fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Throttle every password-verify path (GROUP/GHOST/CERT/DROP/SASL) and key the lockout by resolved account

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 13:06:50 +00:00
parent 1ecb76affb
commit 660362a34b
No known key found for this signature in database
7 changed files with 79 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

33
modules/nickserv/src/cert.rs
View file

@ -5,15 +5,13 @@ use echo_api::{Sender, ServiceCtx};
// fingerprints that may log in to your account via SASL EXTERNAL. Each
// subcommand is password-gated, so it needs no identified-session state.
pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
let auth = |db: &dyn Store, password: &str| db.authenticate(from.nick, password).map(str::to_string);
match args.get(1).map(|s| s.to_ascii_uppercase()).as_deref() {
Some("LIST") => {
let Some(password) = args.get(2) else {
ctx.notice(me, from.uid, "Syntax: CERT LIST <password>");
return;
};
let Some(account) = auth(db, password) else {
ctx.notice(me, from.uid, "Invalid password.");
let Some(account) = verify(me, from, ctx, db, password) else {
return;
};
let fps = db.certfps(&account);
@ -28,8 +26,7 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
ctx.notice(me, from.uid, "Syntax: CERT ADD <password> <fingerprint>");
return;
};
let Some(account) = auth(db, password) else {
ctx.notice(me, from.uid, "Invalid password.");
let Some(account) = verify(me, from, ctx, db, password) else {
return;
};
match db.certfp_add(&account, fp) {
@ -44,8 +41,7 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
ctx.notice(me, from.uid, "Syntax: CERT DEL <password> <fingerprint>");
return;
};
let Some(account) = auth(db, password) else {
ctx.notice(me, from.uid, "Invalid password.");
let Some(account) = verify(me, from, ctx, db, password) else {
return;
};
match db.certfp_del(&account, fp) {
@ -57,3 +53,26 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
_ => ctx.notice(me, from.uid, "Syntax: CERT ADD|DEL|LIST <password> [fingerprint]"),
}
}
// Verify the caller's password against the account matching their current nick,
// throttled and recorded like IDENTIFY — so CERT can't be used as an unthrottled
// guessing oracle (a user can `/nick victim` then CERT LIST <guess>) and each ~1s
// verify can't be spammed to stall the engine.
fn verify(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &mut dyn Store, password: &str) -> Option<String> {
if let Some(secs) = db.auth_lockout(from.nick) {
ctx.notice(me, from.uid, format!("Too many failed attempts. Please wait {secs}s and try again."));
return None;
}
match db.authenticate(from.nick, password).map(str::to_string) {
Some(account) => {
db.note_auth(from.nick, true);
Some(account)
}
None => {
db.note_auth(from.nick, false);
ctx.auth_report(false, Some(from.nick), "NickServ CERT", from.uid, Some("bad password"));
ctx.notice(me, from.uid, "Invalid password.");
None
}
}
}

8
modules/nickserv/src/drop.rs
View file

@ -13,10 +13,18 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net:
ctx.notice(me, from.uid, "Syntax: DROP <password>");
return;
};
// Throttle the confirmation verify like IDENTIFY so the ~1s check can't be
// spammed to stall the engine, and record the attempt.
if let Some(secs) = db.auth_lockout(account) {
ctx.notice(me, from.uid, format!("Too many failed attempts. Please wait {secs}s and try again."));
return;
}
if db.authenticate(account, password).is_none() {
db.note_auth(account, false);
ctx.notice(me, from.uid, "Invalid password.");
return;
}
db.note_auth(account, true);
// A channel with a successor is inherited; the rest are dropped and released.
let (inherited, dropped) = db.release_founded_channels(account);
for chan in &dropped {

22
modules/nickserv/src/ghost.rs
View file

@ -8,7 +8,7 @@ use echo_api::NetView;
// it. Every argument is a distinct input the guest-rename needs, so the count is
// inherent.
#[allow(clippy::too_many_arguments)]
pub fn handle(me: &str, guest_nick: &str, guest_seq: &mut u32, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store, regain: bool) {
pub fn handle(me: &str, guest_nick: &str, guest_seq: &mut u32, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, net: &dyn NetView, db: &mut dyn Store, regain: bool) {
let cmd = if regain { "RECOVER" } else { "GHOST" };
let Some(&target) = args.get(1) else {
ctx.notice(me, from.uid, format!("Syntax: {cmd} <nick> [password]"));
@ -18,7 +18,25 @@ pub fn handle(me: &str, guest_nick: &str, guest_seq: &mut u32, from: &Sender, ar
ctx.notice(me, from.uid, format!("\x02{target}\x02 isn't registered."));
return;
};
let owns = from.account == Some(account.as_str()) || args.get(2).is_some_and(|pw| db.authenticate(target, pw).is_some());
// Ownership by an identified session, or by password — throttled and recorded
// like IDENTIFY so GHOST can't be an unthrottled guessing oracle against any
// registered nick, and each ~1s verify can't be spammed to stall the engine.
let owns = if from.account == Some(account.as_str()) {
true
} else if let Some(&pw) = args.get(2) {
if let Some(secs) = db.auth_lockout(&account) {
ctx.notice(me, from.uid, format!("Too many failed attempts. Please wait {secs}s and try again."));
return;
}
let ok = db.authenticate(&account, pw).is_some();
db.note_auth(&account, ok);
if !ok {
ctx.auth_report(false, Some(&account), "NickServ GHOST", from.uid, Some("bad password"));
}
ok
} else {
false
};
if !owns {
ctx.notice(me, from.uid, format!("Access denied. Identify to \x02{account}\x02 or give its password."));
return;

10
modules/nickserv/src/group.rs
View file

@ -8,10 +8,20 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
ctx.notice(me, from.uid, "Syntax: GROUP <account> <password>");
return;
};
// Throttle + record the attempt like IDENTIFY, or GROUP is an unthrottled
// password-guessing oracle against any account (and each ~1s verify blocks the
// engine). Also feeds the auth audit feed.
if let Some(secs) = db.auth_lockout(account) {
ctx.notice(me, from.uid, format!("Too many failed attempts. Please wait {secs}s and try again."));
return;
}
let Some(canonical) = db.authenticate(account, password).map(str::to_string) else {
db.note_auth(account, false);
ctx.auth_report(false, Some(account), "NickServ GROUP", from.uid, Some("bad password"));
ctx.notice(me, from.uid, "Invalid account or password.");
return;
};
db.note_auth(account, true);
if db.account(from.nick).is_some() {
ctx.notice(me, from.uid, format!("\x02{}\x02 is itself a registered account.", from.nick));
return;