source: protocols/oscar/auth.c @ ce70e88

Last change on this file since ce70e88 was 5ebff60, checked in by dequis <dx@…>, at 2015-02-20T22:50:54Z

Reindent everything to K&R style with tabs

Used uncrustify, with the configuration file in ./doc/uncrustify.cfg

Commit author set to "Indent <please@…>" so that it's easier to
skip while doing git blame.

  • Property mode set to 100644
File size: 15.1 KB
Line 
1/*
2 * Deals with the authorizer (group 0x0017=23, and old-style non-SNAC login).
3 *
4 */
5
6#include <aim.h>
7
8#include "md5.h"
9
10static int aim_encode_password(const char *password, unsigned char *encoded);
11
12/*
13 * This just pushes the passed cookie onto the passed connection, without
14 * the SNAC header or any of that.
15 *
16 * Very commonly used, as every connection except auth will require this to
17 * be the first thing you send.
18 *
19 */
20int aim_sendcookie(aim_session_t *sess, aim_conn_t *conn, const guint8 *chipsahoy)
21{
22        aim_frame_t *fr;
23        aim_tlvlist_t *tl = NULL;
24
25        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x0001, 4 + 2 + 2 + AIM_COOKIELEN))) {
26                return -ENOMEM;
27        }
28
29        aimbs_put32(&fr->data, 0x00000001);
30        aim_addtlvtochain_raw(&tl, 0x0006, AIM_COOKIELEN, chipsahoy);
31        aim_writetlvchain(&fr->data, &tl);
32        aim_freetlvchain(&tl);
33
34        aim_tx_enqueue(sess, fr);
35
36        return 0;
37}
38
39/*
40 * Normally the FLAP version is sent as the first few bytes of the cookie,
41 * meaning you generally never call this.
42 *
43 * But there are times when something might want it seperate. Specifically,
44 * libfaim sends this internally when doing SNAC login.
45 *
46 */
47int aim_sendflapver(aim_session_t *sess, aim_conn_t *conn)
48{
49        aim_frame_t *fr;
50
51        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 4))) {
52                return -ENOMEM;
53        }
54
55        aimbs_put32(&fr->data, 0x00000001);
56
57        aim_tx_enqueue(sess, fr);
58
59        return 0;
60}
61
62/*
63 * This is a bit confusing.
64 *
65 * Normal SNAC login goes like this:
66 *   - connect
67 *   - server sends flap version
68 *   - client sends flap version
69 *   - client sends screen name (17/6)
70 *   - server sends hash key (17/7)
71 *   - client sends auth request (17/2 -- aim_send_login)
72 *   - server yells
73 *
74 * XOR login (for ICQ) goes like this:
75 *   - connect
76 *   - server sends flap version
77 *   - client sends auth request which contains flap version (aim_send_login)
78 *   - server yells
79 *
80 * For the client API, we make them implement the most complicated version,
81 * and for the simpler version, we fake it and make it look like the more
82 * complicated process.
83 *
84 * This is done by giving the client a faked key, just so we can convince
85 * them to call aim_send_login right away, which will detect the session
86 * flag that says this is XOR login and ignore the key, sending an ICQ
87 * login request instead of the normal SNAC one.
88 *
89 * As soon as AOL makes ICQ log in the same way as AIM, this is /gone/.
90 *
91 * XXX This may cause problems if the client relies on callbacks only
92 * being called from the context of aim_rxdispatch()...
93 *
94 */
95static int goddamnicq(aim_session_t *sess, aim_conn_t *conn, const char *sn)
96{
97        aim_frame_t fr;
98        aim_rxcallback_t userfunc;
99
100        sess->flags &= ~AIM_SESS_FLAGS_SNACLOGIN;
101        sess->flags |= AIM_SESS_FLAGS_XORLOGIN;
102
103        fr.conn = conn;
104
105        if ((userfunc = aim_callhandler(sess, conn, 0x0017, 0x0007))) {
106                userfunc(sess, &fr, "");
107        }
108
109        return 0;
110}
111
112/*
113 * In AIM 3.5 protocol, the first stage of login is to request login from the
114 * Authorizer, passing it the screen name for verification.  If the name is
115 * invalid, a 0017/0003 is spit back, with the standard error contents.  If
116 * valid, a 0017/0007 comes back, which is the signal to send it the main
117 * login command (0017/0002).
118 *
119 */
120int aim_request_login(aim_session_t *sess, aim_conn_t *conn, const char *sn)
121{
122        aim_frame_t *fr;
123        aim_snacid_t snacid;
124        aim_tlvlist_t *tl = NULL;
125        struct im_connection *ic = sess->aux_data;
126
127        if (!sess || !conn || !sn) {
128                return -EINVAL;
129        }
130
131        if (g_ascii_isdigit(sn[0]) && set_getbool(&ic->acc->set, "old_icq_auth")) {
132                return goddamnicq(sess, conn, sn);
133        }
134
135        sess->flags |= AIM_SESS_FLAGS_SNACLOGIN;
136
137        aim_sendflapver(sess, conn);
138
139        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 10 + 2 + 2 + strlen(sn)))) {
140                return -ENOMEM;
141        }
142
143        snacid = aim_cachesnac(sess, 0x0017, 0x0006, 0x0000, NULL, 0);
144        aim_putsnac(&fr->data, 0x0017, 0x0006, 0x0000, snacid);
145
146        aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), (guint8 *) sn);
147        aim_writetlvchain(&fr->data, &tl);
148        aim_freetlvchain(&tl);
149
150        aim_tx_enqueue(sess, fr);
151
152        return 0;
153}
154
155/*
156 * Part two of the ICQ hack.  Note the ignoring of the key and clientinfo.
157 */
158static int goddamnicq2(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password)
159{
160        static const char clientstr[] = { "ICQ Inc. - Product of ICQ (TM) 2001b.5.17.1.3642.85" };
161        static const char lang[] = { "en" };
162        static const char country[] = { "us" };
163        aim_frame_t *fr;
164        aim_tlvlist_t *tl = NULL;
165        guint8 *password_encoded;
166
167        if (!(password_encoded = (guint8 *) g_malloc(strlen(password)))) {
168                return -ENOMEM;
169        }
170
171        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 1152))) {
172                g_free(password_encoded);
173                return -ENOMEM;
174        }
175
176        aim_encode_password(password, password_encoded);
177
178        aimbs_put32(&fr->data, 0x00000001);
179        aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), (guint8 *) sn);
180        aim_addtlvtochain_raw(&tl, 0x0002, strlen(password), password_encoded);
181        aim_addtlvtochain_raw(&tl, 0x0003, strlen(clientstr), (guint8 *) clientstr);
182        aim_addtlvtochain16(&tl, 0x0016, 0x010a); /* cliend ID */
183        aim_addtlvtochain16(&tl, 0x0017, 0x0005); /* major version */
184        aim_addtlvtochain16(&tl, 0x0018, 0x0011); /* minor version */
185        aim_addtlvtochain16(&tl, 0x0019, 0x0001); /* point version */
186        aim_addtlvtochain16(&tl, 0x001a, 0x0e3a); /* build */
187        aim_addtlvtochain32(&tl, 0x0014, 0x00000055); /* distribution chan */
188        aim_addtlvtochain_raw(&tl, 0x000f, strlen(lang), (guint8 *) lang);
189        aim_addtlvtochain_raw(&tl, 0x000e, strlen(country), (guint8 *) country);
190
191        aim_writetlvchain(&fr->data, &tl);
192
193        g_free(password_encoded);
194        aim_freetlvchain(&tl);
195
196        aim_tx_enqueue(sess, fr);
197
198        return 0;
199}
200
201/*
202 * send_login(int socket, char *sn, char *password)
203 *
204 * This is the initial login request packet.
205 *
206 * NOTE!! If you want/need to make use of the aim_sendmemblock() function,
207 * then the client information you send here must exactly match the
208 * executable that you're pulling the data from.
209 *
210 * WinAIM 4.8.2540
211 *   clientstring = "AOL Instant Messenger (SM), version 4.8.2540/WIN32"
212 *   clientid = 0x0109
213 *   major = 0x0004
214 *   minor = 0x0008
215 *   point = 0x0000
216 *   build = 0x09ec
217 *   t(0x0014) = 0x000000af
218 *   t(0x004a) = 0x01
219 *
220 * WinAIM 4.3.2188:
221 *   clientstring = "AOL Instant Messenger (SM), version 4.3.2188/WIN32"
222 *   clientid = 0x0109
223 *   major = 0x0400
224 *   minor = 0x0003
225 *   point = 0x0000
226 *   build = 0x088c
227 *   unknown = 0x00000086
228 *   lang = "en"
229 *   country = "us"
230 *   unknown4a = 0x01
231 *
232 * Latest WinAIM that libfaim can emulate without server-side buddylists:
233 *   clientstring = "AOL Instant Messenger (SM), version 4.1.2010/WIN32"
234 *   clientid = 0x0004
235 *   major  = 0x0004
236 *   minor  = 0x0001
237 *   point = 0x0000
238 *   build  = 0x07da
239 *   unknown= 0x0000004b
240 *
241 * WinAIM 3.5.1670:
242 *   clientstring = "AOL Instant Messenger (SM), version 3.5.1670/WIN32"
243 *   clientid = 0x0004
244 *   major =  0x0003
245 *   minor =  0x0005
246 *   point = 0x0000
247 *   build =  0x0686
248 *   unknown =0x0000002a
249 *
250 * Java AIM 1.1.19:
251 *   clientstring = "AOL Instant Messenger (TM) version 1.1.19 for Java built 03/24/98, freeMem 215871 totalMem 1048567, i686, Linus, #2 SMP Sun Feb 11 03:41:17 UTC 2001 2.4.1-ac9, IBM Corporation, 1.1.8, 45.3, Tue Mar 27 12:09:17 PST 2001"
252 *   clientid = 0x0001
253 *   major  = 0x0001
254 *   minor  = 0x0001
255 *   point = (not sent)
256 *   build  = 0x0013
257 *   unknown= (not sent)
258 *
259 * AIM for Linux 1.1.112:
260 *   clientstring = "AOL Instant Messenger (SM)"
261 *   clientid = 0x1d09
262 *   major  = 0x0001
263 *   minor  = 0x0001
264 *   point = 0x0001
265 *   build  = 0x0070
266 *   unknown= 0x0000008b
267 *   serverstore = 0x01
268 *
269 */
270int aim_send_login(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password,
271                   struct client_info_s *ci, const char *key)
272{
273        aim_frame_t *fr;
274        aim_tlvlist_t *tl = NULL;
275        guint8 digest[16];
276        aim_snacid_t snacid;
277
278        if (!ci || !sn || !password) {
279                return -EINVAL;
280        }
281
282        /*
283         * What the XORLOGIN flag _really_ means is that its an ICQ login,
284         * which is really stupid and painful, so its not done here.
285         *
286         */
287        if (sess->flags & AIM_SESS_FLAGS_XORLOGIN) {
288                return goddamnicq2(sess, conn, sn, password);
289        }
290
291
292        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 1152))) {
293                return -ENOMEM;
294        }
295
296        snacid = aim_cachesnac(sess, 0x0017, 0x0002, 0x0000, NULL, 0);
297        aim_putsnac(&fr->data, 0x0017, 0x0002, 0x0000, snacid);
298
299        aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), (guint8 *) sn);
300
301        aim_encode_password_md5(password, key, digest);
302        aim_addtlvtochain_raw(&tl, 0x0025, 16, digest);
303
304        /*
305         * Newer versions of winaim have an empty type x004c TLV here.
306         */
307
308        if (ci->clientstring) {
309                aim_addtlvtochain_raw(&tl, 0x0003, strlen(ci->clientstring), (guint8 *) ci->clientstring);
310        }
311        aim_addtlvtochain16(&tl, 0x0016, (guint16) ci->clientid);
312        aim_addtlvtochain16(&tl, 0x0017, (guint16) ci->major);
313        aim_addtlvtochain16(&tl, 0x0018, (guint16) ci->minor);
314        aim_addtlvtochain16(&tl, 0x0019, (guint16) ci->point);
315        aim_addtlvtochain16(&tl, 0x001a, (guint16) ci->build);
316        aim_addtlvtochain_raw(&tl, 0x000e, strlen(ci->country), (guint8 *) ci->country);
317        aim_addtlvtochain_raw(&tl, 0x000f, strlen(ci->lang), (guint8 *) ci->lang);
318
319        /*
320         * If set, old-fashioned buddy lists will not work. You will need
321         * to use SSI.
322         */
323        aim_addtlvtochain8(&tl, 0x004a, 0x01);
324
325        aim_writetlvchain(&fr->data, &tl);
326
327        aim_freetlvchain(&tl);
328
329        aim_tx_enqueue(sess, fr);
330
331        return 0;
332}
333
334int aim_encode_password_md5(const char *password, const char *key, guint8 *digest)
335{
336        md5_state_t state;
337
338        md5_init(&state);
339        md5_append(&state, (const md5_byte_t *) key, strlen(key));
340        md5_append(&state, (const md5_byte_t *) password, strlen(password));
341        md5_append(&state, (const md5_byte_t *) AIM_MD5_STRING, strlen(AIM_MD5_STRING));
342        md5_finish(&state, (md5_byte_t *) digest);
343
344        return 0;
345}
346
347/**
348 * aim_encode_password - Encode a password using old XOR method
349 * @password: incoming password
350 * @encoded: buffer to put encoded password
351 *
352 * This takes a const pointer to a (null terminated) string
353 * containing the unencoded password.  It also gets passed
354 * an already allocated buffer to store the encoded password.
355 * This buffer should be the exact length of the password without
356 * the null.  The encoded password buffer /is not %NULL terminated/.
357 *
358 * The encoding_table seems to be a fixed set of values.  We'll
359 * hope it doesn't change over time!
360 *
361 * This is only used for the XOR method, not the better MD5 method.
362 *
363 */
364static int aim_encode_password(const char *password, guint8 *encoded)
365{
366        guint8 encoding_table[] = {
367                /* v2.1 table, also works for ICQ */
368                0xf3, 0x26, 0x81, 0xc4,
369                0x39, 0x86, 0xdb, 0x92,
370                0x71, 0xa3, 0xb9, 0xe6,
371                0x53, 0x7a, 0x95, 0x7c
372        };
373        int i;
374
375        for (i = 0; i < strlen(password); i++) {
376                encoded[i] = (password[i] ^ encoding_table[i]);
377        }
378
379        return 0;
380}
381
382/*
383 * This is sent back as a general response to the login command.
384 * It can be either an error or a success, depending on the
385 * precense of certain TLVs.
386 *
387 * The client should check the value passed as errorcode. If
388 * its nonzero, there was an error.
389 *
390 */
391static int parse(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
392{
393        aim_tlvlist_t *tlvlist;
394        aim_rxcallback_t userfunc;
395        struct aim_authresp_info info;
396        int ret = 0;
397
398        memset(&info, 0, sizeof(info));
399
400        /*
401         * Read block of TLVs.  All further data is derived
402         * from what is parsed here.
403         */
404        tlvlist = aim_readtlvchain(bs);
405
406        /*
407         * No matter what, we should have a screen name.
408         */
409        memset(sess->sn, 0, sizeof(sess->sn));
410        if (aim_gettlv(tlvlist, 0x0001, 1)) {
411                info.sn = aim_gettlv_str(tlvlist, 0x0001, 1);
412                strncpy(sess->sn, info.sn, sizeof(sess->sn));
413        }
414
415        /*
416         * Check for an error code.  If so, we should also
417         * have an error url.
418         */
419        if (aim_gettlv(tlvlist, 0x0008, 1)) {
420                info.errorcode = aim_gettlv16(tlvlist, 0x0008, 1);
421        }
422        if (aim_gettlv(tlvlist, 0x0004, 1)) {
423                info.errorurl = aim_gettlv_str(tlvlist, 0x0004, 1);
424        }
425
426        /*
427         * BOS server address.
428         */
429        if (aim_gettlv(tlvlist, 0x0005, 1)) {
430                info.bosip = aim_gettlv_str(tlvlist, 0x0005, 1);
431        }
432
433        /*
434         * Authorization cookie.
435         */
436        if (aim_gettlv(tlvlist, 0x0006, 1)) {
437                aim_tlv_t *tmptlv;
438
439                tmptlv = aim_gettlv(tlvlist, 0x0006, 1);
440
441                info.cookie = tmptlv->value;
442        }
443
444        /*
445         * The email address attached to this account
446         *   Not available for ICQ logins.
447         */
448        if (aim_gettlv(tlvlist, 0x0011, 1)) {
449                info.email = aim_gettlv_str(tlvlist, 0x0011, 1);
450        }
451
452        /*
453         * The registration status.  (Not real sure what it means.)
454         *   Not available for ICQ logins.
455         *
456         *   1 = No disclosure
457         *   2 = Limited disclosure
458         *   3 = Full disclosure
459         *
460         * This has to do with whether your email address is available
461         * to other users or not.  AFAIK, this feature is no longer used.
462         *
463         */
464        if (aim_gettlv(tlvlist, 0x0013, 1)) {
465                info.regstatus = aim_gettlv16(tlvlist, 0x0013, 1);
466        }
467
468        if (aim_gettlv(tlvlist, 0x0040, 1)) {
469                info.latestbeta.build = aim_gettlv32(tlvlist, 0x0040, 1);
470        }
471        if (aim_gettlv(tlvlist, 0x0041, 1)) {
472                info.latestbeta.url = aim_gettlv_str(tlvlist, 0x0041, 1);
473        }
474        if (aim_gettlv(tlvlist, 0x0042, 1)) {
475                info.latestbeta.info = aim_gettlv_str(tlvlist, 0x0042, 1);
476        }
477        if (aim_gettlv(tlvlist, 0x0043, 1)) {
478                info.latestbeta.name = aim_gettlv_str(tlvlist, 0x0043, 1);
479        }
480        if (aim_gettlv(tlvlist, 0x0048, 1)) {
481                ; /* no idea what this is */
482
483        }
484        if (aim_gettlv(tlvlist, 0x0044, 1)) {
485                info.latestrelease.build = aim_gettlv32(tlvlist, 0x0044, 1);
486        }
487        if (aim_gettlv(tlvlist, 0x0045, 1)) {
488                info.latestrelease.url = aim_gettlv_str(tlvlist, 0x0045, 1);
489        }
490        if (aim_gettlv(tlvlist, 0x0046, 1)) {
491                info.latestrelease.info = aim_gettlv_str(tlvlist, 0x0046, 1);
492        }
493        if (aim_gettlv(tlvlist, 0x0047, 1)) {
494                info.latestrelease.name = aim_gettlv_str(tlvlist, 0x0047, 1);
495        }
496        if (aim_gettlv(tlvlist, 0x0049, 1)) {
497                ; /* no idea what this is */
498
499
500        }
501        if ((userfunc = aim_callhandler(sess, rx->conn, snac ? snac->family : 0x0017, snac ? snac->subtype : 0x0003))) {
502                ret = userfunc(sess, rx, &info);
503        }
504
505        g_free(info.sn);
506        g_free(info.bosip);
507        g_free(info.errorurl);
508        g_free(info.email);
509        g_free(info.latestrelease.name);
510        g_free(info.latestrelease.url);
511        g_free(info.latestrelease.info);
512        g_free(info.latestbeta.name);
513        g_free(info.latestbeta.url);
514        g_free(info.latestbeta.info);
515
516        aim_freetlvchain(&tlvlist);
517
518        return ret;
519}
520
521/*
522 * Middle handler for 0017/0007 SNACs.  Contains the auth key prefixed
523 * by only its length in a two byte word.
524 *
525 * Calls the client, which should then use the value to call aim_send_login.
526 *
527 */
528static int keyparse(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
529{
530        int keylen, ret = 1;
531        aim_rxcallback_t userfunc;
532        char *keystr;
533
534        keylen = aimbs_get16(bs);
535        keystr = aimbs_getstr(bs, keylen);
536
537        if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) {
538                ret = userfunc(sess, rx, keystr);
539        }
540
541        g_free(keystr);
542
543        return ret;
544}
545
546static int snachandler(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
547{
548
549        if (snac->subtype == 0x0003) {
550                return parse(sess, mod, rx, snac, bs);
551        } else if (snac->subtype == 0x0007) {
552                return keyparse(sess, mod, rx, snac, bs);
553        }
554
555        return 0;
556}
557
558int auth_modfirst(aim_session_t *sess, aim_module_t *mod)
559{
560
561        mod->family = 0x0017;
562        mod->version = 0x0000;
563        mod->flags = 0;
564        strncpy(mod->name, "auth", sizeof(mod->name));
565        mod->snachandler = snachandler;
566
567        return 0;
568}
569
Note: See TracBrowser for help on using the repository browser.