make auth cookie fixed size

Some clients, such as Perl's net::oscar, assume that the auth cookie is
256 bytes long. In this commit we add padding to the auth cookie to
ensure it stays at a fixed size.

foodgroup/auth.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"fmt"
 	"net"
 
 	"github.com/mk6i/retro-aim-server/config"
@@ -13,6 +14,9 @@ import (
 	"github.com/google/uuid"
 )
 
+// authCookieLen is the fixed auth cookie length.
+const authCookieLen = 256
+
 // NewAuthService creates a new instance of AuthService.
 func NewAuthService(cfg config.Config,
 	sessionManager SessionManager,
@@ -247,12 +251,22 @@ func (s AuthService) login(
 
 		sess := s.sessionManager.AddSession(newUUIDFn().String(), screenName)
 
+		// Some clients (such as perl NET::OSCAR) expect the auth cookie to be
+		// exactly 256 bytes, even though the cookie is stored in a
+		// variable-length TLV. Pad the auth cookie to make sure it's exactly
+		// 256 bytes.
+		if len(sess.ID()) > authCookieLen {
+			return wire.TLVRestBlock{}, fmt.Errorf("sess is too long, expect 256 bytes, got %d", len(sess.ID()))
+		}
+		authCookie := make([]byte, authCookieLen)
+		copy(authCookie, sess.ID())
+
 		// auth success
 		return wire.TLVRestBlock{
 			TLVList: []wire.TLV{
 				wire.NewTLV(wire.LoginTLVTagsScreenName, screenName),
 				wire.NewTLV(wire.LoginTLVTagsReconnectHere, net.JoinHostPort(s.config.OSCARHost, s.config.BOSPort)),
-				wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, sess.ID()),
+				wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, authCookie),
 			},
 		}, nil
 	}

foodgroup/auth_test.go

@@ -83,7 +83,8 @@ func TestAuthService_BUCPLoginRequest(t *testing.T) {
 						TLVList: wire.TLVList{
 							wire.NewTLV(wire.LoginTLVTagsScreenName, user.ScreenName),
 							wire.NewTLV(wire.LoginTLVTagsReconnectHere, "127.0.0.1:1234"),
-							wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, sessUUID.String()),
+							wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, append([]byte(userSession.ID()),
+								make([]byte, authCookieLen-len([]byte(userSession.ID())))...)),
 						},
 					},
 				},
@@ -141,7 +142,8 @@ func TestAuthService_BUCPLoginRequest(t *testing.T) {
 						TLVList: wire.TLVList{
 							wire.NewTLV(wire.LoginTLVTagsScreenName, user.ScreenName),
 							wire.NewTLV(wire.LoginTLVTagsReconnectHere, "127.0.0.1:1234"),
-							wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, sessUUID.String()),
+							wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, append([]byte(userSession.ID()),
+								make([]byte, authCookieLen-len([]byte(userSession.ID())))...)),
 						},
 					},
 				},
@@ -199,7 +201,8 @@ func TestAuthService_BUCPLoginRequest(t *testing.T) {
 						TLVList: wire.TLVList{
 							wire.NewTLV(wire.LoginTLVTagsScreenName, user.ScreenName),
 							wire.NewTLV(wire.LoginTLVTagsReconnectHere, "127.0.0.1:1234"),
-							wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, sessUUID.String()),
+							wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, append([]byte(userSession.ID()),
+								make([]byte, authCookieLen-len([]byte(userSession.ID())))...)),
 						},
 					},
 				},
@@ -258,7 +261,8 @@ func TestAuthService_BUCPLoginRequest(t *testing.T) {
 						TLVList: wire.TLVList{
 							wire.NewTLV(wire.LoginTLVTagsScreenName, user.ScreenName),
 							wire.NewTLV(wire.LoginTLVTagsReconnectHere, "127.0.0.1:1234"),
-							wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, sessUUID.String()),
+							wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, append([]byte(userSession.ID()),
+								make([]byte, authCookieLen-len([]byte(userSession.ID())))...)),
 						},
 					},
 				},
@@ -489,7 +493,8 @@ func TestAuthService_FLAPLoginResponse(t *testing.T) {
 				TLVList: wire.TLVList{
 					wire.NewTLV(wire.LoginTLVTagsScreenName, user.ScreenName),
 					wire.NewTLV(wire.LoginTLVTagsReconnectHere, "127.0.0.1:1234"),
-					wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, sessUUID.String()),
+					wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, append([]byte(userSession.ID()),
+						make([]byte, authCookieLen-len([]byte(userSession.ID())))...)),
 				},
 			},
 		},
@@ -539,7 +544,8 @@ func TestAuthService_FLAPLoginResponse(t *testing.T) {
 				TLVList: wire.TLVList{
 					wire.NewTLV(wire.LoginTLVTagsScreenName, user.ScreenName),
 					wire.NewTLV(wire.LoginTLVTagsReconnectHere, "127.0.0.1:1234"),
-					wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, sessUUID.String()),
+					wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, append([]byte(userSession.ID()),
+						make([]byte, authCookieLen-len([]byte(userSession.ID())))...)),
 				},
 			},
 		},
@@ -589,7 +595,8 @@ func TestAuthService_FLAPLoginResponse(t *testing.T) {
 				TLVList: wire.TLVList{
 					wire.NewTLV(wire.LoginTLVTagsScreenName, user.ScreenName),
 					wire.NewTLV(wire.LoginTLVTagsReconnectHere, "127.0.0.1:1234"),
-					wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, sessUUID.String()),
+					wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, append([]byte(userSession.ID()),
+						make([]byte, authCookieLen-len([]byte(userSession.ID())))...)),
 				},
 			},
 		},
@@ -640,7 +647,8 @@ func TestAuthService_FLAPLoginResponse(t *testing.T) {
 				TLVList: wire.TLVList{
 					wire.NewTLV(wire.LoginTLVTagsScreenName, user.ScreenName),
 					wire.NewTLV(wire.LoginTLVTagsReconnectHere, "127.0.0.1:1234"),
-					wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, sessUUID.String()),
+					wire.NewTLV(wire.LoginTLVTagsAuthorizationCookie, append([]byte(userSession.ID()),
+						make([]byte, authCookieLen-len([]byte(userSession.ID())))...)),
 				},
 			},
 		},

server/oscar/bos.go

@@ -1,6 +1,7 @@
 package oscar
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"io"
@@ -77,7 +78,10 @@ func (rt BOSServer) handleNewConnection(ctx context.Context, rwc io.ReadWriteClo
 		return errors.New("unable to get session id from payload")
 	}
 
+	// Trim the padding added to the auth cookie by the auth service.
+	sessionID = bytes.TrimRight(sessionID, "\x00")
 	sess, err := rt.RetrieveBOSSession(string(sessionID))
+
 	if err != nil {
 		return err
 	}

server/oscar/bos_test.go

@@ -48,7 +48,11 @@ func TestBOSService_handleNewConnection(t *testing.T) {
 		flapSignonFrame = wire.FLAPSignonFrame{
 			FLAPVersion: 1,
 		}
-		flapSignonFrame.Append(wire.NewTLV(wire.OServiceTLVTagsLoginCookie, []byte(sess.ID())))
+		// create padded auth cookie
+		cookie := make([]byte, 220)
+		copy(cookie, sess.ID())
+		flapSignonFrame.Append(wire.NewTLV(wire.OServiceTLVTagsLoginCookie, cookie))
+
 		buf = &bytes.Buffer{}
 		assert.NoError(t, wire.Marshal(flapSignonFrame, buf))
 		flap = wire.FLAPFrame{