]>
Commit | Line | Data |
---|---|---|
9de3ca7e | 1 | /* |
2 | * aim_login.c | |
3 | * | |
4 | * This contains all the functions needed to actually login. | |
5 | * | |
6 | */ | |
7 | ||
37ee990e | 8 | #define FAIM_INTERNAL |
dd60ff8b | 9 | #include <aim.h> |
9de3ca7e | 10 | |
b5bc2a8c | 11 | #include "md5.h" |
12 | ||
5daacaa3 | 13 | static int aim_encode_password(const char *password, unsigned char *encoded); |
9de3ca7e | 14 | |
d410cf58 | 15 | faim_export int aim_sendflapver(aim_session_t *sess, aim_conn_t *conn) |
01b59e1e | 16 | { |
d410cf58 | 17 | aim_frame_t *fr; |
01b59e1e | 18 | |
d410cf58 | 19 | if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 4))) |
355229fe | 20 | return -ENOMEM; |
01b59e1e | 21 | |
d410cf58 | 22 | aimbs_put32(&fr->data, 0x00000001); |
355229fe | 23 | |
d410cf58 | 24 | aim_tx_enqueue(sess, fr); |
355229fe | 25 | |
d410cf58 | 26 | return 0; |
01b59e1e | 27 | } |
28 | ||
3e9e6e14 | 29 | /* |
30 | * This is a bit confusing. | |
31 | * | |
32 | * Normal SNAC login goes like this: | |
33 | * - connect | |
34 | * - server sends flap version | |
35 | * - client sends flap version | |
36 | * - client sends screen name (17/6) | |
37 | * - server sends hash key (17/7) | |
38 | * - client sends auth request (17/2 -- aim_send_login) | |
39 | * - server yells | |
40 | * | |
41 | * XOR login (for ICQ) goes like this: | |
42 | * - connect | |
43 | * - server sends flap version | |
44 | * - client sends auth request which contains flap version (aim_send_login) | |
45 | * - server yells | |
46 | * | |
47 | * For the client API, we make them implement the most complicated version, | |
48 | * and for the simpler version, we fake it and make it look like the more | |
49 | * complicated process. | |
50 | * | |
51 | * This is done by giving the client a faked key, just so we can convince | |
52 | * them to call aim_send_login right away, which will detect the session | |
53 | * flag that says this is XOR login and ignore the key, sending an ICQ | |
54 | * login request instead of the normal SNAC one. | |
55 | * | |
56 | * As soon as AOL makes ICQ log in the same way as AIM, this is /gone/. | |
57 | * | |
58 | * XXX This may cause problems if the client relies on callbacks only | |
59 | * being called from the context of aim_rxdispatch()... | |
60 | * | |
61 | */ | |
62 | static int goddamnicq(aim_session_t *sess, aim_conn_t *conn, const char *sn) | |
63 | { | |
64 | aim_frame_t fr; | |
65 | aim_rxcallback_t userfunc; | |
66 | ||
67 | sess->flags &= ~AIM_SESS_FLAGS_SNACLOGIN; | |
68 | sess->flags |= AIM_SESS_FLAGS_XORLOGIN; | |
69 | ||
70 | fr.conn = conn; | |
71 | ||
72 | if ((userfunc = aim_callhandler(sess, conn, 0x0017, 0x0007))) | |
73 | userfunc(sess, &fr, ""); | |
74 | ||
75 | return 0; | |
76 | } | |
77 | ||
01b59e1e | 78 | /* |
d410cf58 | 79 | * In AIM 3.5 protocol, the first stage of login is to request login from the |
80 | * Authorizer, passing it the screen name for verification. If the name is | |
81 | * invalid, a 0017/0003 is spit back, with the standard error contents. If | |
82 | * valid, a 0017/0007 comes back, which is the signal to send it the main | |
83 | * login command (0017/0002). | |
84 | * | |
85 | * XXX make ICQ logins work again. | |
01b59e1e | 86 | */ |
d410cf58 | 87 | faim_export int aim_request_login(aim_session_t *sess, aim_conn_t *conn, const char *sn) |
01b59e1e | 88 | { |
d410cf58 | 89 | aim_frame_t *fr; |
90 | aim_snacid_t snacid; | |
91 | aim_tlvlist_t *tl = NULL; | |
92 | ||
355229fe | 93 | if (!sess || !conn || !sn) |
94 | return -EINVAL; | |
95 | ||
3e9e6e14 | 96 | if ((sn[0] >= '0') || (sn[0] <= '9')) |
97 | return goddamnicq(sess, conn, sn); | |
98 | ||
355229fe | 99 | sess->flags |= AIM_SESS_FLAGS_SNACLOGIN; |
100 | ||
101 | aim_sendflapver(sess, conn); | |
102 | ||
d410cf58 | 103 | if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 10+2+2+strlen(sn)))) |
355229fe | 104 | return -ENOMEM; |
105 | ||
d410cf58 | 106 | snacid = aim_cachesnac(sess, 0x0017, 0x0006, 0x0000, NULL, 0); |
107 | aim_putsnac(&fr->data, 0x0017, 0x0006, 0x0000, snacid); | |
355229fe | 108 | |
d410cf58 | 109 | aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), sn); |
110 | aim_writetlvchain(&fr->data, &tl); | |
111 | aim_freetlvchain(&tl); | |
355229fe | 112 | |
d410cf58 | 113 | aim_tx_enqueue(sess, fr); |
355229fe | 114 | |
d410cf58 | 115 | return 0; |
01b59e1e | 116 | } |
01b59e1e | 117 | |
3e9e6e14 | 118 | /* |
119 | * Part two of the ICQ hack. Note the ignoring of the key and clientinfo. | |
120 | */ | |
121 | static int goddamnicq2(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password) | |
122 | { | |
123 | static const char clientstr[] = {"ICQ Inc. - Product of ICQ (TM) 2000b.4.65.1.3281.85"}; | |
124 | static const char lang[] = {"en"}; | |
125 | static const char country[] = {"us"}; | |
126 | aim_frame_t *fr; | |
127 | aim_tlvlist_t *tl = NULL; | |
128 | char *password_encoded; | |
129 | ||
130 | if (!(password_encoded = (char *) malloc(strlen(password)))) | |
131 | return -ENOMEM; | |
132 | ||
133 | if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 1152))) { | |
134 | free(password_encoded); | |
135 | return -ENOMEM; | |
136 | } | |
137 | ||
138 | aim_encode_password(password, password_encoded); | |
139 | ||
140 | aimbs_put32(&fr->data, 0x00000001); | |
141 | aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), sn); | |
142 | aim_addtlvtochain_raw(&tl, 0x0002, strlen(password), password_encoded); | |
143 | aim_addtlvtochain_raw(&tl, 0x0003, strlen(clientstr), clientstr); | |
144 | aim_addtlvtochain16(&tl, 0x0016, 0x010a); | |
145 | aim_addtlvtochain16(&tl, 0x0017, 0x0004); | |
146 | aim_addtlvtochain16(&tl, 0x0018, 0x0041); | |
147 | aim_addtlvtochain16(&tl, 0x0019, 0x0001); | |
148 | aim_addtlvtochain16(&tl, 0x001a, 0x0cd1); | |
149 | aim_addtlvtochain32(&tl, 0x0014, 0x00000055); | |
150 | aim_addtlvtochain_raw(&tl, 0x000f, strlen(lang), lang); | |
151 | aim_addtlvtochain_raw(&tl, 0x000e, strlen(country), country); | |
152 | ||
153 | aim_writetlvchain(&fr->data, &tl); | |
154 | ||
155 | free(password_encoded); | |
156 | aim_freetlvchain(&tl); | |
157 | ||
158 | aim_tx_enqueue(sess, fr); | |
159 | ||
160 | return 0; | |
161 | } | |
162 | ||
9de3ca7e | 163 | /* |
24286d93 | 164 | * send_login(int socket, char *sn, char *password) |
9de3ca7e | 165 | * |
166 | * This is the initial login request packet. | |
167 | * | |
b1eac25a | 168 | * NOTE!! If you want/need to make use of the aim_sendmemblock() function, |
169 | * then the client information you send here must exactly match the | |
170 | * executable that you're pulling the data from. | |
9de3ca7e | 171 | * |
355982c5 | 172 | * Latest WinAIM: |
173 | * clientstring = "AOL Instant Messenger (SM), version 4.3.2188/WIN32" | |
174 | * major2 = 0x0109 | |
175 | * major = 0x0400 | |
176 | * minor = 0x0003 | |
177 | * minor2 = 0x0000 | |
178 | * build = 0x088c | |
179 | * unknown = 0x00000086 | |
180 | * lang = "en" | |
181 | * country = "us" | |
182 | * unknown4a = 0x01 | |
154b4093 | 183 | * |
184 | * Latest WinAIM that libfaim can emulate without server-side buddylists: | |
b1eac25a | 185 | * clientstring = "AOL Instant Messenger (SM), version 4.1.2010/WIN32" |
186 | * major2 = 0x0004 | |
187 | * major = 0x0004 | |
188 | * minor = 0x0001 | |
189 | * minor2 = 0x0000 | |
190 | * build = 0x07da | |
191 | * unknown= 0x0000004b | |
192 | * | |
193 | * WinAIM 3.5.1670: | |
154b4093 | 194 | * clientstring = "AOL Instant Messenger (SM), version 3.5.1670/WIN32" |
195 | * major2 = 0x0004 | |
196 | * major = 0x0003 | |
197 | * minor = 0x0005 | |
198 | * minor2 = 0x0000 | |
199 | * build = 0x0686 | |
200 | * unknown =0x0000002a | |
201 | * | |
d32954e7 | 202 | * Java AIM 1.1.19: |
203 | * clientstring = "AOL Instant Messenger (TM) version 1.1.19 for Java built 03/24/98, freeMem 215871 totalMem 1048567, i686, Linus, #2 SMP Sun Feb 11 03:41:17 UTC 2001 2.4.1-ac9, IBM Corporation, 1.1.8, 45.3, Tue Mar 27 12:09:17 PST 2001" | |
204 | * major2 = 0x0001 | |
205 | * major = 0x0001 | |
206 | * minor = 0x0001 | |
207 | * minor2 = (not sent) | |
208 | * build = 0x0013 | |
209 | * unknown= (not sent) | |
210 | * | |
211 | * AIM for Linux 1.1.112: | |
212 | * clientstring = "AOL Instant Messenger (SM)" | |
213 | * major2 = 0x1d09 | |
214 | * major = 0x0001 | |
215 | * minor = 0x0001 | |
216 | * minor2 = 0x0001 | |
217 | * build = 0x0070 | |
218 | * unknown= 0x0000008b | |
219 | * serverstore = 0x01 | |
220 | * | |
9de3ca7e | 221 | */ |
d410cf58 | 222 | faim_export int aim_send_login(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password, struct client_info_s *clientinfo, const char *key) |
9de3ca7e | 223 | { |
d410cf58 | 224 | aim_frame_t *fr; |
225 | aim_tlvlist_t *tl = NULL; | |
3e9e6e14 | 226 | fu8_t digest[16]; |
227 | aim_snacid_t snacid; | |
355229fe | 228 | |
229 | if (!clientinfo || !sn || !password) | |
230 | return -EINVAL; | |
231 | ||
3e9e6e14 | 232 | if (sess->flags & AIM_SESS_FLAGS_XORLOGIN) |
233 | return goddamnicq2(sess, conn, sn, password); | |
234 | ||
d410cf58 | 235 | if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 1152))) |
355229fe | 236 | return -ENOMEM; |
237 | ||
d410cf58 | 238 | if (sess->flags & AIM_SESS_FLAGS_XORLOGIN) { |
239 | fr->hdr.flap.type = 0x01; | |
355229fe | 240 | |
d410cf58 | 241 | /* Use very specific version numbers to further indicate hack */ |
242 | clientinfo->major2 = 0x010a; | |
243 | clientinfo->major = 0x0004; | |
244 | clientinfo->minor = 0x003c; | |
245 | clientinfo->minor2 = 0x0001; | |
246 | clientinfo->build = 0x0cce; | |
247 | clientinfo->unknown = 0x00000055; | |
248 | } | |
355229fe | 249 | |
3e9e6e14 | 250 | snacid = aim_cachesnac(sess, 0x0017, 0x0002, 0x0000, NULL, 0); |
251 | aim_putsnac(&fr->data, 0x0017, 0x0002, 0x0000, snacid); | |
355229fe | 252 | |
d410cf58 | 253 | aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), sn); |
355229fe | 254 | |
3e9e6e14 | 255 | aim_encode_password_md5(password, key, digest); |
256 | aim_addtlvtochain_raw(&tl, 0x0025, 16, digest); | |
355229fe | 257 | |
d410cf58 | 258 | aim_addtlvtochain_raw(&tl, 0x0003, strlen(clientinfo->clientstring), clientinfo->clientstring); |
d410cf58 | 259 | aim_addtlvtochain16(&tl, 0x0016, (fu16_t)clientinfo->major2); |
260 | aim_addtlvtochain16(&tl, 0x0017, (fu16_t)clientinfo->major); | |
261 | aim_addtlvtochain16(&tl, 0x0018, (fu16_t)clientinfo->minor); | |
262 | aim_addtlvtochain16(&tl, 0x0019, (fu16_t)clientinfo->minor2); | |
263 | aim_addtlvtochain16(&tl, 0x001a, (fu16_t)clientinfo->build); | |
d410cf58 | 264 | aim_addtlvtochain_raw(&tl, 0x000e, strlen(clientinfo->country), clientinfo->country); |
265 | aim_addtlvtochain_raw(&tl, 0x000f, strlen(clientinfo->lang), clientinfo->lang); | |
3e9e6e14 | 266 | aim_addtlvtochain16(&tl, 0x0009, 0x0015); |
355229fe | 267 | |
d410cf58 | 268 | aim_writetlvchain(&fr->data, &tl); |
355229fe | 269 | |
d410cf58 | 270 | aim_freetlvchain(&tl); |
271 | ||
272 | aim_tx_enqueue(sess, fr); | |
355229fe | 273 | |
d410cf58 | 274 | return 0; |
9de3ca7e | 275 | } |
9de3ca7e | 276 | |
d410cf58 | 277 | faim_export int aim_encode_password_md5(const char *password, const char *key, fu8_t *digest) |
b5bc2a8c | 278 | { |
355229fe | 279 | md5_state_t state; |
b5bc2a8c | 280 | |
355229fe | 281 | md5_init(&state); |
282 | md5_append(&state, (const md5_byte_t *)key, strlen(key)); | |
283 | md5_append(&state, (const md5_byte_t *)password, strlen(password)); | |
284 | md5_append(&state, (const md5_byte_t *)AIM_MD5_STRING, strlen(AIM_MD5_STRING)); | |
285 | md5_finish(&state, (md5_byte_t *)digest); | |
b5bc2a8c | 286 | |
355229fe | 287 | return 0; |
b5bc2a8c | 288 | } |
289 | ||
5daacaa3 | 290 | /** |
291 | * aim_encode_password - Encode a password using old XOR method | |
292 | * @password: incoming password | |
293 | * @encoded: buffer to put encoded password | |
9de3ca7e | 294 | * |
295 | * This takes a const pointer to a (null terminated) string | |
296 | * containing the unencoded password. It also gets passed | |
297 | * an already allocated buffer to store the encoded password. | |
298 | * This buffer should be the exact length of the password without | |
5daacaa3 | 299 | * the null. The encoded password buffer /is not %NULL terminated/. |
9de3ca7e | 300 | * |
301 | * The encoding_table seems to be a fixed set of values. We'll | |
302 | * hope it doesn't change over time! | |
303 | * | |
5daacaa3 | 304 | * This is only used for the XOR method, not the better MD5 method. |
b5bc2a8c | 305 | * |
9de3ca7e | 306 | */ |
d410cf58 | 307 | static int aim_encode_password(const char *password, fu8_t *encoded) |
9de3ca7e | 308 | { |
d410cf58 | 309 | fu8_t encoding_table[] = { |
b69540e3 | 310 | #if 0 /* old v1 table */ |
355229fe | 311 | 0xf3, 0xb3, 0x6c, 0x99, |
312 | 0x95, 0x3f, 0xac, 0xb6, | |
313 | 0xc5, 0xfa, 0x6b, 0x63, | |
314 | 0x69, 0x6c, 0xc3, 0x9f | |
b69540e3 | 315 | #else /* v2.1 table, also works for ICQ */ |
355229fe | 316 | 0xf3, 0x26, 0x81, 0xc4, |
317 | 0x39, 0x86, 0xdb, 0x92, | |
318 | 0x71, 0xa3, 0xb9, 0xe6, | |
319 | 0x53, 0x7a, 0x95, 0x7c | |
b69540e3 | 320 | #endif |
355229fe | 321 | }; |
322 | int i; | |
5e02cf44 | 323 | |
355229fe | 324 | for (i = 0; i < strlen(password); i++) |
325 | encoded[i] = (password[i] ^ encoding_table[i]); | |
5e02cf44 | 326 | |
355229fe | 327 | return 0; |
5e02cf44 | 328 | } |
329 | ||
e6b05d80 | 330 | /* |
331 | * Generate an authorization response. | |
332 | * | |
d410cf58 | 333 | * You probably don't want this unless you're writing an AIM server. Which |
334 | * I hope you're not doing. Because it's far more difficult than it looks. | |
e6b05d80 | 335 | * |
336 | */ | |
d410cf58 | 337 | faim_export int aim_sendauthresp(aim_session_t *sess, aim_conn_t *conn, const char *sn, int errorcode, const char *errorurl, const char *bosip, const char *cookie, const char *email, int regstatus) |
e6b05d80 | 338 | { |
d410cf58 | 339 | aim_tlvlist_t *tlvlist = NULL; |
340 | aim_frame_t *fr; | |
355229fe | 341 | |
d410cf58 | 342 | if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x04, 1152))) |
355229fe | 343 | return -ENOMEM; |
344 | ||
355229fe | 345 | if (sn) |
d410cf58 | 346 | aim_addtlvtochain_raw(&tlvlist, 0x0001, strlen(sn), sn); |
355229fe | 347 | else |
d410cf58 | 348 | aim_addtlvtochain_raw(&tlvlist, 0x0001, strlen(sess->sn), sess->sn); |
355229fe | 349 | |
350 | if (errorcode) { | |
351 | aim_addtlvtochain16(&tlvlist, 0x0008, errorcode); | |
d410cf58 | 352 | aim_addtlvtochain_raw(&tlvlist, 0x0004, strlen(errorurl), errorurl); |
355229fe | 353 | } else { |
d410cf58 | 354 | aim_addtlvtochain_raw(&tlvlist, 0x0005, strlen(bosip), bosip); |
355 | aim_addtlvtochain_raw(&tlvlist, 0x0006, AIM_COOKIELEN, cookie); | |
356 | aim_addtlvtochain_raw(&tlvlist, 0x0011, strlen(email), email); | |
357 | aim_addtlvtochain16(&tlvlist, 0x0013, (fu16_t)regstatus); | |
355229fe | 358 | } |
359 | ||
d410cf58 | 360 | aim_writetlvchain(&fr->data, &tlvlist); |
361 | aim_freetlvchain(&tlvlist); | |
362 | ||
363 | aim_tx_enqueue(sess, fr); | |
355229fe | 364 | |
d410cf58 | 365 | return 0; |
e6b05d80 | 366 | } |
367 | ||
368 | /* | |
369 | * Generate a random cookie. (Non-client use only) | |
370 | */ | |
d410cf58 | 371 | faim_export int aim_gencookie(fu8_t *buf) |
e6b05d80 | 372 | { |
355229fe | 373 | int i; |
e6b05d80 | 374 | |
355229fe | 375 | srand(time(NULL)); |
e6b05d80 | 376 | |
d410cf58 | 377 | for (i = 0; i < AIM_COOKIELEN; i++) |
355229fe | 378 | buf[i] = 1+(int) (256.0*rand()/(RAND_MAX+0.0)); |
e6b05d80 | 379 | |
355229fe | 380 | return i; |
e6b05d80 | 381 | } |
382 | ||
383 | /* | |
384 | * Send Server Ready. (Non-client) | |
385 | */ | |
d410cf58 | 386 | faim_export int aim_sendserverready(aim_session_t *sess, aim_conn_t *conn) |
e6b05d80 | 387 | { |
d410cf58 | 388 | aim_frame_t *fr; |
389 | aim_snacid_t snacid; | |
355229fe | 390 | |
d410cf58 | 391 | if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 10+0x22))) |
355229fe | 392 | return -ENOMEM; |
393 | ||
d410cf58 | 394 | snacid = aim_cachesnac(sess, 0x0001, 0x0003, 0x0000, NULL, 0); |
355229fe | 395 | |
d410cf58 | 396 | aim_putsnac(&fr->data, 0x0001, 0x0003, 0x0000, snacid); |
397 | aimbs_put16(&fr->data, 0x0001); | |
398 | aimbs_put16(&fr->data, 0x0002); | |
399 | aimbs_put16(&fr->data, 0x0003); | |
400 | aimbs_put16(&fr->data, 0x0004); | |
401 | aimbs_put16(&fr->data, 0x0006); | |
402 | aimbs_put16(&fr->data, 0x0008); | |
403 | aimbs_put16(&fr->data, 0x0009); | |
404 | aimbs_put16(&fr->data, 0x000a); | |
405 | aimbs_put16(&fr->data, 0x000b); | |
406 | aimbs_put16(&fr->data, 0x000c); | |
407 | aimbs_put16(&fr->data, 0x0013); | |
408 | aimbs_put16(&fr->data, 0x0015); | |
355229fe | 409 | |
d410cf58 | 410 | aim_tx_enqueue(sess, fr); |
355229fe | 411 | |
d410cf58 | 412 | return 0; |
e6b05d80 | 413 | } |
414 | ||
415 | ||
416 | /* | |
417 | * Send service redirect. (Non-Client) | |
418 | */ | |
d410cf58 | 419 | faim_export int aim_sendredirect(aim_session_t *sess, aim_conn_t *conn, fu16_t servid, const char *ip, const char *cookie) |
e6b05d80 | 420 | { |
d410cf58 | 421 | aim_tlvlist_t *tlvlist = NULL; |
422 | aim_frame_t *fr; | |
423 | aim_snacid_t snacid; | |
355229fe | 424 | |
d410cf58 | 425 | if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 1152))) |
355229fe | 426 | return -ENOMEM; |
e6b05d80 | 427 | |
d410cf58 | 428 | snacid = aim_cachesnac(sess, 0x0001, 0x0005, 0x0000, NULL, 0); |
429 | aim_putsnac(&fr->data, 0x0001, 0x0005, 0x0000, snacid); | |
e6b05d80 | 430 | |
355229fe | 431 | aim_addtlvtochain16(&tlvlist, 0x000d, servid); |
d410cf58 | 432 | aim_addtlvtochain_raw(&tlvlist, 0x0005, strlen(ip), ip); |
433 | aim_addtlvtochain_raw(&tlvlist, 0x0006, AIM_COOKIELEN, cookie); | |
e6b05d80 | 434 | |
d410cf58 | 435 | aim_writetlvchain(&fr->data, &tlvlist); |
355229fe | 436 | aim_freetlvchain(&tlvlist); |
e6b05d80 | 437 | |
d410cf58 | 438 | aim_tx_enqueue(sess, fr); |
355229fe | 439 | |
d410cf58 | 440 | return 0; |
e6b05d80 | 441 | } |
00ef5271 | 442 | |
443 | ||
d410cf58 | 444 | static int hostonline(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
00ef5271 | 445 | { |
355229fe | 446 | aim_rxcallback_t userfunc; |
447 | int ret = 0; | |
d410cf58 | 448 | fu16_t *families; |
449 | int famcount; | |
00ef5271 | 450 | |
d410cf58 | 451 | if (!(families = malloc(aim_bstream_empty(bs)))) |
355229fe | 452 | return 0; |
00ef5271 | 453 | |
d410cf58 | 454 | for (famcount = 0; aim_bstream_empty(bs); famcount++) |
455 | families[famcount] = aimbs_get16(bs); | |
00ef5271 | 456 | |
355229fe | 457 | if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) |
458 | ret = userfunc(sess, rx, famcount, families); | |
00ef5271 | 459 | |
355229fe | 460 | free(families); |
00ef5271 | 461 | |
d410cf58 | 462 | return ret; |
00ef5271 | 463 | } |
464 | ||
d410cf58 | 465 | static int redirect(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
00ef5271 | 466 | { |
355229fe | 467 | int serviceid; |
d410cf58 | 468 | fu8_t *cookie; |
355229fe | 469 | char *ip; |
470 | aim_rxcallback_t userfunc; | |
d410cf58 | 471 | aim_tlvlist_t *tlvlist; |
355229fe | 472 | char *chathack = NULL; |
473 | int chathackex = 0; | |
474 | int ret = 0; | |
475 | ||
d410cf58 | 476 | tlvlist = aim_readtlvchain(bs); |
355229fe | 477 | |
478 | if (!aim_gettlv(tlvlist, 0x000d, 1) || | |
479 | !aim_gettlv(tlvlist, 0x0005, 1) || | |
480 | !aim_gettlv(tlvlist, 0x0006, 1)) { | |
481 | aim_freetlvchain(&tlvlist); | |
482 | return 0; | |
483 | } | |
484 | ||
485 | serviceid = aim_gettlv16(tlvlist, 0x000d, 1); | |
486 | ip = aim_gettlv_str(tlvlist, 0x0005, 1); | |
487 | cookie = aim_gettlv_str(tlvlist, 0x0006, 1); | |
488 | ||
489 | /* | |
490 | * Chat hack. | |
491 | */ | |
492 | if ((serviceid == AIM_CONN_TYPE_CHAT) && sess->pendingjoin) { | |
493 | chathack = sess->pendingjoin; | |
494 | chathackex = sess->pendingjoinexchange; | |
495 | sess->pendingjoin = NULL; | |
496 | sess->pendingjoinexchange = 0; | |
497 | } | |
498 | ||
499 | if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) | |
500 | ret = userfunc(sess, rx, serviceid, ip, cookie, chathack, chathackex); | |
501 | ||
502 | free(ip); | |
503 | free(cookie); | |
504 | free(chathack); | |
505 | ||
506 | aim_freetlvchain(&tlvlist); | |
507 | ||
508 | return ret; | |
00ef5271 | 509 | } |
510 | ||
511 | /* | |
512 | * The Rate Limiting System, An Abridged Guide to Nonsense. | |
513 | * | |
514 | * OSCAR defines several 'rate classes'. Each class has seperate | |
515 | * rate limiting properties (limit level, alert level, disconnect | |
516 | * level, etc), and a set of SNAC family/type pairs associated with | |
517 | * it. The rate classes, their limiting properties, and the definitions | |
518 | * of which SNACs are belong to which class, are defined in the | |
519 | * Rate Response packet at login to each host. | |
520 | * | |
521 | * Logically, all rate offenses within one class count against further | |
522 | * offenses for other SNACs in the same class (ie, sending messages | |
523 | * too fast will limit the number of user info requests you can send, | |
524 | * since those two SNACs are in the same rate class). | |
525 | * | |
526 | * Since the rate classes are defined dynamically at login, the values | |
527 | * below may change. But they seem to be fairly constant. | |
528 | * | |
529 | * Currently, BOS defines five rate classes, with the commonly used | |
530 | * members as follows... | |
531 | * | |
532 | * Rate class 0x0001: | |
533 | * - Everything thats not in any of the other classes | |
534 | * | |
535 | * Rate class 0x0002: | |
536 | * - Buddy list add/remove | |
537 | * - Permit list add/remove | |
538 | * - Deny list add/remove | |
539 | * | |
540 | * Rate class 0x0003: | |
541 | * - User information requests | |
542 | * - Outgoing ICBMs | |
543 | * | |
544 | * Rate class 0x0004: | |
545 | * - A few unknowns: 2/9, 2/b, and f/2 | |
546 | * | |
547 | * Rate class 0x0005: | |
548 | * - Chat room create | |
549 | * - Outgoing chat ICBMs | |
550 | * | |
551 | * The only other thing of note is that class 5 (chat) has slightly looser | |
552 | * limiting properties than class 3 (normal messages). But thats just a | |
553 | * small bit of trivia for you. | |
554 | * | |
555 | * The last thing that needs to be learned about the rate limiting | |
556 | * system is how the actual numbers relate to the passing of time. This | |
557 | * seems to be a big mystery. | |
558 | * | |
559 | */ | |
560 | ||
561 | /* XXX parse this */ | |
d410cf58 | 562 | static int rateresp(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
00ef5271 | 563 | { |
355229fe | 564 | aim_rxcallback_t userfunc; |
00ef5271 | 565 | |
355229fe | 566 | if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) |
567 | return userfunc(sess, rx); | |
00ef5271 | 568 | |
355229fe | 569 | return 0; |
00ef5271 | 570 | } |
571 | ||
d410cf58 | 572 | static int ratechange(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
00ef5271 | 573 | { |
355229fe | 574 | aim_rxcallback_t userfunc; |
d410cf58 | 575 | fu16_t code, rateclass; |
576 | fu32_t currentavg, maxavg, windowsize, clear, alert, limit, disconnect; | |
577 | ||
578 | code = aimbs_get16(bs); | |
579 | rateclass = aimbs_get16(bs); | |
580 | ||
581 | windowsize = aimbs_get32(bs); | |
582 | clear = aimbs_get32(bs); | |
583 | alert = aimbs_get32(bs); | |
584 | limit = aimbs_get32(bs); | |
585 | disconnect = aimbs_get32(bs); | |
586 | currentavg = aimbs_get32(bs); | |
587 | maxavg = aimbs_get32(bs); | |
355229fe | 588 | |
589 | if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) | |
590 | return userfunc(sess, rx, code, rateclass, windowsize, clear, alert, limit, disconnect, currentavg, maxavg); | |
591 | ||
592 | return 0; | |
00ef5271 | 593 | } |
594 | ||
595 | /* XXX parse this */ | |
d410cf58 | 596 | static int selfinfo(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
00ef5271 | 597 | { |
355229fe | 598 | aim_rxcallback_t userfunc; |
00ef5271 | 599 | |
355229fe | 600 | if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) |
601 | return userfunc(sess, rx); | |
00ef5271 | 602 | |
355229fe | 603 | return 0; |
00ef5271 | 604 | } |
605 | ||
d410cf58 | 606 | static int evilnotify(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
00ef5271 | 607 | { |
d410cf58 | 608 | aim_rxcallback_t userfunc; |
609 | fu16_t newevil; | |
355229fe | 610 | struct aim_userinfo_s userinfo; |
611 | ||
355229fe | 612 | memset(&userinfo, 0, sizeof(struct aim_userinfo_s)); |
d410cf58 | 613 | |
614 | newevil = aimbs_get16(bs); | |
00ef5271 | 615 | |
d410cf58 | 616 | if (aim_bstream_empty(bs)) |
617 | aim_extractuserinfo(sess, bs, &userinfo); | |
00ef5271 | 618 | |
355229fe | 619 | if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) |
620 | return userfunc(sess, rx, newevil, &userinfo); | |
00ef5271 | 621 | |
355229fe | 622 | return 0; |
00ef5271 | 623 | } |
624 | ||
d410cf58 | 625 | static int motd(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
00ef5271 | 626 | { |
355229fe | 627 | aim_rxcallback_t userfunc; |
628 | char *msg = NULL; | |
629 | int ret = 0; | |
d410cf58 | 630 | aim_tlvlist_t *tlvlist; |
631 | fu16_t id; | |
355229fe | 632 | |
633 | /* | |
634 | * Code. | |
635 | * | |
636 | * Valid values: | |
637 | * 1 Mandatory upgrade | |
638 | * 2 Advisory upgrade | |
639 | * 3 System bulletin | |
640 | * 4 Nothing's wrong ("top o the world" -- normal) | |
641 | * | |
642 | */ | |
d410cf58 | 643 | id = aimbs_get16(bs); |
355229fe | 644 | |
645 | /* | |
646 | * TLVs follow | |
647 | */ | |
d410cf58 | 648 | tlvlist = aim_readtlvchain(bs); |
649 | ||
650 | msg = aim_gettlv_str(tlvlist, 0x000b, 1); | |
355229fe | 651 | |
652 | if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) | |
653 | ret = userfunc(sess, rx, id, msg); | |
654 | ||
655 | free(msg); | |
656 | ||
657 | aim_freetlvchain(&tlvlist); | |
658 | ||
659 | return ret; | |
00ef5271 | 660 | } |
661 | ||
d410cf58 | 662 | static int hostversions(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
00ef5271 | 663 | { |
355229fe | 664 | aim_rxcallback_t userfunc; |
665 | int vercount; | |
d410cf58 | 666 | fu8_t *versions; |
00ef5271 | 667 | |
d410cf58 | 668 | vercount = aim_bstream_empty(bs)/4; |
669 | versions = aimbs_getraw(bs, aim_bstream_empty(bs)); | |
00ef5271 | 670 | |
355229fe | 671 | if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) |
d410cf58 | 672 | return userfunc(sess, rx, vercount, versions); |
673 | ||
674 | free(versions); | |
355229fe | 675 | |
676 | return 0; | |
00ef5271 | 677 | } |
b1eac25a | 678 | |
d32954e7 | 679 | /* |
b1eac25a | 680 | * Starting this past week (26 Mar 2001, say), AOL has started sending |
681 | * this nice little extra SNAC. AFAIK, it has never been used until now. | |
682 | * | |
683 | * The request contains eight bytes. The first four are an offset, the | |
684 | * second four are a length. | |
d32954e7 | 685 | * |
b1eac25a | 686 | * The offset is an offset into aim.exe when it is mapped during execution |
687 | * on Win32. So far, AOL has only been requesting bytes in static regions | |
688 | * of memory. (I won't put it past them to start requesting data in | |
689 | * less static regions -- regions that are initialized at run time, but still | |
690 | * before the client recieves this request.) | |
691 | * | |
692 | * When the client recieves the request, it adds it to the current ds | |
693 | * (0x00400000) and dereferences it, copying the data into a buffer which | |
694 | * it then runs directly through the MD5 hasher. The 16 byte output of | |
695 | * the hash is then sent back to the server. | |
696 | * | |
697 | * If the client does not send any data back, or the data does not match | |
698 | * the data that the specific client should have, the client will get the | |
699 | * following message from "AOL Instant Messenger": | |
700 | * "You have been disconnected from the AOL Instant Message Service (SM) | |
701 | * for accessing the AOL network using unauthorized software. You can | |
702 | * download a FREE, fully featured, and authorized client, here | |
703 | * http://www.aol.com/aim/download2.html" | |
704 | * The connection is then closed, recieving disconnect code 1, URL | |
705 | * http://www.aim.aol.com/errors/USER_LOGGED_OFF_NEW_LOGIN.html. | |
706 | * | |
707 | * Note, however, that numerous inconsistencies can cause the above error, | |
708 | * not just sending back a bad hash. Do not immediatly suspect this code | |
709 | * if you get disconnected. AOL and the open/free software community have | |
710 | * played this game for a couple years now, generating the above message | |
711 | * on numerous ocassions. | |
712 | * | |
713 | * Anyway, neener. We win again. | |
d32954e7 | 714 | * |
715 | */ | |
d410cf58 | 716 | static int memrequest(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
d32954e7 | 717 | { |
355229fe | 718 | aim_rxcallback_t userfunc; |
d410cf58 | 719 | fu32_t offset, len; |
720 | aim_tlvlist_t *list; | |
721 | char *modname; | |
b1eac25a | 722 | |
d410cf58 | 723 | offset = aimbs_get32(bs); |
724 | len = aimbs_get32(bs); | |
725 | list = aim_readtlvchain(bs); | |
328837f7 | 726 | |
d410cf58 | 727 | modname = aim_gettlv_str(list, 0x0001, 1); |
5ac961d5 | 728 | |
355229fe | 729 | faimdprintf(sess, 1, "data at 0x%08lx (%d bytes) of requested\n", offset, len, modname ? modname : "aim.exe"); |
b1eac25a | 730 | |
355229fe | 731 | if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) |
732 | return userfunc(sess, rx, offset, len, modname); | |
b1eac25a | 733 | |
355229fe | 734 | free(modname); |
735 | aim_freetlvchain(&list); | |
5ac961d5 | 736 | |
355229fe | 737 | return 0; |
b1eac25a | 738 | } |
739 | ||
d410cf58 | 740 | #if 0 |
741 | static void dumpbox(aim_session_t *sess, unsigned char *buf, int len) | |
001c9b80 | 742 | { |
355229fe | 743 | int i; |
744 | ||
745 | if (!sess || !buf || !len) | |
746 | return; | |
001c9b80 | 747 | |
355229fe | 748 | faimdprintf(sess, 1, "\nDump of %d bytes at %p:", len, buf); |
001c9b80 | 749 | |
355229fe | 750 | for (i = 0; i < len; i++) { |
751 | if ((i % 8) == 0) | |
752 | faimdprintf(sess, 1, "\n\t"); | |
001c9b80 | 753 | |
355229fe | 754 | faimdprintf(sess, 1, "0x%2x ", buf[i]); |
755 | } | |
001c9b80 | 756 | |
355229fe | 757 | faimdprintf(sess, 1, "\n\n"); |
001c9b80 | 758 | |
355229fe | 759 | return; |
001c9b80 | 760 | } |
d410cf58 | 761 | #endif |
001c9b80 | 762 | |
d410cf58 | 763 | faim_export int aim_sendmemblock(aim_session_t *sess, aim_conn_t *conn, fu32_t offset, fu32_t len, const fu8_t *buf, fu8_t flag) |
b1eac25a | 764 | { |
d410cf58 | 765 | aim_frame_t *fr; |
766 | aim_snacid_t snacid; | |
b1eac25a | 767 | |
355229fe | 768 | if (!sess || !conn) |
769 | return -EINVAL; | |
b1eac25a | 770 | |
d410cf58 | 771 | if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 10+2+16))) |
355229fe | 772 | return -ENOMEM; |
b1eac25a | 773 | |
d410cf58 | 774 | snacid = aim_cachesnac(sess, 0x0001, 0x0020, 0x0000, NULL, 0); |
b1eac25a | 775 | |
d410cf58 | 776 | aim_putsnac(&fr->data, 0x0001, 0x0020, 0x0000, snacid); |
777 | aimbs_put16(&fr->data, 0x0010); /* md5 is always 16 bytes */ | |
b1eac25a | 778 | |
355229fe | 779 | if ((flag == AIM_SENDMEMBLOCK_FLAG_ISHASH) && buf && (len == 0x10)) { /* we're getting a hash */ |
d2698e03 | 780 | |
d410cf58 | 781 | aimbs_putraw(&fr->data, buf, 0x10); |
d2698e03 | 782 | |
355229fe | 783 | } else if (buf && (len > 0)) { /* use input buffer */ |
784 | md5_state_t state; | |
d410cf58 | 785 | md5_byte_t digest[0x10]; |
b1eac25a | 786 | |
355229fe | 787 | md5_init(&state); |
788 | md5_append(&state, (const md5_byte_t *)buf, len); | |
d410cf58 | 789 | md5_finish(&state, digest); |
790 | ||
791 | aimbs_putraw(&fr->data, (fu8_t *)digest, 0x10); | |
b1eac25a | 792 | |
355229fe | 793 | } else if (len == 0) { /* no length, just hash NULL (buf is optional) */ |
794 | md5_state_t state; | |
d410cf58 | 795 | fu8_t nil = '\0'; |
796 | md5_byte_t digest[0x10]; | |
001c9b80 | 797 | |
355229fe | 798 | /* |
799 | * These MD5 routines are stupid in that you have to have | |
800 | * at least one append. So thats why this doesn't look | |
801 | * real logical. | |
802 | */ | |
803 | md5_init(&state); | |
804 | md5_append(&state, (const md5_byte_t *)&nil, 0); | |
d410cf58 | 805 | md5_finish(&state, digest); |
806 | ||
807 | aimbs_putraw(&fr->data, (fu8_t *)digest, 0x10); | |
001c9b80 | 808 | |
355229fe | 809 | } else { |
b1eac25a | 810 | |
355229fe | 811 | /* |
812 | * This data is correct for AIM 3.5.1670. | |
813 | * | |
814 | * Using these blocks is as close to "legal" as you can get | |
815 | * without using an AIM binary. | |
816 | * | |
817 | */ | |
818 | if ((offset == 0x03ffffff) && (len == 0x03ffffff)) { | |
fa358732 | 819 | |
820 | #if 1 /* with "AnrbnrAqhfzcd" */ | |
d410cf58 | 821 | aimbs_put32(&fr->data, 0x44a95d26); |
822 | aimbs_put32(&fr->data, 0xd2490423); | |
823 | aimbs_put32(&fr->data, 0x93b8821f); | |
824 | aimbs_put32(&fr->data, 0x51c54b01); | |
fa358732 | 825 | #else /* no filename */ |
d410cf58 | 826 | aimbs_put32(&fr->data, 0x1df8cbae); |
827 | aimbs_put32(&fr->data, 0x5523b839); | |
828 | aimbs_put32(&fr->data, 0xa0e10db3); | |
829 | aimbs_put32(&fr->data, 0xa46d3b39); | |
fa358732 | 830 | #endif |
831 | ||
355229fe | 832 | } else if ((offset == 0x00001000) && (len == 0x00000000)) { |
fa358732 | 833 | |
d410cf58 | 834 | aimbs_put32(&fr->data, 0xd41d8cd9); |
835 | aimbs_put32(&fr->data, 0x8f00b204); | |
836 | aimbs_put32(&fr->data, 0xe9800998); | |
837 | aimbs_put32(&fr->data, 0xecf8427e); | |
fa358732 | 838 | |
355229fe | 839 | } else |
840 | faimdprintf(sess, 0, "sendmemblock: WARNING: unknown hash request\n"); | |
b1eac25a | 841 | |
355229fe | 842 | } |
b1eac25a | 843 | |
d410cf58 | 844 | aim_tx_enqueue(sess, fr); |
b1eac25a | 845 | |
355229fe | 846 | return 0; |
d32954e7 | 847 | } |
00ef5271 | 848 | |
d410cf58 | 849 | static int snachandler(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) |
00ef5271 | 850 | { |
851 | ||
355229fe | 852 | if (snac->subtype == 0x0003) |
d410cf58 | 853 | return hostonline(sess, mod, rx, snac, bs); |
355229fe | 854 | else if (snac->subtype == 0x0005) |
d410cf58 | 855 | return redirect(sess, mod, rx, snac, bs); |
355229fe | 856 | else if (snac->subtype == 0x0007) |
d410cf58 | 857 | return rateresp(sess, mod, rx, snac, bs); |
355229fe | 858 | else if (snac->subtype == 0x000a) |
d410cf58 | 859 | return ratechange(sess, mod, rx, snac, bs); |
355229fe | 860 | else if (snac->subtype == 0x000f) |
d410cf58 | 861 | return selfinfo(sess, mod, rx, snac, bs); |
355229fe | 862 | else if (snac->subtype == 0x0010) |
d410cf58 | 863 | return evilnotify(sess, mod, rx, snac, bs); |
355229fe | 864 | else if (snac->subtype == 0x0013) |
d410cf58 | 865 | return motd(sess, mod, rx, snac, bs); |
355229fe | 866 | else if (snac->subtype == 0x0018) |
d410cf58 | 867 | return hostversions(sess, mod, rx, snac, bs); |
355229fe | 868 | else if (snac->subtype == 0x001f) |
d410cf58 | 869 | return memrequest(sess, mod, rx, snac, bs); |
355229fe | 870 | |
871 | return 0; | |
00ef5271 | 872 | } |
873 | ||
d410cf58 | 874 | faim_internal int general_modfirst(aim_session_t *sess, aim_module_t *mod) |
00ef5271 | 875 | { |
876 | ||
355229fe | 877 | mod->family = 0x0001; |
878 | mod->version = 0x0000; | |
879 | mod->flags = 0; | |
880 | strncpy(mod->name, "general", sizeof(mod->name)); | |
881 | mod->snachandler = snachandler; | |
00ef5271 | 882 | |
355229fe | 883 | return 0; |
00ef5271 | 884 | } |
355229fe | 885 |