nickserv/security: password policy, auth throttle, unguessable codes

Three brute-force / weak-secret gaps closed:
- REGISTER and SET PASSWORD now enforce a length range and reject a password
  equal to the nick (Anope's minpasslen/not-nick rules), with tests.
- IDENTIFY is throttled per account: a few free tries then an exponential
  backoff that clears on success, so a password can't be ground down. SASL had
  a limiter; interactive login had none.
- Emailed confirm/reset codes go from 6 digits to 8 base32 chars (~40 bits) and
  are burned after a few wrong guesses, closing a reset-code takeover window.
Throttle and code state are node-local and in-memory (not in the event log).

nickserv/src/identify.rs

@@ -3,7 +3,7 @@ use fedserv_api::{Sender, ServiceCtx};
 
 // IDENTIFY [account] <password>: log in. The account defaults to the current
 // nick, so both the bare-password and account+password forms work.
-pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &dyn Store) {
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
     let (account_name, password) = match (args.get(1), args.get(2)) {
         (Some(account), Some(password)) => (*account, *password),
         (Some(password), None) => (from.nick, *password),
@@ -17,14 +17,20 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
         ctx.notice(me, from.uid, format!("\x02{account_name}\x02 isn't registered."));
         return;
     }
-    match db.authenticate(account_name, password) {
+    // Refuse while throttled, so a password can't be brute-forced.
+    if let Some(secs) = db.auth_lockout(account_name) {
+        ctx.notice(me, from.uid, format!("Too many failed attempts. Please wait {secs}s and try again."));
+        return;
+    }
+    // Take the result as owned so the account-store borrow ends before note_auth.
+    match db.authenticate(account_name, password).map(str::to_string) {
         Some(account) => {
+            db.note_auth(account_name, true);
             // Already identified to this account: don't re-fire the login.
-            if from.account == Some(account) {
+            if from.account == Some(account.as_str()) {
                 ctx.notice(me, from.uid, format!("You're already identified as \x02{}\x02.", account));
                 return;
             }
-            let account = account.to_string();
             ctx.login(from.uid, &account);
             ctx.notice(me, from.uid, format!("You're now identified as \x02{}\x02. Welcome back!", account));
             // Apply the account's auto-join list (AJOIN).
@@ -32,6 +38,9 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
                 ctx.force_join(from.uid, &entry.channel, &entry.key);
             }
         }
-        None => ctx.notice(me, from.uid, "Invalid password. Please try again."),
+        None => {
+            db.note_auth(account_name, false);
+            ctx.notice(me, from.uid, "Invalid password. Please try again.");
+        }
     }
 }

nickserv/src/lib.rs

@@ -32,6 +32,8 @@ mod resetpass;
 mod confirm;
 #[path = "ajoin.rs"]
 mod ajoin;
+#[path = "password.rs"]
+mod password;
 
 pub struct NickServ {
     pub uid: String,

nickserv/src/password.rs

@@ -0,0 +1,50 @@
+// Password policy for REGISTER and SET PASSWORD. Anope enforces a minimum
+// length and forbids the password matching the nick; we do the same, plus an
+// upper bound so a huge password can't be used to burn CPU in the key
+// derivation. Length is measured in characters, the cap in bytes (what the
+// hasher actually processes).
+
+pub const MIN_PASSWORD_CHARS: usize = 8;
+pub const MAX_PASSWORD_BYTES: usize = 300;
+
+// Validate a new password for the account/nick it will protect. On rejection,
+// returns the message to show the user.
+pub fn validate_password(password: &str, owner: &str) -> Result<(), &'static str> {
+    if password.chars().count() < MIN_PASSWORD_CHARS {
+        return Err("That password is too short — please use at least 8 characters.");
+    }
+    if password.len() > MAX_PASSWORD_BYTES {
+        return Err("That password is too long.");
+    }
+    if password.eq_ignore_ascii_case(owner) {
+        return Err("Your password can't be the same as your nick. Please choose another.");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn accepts_a_reasonable_password() {
+        assert!(validate_password("correct horse", "alice").is_ok());
+    }
+
+    #[test]
+    fn rejects_short_password() {
+        assert!(validate_password("short", "alice").is_err());
+        assert!(validate_password("1234567", "alice").is_err()); // 7 chars
+        assert!(validate_password("12345678", "alice").is_ok()); // 8 chars
+    }
+
+    #[test]
+    fn rejects_password_equal_to_nick() {
+        assert!(validate_password("Password", "password").is_err()); // case-insensitive
+    }
+
+    #[test]
+    fn rejects_overlong_password() {
+        assert!(validate_password(&"x".repeat(MAX_PASSWORD_BYTES + 1), "alice").is_err());
+    }
+}

nickserv/src/register.rs

@@ -8,6 +8,10 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx) {
         ctx.notice(me, from.uid, "Syntax: REGISTER <password> [email]");
         return;
     };
+    if let Err(reason) = crate::password::validate_password(password, from.nick) {
+        ctx.notice(me, from.uid, reason);
+        return;
+    }
     let email = args.get(2).map(|s| s.to_string());
     ctx.defer_register(from.nick, *password, email, RegReply::NickServ {
         agent: me.to_string(),

nickserv/src/set.rs

@@ -13,6 +13,10 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
                 ctx.notice(me, from.uid, "Syntax: SET PASSWORD <newpassword>");
                 return;
             };
+            if let Err(reason) = crate::password::validate_password(password, account) {
+                ctx.notice(me, from.uid, reason);
+                return;
+            }
             // The link layer derives the new password off-thread, then commits it.
             ctx.defer_password(account, password, me, from.uid);
         }