source: protocols/oscar/auth.c @ b7d3cc34

0.99
Last change on this file since b7d3cc34 was b7d3cc34, checked in by Wilmer van der Gaast <wilmer@…>, at 2005-11-06T18:23:18Z

Initial repository (0.99 release tree)

  • Property mode set to 100644
File size: 15.0 KB
Line 
1/*
2 * Deals with the authorizer (group 0x0017=23, and old-style non-SNAC login).
3 *
4 */
5
6#include <aim.h> 
7
8#include "md5.h"
9
10static int aim_encode_password(const char *password, unsigned char *encoded);
11
12/*
13 * This just pushes the passed cookie onto the passed connection, without
14 * the SNAC header or any of that.
15 *
16 * Very commonly used, as every connection except auth will require this to
17 * be the first thing you send.
18 *
19 */
20int aim_sendcookie(aim_session_t *sess, aim_conn_t *conn, const guint8 *chipsahoy)
21{
22        aim_frame_t *fr;
23        aim_tlvlist_t *tl = NULL;
24
25        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x0001, 4+2+2+AIM_COOKIELEN)))
26                return -ENOMEM;
27
28        aimbs_put32(&fr->data, 0x00000001);
29        aim_addtlvtochain_raw(&tl, 0x0006, AIM_COOKIELEN, chipsahoy);   
30        aim_writetlvchain(&fr->data, &tl);
31        aim_freetlvchain(&tl);
32
33        aim_tx_enqueue(sess, fr);
34
35        return 0;
36}
37
38/*
39 * Normally the FLAP version is sent as the first few bytes of the cookie,
40 * meaning you generally never call this.
41 *
42 * But there are times when something might want it seperate. Specifically,
43 * libfaim sends this internally when doing SNAC login.
44 *
45 */
46int aim_sendflapver(aim_session_t *sess, aim_conn_t *conn)
47{
48        aim_frame_t *fr;
49
50        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 4)))
51                return -ENOMEM;
52
53        aimbs_put32(&fr->data, 0x00000001);
54
55        aim_tx_enqueue(sess, fr);
56
57        return 0;
58}
59
60/*
61 * This is a bit confusing.
62 *
63 * Normal SNAC login goes like this:
64 *   - connect
65 *   - server sends flap version
66 *   - client sends flap version
67 *   - client sends screen name (17/6)
68 *   - server sends hash key (17/7)
69 *   - client sends auth request (17/2 -- aim_send_login)
70 *   - server yells
71 *
72 * XOR login (for ICQ) goes like this:
73 *   - connect
74 *   - server sends flap version
75 *   - client sends auth request which contains flap version (aim_send_login)
76 *   - server yells
77 *
78 * For the client API, we make them implement the most complicated version,
79 * and for the simpler version, we fake it and make it look like the more
80 * complicated process.
81 *
82 * This is done by giving the client a faked key, just so we can convince
83 * them to call aim_send_login right away, which will detect the session
84 * flag that says this is XOR login and ignore the key, sending an ICQ
85 * login request instead of the normal SNAC one.
86 *
87 * As soon as AOL makes ICQ log in the same way as AIM, this is /gone/.
88 *
89 * XXX This may cause problems if the client relies on callbacks only
90 * being called from the context of aim_rxdispatch()...
91 *
92 */
93static int goddamnicq(aim_session_t *sess, aim_conn_t *conn, const char *sn)
94{
95        aim_frame_t fr;
96        aim_rxcallback_t userfunc;
97       
98        sess->flags &= ~AIM_SESS_FLAGS_SNACLOGIN;
99        sess->flags |= AIM_SESS_FLAGS_XORLOGIN;
100
101        fr.conn = conn;
102       
103        if ((userfunc = aim_callhandler(sess, conn, 0x0017, 0x0007)))
104                userfunc(sess, &fr, "");
105
106        return 0;
107}
108
109/*
110 * In AIM 3.5 protocol, the first stage of login is to request login from the
111 * Authorizer, passing it the screen name for verification.  If the name is
112 * invalid, a 0017/0003 is spit back, with the standard error contents.  If
113 * valid, a 0017/0007 comes back, which is the signal to send it the main
114 * login command (0017/0002).
115 *
116 */
117int aim_request_login(aim_session_t *sess, aim_conn_t *conn, const char *sn)
118{
119        aim_frame_t *fr;
120        aim_snacid_t snacid;
121        aim_tlvlist_t *tl = NULL;
122       
123        if (!sess || !conn || !sn)
124                return -EINVAL;
125
126        if ((sn[0] >= '0') && (sn[0] <= '9'))
127                return goddamnicq(sess, conn, sn);
128
129        sess->flags |= AIM_SESS_FLAGS_SNACLOGIN;
130
131        aim_sendflapver(sess, conn);
132
133        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 10+2+2+strlen(sn))))
134                return -ENOMEM;
135
136        snacid = aim_cachesnac(sess, 0x0017, 0x0006, 0x0000, NULL, 0);
137        aim_putsnac(&fr->data, 0x0017, 0x0006, 0x0000, snacid);
138
139        aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), (guint8 *)sn);
140        aim_writetlvchain(&fr->data, &tl);
141        aim_freetlvchain(&tl);
142
143        aim_tx_enqueue(sess, fr);
144
145        return 0;
146}
147
148/*
149 * Part two of the ICQ hack.  Note the ignoring of the key and clientinfo.
150 */
151static int goddamnicq2(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password)
152{
153        static const char clientstr[] = {"ICQ Inc. - Product of ICQ (TM) 2001b.5.17.1.3642.85"};
154        static const char lang[] = {"en"};
155        static const char country[] = {"us"};
156        aim_frame_t *fr;
157        aim_tlvlist_t *tl = NULL;
158        guint8 *password_encoded;
159
160        if (!(password_encoded = (guint8 *) g_malloc(strlen(password))))
161                return -ENOMEM;
162
163        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 1152))) {
164                g_free(password_encoded);
165                return -ENOMEM;
166        }
167
168        aim_encode_password(password, password_encoded);
169
170        aimbs_put32(&fr->data, 0x00000001);
171        aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), (guint8 *)sn);
172        aim_addtlvtochain_raw(&tl, 0x0002, strlen(password), password_encoded);
173        aim_addtlvtochain_raw(&tl, 0x0003, strlen(clientstr), (guint8 *)clientstr);
174        aim_addtlvtochain16(&tl, 0x0016, 0x010a); /* cliend ID */
175        aim_addtlvtochain16(&tl, 0x0017, 0x0005); /* major version */
176        aim_addtlvtochain16(&tl, 0x0018, 0x0011); /* minor version */
177        aim_addtlvtochain16(&tl, 0x0019, 0x0001); /* point version */
178        aim_addtlvtochain16(&tl, 0x001a, 0x0e3a); /* build */
179        aim_addtlvtochain32(&tl, 0x0014, 0x00000055); /* distribution chan */
180        aim_addtlvtochain_raw(&tl, 0x000f, strlen(lang), (guint8 *)lang);
181        aim_addtlvtochain_raw(&tl, 0x000e, strlen(country), (guint8 *)country);
182
183        aim_writetlvchain(&fr->data, &tl);
184
185        g_free(password_encoded);
186        aim_freetlvchain(&tl);
187
188        aim_tx_enqueue(sess, fr);
189
190        return 0;
191}
192
193/*
194 * send_login(int socket, char *sn, char *password)
195 * 
196 * This is the initial login request packet.
197 *
198 * NOTE!! If you want/need to make use of the aim_sendmemblock() function,
199 * then the client information you send here must exactly match the
200 * executable that you're pulling the data from.
201 *
202 * WinAIM 4.8.2540
203 *   clientstring = "AOL Instant Messenger (SM), version 4.8.2540/WIN32"
204 *   clientid = 0x0109
205 *   major = 0x0004
206 *   minor = 0x0008
207 *   point = 0x0000
208 *   build = 0x09ec
209 *   t(0x0014) = 0x000000af
210 *   t(0x004a) = 0x01
211 *
212 * WinAIM 4.3.2188:
213 *   clientstring = "AOL Instant Messenger (SM), version 4.3.2188/WIN32"
214 *   clientid = 0x0109
215 *   major = 0x0400
216 *   minor = 0x0003
217 *   point = 0x0000
218 *   build = 0x088c
219 *   unknown = 0x00000086
220 *   lang = "en"
221 *   country = "us"
222 *   unknown4a = 0x01
223 *
224 * Latest WinAIM that libfaim can emulate without server-side buddylists:
225 *   clientstring = "AOL Instant Messenger (SM), version 4.1.2010/WIN32"
226 *   clientid = 0x0004
227 *   major  = 0x0004
228 *   minor  = 0x0001
229 *   point = 0x0000
230 *   build  = 0x07da
231 *   unknown= 0x0000004b
232 *
233 * WinAIM 3.5.1670:
234 *   clientstring = "AOL Instant Messenger (SM), version 3.5.1670/WIN32"
235 *   clientid = 0x0004
236 *   major =  0x0003
237 *   minor =  0x0005
238 *   point = 0x0000
239 *   build =  0x0686
240 *   unknown =0x0000002a
241 *
242 * Java AIM 1.1.19:
243 *   clientstring = "AOL Instant Messenger (TM) version 1.1.19 for Java built 03/24/98, freeMem 215871 totalMem 1048567, i686, Linus, #2 SMP Sun Feb 11 03:41:17 UTC 2001 2.4.1-ac9, IBM Corporation, 1.1.8, 45.3, Tue Mar 27 12:09:17 PST 2001"
244 *   clientid = 0x0001
245 *   major  = 0x0001
246 *   minor  = 0x0001
247 *   point = (not sent)
248 *   build  = 0x0013
249 *   unknown= (not sent)
250 *   
251 * AIM for Linux 1.1.112:
252 *   clientstring = "AOL Instant Messenger (SM)"
253 *   clientid = 0x1d09
254 *   major  = 0x0001
255 *   minor  = 0x0001
256 *   point = 0x0001
257 *   build  = 0x0070
258 *   unknown= 0x0000008b
259 *   serverstore = 0x01
260 *
261 */
262int aim_send_login(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password, struct client_info_s *ci, const char *key)
263{
264        aim_frame_t *fr;
265        aim_tlvlist_t *tl = NULL;
266        guint8 digest[16];
267        aim_snacid_t snacid;
268
269        if (!ci || !sn || !password)
270                return -EINVAL;
271
272        /*
273         * What the XORLOGIN flag _really_ means is that its an ICQ login,
274         * which is really stupid and painful, so its not done here.
275         *
276         */
277        if (sess->flags & AIM_SESS_FLAGS_XORLOGIN)
278                return goddamnicq2(sess, conn, sn, password);
279
280
281        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 1152)))
282                return -ENOMEM;
283
284        snacid = aim_cachesnac(sess, 0x0017, 0x0002, 0x0000, NULL, 0);
285        aim_putsnac(&fr->data, 0x0017, 0x0002, 0x0000, snacid);
286
287        aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), (guint8 *)sn);
288
289        aim_encode_password_md5(password, key, digest);
290        aim_addtlvtochain_raw(&tl, 0x0025, 16, digest);
291
292        /*
293         * Newer versions of winaim have an empty type x004c TLV here.
294         */
295
296        if (ci->clientstring)
297                aim_addtlvtochain_raw(&tl, 0x0003, strlen(ci->clientstring), (guint8 *)ci->clientstring);
298        aim_addtlvtochain16(&tl, 0x0016, (guint16)ci->clientid);
299        aim_addtlvtochain16(&tl, 0x0017, (guint16)ci->major);
300        aim_addtlvtochain16(&tl, 0x0018, (guint16)ci->minor);
301        aim_addtlvtochain16(&tl, 0x0019, (guint16)ci->point);
302        aim_addtlvtochain16(&tl, 0x001a, (guint16)ci->build);
303        aim_addtlvtochain_raw(&tl, 0x000e, strlen(ci->country), (guint8 *)ci->country);
304        aim_addtlvtochain_raw(&tl, 0x000f, strlen(ci->lang), (guint8 *)ci->lang);
305
306        /*
307         * If set, old-fashioned buddy lists will not work. You will need
308         * to use SSI.
309         */
310        aim_addtlvtochain8(&tl, 0x004a, 0x01);
311
312        aim_writetlvchain(&fr->data, &tl);
313
314        aim_freetlvchain(&tl);
315       
316        aim_tx_enqueue(sess, fr);
317
318        return 0;
319}
320
321int aim_encode_password_md5(const char *password, const char *key, guint8 *digest)
322{
323        md5_state_t state;
324
325        md5_init(&state);       
326        md5_append(&state, (const md5_byte_t *)key, strlen(key));
327        md5_append(&state, (const md5_byte_t *)password, strlen(password));
328        md5_append(&state, (const md5_byte_t *)AIM_MD5_STRING, strlen(AIM_MD5_STRING));
329        md5_finish(&state, (md5_byte_t *)digest);
330
331        return 0;
332}
333
334/**
335 * aim_encode_password - Encode a password using old XOR method
336 * @password: incoming password
337 * @encoded: buffer to put encoded password
338 *
339 * This takes a const pointer to a (null terminated) string
340 * containing the unencoded password.  It also gets passed
341 * an already allocated buffer to store the encoded password.
342 * This buffer should be the exact length of the password without
343 * the null.  The encoded password buffer /is not %NULL terminated/.
344 *
345 * The encoding_table seems to be a fixed set of values.  We'll
346 * hope it doesn't change over time! 
347 *
348 * This is only used for the XOR method, not the better MD5 method.
349 *
350 */
351static int aim_encode_password(const char *password, guint8 *encoded)
352{
353        guint8 encoding_table[] = {
354#if 0 /* old v1 table */
355                0xf3, 0xb3, 0x6c, 0x99,
356                0x95, 0x3f, 0xac, 0xb6,
357                0xc5, 0xfa, 0x6b, 0x63,
358                0x69, 0x6c, 0xc3, 0x9f
359#else /* v2.1 table, also works for ICQ */
360                0xf3, 0x26, 0x81, 0xc4,
361                0x39, 0x86, 0xdb, 0x92,
362                0x71, 0xa3, 0xb9, 0xe6,
363                0x53, 0x7a, 0x95, 0x7c
364#endif
365        };
366        int i;
367
368        for (i = 0; i < strlen(password); i++)
369                encoded[i] = (password[i] ^ encoding_table[i]);
370
371        return 0;
372}
373
374/*
375 * This is sent back as a general response to the login command.
376 * It can be either an error or a success, depending on the
377 * precense of certain TLVs. 
378 *
379 * The client should check the value passed as errorcode. If
380 * its nonzero, there was an error.
381 *
382 */
383static int parse(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
384{
385        aim_tlvlist_t *tlvlist;
386        aim_rxcallback_t userfunc;
387        struct aim_authresp_info info;
388        int ret = 0;
389
390        memset(&info, 0, sizeof(info));
391
392        /*
393         * Read block of TLVs.  All further data is derived
394         * from what is parsed here.
395         */
396        tlvlist = aim_readtlvchain(bs);
397
398        /*
399         * No matter what, we should have a screen name.
400         */
401        memset(sess->sn, 0, sizeof(sess->sn));
402        if (aim_gettlv(tlvlist, 0x0001, 1)) {
403                info.sn = aim_gettlv_str(tlvlist, 0x0001, 1);
404                strncpy(sess->sn, info.sn, sizeof(sess->sn));
405        }
406
407        /*
408         * Check for an error code.  If so, we should also
409         * have an error url.
410         */
411        if (aim_gettlv(tlvlist, 0x0008, 1)) 
412                info.errorcode = aim_gettlv16(tlvlist, 0x0008, 1);
413        if (aim_gettlv(tlvlist, 0x0004, 1))
414                info.errorurl = aim_gettlv_str(tlvlist, 0x0004, 1);
415
416        /*
417         * BOS server address.
418         */
419        if (aim_gettlv(tlvlist, 0x0005, 1))
420                info.bosip = aim_gettlv_str(tlvlist, 0x0005, 1);
421
422        /*
423         * Authorization cookie.
424         */
425        if (aim_gettlv(tlvlist, 0x0006, 1)) {
426                aim_tlv_t *tmptlv;
427
428                tmptlv = aim_gettlv(tlvlist, 0x0006, 1);
429
430                info.cookie = tmptlv->value;
431        }
432
433        /*
434         * The email address attached to this account
435         *   Not available for ICQ logins.
436         */
437        if (aim_gettlv(tlvlist, 0x0011, 1))
438                info.email = aim_gettlv_str(tlvlist, 0x0011, 1);
439
440        /*
441         * The registration status.  (Not real sure what it means.)
442         *   Not available for ICQ logins.
443         *
444         *   1 = No disclosure
445         *   2 = Limited disclosure
446         *   3 = Full disclosure
447         *
448         * This has to do with whether your email address is available
449         * to other users or not.  AFAIK, this feature is no longer used.
450         *
451         */
452        if (aim_gettlv(tlvlist, 0x0013, 1))
453                info.regstatus = aim_gettlv16(tlvlist, 0x0013, 1);
454
455        if (aim_gettlv(tlvlist, 0x0040, 1))
456                info.latestbeta.build = aim_gettlv32(tlvlist, 0x0040, 1);
457        if (aim_gettlv(tlvlist, 0x0041, 1))
458                info.latestbeta.url = aim_gettlv_str(tlvlist, 0x0041, 1);
459        if (aim_gettlv(tlvlist, 0x0042, 1))
460                info.latestbeta.info = aim_gettlv_str(tlvlist, 0x0042, 1);
461        if (aim_gettlv(tlvlist, 0x0043, 1))
462                info.latestbeta.name = aim_gettlv_str(tlvlist, 0x0043, 1);
463        if (aim_gettlv(tlvlist, 0x0048, 1))
464                ; /* no idea what this is */
465
466        if (aim_gettlv(tlvlist, 0x0044, 1))
467                info.latestrelease.build = aim_gettlv32(tlvlist, 0x0044, 1);
468        if (aim_gettlv(tlvlist, 0x0045, 1))
469                info.latestrelease.url = aim_gettlv_str(tlvlist, 0x0045, 1);
470        if (aim_gettlv(tlvlist, 0x0046, 1))
471                info.latestrelease.info = aim_gettlv_str(tlvlist, 0x0046, 1);
472        if (aim_gettlv(tlvlist, 0x0047, 1))
473                info.latestrelease.name = aim_gettlv_str(tlvlist, 0x0047, 1);
474        if (aim_gettlv(tlvlist, 0x0049, 1))
475                ; /* no idea what this is */
476
477
478        if ((userfunc = aim_callhandler(sess, rx->conn, snac ? snac->family : 0x0017, snac ? snac->subtype : 0x0003)))
479                ret = userfunc(sess, rx, &info);
480
481        g_free(info.sn);
482        g_free(info.bosip);
483        g_free(info.errorurl);
484        g_free(info.email);
485        g_free(info.latestrelease.name);
486        g_free(info.latestrelease.url);
487        g_free(info.latestrelease.info);
488        g_free(info.latestbeta.name);
489        g_free(info.latestbeta.url);
490        g_free(info.latestbeta.info);
491
492        aim_freetlvchain(&tlvlist);
493
494        return ret;
495}
496
497/*
498 * Middle handler for 0017/0007 SNACs.  Contains the auth key prefixed
499 * by only its length in a two byte word.
500 *
501 * Calls the client, which should then use the value to call aim_send_login.
502 *
503 */
504static int keyparse(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
505{
506        int keylen, ret = 1;
507        aim_rxcallback_t userfunc;
508        char *keystr;
509
510        keylen = aimbs_get16(bs);
511        keystr = aimbs_getstr(bs, keylen);
512
513        if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
514                ret = userfunc(sess, rx, keystr);
515
516        g_free(keystr); 
517
518        return ret;
519}
520
521static int snachandler(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
522{
523
524        if (snac->subtype == 0x0003)
525                return parse(sess, mod, rx, snac, bs);
526        else if (snac->subtype == 0x0007)
527                return keyparse(sess, mod, rx, snac, bs);
528
529        return 0;
530}
531
532int auth_modfirst(aim_session_t *sess, aim_module_t *mod)
533{
534
535        mod->family = 0x0017;
536        mod->version = 0x0000;
537        mod->flags = 0;
538        strncpy(mod->name, "auth", sizeof(mod->name));
539        mod->snachandler = snachandler;
540
541        return 0;
542}
543
Note: See TracBrowser for help on using the repository browser.