Fix string negation bug

diff --git a/hotline/account.go b/hotline/account.go
index b0e9ee5fed98ecf90c3b58e31fbeda4e3a2b6d7c..bcacc73c574a5d2bc0167c057df4adb8bd6360d9 100644 (file)
--- a/hotline/account.go
+++ b/hotline/account.go
@@ -45,7 +45,7 @@ func (a *Account) Payload() (out []byte) {
 
                []byte{0x00, 0x69}, // fieldUserLogin
                loginLen,
-               []byte(NegatedUserString([]byte(a.Login))),
+               negateString([]byte(a.Login)),
 
                []byte{0x00, 0x6e}, // fieldUserAccess
                []byte{0x00, 0x08},

diff --git a/hotline/client.go b/hotline/client.go
index fb3f4e781600b1d041240f005294e91f34880fbb..b423f9f7d778a1c30ec3341b72b742e98c6618f6 100644 (file)
--- a/hotline/client.go
+++ b/hotline/client.go
@@ -612,8 +612,8 @@ func (c *Client) LogIn(login string, password string) error {
                        tranLogin, nil,
                        NewField(fieldUserName, []byte(c.pref.Username)),
                        NewField(fieldUserIconID, c.pref.IconBytes()),
-                       NewField(fieldUserLogin, []byte(NegatedUserString([]byte(login)))),
-                       NewField(fieldUserPassword, []byte(NegatedUserString([]byte(password)))),
+                       NewField(fieldUserLogin, negateString([]byte(login))),
+                       NewField(fieldUserPassword, negateString([]byte(password))),
                        NewField(fieldVersion, []byte{0, 2}),
                ),
        )

diff --git a/hotline/server_blackbox_test.go b/hotline/server_blackbox_test.go
index b8990adc6fa3456e70691f83d7567e6e53526b1a..41d331b34c13ccd70eb6dcc2293e9cc5423ab9e2 100644 (file)
--- a/hotline/server_blackbox_test.go
+++ b/hotline/server_blackbox_test.go
@@ -22,7 +22,7 @@ type testCase struct {
 }
 
 func (tt *testCase) Setup(srv *Server) error {
-       if err := srv.NewUser(tt.account.Login, tt.account.Name, NegatedUserString([]byte(tt.account.Password)), *tt.account.Access); err != nil {
+       if err := srv.NewUser(tt.account.Login, tt.account.Name, string(negateString([]byte(tt.account.Password))), *tt.account.Access); err != nil {
                return err
        }
 

diff --git a/hotline/transaction_handlers.go b/hotline/transaction_handlers.go
index b06297dc6926169d2dceebcb69e96ad699b1e746..0ae6071e35963b3616dd3b4868c917fb9f18cd70 100644 (file)
--- a/hotline/transaction_handlers.go
+++ b/hotline/transaction_handlers.go
@@ -625,7 +625,6 @@ func HandleSetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error
 
 func HandleGetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error) {
        userLogin := string(t.GetField(fieldUserLogin).Data)
-       decodedUserLogin := NegatedUserString(t.GetField(fieldUserLogin).Data)
        account := cc.Server.Accounts[userLogin]
        if account == nil {
                errorT := cc.NewErrReply(t, "Account does not exist.")
@@ -635,7 +634,7 @@ func HandleGetUser(cc *ClientConn, t *Transaction) (res []Transaction, err error
 
        res = append(res, cc.NewReply(t,
                NewField(fieldUserName, []byte(account.Name)),
-               NewField(fieldUserLogin, []byte(decodedUserLogin)),
+               NewField(fieldUserLogin, negateString(t.GetField(fieldUserLogin).Data)),
                NewField(fieldUserPassword, []byte(account.Password)),
                NewField(fieldUserAccess, *account.Access),
        ))

diff --git a/hotline/user.go b/hotline/user.go
index f80fd721a88058bac73ffb98635cc5fa1caa6b43..5d09b2d449e069fc0f9ffaa296e6567ccd510248 100644 (file)
--- a/hotline/user.go
+++ b/hotline/user.go
@@ -51,19 +51,20 @@ func ReadUser(b []byte) (*User, error) {
 
 // DecodeUserString decodes an obfuscated user string from a client
 // e.g. 98 8a 9a 8c 8b => "guest"
-func DecodeUserString(encodedString []byte) (decodedString string) {
-       for _, char := range encodedString {
-               decodedString += string(rune(255 - uint(char)))
+func DecodeUserString(obfuText []byte) (clearText string) {
+       for _, char := range obfuText {
+               clearText += string(rune(255 - uint(char)))
        }
-       return decodedString
+       return clearText
 }
 
-// Take a []byte of uncoded ascii as input and encode it
-// TODO: change the method signature to take a string and return []byte
-func NegatedUserString(encodedString []byte) string {
-       var decodedString string
-       for _, char := range encodedString {
-               decodedString += string(255 - uint8(char))[1:]
+// negateString takes []byte s containing cleartext and rotates by 255 into obfuscated cleartext.
+// The Hotline protocol uses this format for sending passwords over network.
+// Not secure, but hey, it was the 90s!
+func negateString(clearText []byte) []byte {
+       obfuText := make([]byte, len(clearText))
+       for i := 0; i < len(clearText); i++ {
+               obfuText[i] = 255 - clearText[i]
        }
-       return decodedString
+       return obfuText
 }

diff --git a/hotline/user_test.go b/hotline/user_test.go
index dae4274a8bcf224461913afa79b01f680063ff12..705dec0417bf125fff0c81a20d68a72302a050bc 100644 (file)
--- a/hotline/user_test.go
+++ b/hotline/user_test.go
@@ -1,6 +1,7 @@
 package hotline
 
 import (
+       "bytes"
        "github.com/stretchr/testify/assert"
        "testing"
 )
@@ -90,20 +91,27 @@ func TestNegatedUserString(t *testing.T) {
        tests := []struct {
                name string
                args args
-               want string
+               want []byte
        }{
                {
-                       name: "encodes bytes to string",
+                       name: "encodes bytes to expected string",
                        args: args{
                                encodedString: []byte("guest"),
                        },
-                       want: string([]byte{0x98, 0x8a, 0x9a, 0x8c, 0x8b}),
+                       want: []byte{0x98, 0x8a, 0x9a, 0x8c, 0x8b},
+               },
+               {
+                       name: "encodes bytes with numerals to expected string",
+                       args: args{
+                               encodedString: []byte("foo1"),
+                       },
+                       want: []byte{0x99, 0x90, 0x90, 0xce },
                },
        }
        for _, tt := range tests {
                t.Run(tt.name, func(t *testing.T) {
-                       if got := NegatedUserString(tt.args.encodedString); got != tt.want {
-                               t.Errorf("NegatedUserString() = %v, want %v", got, tt.want)
+                       if got := negateString(tt.args.encodedString); !bytes.Equal(got, tt.want) {
+                               t.Errorf("NegatedUserString() = %x, want %x", got, tt.want)
                        }
                })
        }