aboutsummaryrefslogtreecommitdiffstats
path: root/tests/check_arc.c
blob: 9d913dcd142b331d89437cb3a1fd9946b32c4cba (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
#include <stdlib.h>
#include <glib.h>
#include <gmodule.h>
#include <check.h>
#include <string.h>
#include <stdio.h>
#include "arc.h"

char *password = "ArcVier";

char *clear_tests[] =
{
	"Wie dit leest is gek :-)",
	"ItllBeBitlBee",
	"One more boring password",
	"Hoi hoi",
	NULL
};

static void check_codec(int l)
{
	int i;
	
	for( i = 0; clear_tests[i]; i++ )
	{
  		tcase_fn_start (clear_tests[i], __FILE__, __LINE__);
		unsigned char *crypted;
		char *decrypted;
		int len;
		
		len = arc_encode( clear_tests[i], 0, &crypted, password, 12 );
		len = arc_decode( crypted, len, &decrypted, password );
		
		fail_if( strcmp( clear_tests[i], decrypted ) != 0,
		         "%s didn't decrypt back properly", clear_tests[i] );
		
		g_free( crypted );
		g_free( decrypted );
	}
}

struct
{
	unsigned char crypted[30];
	int len;
	char *decrypted;
} decrypt_tests[] = {
	/* One block with padding. */
	{
		{
			0x3f, 0x79, 0xb0, 0xf5, 0x91, 0x56, 0xd2, 0x1b, 0xd1, 0x4b, 0x67, 0xac,
			0xb1, 0x31, 0xc9, 0xdb, 0xf9, 0xaa
		}, 18, "short pass"
	},
	
	/* Two blocks with padding. */
	{
		{
			0xf9, 0xa6, 0xec, 0x5d, 0xc7, 0x06, 0xb8, 0x6b, 0x63, 0x9f, 0x2d, 0xb5,
			0x7d, 0xaa, 0x32, 0xbb, 0xd8, 0x08, 0xfd, 0x81, 0x2e, 0xca, 0xb4, 0xd7,
			0x2f, 0x36, 0x9c, 0xac, 0xa0, 0xbc
		}, 30, "longer password"
	},

	/* This string is exactly two "blocks" long, to make sure unpadded strings also decrypt
	   properly. */
	{
		{
			0x95, 0x4d, 0xcf, 0x4d, 0x5e, 0x6c, 0xcf, 0xef, 0xb9, 0x80, 0x00, 0xef,
			0x25, 0xe9, 0x17, 0xf6, 0x29, 0x6a, 0x82, 0x79, 0x1c, 0xca, 0x68, 0xb5,
			0x4e, 0xd0, 0xc1, 0x41, 0x8e, 0xe6
		}, 30, "OSCAR is really creepy.."
	},
	{ "", 0, NULL }
};

static void check_decod(int l)
{
	int i;
	
	for( i = 0; decrypt_tests[i].len; i++ )
	{
  		tcase_fn_start (decrypt_tests[i].decrypted, __FILE__, __LINE__);
		char *decrypted;
		int len;
		
		len = arc_decode( decrypt_tests[i].crypted, decrypt_tests[i].len,
		                  &decrypted, password );
		
		fail_if( strcmp( decrypt_tests[i].decrypted, decrypted ) != 0,
		         "`%s' didn't decrypt properly", decrypt_tests[i].decrypted );
		
		g_free( decrypted );
	}
}

Suite *arc_suite (void)
{
	Suite *s = suite_create("ArcFour");
	TCase *tc_core = tcase_create("Core");
	suite_add_tcase (s, tc_core);
	tcase_add_test (tc_core, check_codec);
	tcase_add_test (tc_core, check_decod);
	return s;
}
int aim_sendflapver(aim_session_t *sess, aim_conn_t *conn) { aim_frame_t *fr; if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 4))) return -ENOMEM; aimbs_put32(&fr->data, 0x00000001); aim_tx_enqueue(sess, fr); return 0; } /* * This is a bit confusing. * * Normal SNAC login goes like this: * - connect * - server sends flap version * - client sends flap version * - client sends screen name (17/6) * - server sends hash key (17/7) * - client sends auth request (17/2 -- aim_send_login) * - server yells * * XOR login (for ICQ) goes like this: * - connect * - server sends flap version * - client sends auth request which contains flap version (aim_send_login) * - server yells * * For the client API, we make them implement the most complicated version, * and for the simpler version, we fake it and make it look like the more * complicated process. * * This is done by giving the client a faked key, just so we can convince * them to call aim_send_login right away, which will detect the session * flag that says this is XOR login and ignore the key, sending an ICQ * login request instead of the normal SNAC one. * * As soon as AOL makes ICQ log in the same way as AIM, this is /gone/. * * XXX This may cause problems if the client relies on callbacks only * being called from the context of aim_rxdispatch()... * */ static int goddamnicq(aim_session_t *sess, aim_conn_t *conn, const char *sn) { aim_frame_t fr; aim_rxcallback_t userfunc; sess->flags &= ~AIM_SESS_FLAGS_SNACLOGIN; sess->flags |= AIM_SESS_FLAGS_XORLOGIN; fr.conn = conn; if ((userfunc = aim_callhandler(sess, conn, 0x0017, 0x0007))) userfunc(sess, &fr, ""); return 0; } /* * In AIM 3.5 protocol, the first stage of login is to request login from the * Authorizer, passing it the screen name for verification. If the name is * invalid, a 0017/0003 is spit back, with the standard error contents. If * valid, a 0017/0007 comes back, which is the signal to send it the main * login command (0017/0002). * */ int aim_request_login(aim_session_t *sess, aim_conn_t *conn, const char *sn) { aim_frame_t *fr; aim_snacid_t snacid; aim_tlvlist_t *tl = NULL; if (!sess || !conn || !sn) return -EINVAL; if ((sn[0] >= '0') && (sn[0] <= '9')) return goddamnicq(sess, conn, sn); sess->flags |= AIM_SESS_FLAGS_SNACLOGIN; aim_sendflapver(sess, conn); if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 10+2+2+strlen(sn)))) return -ENOMEM; snacid = aim_cachesnac(sess, 0x0017, 0x0006, 0x0000, NULL, 0); aim_putsnac(&fr->data, 0x0017, 0x0006, 0x0000, snacid); aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), (guint8 *)sn); aim_writetlvchain(&fr->data, &tl); aim_freetlvchain(&tl); aim_tx_enqueue(sess, fr); return 0; } /* * Part two of the ICQ hack. Note the ignoring of the key and clientinfo. */ static int goddamnicq2(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password) { static const char clientstr[] = {"ICQ Inc. - Product of ICQ (TM) 2001b.5.17.1.3642.85"}; static const char lang[] = {"en"}; static const char country[] = {"us"}; aim_frame_t *fr; aim_tlvlist_t *tl = NULL; guint8 *password_encoded; if (!(password_encoded = (guint8 *) g_malloc(strlen(password)))) return -ENOMEM; if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x01, 1152))) { g_free(password_encoded); return -ENOMEM; } aim_encode_password(password, password_encoded); aimbs_put32(&fr->data, 0x00000001); aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), (guint8 *)sn); aim_addtlvtochain_raw(&tl, 0x0002, strlen(password), password_encoded); aim_addtlvtochain_raw(&tl, 0x0003, strlen(clientstr), (guint8 *)clientstr); aim_addtlvtochain16(&tl, 0x0016, 0x010a); /* cliend ID */ aim_addtlvtochain16(&tl, 0x0017, 0x0005); /* major version */ aim_addtlvtochain16(&tl, 0x0018, 0x0011); /* minor version */ aim_addtlvtochain16(&tl, 0x0019, 0x0001); /* point version */ aim_addtlvtochain16(&tl, 0x001a, 0x0e3a); /* build */ aim_addtlvtochain32(&tl, 0x0014, 0x00000055); /* distribution chan */ aim_addtlvtochain_raw(&tl, 0x000f, strlen(lang), (guint8 *)lang); aim_addtlvtochain_raw(&tl, 0x000e, strlen(country), (guint8 *)country); aim_writetlvchain(&fr->data, &tl); g_free(password_encoded); aim_freetlvchain(&tl); aim_tx_enqueue(sess, fr); return 0; } /* * send_login(int socket, char *sn, char *password) * * This is the initial login request packet. * * NOTE!! If you want/need to make use of the aim_sendmemblock() function, * then the client information you send here must exactly match the * executable that you're pulling the data from. * * WinAIM 4.8.2540 * clientstring = "AOL Instant Messenger (SM), version 4.8.2540/WIN32" * clientid = 0x0109 * major = 0x0004 * minor = 0x0008 * point = 0x0000 * build = 0x09ec * t(0x0014) = 0x000000af * t(0x004a) = 0x01 * * WinAIM 4.3.2188: * clientstring = "AOL Instant Messenger (SM), version 4.3.2188/WIN32" * clientid = 0x0109 * major = 0x0400 * minor = 0x0003 * point = 0x0000 * build = 0x088c * unknown = 0x00000086 * lang = "en" * country = "us" * unknown4a = 0x01 * * Latest WinAIM that libfaim can emulate without server-side buddylists: * clientstring = "AOL Instant Messenger (SM), version 4.1.2010/WIN32" * clientid = 0x0004 * major = 0x0004 * minor = 0x0001 * point = 0x0000 * build = 0x07da * unknown= 0x0000004b * * WinAIM 3.5.1670: * clientstring = "AOL Instant Messenger (SM), version 3.5.1670/WIN32" * clientid = 0x0004 * major = 0x0003 * minor = 0x0005 * point = 0x0000 * build = 0x0686 * unknown =0x0000002a * * Java AIM 1.1.19: * clientstring = "AOL Instant Messenger (TM) version 1.1.19 for Java built 03/24/98, freeMem 215871 totalMem 1048567, i686, Linus, #2 SMP Sun Feb 11 03:41:17 UTC 2001 2.4.1-ac9, IBM Corporation, 1.1.8, 45.3, Tue Mar 27 12:09:17 PST 2001" * clientid = 0x0001 * major = 0x0001 * minor = 0x0001 * point = (not sent) * build = 0x0013 * unknown= (not sent) * * AIM for Linux 1.1.112: * clientstring = "AOL Instant Messenger (SM)" * clientid = 0x1d09 * major = 0x0001 * minor = 0x0001 * point = 0x0001 * build = 0x0070 * unknown= 0x0000008b * serverstore = 0x01 * */ int aim_send_login(aim_session_t *sess, aim_conn_t *conn, const char *sn, const char *password, struct client_info_s *ci, const char *key) { aim_frame_t *fr; aim_tlvlist_t *tl = NULL; guint8 digest[16]; aim_snacid_t snacid; if (!ci || !sn || !password) return -EINVAL; /* * What the XORLOGIN flag _really_ means is that its an ICQ login, * which is really stupid and painful, so its not done here. * */ if (sess->flags & AIM_SESS_FLAGS_XORLOGIN) return goddamnicq2(sess, conn, sn, password); if (!(fr = aim_tx_new(sess, conn, AIM_FRAMETYPE_FLAP, 0x02, 1152))) return -ENOMEM; snacid = aim_cachesnac(sess, 0x0017, 0x0002, 0x0000, NULL, 0); aim_putsnac(&fr->data, 0x0017, 0x0002, 0x0000, snacid); aim_addtlvtochain_raw(&tl, 0x0001, strlen(sn), (guint8 *)sn); aim_encode_password_md5(password, key, digest); aim_addtlvtochain_raw(&tl, 0x0025, 16, digest); /* * Newer versions of winaim have an empty type x004c TLV here. */ if (ci->clientstring) aim_addtlvtochain_raw(&tl, 0x0003, strlen(ci->clientstring), (guint8 *)ci->clientstring); aim_addtlvtochain16(&tl, 0x0016, (guint16)ci->clientid); aim_addtlvtochain16(&tl, 0x0017, (guint16)ci->major); aim_addtlvtochain16(&tl, 0x0018, (guint16)ci->minor); aim_addtlvtochain16(&tl, 0x0019, (guint16)ci->point); aim_addtlvtochain16(&tl, 0x001a, (guint16)ci->build); aim_addtlvtochain_raw(&tl, 0x000e, strlen(ci->country), (guint8 *)ci->country); aim_addtlvtochain_raw(&tl, 0x000f, strlen(ci->lang), (guint8 *)ci->lang); /* * If set, old-fashioned buddy lists will not work. You will need * to use SSI. */ aim_addtlvtochain8(&tl, 0x004a, 0x01); aim_writetlvchain(&fr->data, &tl); aim_freetlvchain(&tl); aim_tx_enqueue(sess, fr); return 0; } int aim_encode_password_md5(const char *password, const char *key, guint8 *digest) { md5_state_t state; md5_init(&state); md5_append(&state, (const md5_byte_t *)key, strlen(key)); md5_append(&state, (const md5_byte_t *)password, strlen(password)); md5_append(&state, (const md5_byte_t *)AIM_MD5_STRING, strlen(AIM_MD5_STRING)); md5_finish(&state, (md5_byte_t *)digest); return 0; } /** * aim_encode_password - Encode a password using old XOR method * @password: incoming password * @encoded: buffer to put encoded password * * This takes a const pointer to a (null terminated) string * containing the unencoded password. It also gets passed * an already allocated buffer to store the encoded password. * This buffer should be the exact length of the password without * the null. The encoded password buffer /is not %NULL terminated/. * * The encoding_table seems to be a fixed set of values. We'll * hope it doesn't change over time! * * This is only used for the XOR method, not the better MD5 method. * */ static int aim_encode_password(const char *password, guint8 *encoded) { guint8 encoding_table[] = { /* v2.1 table, also works for ICQ */ 0xf3, 0x26, 0x81, 0xc4, 0x39, 0x86, 0xdb, 0x92, 0x71, 0xa3, 0xb9, 0xe6, 0x53, 0x7a, 0x95, 0x7c }; int i; for (i = 0; i < strlen(password); i++) encoded[i] = (password[i] ^ encoding_table[i]); return 0; } /* * This is sent back as a general response to the login command. * It can be either an error or a success, depending on the * precense of certain TLVs. * * The client should check the value passed as errorcode. If * its nonzero, there was an error. * */ static int parse(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) { aim_tlvlist_t *tlvlist; aim_rxcallback_t userfunc; struct aim_authresp_info info; int ret = 0; memset(&info, 0, sizeof(info)); /* * Read block of TLVs. All further data is derived * from what is parsed here. */ tlvlist = aim_readtlvchain(bs); /* * No matter what, we should have a screen name. */ memset(sess->sn, 0, sizeof(sess->sn)); if (aim_gettlv(tlvlist, 0x0001, 1)) { info.sn = aim_gettlv_str(tlvlist, 0x0001, 1); strncpy(sess->sn, info.sn, sizeof(sess->sn)); } /* * Check for an error code. If so, we should also * have an error url. */ if (aim_gettlv(tlvlist, 0x0008, 1)) info.errorcode = aim_gettlv16(tlvlist, 0x0008, 1); if (aim_gettlv(tlvlist, 0x0004, 1)) info.errorurl = aim_gettlv_str(tlvlist, 0x0004, 1); /* * BOS server address. */ if (aim_gettlv(tlvlist, 0x0005, 1)) info.bosip = aim_gettlv_str(tlvlist, 0x0005, 1); /* * Authorization cookie. */ if (aim_gettlv(tlvlist, 0x0006, 1)) { aim_tlv_t *tmptlv; tmptlv = aim_gettlv(tlvlist, 0x0006, 1); info.cookie = tmptlv->value; } /* * The email address attached to this account * Not available for ICQ logins. */ if (aim_gettlv(tlvlist, 0x0011, 1)) info.email = aim_gettlv_str(tlvlist, 0x0011, 1); /* * The registration status. (Not real sure what it means.) * Not available for ICQ logins. * * 1 = No disclosure * 2 = Limited disclosure * 3 = Full disclosure * * This has to do with whether your email address is available * to other users or not. AFAIK, this feature is no longer used. * */ if (aim_gettlv(tlvlist, 0x0013, 1)) info.regstatus = aim_gettlv16(tlvlist, 0x0013, 1); if (aim_gettlv(tlvlist, 0x0040, 1)) info.latestbeta.build = aim_gettlv32(tlvlist, 0x0040, 1); if (aim_gettlv(tlvlist, 0x0041, 1)) info.latestbeta.url = aim_gettlv_str(tlvlist, 0x0041, 1); if (aim_gettlv(tlvlist, 0x0042, 1)) info.latestbeta.info = aim_gettlv_str(tlvlist, 0x0042, 1); if (aim_gettlv(tlvlist, 0x0043, 1)) info.latestbeta.name = aim_gettlv_str(tlvlist, 0x0043, 1); if (aim_gettlv(tlvlist, 0x0048, 1)) ; /* no idea what this is */ if (aim_gettlv(tlvlist, 0x0044, 1)) info.latestrelease.build = aim_gettlv32(tlvlist, 0x0044, 1); if (aim_gettlv(tlvlist, 0x0045, 1)) info.latestrelease.url = aim_gettlv_str(tlvlist, 0x0045, 1); if (aim_gettlv(tlvlist, 0x0046, 1)) info.latestrelease.info = aim_gettlv_str(tlvlist, 0x0046, 1); if (aim_gettlv(tlvlist, 0x0047, 1)) info.latestrelease.name = aim_gettlv_str(tlvlist, 0x0047, 1); if (aim_gettlv(tlvlist, 0x0049, 1)) ; /* no idea what this is */ if ((userfunc = aim_callhandler(sess, rx->conn, snac ? snac->family : 0x0017, snac ? snac->subtype : 0x0003))) ret = userfunc(sess, rx, &info); g_free(info.sn); g_free(info.bosip); g_free(info.errorurl); g_free(info.email); g_free(info.latestrelease.name); g_free(info.latestrelease.url); g_free(info.latestrelease.info); g_free(info.latestbeta.name); g_free(info.latestbeta.url); g_free(info.latestbeta.info); aim_freetlvchain(&tlvlist); return ret; } /* * Middle handler for 0017/0007 SNACs. Contains the auth key prefixed * by only its length in a two byte word. * * Calls the client, which should then use the value to call aim_send_login. * */ static int keyparse(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) { int keylen, ret = 1; aim_rxcallback_t userfunc; char *keystr; keylen = aimbs_get16(bs); keystr = aimbs_getstr(bs, keylen); if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) ret = userfunc(sess, rx, keystr); g_free(keystr); return ret; } static int snachandler(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs) { if (snac->subtype == 0x0003) return parse(sess, mod, rx, snac, bs); else if (snac->subtype == 0x0007) return keyparse(sess, mod, rx, snac, bs); return 0; } int auth_modfirst(aim_session_t *sess, aim_module_t *mod) { mod->family = 0x0017; mod->version = 0x0000; mod->flags = 0; strncpy(mod->name, "auth", sizeof(mod->name)); mod->snachandler = snachandler; return 0; }