fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Throttle every password-verify path (GROUP/GHOST/CERT/DROP/SASL) and key the lockout by resolved account

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 13:06:50 +00:00
parent 1ecb76affb
commit 660362a34b
No known key found for this signature in database
7 changed files with 79 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

10
modules/nickserv/src/group.rs
View file

@ -8,10 +8,20 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
ctx.notice(me, from.uid, "Syntax: GROUP <account> <password>");
return;
};
// Throttle + record the attempt like IDENTIFY, or GROUP is an unthrottled
// password-guessing oracle against any account (and each ~1s verify blocks the
// engine). Also feeds the auth audit feed.
if let Some(secs) = db.auth_lockout(account) {
ctx.notice(me, from.uid, format!("Too many failed attempts. Please wait {secs}s and try again."));
return;
}
let Some(canonical) = db.authenticate(account, password).map(str::to_string) else {
db.note_auth(account, false);
ctx.auth_report(false, Some(account), "NickServ GROUP", from.uid, Some("bad password"));
ctx.notice(me, from.uid, "Invalid account or password.");
return;
};
db.note_auth(account, true);
if db.account(from.nick).is_some() {
ctx.notice(me, from.uid, format!("\x02{}\x02 is itself a registered account.", from.nick));
return;