static int consumesnac(aim_session_t *sess, aim_frame_t *rx)
{
aim_module_t *cur;
aim_modsnac_t snac;
if (aim_bstream_empty(&rx->data) < 10)
return 0;
snac.family = aimbs_get16(&rx->data);
snac.subtype = aimbs_get16(&rx->data);
snac.flags = aimbs_get16(&rx->data);
snac.id = aimbs_get32(&rx->data);
for (cur = (aim_module_t *)sess->modlistv; cur; cur = cur->next) {
if (!(cur->flags & AIM_MODFLAG_MULTIFAMILY) &&
(cur->family != snac.family))
continue;
if (cur->snachandler(sess, cur, rx, &snac, &rx->data))
return 1;
}
return 0;
}
/**
* Subtype 0x0005 - Receive a buddy icon.
*
* This is sent in response to a buddy icon request.
*/
static int parseicon(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
int ret = 0;
aim_rxcallback_t userfunc;
char *sn;
fu16_t flags, iconlen;
fu8_t iconcsumtype, iconcsumlen, *iconcsum, *icon;
sn = aimbs_getstr(bs, aimbs_get8(bs));
flags = aimbs_get16(bs);
iconcsumtype = aimbs_get8(bs);
iconcsumlen = aimbs_get8(bs);
iconcsum = aimbs_getraw(bs, iconcsumlen);
iconlen = aimbs_get16(bs);
icon = aimbs_getraw(bs, iconlen);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, sn, iconcsumtype, iconcsum, iconcsumlen, icon, iconlen);
free(sn);
free(iconcsum);
free(icon);
return ret;
}
faim_internal int aim_chat_readroominfo(aim_bstream_t *bs, struct aim_chat_roominfo *outinfo)
{
int namelen;
if (!bs || !outinfo)
return 0;
outinfo->exchange = aimbs_get16(bs);
namelen = aimbs_get8(bs);
outinfo->name = aimbs_getstr(bs, namelen);
outinfo->instance = aimbs_get16(bs);
return 0;
}
/* called for both reply and change-reply */
static int infochange(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
/*
* struct {
* guint16 perms;
* guint16 tlvcount;
* aim_tlv_t tlvs[tlvcount];
* } admin_info[n];
*/
while (aim_bstream_empty(bs)) {
guint16 perms, tlvcount;
perms = aimbs_get16(bs);
tlvcount = aimbs_get16(bs);
while (tlvcount && aim_bstream_empty(bs)) {
aim_rxcallback_t userfunc;
guint16 type, len;
guint8 *val;
int str = 0;
type = aimbs_get16(bs);
len = aimbs_get16(bs);
if ((type == 0x0011) || (type == 0x0004)) {
str = 1;
}
if (str) {
val = (guint8 *) aimbs_getstr(bs, len);
} else {
val = aimbs_getraw(bs, len);
}
/* XXX fix so its only called once for the entire packet */
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) {
userfunc(sess, rx, (snac->subtype == 0x0005) ? 1 : 0, perms, type, len, val, str);
}
g_free(val);
tlvcount--;
}
}
return 1;
}
/**
* Subtype 0x0003 - Acknowledgement for uploading a buddy icon.
*
* You get this honky after you upload a buddy icon.
*/
static int uploadack(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
int ret = 0;
aim_rxcallback_t userfunc;
fu16_t something, somethingelse;
fu8_t onemorething;
something = aimbs_get16(bs);
somethingelse = aimbs_get16(bs);
onemorething = aimbs_get8(bs);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx);
return ret;
}
static int consumesnac(aim_session_t *sess, aim_frame_t *rx)
{
aim_module_t *cur;
aim_modsnac_t snac;
if (aim_bstream_empty(&rx->data) < 10)
return 0;
snac.family = aimbs_get16(&rx->data);
snac.subtype = aimbs_get16(&rx->data);
snac.flags = aimbs_get16(&rx->data);
snac.id = aimbs_get32(&rx->data);
/* SNAC flags are apparently uniform across all SNACs, so we handle them here */
if (snac.flags & 0x0001) {
/*
* This means the SNAC will be followed by another SNAC with
* related information. We don't need to do anything about
* this here.
*/
}
if (snac.flags & 0x8000) {
/*
* This packet contains the version of the family that this SNAC is
* in. You get this when your SSI module is version 2 or higher.
* For now we have no need for this, but you could always save
* it as a part of aim_modnsac_t, or something. The format is...
* 2 byte length of total mini-header (which is 6 bytes), then TLV
* of type 0x0001, length 0x0002, value is the 2 byte version
* number
*/
aim_bstream_advance(&rx->data, aimbs_get16(&rx->data));
}
for (cur = (aim_module_t *)sess->modlistv; cur; cur = cur->next) {
if (!(cur->flags & AIM_MODFLAG_MULTIFAMILY) &&
(cur->family != snac.family))
continue;
if (cur->snachandler(sess, cur, rx, &snac, &rx->data))
return 1;
}
return 0;
}
/**
* aim_readtlvchain_len - Read a TLV chain from a buffer.
* @param bs Input bstream
* @param len The max length in bytes that will be read.
* There are a number of places where you want to read in a tlvchain,
* but the chain is not at the end of the SNAC, and the chain is
* preceeded by the length of the TLVs. So you can limit that with this.
*
* Reads and parses a series of TLV patterns from a data buffer; the
* returned structure is manipulatable with the rest of the TLV
* routines. When done with a TLV chain, aim_freetlvchain() should
* be called to free the dynamic substructures.
*
* XXX There should be a flag setable here to have the tlvlist contain
* bstream references, so that at least the ->value portion of each
* element doesn't need to be malloc/memcpy'd. This could prove to be
* just as effecient as the in-place TLV parsing used in a couple places
* in libfaim.
*
*/
faim_internal aim_tlvlist_t *aim_readtlvchain_len(aim_bstream_t *bs, fu16_t len)
{
aim_tlvlist_t *list = NULL, *cur;
while ((aim_bstream_empty(bs) > 0) && (len > 0)) {
fu16_t type, length;
type = aimbs_get16(bs);
length = aimbs_get16(bs);
if (length > aim_bstream_empty(bs)) {
aim_freetlvchain(&list);
return NULL;
}
cur = (aim_tlvlist_t *)malloc(sizeof(aim_tlvlist_t));
if (!cur) {
aim_freetlvchain(&list);
return NULL;
}
memset(cur, 0, sizeof(aim_tlvlist_t));
cur->tlv = createtlv();
if (!cur->tlv) {
free(cur);
aim_freetlvchain(&list);
return NULL;
}
cur->tlv->type = type;
if ((cur->tlv->length = length)) {
cur->tlv->value = aimbs_getraw(bs, length);
if (!cur->tlv->value) {
freetlv(&cur->tlv);
free(cur);
aim_freetlvchain(&list);
return NULL;
}
}
len -= aim_sizetlvchain(&cur);
cur->next = list;
list = cur;
}
return list;
}
/**
* Read a TLV chain from a buffer.
*
* Reads and parses a series of TLV patterns from a data buffer; the
* returned structure is manipulatable with the rest of the TLV
* routines. When done with a TLV chain, aim_tlvlist_free() should
* be called to free the dynamic substructures.
*
* XXX There should be a flag setable here to have the tlvlist contain
* bstream references, so that at least the ->value portion of each
* element doesn't need to be malloc/memcpy'd. This could prove to be
* just as effecient as the in-place TLV parsing used in a couple places
* in libfaim.
*
* @param bs Input bstream
* @param num The max number of TLVs that will be read, or -1 if unlimited.
* There are a number of places where you want to read in a tlvchain,
* but the chain is not at the end of the SNAC, and the chain is
* preceeded by the number of TLVs. So you can limit that with this.
*/
faim_internal aim_tlvlist_t *aim_tlvlist_readnum(aim_bstream_t *bs, fu16_t num)
{
aim_tlvlist_t *list = NULL, *cur;
while ((aim_bstream_empty(bs) > 0) && (num != 0)) {
fu16_t type, length;
type = aimbs_get16(bs);
length = aimbs_get16(bs);
if (length > aim_bstream_empty(bs)) {
aim_tlvlist_free(&list);
return NULL;
}
cur = (aim_tlvlist_t *)malloc(sizeof(aim_tlvlist_t));
if (!cur) {
aim_tlvlist_free(&list);
return NULL;
}
memset(cur, 0, sizeof(aim_tlvlist_t));
cur->tlv = createtlv(type, length, NULL);
if (!cur->tlv) {
free(cur);
aim_tlvlist_free(&list);
return NULL;
}
if (cur->tlv->length > 0) {
cur->tlv->value = aimbs_getraw(bs, length);
if (!cur->tlv->value) {
freetlv(&cur->tlv);
free(cur);
aim_tlvlist_free(&list);
return NULL;
}
}
if (num > 0)
num--;
cur->next = list;
list = cur;
}
return list;
}
static int paraminfo(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
struct aim_icbmparameters params;
aim_rxcallback_t userfunc;
params.maxchan = aimbs_get16(bs);
params.flags = aimbs_get32(bs);
params.maxmsglen = aimbs_get16(bs);
params.maxsenderwarn = aimbs_get16(bs);
params.maxrecverwarn = aimbs_get16(bs);
params.minmsginterval = aimbs_get32(bs);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
return userfunc(sess, rx, ¶ms);
return 0;
}
/*
* Read a FLAP header from conn into fr, and return the number of bytes in the payload.
*/
static int aim_get_command_flap(aim_session_t *sess, aim_conn_t *conn,
aim_frame_t *fr)
{
fu8_t flaphdr_raw[6];
aim_bstream_t flaphdr;
fu16_t payloadlen;
aim_bstream_init(&flaphdr, flaphdr_raw, sizeof(flaphdr_raw));
/*
* Read FLAP header. Six bytes:
* 0 char -- Always 0x2a
* 1 char -- Channel ID. Usually 2 -- 1 and 4 are used during login.
* 2 short -- Sequence number
* 4 short -- Number of data bytes that follow.
*/
if (aim_bstream_recv(&flaphdr, conn->fd, 6) < 6) {
aim_conn_close(conn);
return -1;
}
aim_bstream_rewind(&flaphdr);
/*
* This shouldn't happen unless the socket breaks, the server breaks,
* or we break. We must handle it just in case.
*/
if (aimbs_get8(&flaphdr) != 0x2a) {
fu8_t start;
aim_bstream_rewind(&flaphdr);
start = aimbs_get8(&flaphdr);
faimdprintf(sess, 0, "FLAP framing disrupted (0x%02x)", start);
aim_conn_close(conn);
return -1;
}
/* we're doing FLAP if we're here */
fr->hdrtype = AIM_FRAMETYPE_FLAP;
fr->hdr.flap.type = aimbs_get8(&flaphdr);
fr->hdr.flap.seqnum = aimbs_get16(&flaphdr);
payloadlen = aimbs_get16(&flaphdr); /* length of payload */
return payloadlen;
}
/**
* aim_readtlvchain - Read a TLV chain from a buffer.
* @buf: Input buffer
* @maxlen: Length of input buffer
*
* Reads and parses a series of TLV patterns from a data buffer; the
* returned structure is manipulatable with the rest of the TLV
* routines. When done with a TLV chain, aim_freetlvchain() should
* be called to free the dynamic substructures.
*
* XXX There should be a flag setable here to have the tlvlist contain
* bstream references, so that at least the ->value portion of each
* element doesn't need to be malloc/memcpy'd. This could prove to be
* just as effecient as the in-place TLV parsing used in a couple places
* in libfaim.
*
*/
faim_internal aim_tlvlist_t *aim_readtlvchain(aim_bstream_t *bs)
{
aim_tlvlist_t *list = NULL, *cur;
fu16_t type, length;
while (aim_bstream_empty(bs)) {
type = aimbs_get16(bs);
length = aimbs_get16(bs);
#if 0 /* temporarily disabled until I know if they're still doing it or not */
/*
* Okay, so now AOL has decided that any TLV of
* type 0x0013 can only be two bytes, despite
* what the actual given length is. So here
* we dump any invalid TLVs of that sort. Hopefully
* theres no special cases to this special case.
* - mid (30jun2000)
*/
if ((type == 0x0013) && (length != 0x0002))
length = 0x0002;
#else
if (0)
;
#endif
else {
cur = (aim_tlvlist_t *)malloc(sizeof(aim_tlvlist_t));
memset(cur, 0, sizeof(aim_tlvlist_t));
cur->tlv = createtlv();
cur->tlv->type = type;
if ((cur->tlv->length = length))
cur->tlv->value = aimbs_getraw(bs, length);
cur->next = list;
list = cur;
}
}
return list;
}
static int missedcall(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
int ret = 0;
aim_rxcallback_t userfunc;
guint16 channel, nummissed, reason;
aim_userinfo_t userinfo;
while (aim_bstream_empty(bs)) {
channel = aimbs_get16(bs);
aim_extractuserinfo(sess, bs, &userinfo);
nummissed = aimbs_get16(bs);
reason = aimbs_get16(bs);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, channel, &userinfo, nummissed, reason);
}
return ret;
}
/*
* Subtype 0x0014 - Receive a mini typing notification (mtn) packet.
*
* This is supported by winaim5 and newer, MacAIM bleh and newer, iChat bleh and newer,
* and Gaim 0.60 and newer.
*
*/
static int mtn_receive(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
int ret = 0;
aim_rxcallback_t userfunc;
char *sn;
guint8 snlen;
guint16 type1, type2;
aim_bstream_advance(bs, 8); /* Unknown - All 0's */
type1 = aimbs_get16(bs);
snlen = aimbs_get8(bs);
sn = aimbs_getstr(bs, snlen);
type2 = aimbs_get16(bs);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, type1, sn, type2);
g_free(sn);
return ret;
}
static int reportinterval(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac,
aim_bstream_t *bs)
{
guint16 interval;
aim_rxcallback_t userfunc;
interval = aimbs_get16(bs);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) {
return userfunc(sess, rx, interval);
}
return 0;
}
/*
* Read a rendezvous header from conn into fr, and return the number of bytes in the payload.
*/
static int aim_get_command_rendezvous(aim_session_t *sess, aim_conn_t *conn,
aim_frame_t *fr)
{
fu8_t rendhdr_raw[8];
aim_bstream_t rendhdr;
aim_bstream_init(&rendhdr, rendhdr_raw, sizeof(rendhdr_raw));
if (aim_bstream_recv(&rendhdr, conn->fd, 8) < 8) {
aim_conn_close(conn);
return -1;
}
aim_bstream_rewind(&rendhdr);
fr->hdrtype = AIM_FRAMETYPE_OFT; /* a misnomer--rendezvous */
aimbs_getrawbuf(&rendhdr, fr->hdr.rend.magic, 4);
fr->hdr.rend.hdrlen = aimbs_get16(&rendhdr) - 8;
fr->hdr.rend.type = aimbs_get16(&rendhdr);
return fr->hdr.rend.hdrlen;
}
static int accountconfirm(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac,
aim_bstream_t *bs)
{
aim_rxcallback_t userfunc;
guint16 status;
status = aimbs_get16(bs);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) {
return userfunc(sess, rx, status);
}
return 0;
}
/*
* Middle handler for 0017/0007 SNACs. Contains the auth key prefixed
* by only its length in a two byte word.
*
* Calls the client, which should then use the value to call aim_send_login.
*
*/
static int keyparse(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
int keylen, ret = 1;
aim_rxcallback_t userfunc;
char *keystr;
keylen = aimbs_get16(bs);
keystr = aimbs_getstr(bs, keylen);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, keystr);
g_free(keystr);
return ret;
}
static int msgack(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
aim_rxcallback_t userfunc;
guint16 type;
guint8 snlen, *ck;
char *sn;
int ret = 0;
ck = aimbs_getraw(bs, 8);
type = aimbs_get16(bs);
snlen = aimbs_get8(bs);
sn = aimbs_getstr(bs, snlen);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, type, sn);
g_free(sn);
g_free(ck);
return ret;
}
/*
* Should be generic enough to handle the errors for all groups.
*
*/
static int generror(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
int ret = 0;
int error = 0;
aim_rxcallback_t userfunc;
aim_snac_t *snac2;
snac2 = aim_remsnac(sess, snac->id);
if (aim_bstream_empty(bs))
error = aimbs_get16(bs);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, error, snac2 ? snac2->data : NULL);
if (snac2)
g_free(snac2->data);
g_free(snac2);
return ret;
}
static int incomingim_ch2(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, guint16 channel, aim_userinfo_t *userinfo, aim_tlvlist_t *tlvlist, guint8 *cookie)
{
aim_rxcallback_t userfunc;
aim_tlv_t *block1, *servdatatlv;
aim_tlvlist_t *list2;
struct aim_incomingim_ch2_args args;
aim_bstream_t bbs, sdbs, *sdbsptr = NULL;
guint8 *cookie2;
int ret = 0;
char clientip1[30] = {""};
char clientip2[30] = {""};
char verifiedip[30] = {""};
memset(&args, 0, sizeof(args));
/*
* There's another block of TLVs embedded in the type 5 here.
*/
block1 = aim_gettlv(tlvlist, 0x0005, 1);
aim_bstream_init(&bbs, block1->value, block1->length);
/*
* First two bytes represent the status of the connection.
*
* 0 is a request, 1 is a deny (?), 2 is an accept
*/
args.status = aimbs_get16(&bbs);
/*
* Next comes the cookie. Should match the ICBM cookie.
*/
cookie2 = aimbs_getraw(&bbs, 8);
if (memcmp(cookie, cookie2, 8) != 0)
imcb_error(sess->aux_data, "rend: warning cookies don't match!");
memcpy(args.cookie, cookie2, 8);
g_free(cookie2);
/*
* The next 16bytes are a capability block so we can
* identify what type of rendezvous this is.
*/
args.reqclass = aim_getcap(sess, &bbs, 0x10);
/*
* What follows may be TLVs or nothing, depending on the
* purpose of the message.
*
* Ack packets for instance have nothing more to them.
*/
list2 = aim_readtlvchain(&bbs);
/*
* IP address from the perspective of the client.
*/
if (aim_gettlv(list2, 0x0002, 1)) {
aim_tlv_t *iptlv;
iptlv = aim_gettlv(list2, 0x0002, 1);
g_snprintf(clientip1, sizeof(clientip1), "%d.%d.%d.%d",
aimutil_get8(iptlv->value+0),
aimutil_get8(iptlv->value+1),
aimutil_get8(iptlv->value+2),
aimutil_get8(iptlv->value+3));
}
/*
* Secondary IP address from the perspective of the client.
*/
if (aim_gettlv(list2, 0x0003, 1)) {
aim_tlv_t *iptlv;
iptlv = aim_gettlv(list2, 0x0003, 1);
g_snprintf(clientip2, sizeof(clientip2), "%d.%d.%d.%d",
aimutil_get8(iptlv->value+0),
aimutil_get8(iptlv->value+1),
aimutil_get8(iptlv->value+2),
aimutil_get8(iptlv->value+3));
}
/*
* Verified IP address (from the perspective of Oscar).
*
* This is added by the server.
*/
if (aim_gettlv(list2, 0x0004, 1)) {
aim_tlv_t *iptlv;
iptlv = aim_gettlv(list2, 0x0004, 1);
g_snprintf(verifiedip, sizeof(verifiedip), "%d.%d.%d.%d",
aimutil_get8(iptlv->value+0),
aimutil_get8(iptlv->value+1),
aimutil_get8(iptlv->value+2),
aimutil_get8(iptlv->value+3));
}
/*
* Port number for something.
*/
if (aim_gettlv(list2, 0x0005, 1))
args.port = aim_gettlv16(list2, 0x0005, 1);
/*
* Error code.
*/
if (aim_gettlv(list2, 0x000b, 1))
args.errorcode = aim_gettlv16(list2, 0x000b, 1);
/*
* Invitation message / chat description.
*/
if (aim_gettlv(list2, 0x000c, 1))
args.msg = aim_gettlv_str(list2, 0x000c, 1);
/*
* Character set.
*/
if (aim_gettlv(list2, 0x000d, 1))
args.encoding = aim_gettlv_str(list2, 0x000d, 1);
/*
* Language.
*/
if (aim_gettlv(list2, 0x000e, 1))
args.language = aim_gettlv_str(list2, 0x000e, 1);
/* Unknown -- two bytes = 0x0001 */
if (aim_gettlv(list2, 0x000a, 1))
;
/* Unknown -- no value */
if (aim_gettlv(list2, 0x000f, 1))
;
if (strlen(clientip1))
args.clientip = (char *)clientip1;
if (strlen(clientip2))
args.clientip2 = (char *)clientip2;
if (strlen(verifiedip))
args.verifiedip = (char *)verifiedip;
/*
* This is must be present in PROPOSALs, but will probably not
* exist in CANCELs and ACCEPTs.
*
* Service Data blocks are module-specific in format.
*/
if ((servdatatlv = aim_gettlv(list2, 0x2711 /* 10001 */, 1))) {
aim_bstream_init(&sdbs, servdatatlv->value, servdatatlv->length);
sdbsptr = &sdbs;
}
if (args.reqclass & AIM_CAPS_ICQSERVERRELAY)
incomingim_ch2_icqserverrelay(sess, mod, rx, snac, userinfo, &args, sdbsptr);
else if (args.reqclass & AIM_CAPS_CHAT)
incomingim_ch2_chat(sess, mod, rx, snac, userinfo, &args, sdbsptr);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, channel, userinfo, &args);
if (args.destructor)
((ch2_args_destructor_t)args.destructor)(sess, &args);
g_free((char *)args.msg);
g_free((char *)args.encoding);
g_free((char *)args.language);
aim_freetlvchain(&list2);
return ret;
}
/*
* We could probably include this in the normal ICBM parsing
* code as channel 0x0003, however, since only the start
* would be the same, we might as well do it here.
*
* General outline of this SNAC:
* snac
* cookie
* channel id
* tlvlist
* unknown
* source user info
* name
* evility
* userinfo tlvs
* online time
* etc
* message metatlv
* message tlv
* message string
* possibly others
*
*/
static int incomingmsg(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
aim_userinfo_t userinfo;
aim_rxcallback_t userfunc;
int ret = 0;
fu8_t *cookie;
fu16_t channel;
aim_tlvlist_t *otl;
char *msg = NULL;
aim_msgcookie_t *ck;
memset(&userinfo, 0, sizeof(aim_userinfo_t));
/*
* ICBM Cookie. Uncache it.
*/
cookie = aimbs_getraw(bs, 8);
if ((ck = aim_uncachecookie(sess, cookie, AIM_COOKIETYPE_CHAT))) {
free(ck->data);
free(ck);
}
/*
* Channel ID
*
* Channels 1 and 2 are implemented in the normal ICBM
* parser.
*
* We only do channel 3 here.
*
*/
channel = aimbs_get16(bs);
if (channel != 0x0003) {
faimdprintf(sess, 0, "faim: chat_incoming: unknown channel! (0x%04x)\n", channel);
return 0;
}
/*
* Start parsing TLVs right away.
*/
otl = aim_readtlvchain(bs);
/*
* Type 0x0003: Source User Information
*/
if (aim_gettlv(otl, 0x0003, 1)) {
aim_tlv_t *userinfotlv;
aim_bstream_t tbs;
userinfotlv = aim_gettlv(otl, 0x0003, 1);
aim_bstream_init(&tbs, userinfotlv->value, userinfotlv->length);
aim_extractuserinfo(sess, &tbs, &userinfo);
}
/*
* Type 0x0001: If present, it means it was a message to the
* room (as opposed to a whisper).
*/
if (aim_gettlv(otl, 0x0001, 1))
;
/*
* Type 0x0005: Message Block. Conains more TLVs.
*/
if (aim_gettlv(otl, 0x0005, 1)) {
aim_tlvlist_t *itl;
aim_tlv_t *msgblock;
aim_bstream_t tbs;
msgblock = aim_gettlv(otl, 0x0005, 1);
aim_bstream_init(&tbs, msgblock->value, msgblock->length);
itl = aim_readtlvchain(&tbs);
/*
* Type 0x0001: Message.
*/
if (aim_gettlv(itl, 0x0001, 1))
msg = aim_gettlv_str(itl, 0x0001, 1);
aim_freetlvchain(&itl);
}
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, &userinfo, msg);
free(cookie);
free(msg);
aim_freetlvchain(&otl);
return ret;
}
/*
* Grab a single command sequence off the socket, and enqueue
* it in the incoming event queue in a seperate struct.
*/
int aim_get_command(aim_session_t *sess, aim_conn_t *conn)
{
guint8 flaphdr_raw[6];
aim_bstream_t flaphdr;
aim_frame_t *newrx;
guint16 payloadlen;
if (!sess || !conn)
return 0;
if (conn->fd == -1)
return -1; /* its a aim_conn_close()'d connection */
/* KIDS, THIS IS WHAT HAPPENS IF YOU USE CODE WRITTEN FOR GUIS IN A DAEMON!
And wouldn't it make sense to return something that prevents this function
from being called again IMMEDIATELY (and making the program suck up all
CPU time)?...
if (conn->fd < 3)
return 0;
*/
if (conn->status & AIM_CONN_STATUS_INPROGRESS)
return aim_conn_completeconnect(sess, conn);
aim_bstream_init(&flaphdr, flaphdr_raw, sizeof(flaphdr_raw));
/*
* Read FLAP header. Six bytes:
*
* 0 char -- Always 0x2a
* 1 char -- Channel ID. Usually 2 -- 1 and 4 are used during login.
* 2 short -- Sequence number
* 4 short -- Number of data bytes that follow.
*/
if (aim_bstream_recv(&flaphdr, conn->fd, 6) < 6) {
aim_conn_close(conn);
return -1;
}
aim_bstream_rewind(&flaphdr);
/*
* This shouldn't happen unless the socket breaks, the server breaks,
* or we break. We must handle it just in case.
*/
if (aimbs_get8(&flaphdr) != 0x2a) {
aim_bstream_rewind(&flaphdr);
aimbs_get8(&flaphdr);
imcb_error(sess->aux_data, "FLAP framing disrupted");
aim_conn_close(conn);
return -1;
}
/* allocate a new struct */
if (!(newrx = (aim_frame_t *)g_new0(aim_frame_t,1)))
return -1;
/* we're doing FLAP if we're here */
newrx->hdrtype = AIM_FRAMETYPE_FLAP;
newrx->hdr.flap.type = aimbs_get8(&flaphdr);
newrx->hdr.flap.seqnum = aimbs_get16(&flaphdr);
payloadlen = aimbs_get16(&flaphdr);
newrx->nofree = 0; /* free by default */
if (payloadlen) {
guint8 *payload = NULL;
if (!(payload = (guint8 *) g_malloc(payloadlen))) {
aim_frame_destroy(newrx);
return -1;
}
aim_bstream_init(&newrx->data, payload, payloadlen);
/* read the payload */
if (aim_bstream_recv(&newrx->data, conn->fd, payloadlen) < payloadlen) {
aim_frame_destroy(newrx); /* free's payload */
aim_conn_close(conn);
return -1;
}
} else
aim_bstream_init(&newrx->data, NULL, 0);
aim_bstream_rewind(&newrx->data);
newrx->conn = conn;
newrx->next = NULL; /* this will always be at the bottom */
if (!sess->queue_incoming)
sess->queue_incoming = newrx;
else {
aim_frame_t *cur;
for (cur = sess->queue_incoming; cur->next; cur = cur->next)
;
cur->next = newrx;
}
newrx->conn->lastactivity = time(NULL);
return 0;
}
/*
* AIM is fairly regular about providing user info. This is a generic
* routine to extract it in its standard form.
*/
faim_internal int aim_extractuserinfo(aim_session_t *sess, aim_bstream_t *bs, aim_userinfo_t *outinfo)
{
int curtlv, tlvcnt;
fu8_t snlen;
if (!bs || !outinfo)
return -EINVAL;
/* Clear out old data first */
memset(outinfo, 0x00, sizeof(aim_userinfo_t));
/*
* Screen name. Stored as an unterminated string prepended with a
* byte containing its length.
*/
snlen = aimbs_get8(bs);
aimbs_getrawbuf(bs, outinfo->sn, snlen);
/*
* Warning Level. Stored as an unsigned short.
*/
outinfo->warnlevel = aimbs_get16(bs);
/*
* TLV Count. Unsigned short representing the number of
* Type-Length-Value triples that follow.
*/
tlvcnt = aimbs_get16(bs);
/*
* Parse out the Type-Length-Value triples as they're found.
*/
for (curtlv = 0; curtlv < tlvcnt; curtlv++) {
int endpos;
fu16_t type, length;
type = aimbs_get16(bs);
length = aimbs_get16(bs);
endpos = aim_bstream_curpos(bs) + length;
if (type == 0x0001) {
/*
* Type = 0x0001: User flags
*
* Specified as any of the following ORed together:
* 0x0001 Trial (user less than 60days)
* 0x0002 Unknown bit 2
* 0x0004 AOL Main Service user
* 0x0008 Unknown bit 4
* 0x0010 Free (AIM) user
* 0x0020 Away
* 0x0400 ActiveBuddy
*
*/
outinfo->flags = aimbs_get16(bs);
} else if (type == 0x0002) {
/*
* Type = 0x0002: Member-Since date.
*
* The time/date that the user originally registered for
* the service, stored in time_t format.
*/
outinfo->membersince = aimbs_get32(bs);
} else if (type == 0x0003) {
/*
* Type = 0x0003: On-Since date.
*
* The time/date that the user started their current
* session, stored in time_t format.
*/
outinfo->onlinesince = aimbs_get32(bs);
} else if (type == 0x0004) {
/*
* Type = 0x0004: Idle time.
*
* Number of seconds since the user actively used the
* service.
*
* Note that the client tells the server when to start
* counting idle times, so this may or may not be
* related to reality.
*/
outinfo->idletime = aimbs_get16(bs);
} else if (type == 0x0006) {
/*
* Type = 0x0006: ICQ Online Status
*
* ICQ's Away/DND/etc "enriched" status. Some decoding
* of values done by Scott <*****@*****.**>
*/
aimbs_get16(bs);
outinfo->icqinfo.status = aimbs_get16(bs);
} else if (type == 0x000a) {
/*
* Type = 0x000a
*
* ICQ User IP Address.
* Ahh, the joy of ICQ security.
*/
outinfo->icqinfo.ipaddr = aimbs_get32(bs);
} else if (type == 0x000c) {
/*
* Type = 0x000c
*
* random crap containing the IP address,
* apparently a port number, and some Other Stuff.
*
*/
aimbs_getrawbuf(bs, outinfo->icqinfo.crap, 0x25);
} else if (type == 0x000d) {
/*
* Type = 0x000d
*
* Capability information.
*
*/
outinfo->capabilities = aim_getcap(sess, bs, length);
outinfo->capspresent = 1;
} else if (type == 0x000e) {
/*
* Type = 0x000e
*
* Unknown. Always of zero length, and always only
* on AOL users.
*
* Ignore.
*
*/
} else if ((type == 0x000f) || (type == 0x0010)) {
/*
* Type = 0x000f: Session Length. (AIM)
* Type = 0x0010: Session Length. (AOL)
*
* The duration, in seconds, of the user's current
* session.
*
* Which TLV type this comes in depends on the
* service the user is using (AIM or AOL).
*
*/
outinfo->sessionlen = aimbs_get32(bs);
} else {
/*
* Reaching here indicates that either AOL has
* added yet another TLV for us to deal with,
* or the parsing has gone Terribly Wrong.
*
* Either way, inform the owner and attempt
* recovery.
*
*/
faimdprintf(sess, 0, "userinfo: **warning: unexpected TLV:\n");
faimdprintf(sess, 0, "userinfo: sn =%s\n", outinfo->sn);
faimdprintf(sess, 0, "userinfo: type =0x%04x\n",type);
faimdprintf(sess, 0, "userinfo: length=0x%04x\n", length);
}
/* Save ourselves. */
aim_bstream_setpos(bs, endpos);
}
return 0;
}
static int parseinfo_create(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs, aim_snac_t *snac2)
{
aim_rxcallback_t userfunc;
aim_tlvlist_t *tlvlist, *innerlist;
char *ck = NULL, *fqcn = NULL, *name = NULL;
fu16_t exchange = 0, instance = 0, unknown = 0, flags = 0, maxmsglen = 0, maxoccupancy = 0;
fu32_t createtime = 0;
fu8_t createperms = 0, detaillevel;
int cklen;
aim_tlv_t *bigblock;
int ret = 0;
aim_bstream_t bbbs;
tlvlist = aim_readtlvchain(bs);
if (!(bigblock = aim_gettlv(tlvlist, 0x0004, 1))) {
faimdprintf(sess, 0, "no bigblock in top tlv in create room response\n");
aim_freetlvchain(&tlvlist);
return 0;
}
aim_bstream_init(&bbbs, bigblock->value, bigblock->length);
exchange = aimbs_get16(&bbbs);
cklen = aimbs_get8(&bbbs);
ck = aimbs_getstr(&bbbs, cklen);
instance = aimbs_get16(&bbbs);
detaillevel = aimbs_get8(&bbbs);
if (detaillevel != 0x02) {
faimdprintf(sess, 0, "unknown detaillevel in create room response (0x%02x)\n", detaillevel);
aim_freetlvchain(&tlvlist);
free(ck);
return 0;
}
unknown = aimbs_get16(&bbbs);
innerlist = aim_readtlvchain(&bbbs);
if (aim_gettlv(innerlist, 0x006a, 1))
fqcn = aim_gettlv_str(innerlist, 0x006a, 1);
if (aim_gettlv(innerlist, 0x00c9, 1))
flags = aim_gettlv16(innerlist, 0x00c9, 1);
if (aim_gettlv(innerlist, 0x00ca, 1))
createtime = aim_gettlv32(innerlist, 0x00ca, 1);
if (aim_gettlv(innerlist, 0x00d1, 1))
maxmsglen = aim_gettlv16(innerlist, 0x00d1, 1);
if (aim_gettlv(innerlist, 0x00d2, 1))
maxoccupancy = aim_gettlv16(innerlist, 0x00d2, 1);
if (aim_gettlv(innerlist, 0x00d3, 1))
name = aim_gettlv_str(innerlist, 0x00d3, 1);
if (aim_gettlv(innerlist, 0x00d5, 1))
createperms = aim_gettlv8(innerlist, 0x00d5, 1);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) {
ret = userfunc(sess, rx, snac2->type, fqcn, instance, exchange, flags, createtime, maxmsglen, maxoccupancy, createperms, unknown, name, ck);
}
free(ck);
free(name);
free(fqcn);
aim_freetlvchain(&innerlist);
aim_freetlvchain(&tlvlist);
return ret;
}
static int parseinfo_perms(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs, aim_snac_t *snac2)
{
aim_rxcallback_t userfunc;
int ret = 0;
struct aim_chat_exchangeinfo *exchanges = NULL;
int curexchange;
aim_tlv_t *exchangetlv;
fu8_t maxrooms = 0;
aim_tlvlist_t *tlvlist, *innerlist;
tlvlist = aim_readtlvchain(bs);
/*
* Type 0x0002: Maximum concurrent rooms.
*/
if (aim_gettlv(tlvlist, 0x0002, 1))
maxrooms = aim_gettlv8(tlvlist, 0x0002, 1);
/*
* Type 0x0003: Exchange information
*
* There can be any number of these, each one
* representing another exchange.
*
*/
for (curexchange = 0; ((exchangetlv = aim_gettlv(tlvlist, 0x0003, curexchange+1))); ) {
aim_bstream_t tbs;
aim_bstream_init(&tbs, exchangetlv->value, exchangetlv->length);
curexchange++;
exchanges = realloc(exchanges, curexchange * sizeof(struct aim_chat_exchangeinfo));
/* exchange number */
exchanges[curexchange-1].number = aimbs_get16(&tbs);
innerlist = aim_readtlvchain(&tbs);
/*
* Type 0x000a: Unknown.
*
* Usually three bytes: 0x0114 (exchange 1) or 0x010f (others).
*
*/
if (aim_gettlv(innerlist, 0x000a, 1))
;
/*
* Type 0x000d: Unknown.
*/
if (aim_gettlv(innerlist, 0x000d, 1))
;
/*
* Type 0x0004: Unknown
*/
if (aim_gettlv(innerlist, 0x0004, 1))
;
/*
* Type 0x0002: Unknown
*/
if (aim_gettlv(innerlist, 0x0002, 1)) {
fu16_t classperms;
classperms = aim_gettlv16(innerlist, 0x0002, 1);
faimdprintf(sess, 1, "faim: class permissions %x\n", classperms);
}
/*
* Type 0x00c9: Flags
*
* 1 Evilable
* 2 Nav Only
* 4 Instancing Allowed
* 8 Occupant Peek Allowed
*
*/
if (aim_gettlv(innerlist, 0x00c9, 1))
exchanges[curexchange-1].flags = aim_gettlv16(innerlist, 0x00c9, 1);
/*
* Type 0x00ca: Creation Date
*/
if (aim_gettlv(innerlist, 0x00ca, 1))
;
/*
* Type 0x00d0: Mandatory Channels?
*/
if (aim_gettlv(innerlist, 0x00d0, 1))
;
/*
* Type 0x00d1: Maximum Message length
*/
if (aim_gettlv(innerlist, 0x00d1, 1))
;
/*
* Type 0x00d2: Maximum Occupancy?
*/
if (aim_gettlv(innerlist, 0x00d2, 1))
;
/*
* Type 0x00d3: Exchange Description
*/
if (aim_gettlv(innerlist, 0x00d3, 1))
exchanges[curexchange-1].name = aim_gettlv_str(innerlist, 0x00d3, 1);
else
exchanges[curexchange-1].name = NULL;
/*
* Type 0x00d4: Exchange Description URL
*/
if (aim_gettlv(innerlist, 0x00d4, 1))
;
/*
* Type 0x00d5: Creation Permissions
*
* 0 Creation not allowed
* 1 Room creation allowed
* 2 Exchange creation allowed
*
*/
if (aim_gettlv(innerlist, 0x00d5, 1)) {
fu8_t createperms;
createperms = aim_gettlv8(innerlist, 0x00d5, 1);
}
/*
* Type 0x00d6: Character Set (First Time)
*/
if (aim_gettlv(innerlist, 0x00d6, 1))
exchanges[curexchange-1].charset1 = aim_gettlv_str(innerlist, 0x00d6, 1);
else
exchanges[curexchange-1].charset1 = NULL;
/*
* Type 0x00d7: Language (First Time)
*/
if (aim_gettlv(innerlist, 0x00d7, 1))
exchanges[curexchange-1].lang1 = aim_gettlv_str(innerlist, 0x00d7, 1);
else
exchanges[curexchange-1].lang1 = NULL;
/*
* Type 0x00d8: Character Set (Second Time)
*/
if (aim_gettlv(innerlist, 0x00d8, 1))
exchanges[curexchange-1].charset2 = aim_gettlv_str(innerlist, 0x00d8, 1);
else
exchanges[curexchange-1].charset2 = NULL;
/*
* Type 0x00d9: Language (Second Time)
*/
if (aim_gettlv(innerlist, 0x00d9, 1))
exchanges[curexchange-1].lang2 = aim_gettlv_str(innerlist, 0x00d9, 1);
else
exchanges[curexchange-1].lang2 = NULL;
/*
* Type 0x00da: Unknown
*/
if (aim_gettlv(innerlist, 0x00da, 1))
;
aim_freetlvchain(&innerlist);
}
/*
* Call client.
*/
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, snac2->type, maxrooms, curexchange, exchanges);
for (curexchange--; curexchange >= 0; curexchange--) {
free(exchanges[curexchange].name);
free(exchanges[curexchange].charset1);
free(exchanges[curexchange].lang1);
free(exchanges[curexchange].charset2);
free(exchanges[curexchange].lang2);
}
free(exchanges);
aim_freetlvchain(&tlvlist);
return ret;
}
/*
* Bleck functions get called when there's no non-bleck functions
* around to cleanup the mess...
*/
faim_internal int bleck(aim_session_t *sess, aim_frame_t *frame, ...)
{
fu16_t family, subtype;
fu16_t maxf, maxs;
static const char *channels[6] = {
"Invalid (0)",
"FLAP Version",
"SNAC",
"Invalid (3)",
"Negotiation",
"FLAP NOP"
};
static const int maxchannels = 5;
/* XXX: this is ugly. and big just for debugging. */
static const char *literals[14][25] = {
{"Invalid",
NULL
},
{"General",
"Invalid",
"Error",
"Client Ready",
"Server Ready",
"Service Request",
"Redirect",
"Rate Information Request",
"Rate Information",
"Rate Information Ack",
NULL,
"Rate Information Change",
"Server Pause",
NULL,
"Server Resume",
"Request Personal User Information",
"Personal User Information",
"Evil Notification",
NULL,
"Migration notice",
"Message of the Day",
"Set Privacy Flags",
"Well Known URL",
"NOP"
},
{"Location",
"Invalid",
"Error",
"Request Rights",
"Rights Information",
"Set user information",
"Request User Information",
"User Information",
"Watcher Sub Request",
"Watcher Notification"
},
{"Buddy List Management",
"Invalid",
"Error",
"Request Rights",
"Rights Information",
"Add Buddy",
"Remove Buddy",
"Watcher List Query",
"Watcher List Response",
"Watcher SubRequest",
"Watcher Notification",
"Reject Notification",
"Oncoming Buddy",
"Offgoing Buddy"
},
{"Messeging",
"Invalid",
"Error",
"Add ICBM Parameter",
"Remove ICBM Parameter",
"Request Parameter Information",
"Parameter Information",
"Outgoing Message",
"Incoming Message",
"Evil Request",
"Evil Reply",
"Missed Calls",
"Message Error",
"Host Ack"
},
{"Advertisements",
"Invalid",
"Error",
"Request Ad",
"Ad Data (GIFs)"
},
{"Invitation / Client-to-Client",
"Invalid",
"Error",
"Invite a Friend",
"Invitation Ack"
},
{"Administrative",
"Invalid",
"Error",
"Information Request",
"Information Reply",
"Information Change Request",
"Information Chat Reply",
"Account Confirm Request",
"Account Confirm Reply",
"Account Delete Request",
"Account Delete Reply"
},
{"Popups",
"Invalid",
"Error",
"Display Popup"
},
{"BOS",
"Invalid",
"Error",
"Request Rights",
"Rights Response",
"Set group permission mask",
"Add permission list entries",
"Delete permission list entries",
"Add deny list entries",
"Delete deny list entries",
"Server Error"
},
{"User Lookup",
"Invalid",
"Error",
"Search Request",
"Search Response"
},
{"Stats",
"Invalid",
"Error",
"Set minimum report interval",
"Report Events"
},
{"Translate",
"Invalid",
"Error",
"Translate Request",
"Translate Reply",
},
{"Chat Navigation",
"Invalid",
"Error",
"Request rights",
"Request Exchange Information",
"Request Room Information",
"Request Occupant List",
"Search for Room",
"Outgoing Message",
"Incoming Message",
"Evil Request",
"Evil Reply",
"Chat Error",
}
};
maxf = sizeof(literals) / sizeof(literals[0]);
maxs = sizeof(literals[0]) / sizeof(literals[0][0]);
if (frame->hdr.flap.channel == 0x02) {
family = aimbs_get16(&frame->data);
subtype = aimbs_get16(&frame->data);
if ((family < maxf) && (subtype+1 < maxs) && (literals[family][subtype] != NULL))
faimdprintf(sess, 0, "bleck: channel %s: null handler for %04x/%04x (%s)\n", channels[frame->hdr.flap.channel], family, subtype, literals[family][subtype+1]);
else
faimdprintf(sess, 0, "bleck: channel %s: null handler for %04x/%04x (no literal)\n", channels[frame->hdr.flap.channel], family, subtype);
} else {
if (frame->hdr.flap.channel <= maxchannels)
faimdprintf(sess, 0, "bleck: channel %s (0x%02x)\n", channels[frame->hdr.flap.channel], frame->hdr.flap.channel);
else
faimdprintf(sess, 0, "bleck: unknown channel 0x%02x\n", frame->hdr.flap.channel);
}
return 1;
}
/*
* General room information. Lots of stuff.
*
* Values I know are in here but I havent attached
* them to any of the 'Unknown's:
* - Language (English)
*
* SNAC 000e/0002
*/
static int infoupdate(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, aim_bstream_t *bs)
{
aim_userinfo_t *userinfo = NULL;
aim_rxcallback_t userfunc;
int ret = 0;
int usercount = 0;
fu8_t detaillevel = 0;
char *roomname = NULL;
struct aim_chat_roominfo roominfo;
fu16_t tlvcount = 0;
aim_tlvlist_t *tlvlist;
char *roomdesc = NULL;
fu16_t flags = 0;
fu32_t creationtime = 0;
fu16_t maxmsglen = 0, maxvisiblemsglen = 0;
fu16_t unknown_d2 = 0, unknown_d5 = 0;
aim_chat_readroominfo(bs, &roominfo);
detaillevel = aimbs_get8(bs);
if (detaillevel != 0x02) {
faimdprintf(sess, 0, "faim: chat_roomupdateinfo: detail level %d not supported\n", detaillevel);
return 1;
}
tlvcount = aimbs_get16(bs);
/*
* Everything else are TLVs.
*/
tlvlist = aim_readtlvchain(bs);
/*
* TLV type 0x006a is the room name in Human Readable Form.
*/
if (aim_gettlv(tlvlist, 0x006a, 1))
roomname = aim_gettlv_str(tlvlist, 0x006a, 1);
/*
* Type 0x006f: Number of occupants.
*/
if (aim_gettlv(tlvlist, 0x006f, 1))
usercount = aim_gettlv16(tlvlist, 0x006f, 1);
/*
* Type 0x0073: Occupant list.
*/
if (aim_gettlv(tlvlist, 0x0073, 1)) {
int curoccupant = 0;
aim_tlv_t *tmptlv;
aim_bstream_t occbs;
tmptlv = aim_gettlv(tlvlist, 0x0073, 1);
/* Allocate enough userinfo structs for all occupants */
userinfo = calloc(usercount, sizeof(aim_userinfo_t));
aim_bstream_init(&occbs, tmptlv->value, tmptlv->length);
while (curoccupant < usercount)
aim_extractuserinfo(sess, &occbs, &userinfo[curoccupant++]);
}
/*
* Type 0x00c9: Flags. (AIM_CHATROOM_FLAG)
*/
if (aim_gettlv(tlvlist, 0x00c9, 1))
flags = aim_gettlv16(tlvlist, 0x00c9, 1);
/*
* Type 0x00ca: Creation time (4 bytes)
*/
if (aim_gettlv(tlvlist, 0x00ca, 1))
creationtime = aim_gettlv32(tlvlist, 0x00ca, 1);
/*
* Type 0x00d1: Maximum Message Length
*/
if (aim_gettlv(tlvlist, 0x00d1, 1))
maxmsglen = aim_gettlv16(tlvlist, 0x00d1, 1);
/*
* Type 0x00d2: Unknown. (2 bytes)
*/
if (aim_gettlv(tlvlist, 0x00d2, 1))
unknown_d2 = aim_gettlv16(tlvlist, 0x00d2, 1);
/*
* Type 0x00d3: Room Description
*/
if (aim_gettlv(tlvlist, 0x00d3, 1))
roomdesc = aim_gettlv_str(tlvlist, 0x00d3, 1);
/*
* Type 0x000d4: Unknown (flag only)
*/
if (aim_gettlv(tlvlist, 0x000d4, 1))
;
/*
* Type 0x00d5: Unknown. (1 byte)
*/
if (aim_gettlv(tlvlist, 0x00d5, 1))
unknown_d5 = aim_gettlv8(tlvlist, 0x00d5, 1);
/*
* Type 0x00d6: Encoding 1 ("us-ascii")
*/
if (aim_gettlv(tlvlist, 0x000d6, 1))
;
/*
* Type 0x00d7: Language 1 ("en")
*/
if (aim_gettlv(tlvlist, 0x000d7, 1))
;
/*
* Type 0x00d8: Encoding 2 ("us-ascii")
*/
if (aim_gettlv(tlvlist, 0x000d8, 1))
;
/*
* Type 0x00d9: Language 2 ("en")
*/
if (aim_gettlv(tlvlist, 0x000d9, 1))
;
/*
* Type 0x00da: Maximum visible message length
*/
if (aim_gettlv(tlvlist, 0x000da, 1))
maxvisiblemsglen = aim_gettlv16(tlvlist, 0x00da, 1);
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype))) {
ret = userfunc(sess,
rx,
&roominfo,
roomname,
usercount,
userinfo,
roomdesc,
flags,
creationtime,
maxmsglen,
unknown_d2,
unknown_d5,
maxvisiblemsglen);
}
free(roominfo.name);
free(userinfo);
free(roomname);
free(roomdesc);
aim_freetlvchain(&tlvlist);
return ret;
}
/*
* AIM is fairly regular about providing user info. This is a generic
* routine to extract it in its standard form.
*/
faim_internal int aim_extractuserinfo(aim_session_t *sess, aim_bstream_t *bs, aim_userinfo_t *outinfo)
{
int curtlv, tlvcnt;
fu8_t snlen;
if (!bs || !outinfo)
return -EINVAL;
/* Clear out old data first */
memset(outinfo, 0x00, sizeof(aim_userinfo_t));
/*
* Screen name. Stored as an unterminated string prepended with a
* byte containing its length.
*/
snlen = aimbs_get8(bs);
aimbs_getrawbuf(bs, outinfo->sn, snlen);
/*
* Warning Level. Stored as an unsigned short.
*/
outinfo->warnlevel = aimbs_get16(bs);
/*
* TLV Count. Unsigned short representing the number of
* Type-Length-Value triples that follow.
*/
tlvcnt = aimbs_get16(bs);
/*
* Parse out the Type-Length-Value triples as they're found.
*/
for (curtlv = 0; curtlv < tlvcnt; curtlv++) {
int endpos;
fu16_t type, length;
type = aimbs_get16(bs);
length = aimbs_get16(bs);
endpos = aim_bstream_curpos(bs) + length;
if (type == 0x0001) {
/*
* Type = 0x0001: User flags
*
* Specified as any of the following ORed together:
* 0x0001 Trial (user less than 60days)
* 0x0002 Unknown bit 2
* 0x0004 AOL Main Service user
* 0x0008 Unknown bit 4
* 0x0010 Free (AIM) user
* 0x0020 Away
* 0x0400 ActiveBuddy
*
*/
outinfo->flags = aimbs_get16(bs);
outinfo->present |= AIM_USERINFO_PRESENT_FLAGS;
} else if (type == 0x0002) {
/*
* Type = 0x0002: Account creation time.
*
* The time/date that the user originally registered for
* the service, stored in time_t format.
*
* I'm not sure how this differs from type 5 ("member
* since").
*
* Note: This is the field formerly known as "member
* since". All these years and I finally found out
* that I got the name wrong.
*/
outinfo->createtime = aimbs_get32(bs);
outinfo->present |= AIM_USERINFO_PRESENT_CREATETIME;
} else if (type == 0x0003) {
/*
* Type = 0x0003: On-Since date.
*
* The time/date that the user started their current
* session, stored in time_t format.
*/
outinfo->onlinesince = aimbs_get32(bs);
outinfo->present |= AIM_USERINFO_PRESENT_ONLINESINCE;
} else if (type == 0x0004) {
/*
* Type = 0x0004: Idle time.
*
* Number of seconds since the user actively used the
* service.
*
* Note that the client tells the server when to start
* counting idle times, so this may or may not be
* related to reality.
*/
outinfo->idletime = aimbs_get16(bs);
outinfo->present |= AIM_USERINFO_PRESENT_IDLE;
} else if (type == 0x0005) {
/*
* Type = 0x0005: Member since date.
*
* The time/date that the user originally registered for
* the service, stored in time_t format.
*
* This is sometimes sent instead of type 2 ("account
* creation time"), particularly in the self-info.
*/
outinfo->membersince = aimbs_get32(bs);
outinfo->present |= AIM_USERINFO_PRESENT_MEMBERSINCE;
} else if (type == 0x0006) {
/*
* Type = 0x0006: ICQ Online Status
*
* ICQ's Away/DND/etc "enriched" status. Some decoding
* of values done by Scott <*****@*****.**>
*/
aimbs_get16(bs);
outinfo->icqinfo.status = aimbs_get16(bs);
outinfo->present |= AIM_USERINFO_PRESENT_ICQEXTSTATUS;
} else if (type == 0x000a) {
/*
* Type = 0x000a
*
* ICQ User IP Address.
* Ahh, the joy of ICQ security.
*/
outinfo->icqinfo.ipaddr = aimbs_get32(bs);
outinfo->present |= AIM_USERINFO_PRESENT_ICQIPADDR;
} else if (type == 0x000c) {
/*
* Type = 0x000c
*
* random crap containing the IP address,
* apparently a port number, and some Other Stuff.
*
*/
aimbs_getrawbuf(bs, outinfo->icqinfo.crap, 0x25);
outinfo->present |= AIM_USERINFO_PRESENT_ICQDATA;
} else if (type == 0x000d) {
/*
* Type = 0x000d
*
* Capability information.
*
*/
outinfo->capabilities = aim_getcap(sess, bs, length);
outinfo->present |= AIM_USERINFO_PRESENT_CAPABILITIES;
} else if (type == 0x000e) {
/*
* Type = 0x000e
*
* Unknown. Always of zero length, and always only
* on AOL users.
*
* Ignore.
*
*/
} else if ((type == 0x000f) || (type == 0x0010)) {
/*
* Type = 0x000f: Session Length. (AIM)
* Type = 0x0010: Session Length. (AOL)
*
* The duration, in seconds, of the user's current
* session.
*
* Which TLV type this comes in depends on the
* service the user is using (AIM or AOL).
*
*/
outinfo->sessionlen = aimbs_get32(bs);
outinfo->present |= AIM_USERINFO_PRESENT_SESSIONLEN;
} else if (type == 0x001d) {
/*
* Type 29: Unknown.
*
* Currently very rare. Always 18 bytes of mostly zero.
*/
} else if (type == 0x001e) {
/*
* Type 30: Unknown.
*
* Always four bytes, but it doesn't look like an int.
*/
} else {
/*
* Reaching here indicates that either AOL has
* added yet another TLV for us to deal with,
* or the parsing has gone Terribly Wrong.
*
* Either way, inform the owner and attempt
* recovery.
*
*/
faimdprintf(sess, 0, "userinfo: **warning: unexpected TLV:\n");
faimdprintf(sess, 0, "userinfo: sn =%s\n", outinfo->sn);
dumptlv(sess, type, bs, length);
}
/* Save ourselves. */
aim_bstream_setpos(bs, endpos);
}
return 0;
}
static int incomingim_ch1(aim_session_t *sess, aim_module_t *mod, aim_frame_t *rx, aim_modsnac_t *snac, guint16 channel, aim_userinfo_t *userinfo, aim_bstream_t *bs, guint8 *cookie)
{
guint16 type, length;
aim_rxcallback_t userfunc;
int ret = 0;
struct aim_incomingim_ch1_args args;
int endpos;
memset(&args, 0, sizeof(args));
aim_mpmsg_init(sess, &args.mpmsg);
/*
* This used to be done using tlvchains. For performance reasons,
* I've changed it to process the TLVs in-place. This avoids lots
* of per-IM memory allocations.
*/
while (aim_bstream_empty(bs)) {
type = aimbs_get16(bs);
length = aimbs_get16(bs);
endpos = aim_bstream_curpos(bs) + length;
if (type == 0x0002) { /* Message Block */
/*
* This TLV consists of the following:
* - 0501 -- Unknown
* - Features: Don't know how to interpret these
* - 0101 -- Unknown
* - Message
*
*/
aimbs_get8(bs); /* 05 */
aimbs_get8(bs); /* 01 */
args.featureslen = aimbs_get16(bs);
/* XXX XXX this is all evil! */
args.features = bs->data + bs->offset;
aim_bstream_advance(bs, args.featureslen);
args.icbmflags |= AIM_IMFLAGS_CUSTOMFEATURES;
/*
* The rest of the TLV contains one or more message
* blocks...
*/
incomingim_ch1_parsemsgs(sess, bs->data + bs->offset /* XXX evil!!! */, length - 2 - 2 - args.featureslen, &args);
} else if (type == 0x0003) { /* Server Ack Requested */
args.icbmflags |= AIM_IMFLAGS_ACK;
} else if (type == 0x0004) { /* Message is Auto Response */
args.icbmflags |= AIM_IMFLAGS_AWAY;
} else if (type == 0x0006) { /* Message was received offline. */
/* XXX not sure if this actually gets sent. */
args.icbmflags |= AIM_IMFLAGS_OFFLINE;
} else if (type == 0x0008) { /* I-HAVE-A-REALLY-PURTY-ICON Flag */
args.iconlen = aimbs_get32(bs);
aimbs_get16(bs); /* 0x0001 */
args.iconsum = aimbs_get16(bs);
args.iconstamp = aimbs_get32(bs);
/*
* This looks to be a client bug. MacAIM 4.3 will
* send this tag, but with all zero values, in the
* first message of a conversation. This makes no
* sense whatsoever, so I'm going to say its a bug.
*
* You really shouldn't advertise a zero-length icon
* anyway.
*
*/
if (args.iconlen)
args.icbmflags |= AIM_IMFLAGS_HASICON;
} else if (type == 0x0009) {
args.icbmflags |= AIM_IMFLAGS_BUDDYREQ;
} else if (type == 0x0017) {
args.extdatalen = length;
args.extdata = aimbs_getraw(bs, args.extdatalen);
} else {
// imcb_error(sess->aux_data, "Unknown TLV encountered");
}
/*
* This is here to protect ourselves from ourselves. That
* is, if something above doesn't completly parse its value
* section, or, worse, overparses it, this will set the
* stream where it needs to be in order to land on the next
* TLV when the loop continues.
*
*/
aim_bstream_setpos(bs, endpos);
}
if ((userfunc = aim_callhandler(sess, rx->conn, snac->family, snac->subtype)))
ret = userfunc(sess, rx, channel, userinfo, &args);
aim_mpmsg_free(sess, &args.mpmsg);
g_free(args.extdata);
return ret;
}
/*
* Grab a single command sequence off the socket, and enqueue
* it in the incoming event queue in a seperate struct.
*/
faim_export int aim_get_command(aim_session_t *sess, aim_conn_t *conn)
{
fu8_t flaphdr_raw[6];
aim_bstream_t flaphdr;
aim_frame_t *newrx;
fu16_t payloadlen;
if (!sess || !conn)
return 0;
if (conn->fd == -1)
return -1; /* its a aim_conn_close()'d connection */
if (conn->fd < 3) /* can happen when people abuse the interface */
return 0;
if (conn->status & AIM_CONN_STATUS_INPROGRESS)
return aim_conn_completeconnect(sess, conn);
/*
* Rendezvous (client-client) connections do not speak
* FLAP, so this function will break on them.
*/
if (conn->type == AIM_CONN_TYPE_RENDEZVOUS)
return aim_get_command_rendezvous(sess, conn);
else if (conn->type == AIM_CONN_TYPE_RENDEZVOUS_OUT) {
faimdprintf(sess, 0, "AIM_CONN_TYPE_RENDEZVOUS_OUT on fd %d\n", conn->fd);
return 0;
}
aim_bstream_init(&flaphdr, flaphdr_raw, sizeof(flaphdr_raw));
/*
* Read FLAP header. Six bytes:
*
* 0 char -- Always 0x2a
* 1 char -- Channel ID. Usually 2 -- 1 and 4 are used during login.
* 2 short -- Sequence number
* 4 short -- Number of data bytes that follow.
*/
if (aim_bstream_recv(&flaphdr, conn->fd, 6) < 6) {
aim_conn_close(conn);
return -1;
}
aim_bstream_rewind(&flaphdr);
/*
* This shouldn't happen unless the socket breaks, the server breaks,
* or we break. We must handle it just in case.
*/
if (aimbs_get8(&flaphdr) != 0x2a) {
fu8_t start;
aim_bstream_rewind(&flaphdr);
start = aimbs_get8(&flaphdr);
faimdprintf(sess, 0, "FLAP framing disrupted (0x%02x)", start);
aim_conn_close(conn);
return -1;
}
/* allocate a new struct */
if (!(newrx = (aim_frame_t *)malloc(sizeof(aim_frame_t))))
return -1;
memset(newrx, 0, sizeof(aim_frame_t));
/* we're doing FLAP if we're here */
newrx->hdrtype = AIM_FRAMETYPE_FLAP;
newrx->hdr.flap.type = aimbs_get8(&flaphdr);
newrx->hdr.flap.seqnum = aimbs_get16(&flaphdr);
payloadlen = aimbs_get16(&flaphdr);
newrx->nofree = 0; /* free by default */
if (payloadlen) {
fu8_t *payload = NULL;
if (!(payload = (fu8_t *) malloc(payloadlen))) {
aim_frame_destroy(newrx);
return -1;
}
aim_bstream_init(&newrx->data, payload, payloadlen);
/* read the payload */
if (aim_bstream_recv(&newrx->data, conn->fd, payloadlen) < payloadlen) {
free(payload);
aim_frame_destroy(newrx);
aim_conn_close(conn);
return -1;
}
} else
aim_bstream_init(&newrx->data, NULL, 0);
aim_bstream_rewind(&newrx->data);
newrx->conn = conn;
newrx->next = NULL; /* this will always be at the bottom */
if (!sess->queue_incoming)
sess->queue_incoming = newrx;
else {
aim_frame_t *cur;
for (cur = sess->queue_incoming; cur->next; cur = cur->next)
;
cur->next = newrx;
}
newrx->conn->lastactivity = time(NULL);
return 0;
}
