OperServ: JUPE — hold a server name against a rogue link

JUPE <server.name> [reason] introduces a fake server holding the name so
the real one can't link; JUPE DEL <name> squits it; JUPE LIST shows them.
Node-local (the introducing node owns the jupe, so it isn't federated —
that would collide SIDs across nodes) and re-asserted at burst. A fake
server id is allocated per jupe. New JupeServer/Squit actions serialise to
the mid-link SERVER introduction and SQUIT. Admin-only.

api/src/lib.rs

@@ -94,6 +94,11 @@ pub enum NetAction {
     DelLine { kind: String, mask: String },
     // Disconnect a user from the network, sourced from pseudoclient `from`.
     KillUser { from: String, uid: String, reason: String },
+    // Introduce a juped server (a fake server holding a name so the real one
+    // can't link), sourced from our server. `sid` is its allocated server id.
+    JupeServer { name: String, sid: String, reason: String },
+    // Delink a server (used to lift a jupe), by name or sid.
+    Squit { target: String, reason: String },
     Raw(String),
     // Internal only, never serialized to the wire: a registration whose password
     // still needs its (expensive) key derivation. The link layer runs the
@@ -405,6 +410,16 @@ impl ServiceCtx {
     pub fn global(&mut self, from: &str, text: impl Into<String>) {
         self.actions.push(NetAction::Notice { from: from.to_string(), to: "$*".to_string(), text: text.into() });
     }
+
+    // Introduce a juped server holding `name` (with allocated `sid`).
+    pub fn jupe(&mut self, name: &str, sid: &str, reason: &str) {
+        self.actions.push(NetAction::JupeServer { name: name.to_string(), sid: sid.to_string(), reason: reason.to_string() });
+    }
+
+    // Delink a server by name or sid (lifts a jupe).
+    pub fn squit(&mut self, target: &str, reason: &str) {
+        self.actions.push(NetAction::Squit { target: target.to_string(), reason: reason.to_string() });
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -751,6 +766,11 @@ pub trait Store {
     fn ignore_add(&mut self, mask: &str, reason: &str, expires: Option<u64>);
     fn ignore_del(&mut self, mask: &str) -> bool;
     fn ignores(&self) -> Vec<IgnoreView>;
+    // Juped servers (node-local, oper-only). jupe_add returns the allocated sid;
+    // jupe_del returns the sid to squit if it existed.
+    fn jupe_add(&mut self, name: &str, reason: &str) -> String;
+    fn jupe_del(&mut self, name: &str) -> Option<String>;
+    fn jupes(&self) -> Vec<(String, String, String)>;
     // Staff notes on accounts/channels (oper-only), shown in INFO to operators.
     fn set_account_note(&mut self, account: &str, note: Option<String>) -> bool;
     fn account_note(&self, account: &str) -> Option<String>;

inspircd/src/lib.rs

@@ -329,6 +329,11 @@ impl Protocol for InspIrcd {
             }
             NetAction::DelLine { kind, mask } => vec![self.sourced(format!("DELLINE {} {}", kind, mask))],
             NetAction::KillUser { from, uid, reason } => vec![format!(":{} KILL {} :{}", from, uid, reason)],
+            // Introduce a server behind us: :<our-sid> SERVER <name> <sid> :<desc>.
+            NetAction::JupeServer { name, sid, reason } => {
+                vec![self.sourced(format!("SERVER {} {} :JUPED: {}", name, sid, reason))]
+            }
+            NetAction::Squit { target, reason } => vec![self.sourced(format!("SQUIT {} :{}", target, reason))],
             NetAction::Raw(s) => vec![s.clone()],
             // Internal: the link layer handles these before serialization.
             NetAction::DeferRegister { .. } | NetAction::DeferPassword { .. } | NetAction::SendEmail { .. } => vec![],

operserv/src/jupe.rs

@@ -0,0 +1,49 @@
+use fedserv_api::{Priv, Sender, ServiceCtx, Store};
+
+// JUPE <server.name> [reason] | JUPE DEL <server.name> | JUPE LIST: hold a
+// server name with a fake server so a rogue one can't link (or lift it). Admin-
+// only. Node-local: the introducing node owns the jupe.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    if !from.privs.has(Priv::Admin) {
+        ctx.notice(me, from.uid, "Access denied — JUPE needs the \x02admin\x02 privilege.");
+        return;
+    }
+    match args.get(1) {
+        Some(&sub) if sub.eq_ignore_ascii_case("DEL") || sub.eq_ignore_ascii_case("REMOVE") => del(me, from, args.get(2).copied(), ctx, db),
+        Some(&sub) if sub.eq_ignore_ascii_case("LIST") => list(me, from, ctx, db),
+        Some(&name) if name.contains('.') => {
+            let reason = if args.len() > 2 { args[2..].join(" ") } else { "Juped by services".to_string() };
+            let by = from.account.unwrap_or(from.nick);
+            let sid = db.jupe_add(name, &format!("({by}) {reason}"));
+            ctx.jupe(name, &sid, &format!("({by}) {reason}"));
+            ctx.notice(me, from.uid, format!("\x02{name}\x02 is now juped."));
+        }
+        _ => ctx.notice(me, from.uid, "Syntax: JUPE <server.name> [reason] | JUPE DEL <server.name> | JUPE LIST"),
+    }
+}
+
+fn del(me: &str, from: &Sender, name: Option<&str>, ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    let Some(name) = name else {
+        ctx.notice(me, from.uid, "Syntax: JUPE DEL <server.name>");
+        return;
+    };
+    match db.jupe_del(name) {
+        Some(sid) => {
+            ctx.squit(&sid, "Jupe lifted");
+            ctx.notice(me, from.uid, format!("The jupe on \x02{name}\x02 has been lifted."));
+        }
+        None => ctx.notice(me, from.uid, format!("\x02{name}\x02 isn't juped.")),
+    }
+}
+
+fn list(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    let jupes = db.jupes();
+    if jupes.is_empty() {
+        ctx.notice(me, from.uid, "No servers are juped.");
+        return;
+    }
+    for (name, sid, reason) in &jupes {
+        ctx.notice(me, from.uid, format!("  \x02{name}\x02 ({sid}) — {reason}"));
+    }
+    ctx.notice(me, from.uid, format!("End of jupe list ({} shown).", jupes.len()));
+}

operserv/src/lib.rs

@@ -29,6 +29,8 @@ mod news;
 mod oper;
 #[path = "session.rs"]
 mod session;
+#[path = "jupe.rs"]
+mod jupe;
 
 pub struct OperServ {
     pub uid: String,
@@ -69,6 +71,7 @@ impl Service for OperServ {
             Some(cmd) if cmd.eq_ignore_ascii_case("OPER") => oper::handle(me, from, args, ctx, db),
             Some(cmd) if cmd.eq_ignore_ascii_case("SESSION") => session::handle_session(me, from, args, ctx, net),
             Some(cmd) if cmd.eq_ignore_ascii_case("EXCEPTION") => session::handle_exception(me, from, args, ctx, db),
+            Some(cmd) if cmd.eq_ignore_ascii_case("JUPE") => jupe::handle(me, from, args, ctx, db),
             Some(cmd) if cmd.eq_ignore_ascii_case("HELP") => help(me, from, ctx),
             None => help(me, from, ctx),
             Some(other) => ctx.notice(me, from.uid, format!("I don't know \x02{other}\x02. Try \x02HELP\x02.")),
@@ -77,5 +80,5 @@ impl Service for OperServ {
 }
 
 fn help(me: &str, from: &Sender, ctx: &mut ServiceCtx) {
-    ctx.notice(me, from.uid, "OperServ holds network operator tools (Priv::Admin): \x02AKILL\x02 ADD|DEL|LIST (user@host bans), \x02SQLINE\x02 ADD|DEL|LIST (nick bans), \x02SNLINE\x02 ADD|DEL|LIST (realname bans), \x02GLOBAL\x02 <message> (announce to everyone), \x02KILL\x02 <nick> [reason] (disconnect a user), \x02KICK\x02 <#chan> <nick> [reason], \x02MODE\x02 <#chan> <modes> [params], \x02IGNORE\x02 ADD|DEL|LIST (silence a user from services), \x02STATS\x02 (enforcement overview), \x02SVSNICK\x02 <nick> <newnick>, \x02SVSJOIN\x02 <nick> <#chan> [key], \x02INFO\x02 ADD|DEL <target> (staff notes), \x02NEWS\x02 ADD|DEL|LIST <LOGON|OPER> (announcements), \x02OPER\x02 ADD|DEL|LIST (runtime operators), \x02SESSION\x02 LIST|VIEW + \x02EXCEPTION\x02 ADD|DEL|LIST (per-IP session limits).");
+    ctx.notice(me, from.uid, "OperServ holds network operator tools (Priv::Admin): \x02AKILL\x02 ADD|DEL|LIST (user@host bans), \x02SQLINE\x02 ADD|DEL|LIST (nick bans), \x02SNLINE\x02 ADD|DEL|LIST (realname bans), \x02GLOBAL\x02 <message> (announce to everyone), \x02KILL\x02 <nick> [reason] (disconnect a user), \x02KICK\x02 <#chan> <nick> [reason], \x02MODE\x02 <#chan> <modes> [params], \x02IGNORE\x02 ADD|DEL|LIST (silence a user from services), \x02STATS\x02 (enforcement overview), \x02SVSNICK\x02 <nick> <newnick>, \x02SVSJOIN\x02 <nick> <#chan> [key], \x02INFO\x02 ADD|DEL <target> (staff notes), \x02NEWS\x02 ADD|DEL|LIST <LOGON|OPER> (announcements), \x02OPER\x02 ADD|DEL|LIST (runtime operators), \x02SESSION\x02 LIST|VIEW + \x02EXCEPTION\x02 ADD|DEL|LIST (per-IP session limits), \x02JUPE\x02 <server> | DEL | LIST.");
 }

src/engine/db.rs

@@ -338,6 +338,15 @@ fn gline_kind() -> String {
     "G".to_string()
 }
 
+// A valid 3-char server id for a juped server from a counter: a leading digit
+// (kept high to avoid colliding with typical real SIDs) then two base-36 chars.
+fn jupe_sid(seq: u32) -> String {
+    const C: &[u8] = b"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    let b = C[(seq / 36 % 36) as usize];
+    let c = C[(seq % 36) as usize];
+    String::from_utf8(vec![b'9', b, c]).unwrap()
+}
+
 // A services ignore: services silently drop commands from a matching user. Node-
 // local and in-memory (like the auth throttle) — a fast, transient moderation
 // tool, not persisted or federated.
@@ -956,6 +965,18 @@ pub struct Db {
     net: NetData,
     // Services ignores (OperServ IGNORE), node-local and in-memory.
     ignores: Vec<Ignore>,
+    // Juped servers (OperServ JUPE), node-local: the introducing node owns them,
+    // so they aren't federated (that would collide SIDs across nodes).
+    jupes: Vec<Jupe>,
+    jupe_seq: u32,
+}
+
+// A juped server: the held name, the fake server id we allocated for it, and why.
+#[derive(Debug, Clone)]
+pub struct Jupe {
+    pub name: String,
+    pub sid: String,
+    pub reason: String,
 }
 
 // Network-wide HostServ configuration, rebuilt from the event log.
@@ -1011,7 +1032,7 @@ impl Db {
             apply(&mut accounts, &mut channels, &mut grouped, &mut bots, &mut host_cfg, &mut net, event);
         }
         tracing::info!(accounts = accounts.len(), channels = channels.len(), "account store loaded");
-        Self { accounts, channels, grouped, log, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), vhost_req_times: HashMap::new(), bots, host_cfg, net, ignores: Vec::new() }
+        Self { accounts, channels, grouped, log, scram_iterations: scram::DEFAULT_ITERATIONS, email_enabled: false, email_brand: "Network Services".to_string(), email_accent: "#4f46e5".to_string(), email_logo: String::new(), codes: HashMap::new(), auth_fails: HashMap::new(), vhost_req_times: HashMap::new(), bots, host_cfg, net, ignores: Vec::new(), jupes: Vec::new(), jupe_seq: 0 }
     }
 
     /// Fold an entry authored by another node into the store — the services-side
@@ -2004,6 +2025,30 @@ impl Db {
             .collect()
     }
 
+    /// Jupe a server name: allocate a fake sid, store it, return the sid to
+    /// introduce (or the existing sid if the name is already juped).
+    pub fn jupe_add(&mut self, name: &str, reason: &str) -> String {
+        if let Some(j) = self.jupes.iter().find(|j| j.name.eq_ignore_ascii_case(name)) {
+            return j.sid.clone();
+        }
+        let sid = jupe_sid(self.jupe_seq);
+        self.jupe_seq += 1;
+        self.jupes.push(Jupe { name: name.to_string(), sid: sid.clone(), reason: reason.to_string() });
+        sid
+    }
+
+    /// Lift a jupe. Returns the sid to squit if it existed.
+    pub fn jupe_del(&mut self, name: &str) -> Option<String> {
+        let sid = self.jupes.iter().find(|j| j.name.eq_ignore_ascii_case(name)).map(|j| j.sid.clone())?;
+        self.jupes.retain(|j| !j.name.eq_ignore_ascii_case(name));
+        Some(sid)
+    }
+
+    /// The juped servers, as (name, sid, reason).
+    pub fn jupes(&self) -> Vec<(String, String, String)> {
+        self.jupes.iter().map(|j| (j.name.clone(), j.sid.clone(), j.reason.clone())).collect()
+    }
+
     /// Add a services ignore, replacing any existing entry for the same mask.
     pub fn ignore_add(&mut self, mask: &str, reason: &str, expires: Option<u64>) {
         self.ignores.retain(|i| !i.mask.eq_ignore_ascii_case(mask));
@@ -3245,6 +3290,15 @@ impl Store for Db {
     fn ignores(&self) -> Vec<IgnoreView> {
         Db::ignores(self)
     }
+    fn jupe_add(&mut self, name: &str, reason: &str) -> String {
+        Db::jupe_add(self, name, reason)
+    }
+    fn jupe_del(&mut self, name: &str) -> Option<String> {
+        Db::jupe_del(self, name)
+    }
+    fn jupes(&self) -> Vec<(String, String, String)> {
+        Db::jupes(self)
+    }
     fn set_account_note(&mut self, account: &str, note: Option<String>) -> bool {
         Db::set_account_note(self, account, note)
     }

src/engine/mod.rs

@@ -719,6 +719,10 @@ impl Engine {
             let duration = a.expires.map(|e| e.saturating_sub(now)).unwrap_or(0);
             out.push(NetAction::AddLine { kind: a.kind, mask: a.mask, setter: a.setter, duration, reason: a.reason });
         }
+        // Re-introduce our juped servers over the fresh link.
+        for (name, sid, reason) in self.db.jupes() {
+            out.push(NetAction::JupeServer { name, sid, reason });
+        }
         out.push(NetAction::Metadata {
             target: "*".to_string(),
             key: "saslmechlist".to_string(),
@@ -4086,6 +4090,48 @@ mod tests {
         }
     }
 
+    // OperServ JUPE: hold a server name with a fake server, re-assert it at burst,
+    // and lift it with a squit. Admin-only.
+    #[test]
+    fn operserv_jupe_holds_and_lifts() {
+        use fedserv_operserv::OperServ;
+        let path = std::env::temp_dir().join("fedserv-osjupe.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        db.register("staff", "password1", None).unwrap();
+        let mut e = Engine::new(
+            vec![
+                Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }),
+                Box::new(OperServ { uid: "42SAAAAAH".into() }),
+            ],
+            db,
+        );
+        e.set_sid("42S".into());
+        let mut opers = std::collections::HashMap::new();
+        opers.insert("staff".to_string(), Privs::default().with(fedserv_api::Priv::Admin));
+        e.set_opers(opers);
+        let os = |e: &mut Engine, uid: &str, t: &str| e.handle(NetEvent::Privmsg { from: uid.into(), to: "42SAAAAAH".into(), text: t.into() });
+
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAS".into(), nick: "staff".into(), host: "h".into(), ip: "9.9.9.9".into() });
+        e.handle(NetEvent::Privmsg { from: "000AAAAAS".into(), to: "42SAAAAAA".into(), text: "IDENTIFY password1".into() });
+
+        // Juping introduces a fake server holding the name.
+        let out = os(&mut e, "000AAAAAS", "JUPE rogue.example evil twin");
+        assert!(out.iter().any(|a| matches!(a, NetAction::JupeServer { name, .. } if name == "rogue.example")), "jupe introduced: {out:?}");
+        // A bare name (no dot) isn't a server — syntax refused.
+        assert!(os(&mut e, "000AAAAAS", "JUPE notaserver").iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("Syntax"))), "needs a server name");
+
+        // It's re-introduced at burst.
+        assert!(e.startup_actions().iter().any(|a| matches!(a, NetAction::JupeServer { name, .. } if name == "rogue.example")), "re-asserted at burst");
+        // LIST shows it.
+        assert!(os(&mut e, "000AAAAAS", "JUPE LIST").iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("rogue.example"))), "listed");
+
+        // DEL squits the fake server.
+        assert!(os(&mut e, "000AAAAAS", "JUPE DEL rogue.example").iter().any(|a| matches!(a, NetAction::Squit { .. })), "squit on lift");
+        assert!(!e.startup_actions().iter().any(|a| matches!(a, NetAction::JupeServer { .. })), "gone after DEL");
+    }
+
     // OperServ session limiting: the connection that puts an IP over its limit is
     // killed; SESSION inspects counts; EXCEPTION raises the allowance per IP-mask.
     #[test]