fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DebugServ: professional, sourced auth feed
All checks were successful
CI / check (push) Successful in 3m54s
Details

Browse source 
Rework the AUTH feed for an admin log channel. Drop the check/cross icons; each
line now reads "account login ok|FAILED - mechanism - from source [- reason]".
The important fix is the source: mid-SASL the client isn't a connected user yet,
so the old lines showed "?" and a cloaked host — capture the real host+IP the
ircd hands us in the SASL H message instead, and fall back to the live user's
nick@host for a NickServ IDENTIFY. Failures now always name the account (which is
attacker-supplied on a bad attempt, so it's stripped of control codes and capped
before it goes in the channel message). Also emit an echo::auth info log so auth
events land on disk, not only in the channel. No secret is ever included.
This commit is contained in:
Jean Chevronnet 2026-07-16 23:08:30 +00:00
parent f2fd80694d
commit 4e12531815
No known key found for this signature in database
3 changed files with 70 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/engine/register.rs
View file

@ -305,9 +305,9 @@ impl Engine {
self.bump(&key);
}
let feed = if ok {
self.feed("AUTH", format!("\x0303✓\x03 {} identified to \x02{account}\x02 via IDENTIFY", self.who(&uid)))
self.auth_report(true, Some(&account), "NickServ IDENTIFY", &uid, None)
} else {
self.feed("AUTH", format!("\x0304✗\x03 {} — IDENTIFY failed for \x02{name}\x02 (bad password)", self.who(&uid)))
self.auth_report(false, Some(&name), "NickServ IDENTIFY", &uid, Some("bad password"))
};
let mut actions = ctx.actions;
actions.extend(feed);
@ -317,7 +317,7 @@ impl Engine {
if ok {
self.sasl_login("SASL PLAIN", &agent, &client, account)
} else {
self.sasl_deny("SASL PLAIN", &agent, &client, "bad password")
self.sasl_deny("SASL PLAIN", &agent, &client, Some(&account), "bad password")
}
}
}