fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Resolve grouped-nick authzid in SASL EXTERNAL and saturate the Lamport clock
All checks were successful
CI / check (push) Successful in 4m10s
Details

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 15:59:00 +00:00
parent 8f41fc9903
commit 7894de4217
No known key found for this signature in database
2 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/engine/db/mod.rs
View file

@ -839,7 +839,7 @@ impl EventLog {
}
let global = event.scope() == Scope::Global;
let entry = if global {
self.lamport += 1;
self.lamport = self.lamport.saturating_add(1);
LogEntry { origin: self.origin.clone(), seq: self.next_seq(), lamport: self.lamport, event }
} else {
LogEntry { origin: self.origin.clone(), seq: 0, lamport: 0, event }
@ -876,7 +876,7 @@ impl EventLog {
return Ok(None); // already have it
}
self.persist(&entry)?;
self.lamport = self.lamport.max(entry.lamport) + 1; // Lamport receive rule
self.lamport = self.lamport.max(entry.lamport).saturating_add(1); // Lamport receive rule
self.versions.insert(entry.origin.clone(), entry.seq);
let event = entry.event.clone();
self.notify(&entry);
@ -958,7 +958,7 @@ impl EventLog {
let mut snapshot = Vec::with_capacity(events.len());
for event in events {
let entry = if event.scope() == Scope::Global {
self.lamport += 1;
self.lamport = self.lamport.saturating_add(1);
let e = LogEntry { origin: self.origin.clone(), seq, lamport: self.lamport, event };
last_global = Some(seq);
seq += 1;

9
src/engine/sasl.rs
View file

@ -189,7 +189,14 @@ impl Engine {
}
};
match fingerprints.iter().find_map(|fp| self.db.certfp_owner(fp)) {
Some(account) if authzid.is_empty() || authzid.eq_ignore_ascii_case(account) => {
// Accept an authzid that is empty, matches the cert's account, OR resolves
// to it via a grouped nick — mirroring the PLAIN/SCRAM paths, which resolve
// aliases (else naming your own grouped nick is wrongly refused).
Some(account)
if authzid.is_empty()
|| authzid.eq_ignore_ascii_case(account)
|| self.db.resolve_account(&authzid).is_some_and(|a| a.eq_ignore_ascii_case(account)) =>
{
let account = account.to_string();
self.sasl_login("SASL EXTERNAL", agent, client, account)
}