source: libfaim/auth.c @ ae4cd12

barnowl_perlaimdebianowlrelease-1.10release-1.4release-1.5release-1.6release-1.7release-1.8release-1.9
Last change on this file since ae4cd12 was 5e53c4a, checked in by James M. Kretchmar <kretch@mit.edu>, 21 years ago
*** empty log message ***
  • Property mode set to 100644
File size: 14.9 KB
Line 
1/*
2 * Deals with the authorizer (group 0x0017=23, and old-style non-SNAC login).
3 *
4 */
5
6#define FAIM_INTERNAL
7#include <aim.h>
8
9#include "md5.h"
10
11static int aim_encode_password(const char *password, unsigned char *encoded);
12
13/*
14 * This just pushes the passed cookie onto the passed connection, without
15 * the SNAC header or any of that.
16 *
17 * Very commonly used, as every connection except auth will require this to
18 * be the first thing you send.
19 *
20 */
21faim_export int aim_sendcookie(aim_session_t *sess, aim_conn_t *conn, const fu8_t *chipsahoy)
22{
23        aim_frame_t *fr;
24        aim_tlvlist_t *tl = NULL;
25
26        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x0001, 4+2+2+AIM_COOKIELEN)))
27                return -ENOMEM;
28
29        aimbs_put32(&fr->data, 0x00000001);
30        aim_addtlvtochain_raw(&tl, 0x0006, AIM_COOKIELEN, chipsahoy);   
31        aim_writetlvchain(&fr->data, &tl);
32        aim_freetlvchain(&tl);
33
34        aim_tx_enqueue(sess, fr);
35
36        return 0;
37}
38
39/*
40 * Normally the FLAP version is sent as the first few bytes of the cookie,
41 * meaning you generally never call this.
42 *
43 * But there are times when something might want it seperate. Specifically,
44 * libfaim sends this internally when doing SNAC login.
45 *
46 */
47faim_export int aim_sendflapver(aim_session_t *sess, aim_conn_t *conn)
48{
49        aim_frame_t *fr;
50
51        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 4)))
52                return -ENOMEM;
53
54        aimbs_put32(&fr->data, 0x00000001);
55
56        aim_tx_enqueue(sess, fr);
57
58        return 0;
59}
60
61/*
62 * This is a bit confusing.
63 *
64 * Normal SNAC login goes like this:
65 *   - connect
66 *   - server sends flap version
67 *   - client sends flap version
68 *   - client sends screen name (17/6)
69 *   - server sends hash key (17/7)
70 *   - client sends auth request (17/2 -- aim_send_login)
71 *   - server yells
72 *
73 * XOR login (for ICQ) goes like this:
74 *   - connect
75 *   - server sends flap version
76 *   - client sends auth request which contains flap version (aim_send_login)
77 *   - server yells
78 *
79 * For the client API, we make them implement the most complicated version,
80 * and for the simpler version, we fake it and make it look like the more
81 * complicated process.
82 *
83 * This is done by giving the client a faked key, just so we can convince
84 * them to call aim_send_login right away, which will detect the session
85 * flag that says this is XOR login and ignore the key, sending an ICQ
86 * login request instead of the normal SNAC one.
87 *
88 * As soon as AOL makes ICQ log in the same way as AIM, this is /gone/.
89 *
90 * XXX This may cause problems if the client relies on callbacks only
91 * being called from the context of aim_rxdispatch()...
92 *
93 */
94static int goddamnicq(aim_session_t *sess, aim_conn_t *conn, const char *sn)
95{
96        aim_frame_t fr;
97        aim_rxcallback_t userfunc;
98       
99        sess->flags &= ~AIM_SESS_FLAGS_SNACLOGIN;
100        sess->flags |= AIM_SESS_FLAGS_XORLOGIN;
101
102        fr.conn = conn;
103       
104        if ((userfunc = aim_callhandler(sess, conn, 0x0017, 0x0007)))
105                userfunc(sess, &fr, "");
106
107        return 0;
108}
109
110/*
111 * In AIM 3.5 protocol, the first stage of login is to request login from the
112 * Authorizer, passing it the screen name for verification.  If the name is
113 * invalid, a 0017/0003 is spit back, with the standard error contents.  If
114 * valid, a 0017/0007 comes back, which is the signal to send it the main
115 * login command (0017/0002).
116 *
117 */
118faim_export int aim_request_login(aim_session_t *sess, aim_conn_t *conn, const char *sn)
119{
120        aim_frame_t *fr;
121        aim_snacid_t snacid;
122        aim_tlvlist_t *tl = NULL;
123       
124        if (!sess || !conn || !sn)
125                return -EINVAL;
126
127        if ((sn[0] >= '0') && (sn[0] <= '9'))
128                return goddamnicq(sess, conn, sn);
129
130        sess->flags |= AIM_SESS_FLAGS_SNACLOGIN;
131
132        aim_sendflapver(sess, conn);
133
134        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 10+2+2+strlen(sn))))
135                return -ENOMEM;
136
137        snacid = aim_cachesnac(sess, 0x0017, 0x0006, 0x0000, NULL, 0);
138        aim_putsnac(&fr->data, 0x0017, 0x0006, 0x0000, snacid);
139
140        aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), sn);
141        aim_writetlvchain(&fr->data, &tl);
142        aim_freetlvchain(&tl);
143
144        aim_tx_enqueue(sess, fr);
145
146        return 0;
147}
148
149/*
150 * Part two of the ICQ hack.  Note the ignoring of the key and clientinfo.
151 */
152static int goddamnicq2(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password)
153{
154        static const char clientstr[] = {"ICQ Inc. - Product of ICQ (TM) 2000b.4.65.1.3281.85"};
155        static const char lang[] = {"en"};
156        static const char country[] = {"us"};
157        aim_frame_t *fr;
158        aim_tlvlist_t *tl = NULL;
159        char *password_encoded;
160
161        if (!(password_encoded = (char *) malloc(strlen(password))))
162                return -ENOMEM;
163
164        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 1152))) {
165                free(password_encoded);
166                return -ENOMEM;
167        }
168
169        aim_encode_password(password, password_encoded);
170
171        aimbs_put32(&fr->data, 0x00000001);
172        aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), sn);
173        aim_addtlvtochain_raw(&tl, 0x0002, strlen(password), password_encoded);
174        aim_addtlvtochain_raw(&tl, 0x0003, strlen(clientstr), clientstr);
175        aim_addtlvtochain16(&tl, 0x0016, 0x010a); /* cliend ID */
176        aim_addtlvtochain16(&tl, 0x0017, 0x0004); /* major version */
177        aim_addtlvtochain16(&tl, 0x0018, 0x0041); /* minor version */
178        aim_addtlvtochain16(&tl, 0x0019, 0x0001); /* point version */
179        aim_addtlvtochain16(&tl, 0x001a, 0x0cd1); /* build */
180        aim_addtlvtochain32(&tl, 0x0014, 0x00000055); /* distribution chan */
181        aim_addtlvtochain_raw(&tl, 0x000f, strlen(lang), lang);
182        aim_addtlvtochain_raw(&tl, 0x000e, strlen(country), country);
183
184        aim_writetlvchain(&fr->data, &tl);
185
186        free(password_encoded);
187        aim_freetlvchain(&tl);
188
189        aim_tx_enqueue(sess, fr);
190
191        return 0;
192}
193
194/*
195 * send_login(int socket, char *sn, char *password)
196 * 
197 * This is the initial login request packet.
198 *
199 * NOTE!! If you want/need to make use of the aim_sendmemblock() function,
200 * then the client information you send here must exactly match the
201 * executable that you're pulling the data from.
202 *
203 * WinAIM 4.8.2540
204 *   clientstring = "AOL Instant Messenger (SM), version 4.8.2540/WIN32"
205 *   clientid = 0x0109
206 *   major = 0x0004
207 *   minor = 0x0008
208 *   point = 0x0000
209 *   build = 0x09ec
210 *   t(0x0014) = 0x000000af
211 *   t(0x004a) = 0x01
212 *
213 * WinAIM 4.3.2188:
214 *   clientstring = "AOL Instant Messenger (SM), version 4.3.2188/WIN32"
215 *   clientid = 0x0109
216 *   major = 0x0400
217 *   minor = 0x0003
218 *   point = 0x0000
219 *   build = 0x088c
220 *   unknown = 0x00000086
221 *   lang = "en"
222 *   country = "us"
223 *   unknown4a = 0x01
224 *
225 * Latest WinAIM that libfaim can emulate without server-side buddylists:
226 *   clientstring = "AOL Instant Messenger (SM), version 4.1.2010/WIN32"
227 *   clientid = 0x0004
228 *   major  = 0x0004
229 *   minor  = 0x0001
230 *   point = 0x0000
231 *   build  = 0x07da
232 *   unknown= 0x0000004b
233 *
234 * WinAIM 3.5.1670:
235 *   clientstring = "AOL Instant Messenger (SM), version 3.5.1670/WIN32"
236 *   clientid = 0x0004
237 *   major =  0x0003
238 *   minor =  0x0005
239 *   point = 0x0000
240 *   build =  0x0686
241 *   unknown =0x0000002a
242 *
243 * Java AIM 1.1.19:
244 *   clientstring = "AOL Instant Messenger (TM) version 1.1.19 for Java built 03/24/98, freeMem 215871 totalMem 1048567, i686, Linus, #2 SMP Sun Feb 11 03:41:17 UTC 2001 2.4.1-ac9, IBM Corporation, 1.1.8, 45.3, Tue Mar 27 12:09:17 PST 2001"
245 *   clientid = 0x0001
246 *   major  = 0x0001
247 *   minor  = 0x0001
248 *   point = (not sent)
249 *   build  = 0x0013
250 *   unknown= (not sent)
251 *   
252 * AIM for Linux 1.1.112:
253 *   clientstring = "AOL Instant Messenger (SM)"
254 *   clientid = 0x1d09
255 *   major  = 0x0001
256 *   minor  = 0x0001
257 *   point = 0x0001
258 *   build  = 0x0070
259 *   unknown= 0x0000008b
260 *   serverstore = 0x01
261 *
262 */
263faim_export int aim_send_login(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password, struct client_info_s *ci, const char *key)
264{
265        aim_frame_t *fr;
266        aim_tlvlist_t *tl = NULL;
267        fu8_t digest[16];
268        aim_snacid_t snacid;
269
270        if (!ci || !sn || !password)
271                return -EINVAL;
272
273        /*
274         * What the XORLOGIN flag _really_ means is that its an ICQ login,
275         * which is really stupid and painful, so its not done here.
276         *
277         */
278        if (sess->flags & AIM_SESS_FLAGS_XORLOGIN)
279                return goddamnicq2(sess, conn, sn, password);
280
281
282        if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 1152)))
283                return -ENOMEM;
284
285        snacid = aim_cachesnac(sess, 0x0017, 0x0002, 0x0000, NULL, 0);
286        aim_putsnac(&fr->data, 0x0017, 0x0002, 0x0000, snacid);
287
288        aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), sn);
289
290        aim_encode_password_md5(password, key, digest);
291        aim_addtlvtochain_raw(&tl, 0x0025, 16, digest);
292
293        if (ci->clientstring)
294                aim_addtlvtochain_raw(&tl, 0x0003, strlen(ci->clientstring), ci->clientstring);
295        aim_addtlvtochain16(&tl, 0x0016, (fu16_t)ci->clientid);
296        aim_addtlvtochain16(&tl, 0x0017, (fu16_t)ci->major);
297        aim_addtlvtochain16(&tl, 0x0018, (fu16_t)ci->minor);
298        aim_addtlvtochain16(&tl, 0x0019, (fu16_t)ci->point);
299        aim_addtlvtochain16(&tl, 0x001a, (fu16_t)ci->build);
300        aim_addtlvtochain_raw(&tl, 0x000e, strlen(ci->country), ci->country);
301        aim_addtlvtochain_raw(&tl, 0x000f, strlen(ci->lang), ci->lang);
302
303        /*
304         * If set, old-fashioned buddy lists will not work. You will need
305         * to use SSI.
306         */
307        if (0)
308                aim_addtlvtochain8(&tl, 0x004a, 0x01);
309
310        aim_writetlvchain(&fr->data, &tl);
311
312        aim_freetlvchain(&tl);
313       
314        aim_tx_enqueue(sess, fr);
315
316        return 0;
317}
318
319faim_export int aim_encode_password_md5(const char *password, const char *key, fu8_t *digest)
320{
321        md5_state_t state;
322
323        md5_init(&state);       
324        md5_append(&state, (const md5_byte_t *)key, strlen(key));
325        md5_append(&state, (const md5_byte_t *)password, strlen(password));
326        md5_append(&state, (const md5_byte_t *)AIM_MD5_STRING, strlen(AIM_MD5_STRING));
327        md5_finish(&state, (md5_byte_t *)digest);
328
329        return 0;
330}
331
332/**
333 * aim_encode_password - Encode a password using old XOR method
334 * @password: incoming password
335 * @encoded: buffer to put encoded password
336 *
337 * This takes a const pointer to a (null terminated) string
338 * containing the unencoded password.  It also gets passed
339 * an already allocated buffer to store the encoded password.
340 * This buffer should be the exact length of the password without
341 * the null.  The encoded password buffer /is not %NULL terminated/.
342 *
343 * The encoding_table seems to be a fixed set of values.  We'll
344 * hope it doesn't change over time! 
345 *
346 * This is only used for the XOR method, not the better MD5 method.
347 *
348 */
349static int aim_encode_password(const char *password, fu8_t *encoded)
350{
351        fu8_t encoding_table[] = {
352#if 0 /* old v1 table */
353                0xf3, 0xb3, 0x6c, 0x99,
354                0x95, 0x3f, 0xac, 0xb6,
355                0xc5, 0xfa, 0x6b, 0x63,
356                0x69, 0x6c, 0xc3, 0x9f
357#else /* v2.1 table, also works for ICQ */
358                0xf3, 0x26, 0x81, 0xc4,
359                0x39, 0x86, 0xdb, 0x92,
360                0x71, 0xa3, 0xb9, 0xe6,
361                0x53, 0x7a, 0x95, 0x7c
362#endif
363        };
364        int i;
365
366        for (i = 0; i < strlen(password); i++)
367                encoded[i] = (password[i] ^ encoding_table[i]);
368
369        return 0;
370}
371
372/*
373 * This is sent back as a general response to the login command.
374 * It can be either an error or a success, depending on the
375 * precense of certain TLVs. 
376 *
377 * The client should check the value passed as errorcode. If
378 * its nonzero, there was an error.
379 *
380 */
381static int parse(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
382{
383        aim_tlvlist_t *tlvlist;
384        aim_rxcallback_t userfunc;
385        struct aim_authresp_info info;
386        int ret = 0;
387
388        memset(&info, 0, sizeof(info));
389
390        /*
391         * Read block of TLVs.  All further data is derived
392         * from what is parsed here.
393         */
394        tlvlist = aim_readtlvchain(bs);
395
396        /*
397         * No matter what, we should have a screen name.
398         */
399        memset(sess->sn, 0, sizeof(sess->sn));
400        if (aim_gettlv(tlvlist, 0x0001, 1)) {
401                info.sn = aim_gettlv_str(tlvlist, 0x0001, 1);
402                strncpy(sess->sn, info.sn, sizeof(sess->sn));
403        }
404
405        /*
406         * Check for an error code.  If so, we should also
407         * have an error url.
408         */
409        if (aim_gettlv(tlvlist, 0x0008, 1)) 
410                info.errorcode = aim_gettlv16(tlvlist, 0x0008, 1);
411        if (aim_gettlv(tlvlist, 0x0004, 1))
412                info.errorurl = aim_gettlv_str(tlvlist, 0x0004, 1);
413
414        /*
415         * BOS server address.
416         */
417        if (aim_gettlv(tlvlist, 0x0005, 1))
418                info.bosip = aim_gettlv_str(tlvlist, 0x0005, 1);
419
420        /*
421         * Authorization cookie.
422         */
423        if (aim_gettlv(tlvlist, 0x0006, 1)) {
424                aim_tlv_t *tmptlv;
425
426                tmptlv = aim_gettlv(tlvlist, 0x0006, 1);
427
428                info.cookie = tmptlv->value;
429        }
430
431        /*
432         * The email address attached to this account
433         *   Not available for ICQ logins.
434         */
435        if (aim_gettlv(tlvlist, 0x0011, 1))
436                info.email = aim_gettlv_str(tlvlist, 0x0011, 1);
437
438        /*
439         * The registration status.  (Not real sure what it means.)
440         *   Not available for ICQ logins.
441         *
442         *   1 = No disclosure
443         *   2 = Limited disclosure
444         *   3 = Full disclosure
445         *
446         * This has to do with whether your email address is available
447         * to other users or not.  AFAIK, this feature is no longer used.
448         *
449         */
450        if (aim_gettlv(tlvlist, 0x0013, 1))
451                info.regstatus = aim_gettlv16(tlvlist, 0x0013, 1);
452
453        if (aim_gettlv(tlvlist, 0x0040, 1))
454                info.latestbeta.build = aim_gettlv32(tlvlist, 0x0040, 1);
455        if (aim_gettlv(tlvlist, 0x0041, 1))
456                info.latestbeta.url = aim_gettlv_str(tlvlist, 0x0041, 1);
457        if (aim_gettlv(tlvlist, 0x0042, 1))
458                info.latestbeta.info = aim_gettlv_str(tlvlist, 0x0042, 1);
459        if (aim_gettlv(tlvlist, 0x0043, 1))
460                info.latestbeta.name = aim_gettlv_str(tlvlist, 0x0043, 1);
461        if (aim_gettlv(tlvlist, 0x0048, 1))
462                ; /* no idea what this is */
463
464        if (aim_gettlv(tlvlist, 0x0044, 1))
465                info.latestrelease.build = aim_gettlv32(tlvlist, 0x0044, 1);
466        if (aim_gettlv(tlvlist, 0x0045, 1))
467                info.latestrelease.url = aim_gettlv_str(tlvlist, 0x0045, 1);
468        if (aim_gettlv(tlvlist, 0x0046, 1))
469                info.latestrelease.info = aim_gettlv_str(tlvlist, 0x0046, 1);
470        if (aim_gettlv(tlvlist, 0x0047, 1))
471                info.latestrelease.name = aim_gettlv_str(tlvlist, 0x0047, 1);
472        if (aim_gettlv(tlvlist, 0x0049, 1))
473                ; /* no idea what this is */
474
475
476        if ((userfunc = aim_callhandler(sess, rx->conn, snac ? snac->family : 0x0017, snac ? snac->subtype : 0x0003)))
477                ret = userfunc(sess, rx, &info);
478
479        free(info.sn);
480        free(info.bosip);
481        free(info.errorurl);
482        free(info.email);
483        free(info.latestrelease.name);
484        free(info.latestrelease.url);
485        free(info.latestrelease.info);
486        free(info.latestbeta.name);
487        free(info.latestbeta.url);
488        free(info.latestbeta.info);
489
490        aim_freetlvchain(&tlvlist);
491
492        return ret;
493}
494
495/*
496 * Middle handler for 0017/0007 SNACs.  Contains the auth key prefixed
497 * by only its length in a two byte word.
498 *
499 * Calls the client, which should then use the value to call aim_send_login.
500 *
501 */
502static int keyparse(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
503{
504        int keylen, ret = 1;
505        aim_rxcallback_t userfunc;
506        char *keystr;
507
508        keylen = aimbs_get16(bs);
509        keystr = aimbs_getstr(bs, keylen);
510
511        if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
512                ret = userfunc(sess, rx, keystr);
513
514        free(keystr); 
515
516        return ret;
517}
518
519static int snachandler(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
520{
521
522        if (snac->subtype == 0x0003)
523                return parse(sess, mod, rx, snac, bs);
524        else if (snac->subtype == 0x0007)
525                return keyparse(sess, mod, rx, snac, bs);
526
527        return 0;
528}
529
530faim_internal int auth_modfirst(aim_session_t *sess, aim_module_t *mod)
531{
532
533        mod->family = 0x0017;
534        mod->version = 0x0000;
535        mod->flags = 0;
536        strncpy(mod->name, "auth", sizeof(mod->name));
537        mod->snachandler = snachandler;
538
539        return 0;
540}
541
Note: See TracBrowser for help on using the repository browser.