) {		count++;		if (count > max_len)			break;		prev = pac;		pac = pac->next;	}	if (count <= max_len || prev == NULL)		return 0;	count = 0;	prev->next = NULL;	while (pac) {		prev = pac;		pac = pac->next;		eap_fast_free_pac(prev);		count++;	}	return count;}static void eap_fast_pac_get_a_id(struct eap_fast_pac *pac){	u8 *pos, *end;	u16 type, len;	pos = pac->pac_info;	end = pos + pac->pac_info_len;	while (pos + 4 < end) {		type = WPA_GET_BE16(pos);		pos += 2;		len = WPA_GET_BE16(pos);		pos += 2;		if (pos + len > end)			break;		if (type == PAC_TYPE_A_ID) {			os_free(pac->a_id);			pac->a_id = os_malloc(len);			if (pac->a_id == NULL)				break;			os_memcpy(pac->a_id, pos, len);			pac->a_id_len = len;		}		if (type == PAC_TYPE_A_ID_INFO) {			os_free(pac->a_id_info);			pac->a_id_info = os_malloc(len);			if (pac->a_id_info == NULL)				break;			os_memcpy(pac->a_id_info, pos, len);			pac->a_id_info_len = len;		}		pos += len;	}}/** * eap_fast_load_pac_bin - Load PAC entries (binary format) * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() * @pac_root: Pointer to root of the PAC list (to be filled) * @pac_file: Name of the PAC file/blob to load * Returns: 0 on success, -1 on failure */int eap_fast_load_pac_bin(struct eap_sm *sm, struct eap_fast_pac **pac_root,			  const char *pac_file){	const struct wpa_config_blob *blob = NULL;	u8 *buf, *end, *pos;	size_t len, count = 0;	struct eap_fast_pac *pac, *prev;	*pac_root = NULL;	if (pac_file == NULL)		return -1;	if (os_strncmp(pac_file, "blob://", 7) == 0) {		blob = eap_get_config_blob(sm, pac_file + 7);		if (blob == NULL) {			wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "				   "assume no PAC entries have been "				   "provisioned", pac_file + 7);			return 0;		}		buf = blob->data;		len = blob->len;	} else {		buf = (u8 *) os_readfile(pac_file, &len);		if (buf == NULL) {			wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "				   "assume no PAC entries have been "				   "provisioned", pac_file);			return 0;		}	}	if (len == 0) {		if (blob == NULL)			os_free(buf);		return 0;	}	if (len < 6 || WPA_GET_BE32(buf) != EAP_FAST_PAC_BINARY_MAGIC ||	    WPA_GET_BE16(buf + 4) != EAP_FAST_PAC_BINARY_FORMAT_VERSION) {		wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC file '%s' (bin)",			   pac_file);		if (blob == NULL)			os_free(buf);		return -1;	}	pac = prev = NULL;	pos = buf + 6;	end = buf + len;	while (pos < end) {		if (end - pos < 2 + 32 + 2 + 2)			goto parse_fail;		pac = os_zalloc(sizeof(*pac));		if (pac == NULL)			goto parse_fail;		pac->pac_type = WPA_GET_BE16(pos);		pos += 2;		os_memcpy(pac->pac_key, pos, EAP_FAST_PAC_KEY_LEN);		pos += EAP_FAST_PAC_KEY_LEN;		pac->pac_opaque_len = WPA_GET_BE16(pos);		pos += 2;		if (pos + pac->pac_opaque_len + 2 > end)			goto parse_fail;		pac->pac_opaque = os_malloc(pac->pac_opaque_len);		if (pac->pac_opaque == NULL)			goto parse_fail;		os_memcpy(pac->pac_opaque, pos, pac->pac_opaque_len);		pos += pac->pac_opaque_len;		pac->pac_info_len = WPA_GET_BE16(pos);		pos += 2;		if (pos + pac->pac_info_len > end)			goto parse_fail;		pac->pac_info = os_malloc(pac->pac_info_len);		if (pac->pac_info == NULL)			goto parse_fail;		os_memcpy(pac->pac_info, pos, pac->pac_info_len);		pos += pac->pac_info_len;		eap_fast_pac_get_a_id(pac);		count++;		if (prev)			prev->next = pac;		else			*pac_root = pac;		prev = pac;	}	if (blob == NULL)		os_free(buf);	wpa_printf(MSG_DEBUG, "EAP-FAST: Read %lu PAC entries from '%s' (bin)",		   (unsigned long) count, pac_file);	return 0;parse_fail:	wpa_printf(MSG_INFO, "EAP-FAST: Failed to parse PAC file '%s' (bin)",		   pac_file);	if (blob == NULL)		os_free(buf);	if (pac)		eap_fast_free_pac(pac);	return -1;}/** * eap_fast_save_pac_bin - Save PAC entries (binary format) * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() * @pac_root: Root of the PAC list * @pac_file: Name of the PAC file/blob * Returns: 0 on success, -1 on failure */int eap_fast_save_pac_bin(struct eap_sm *sm, struct eap_fast_pac *pac_root,			  const char *pac_file){	size_t len, count = 0;	struct eap_fast_pac *pac;	u8 *buf, *pos;	len = 6;	pac = pac_root;	while (pac) {		if (pac->pac_opaque_len > 65535 ||		    pac->pac_info_len > 65535)			return -1;		len += 2 + EAP_FAST_PAC_KEY_LEN + 2 + pac->pac_opaque_len +			2 + pac->pac_info_len;		pac = pac->next;	}	buf = os_malloc(len);	if (buf == NULL)		return -1;	pos = buf;	WPA_PUT_BE32(pos, EAP_FAST_PAC_BINARY_MAGIC);	pos += 4;	WPA_PUT_BE16(pos, EAP_FAST_PAC_BINARY_FORMAT_VERSION);	pos += 2;	pac = pac_root;	while (pac) {		WPA_PUT_BE16(pos, pac->pac_type);		pos += 2;		os_memcpy(pos, pac->pac_key, EAP_FAST_PAC_KEY_LEN);		pos += EAP_FAST_PAC_KEY_LEN;		WPA_PUT_BE16(pos, pac->pac_opaque_len);		pos += 2;		os_memcpy(pos, pac->pac_opaque, pac->pac_opaque_len);		pos += pac->pac_opaque_len;		WPA_PUT_BE16(pos, pac->pac_info_len);		pos += 2;		os_memcpy(pos, pac->pac_info, pac->pac_info_len);		pos += pac->pac_info_len;		pac = pac->next;		count++;	}	if (eap_fast_write_pac(sm, pac_file, (char *) buf, len)) {		os_free(buf);		return -1;	}	wpa_printf(MSG_DEBUG, "EAP-FAST: Wrote %lu PAC entries into '%s' "		   "(bin)", (unsigned long) count, pac_file);	return 0;}