diff --git a/shadowsocks/obfsplugin/plain.py b/shadowsocks/obfsplugin/plain.py
index a99fb0b..5bba57c 100644
--- a/shadowsocks/obfsplugin/plain.py
+++ b/shadowsocks/obfsplugin/plain.py
@@ -75,7 +75,7 @@ class plain(object):
     def get_head_size(self, buf, def_value):
         if len(buf) < 2:
             return def_value
-        head_type = ord(buf[0]) & 0xF
+        head_type = ord(buf[0]) & 0x7
         if head_type == 1:
             return 7
         if head_type == 4:
diff --git a/shadowsocks/obfsplugin/verify.py b/shadowsocks/obfsplugin/verify.py
index 1dfbdb0..770ce29 100644
--- a/shadowsocks/obfsplugin/verify.py
+++ b/shadowsocks/obfsplugin/verify.py
@@ -288,7 +288,7 @@ class verify_sha1(verify_base):
 
     def pack_auth_data(self, buf):
         data = chr(ord(buf[0]) | 0x10) + buf[1:]
-        data += hmac.new(self.server_info.iv + self.server_info.key, buf, hashlib.sha1).digest()[:10]
+        data += hmac.new(self.server_info.iv + self.server_info.key, data, hashlib.sha1).digest()[:10]
         return data
 
     def client_pre_encrypt(self, buf):