Cap FORBID and vhost LIST output so a huge list can't overflow the operator's receive queue

api/src/lib.rs

@@ -280,6 +280,10 @@ pub fn chanmode_takes_param(m: char, adding: bool) -> bool {
 // mask or value. Fallback before the ircd's live prefix set is learned.
 pub const STATUS_MODES: &str = "qaohv";
 
+/// Max entries a service prints for a LIST before truncating, so a huge list
+/// can't exceed the client's receive queue and disconnect the operator.
+pub const LIST_CAP: usize = 200;
+
 /// How a channel mode consumes its parameter, from the ircd's `CAPAB CHANMODES`.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ChanModeKind {
@@ -2093,6 +2097,7 @@ pub trait Store {
     fn set_vhost(&mut self, account: &str, host: &str, setter: &str, ttl: Option<u64>) -> Result<(), RegError>;
     fn del_vhost(&mut self, account: &str) -> Result<bool, RegError>;
     fn vhost(&self, account: &str) -> Option<VhostView>;
+    fn active_vhost(&self, account: &str) -> Option<String>;
     fn vhosts(&self) -> Vec<VhostView>;
     fn vhost_owner(&self, host: &str) -> Option<String>;
     fn request_vhost(&mut self, account: &str, host: &str) -> Result<(), RegError>;
@@ -2446,6 +2451,26 @@ pub fn next_guest_nick(base: &str, seq: &mut u32, net: &dyn NetView, store: &dyn
     candidate
 }
 
+/// The actions to reverse a services vhost when a session logs out: restore the
+/// connect-time host, and the ident too if the vhost set one (`ident@host`).
+/// Empty when the account holds no vhost. Restores the stored displayed host —
+/// the cloak, never the real host — since the vhost apply never overwrites it.
+pub fn vhost_restore_actions(net: &dyn NetView, store: &dyn Store, uid: &str, account: &str) -> Vec<NetAction> {
+    let Some(vhost) = store.active_vhost(account) else {
+        return Vec::new();
+    };
+    let mut out = Vec::new();
+    if vhost.contains('@') {
+        if let Some(ident) = net.ident_of(uid).filter(|i| !i.is_empty()) {
+            out.push(NetAction::SetIdent { uid: uid.to_string(), ident: ident.to_string() });
+        }
+    }
+    if let Some(host) = net.host_of(uid).filter(|h| !h.is_empty()) {
+        out.push(NetAction::SetHost { uid: uid.to_string(), host: host.to_string() });
+    }
+    out
+}
+
 /// Tell `target` account they were affected by someone else's action: notice
 /// every online session, or leave a memo (from `by`) if they're offline. The
 /// message renders in the target's own language. No-op when the actor is the

lang/de.json

@@ -1365,5 +1365,6 @@
  "Added \u0002{count}\u0002 channels to your auto-join list.": "\u0002{count}\u0002 Kanäle zu deiner Auto-Join-Liste hinzugefügt.",
  "Unknown AJOIN command \u0002{other}\u0002. Use \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 or \u0002LIST\u0002.": "Unbekannter AJOIN-Befehl \u0002{other}\u0002. Nutze \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 oder \u0002LIST\u0002.",
  "Or confirm in one click: {link}": "Oder bestätige mit einem Klick: {link}",
- "Confirm now": "Jetzt bestätigen"
+ "Confirm now": "Jetzt bestätigen",
+ "… and \u0002{more}\u0002 more; showing the first {cap}.": "… und \u0002{more}\u0002 weitere; die ersten {cap} werden angezeigt."
 }

lang/es-ar.json

@@ -1365,5 +1365,6 @@
  "Added \u0002{count}\u0002 channels to your auto-join list.": "\u0002{count}\u0002 canales agregados a tu lista de auto-unión.",
  "Unknown AJOIN command \u0002{other}\u0002. Use \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 or \u0002LIST\u0002.": "Comando AJOIN desconocido \u0002{other}\u0002. Usá \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 o \u0002LIST\u0002.",
  "Or confirm in one click: {link}": "O confirmá con un clic: {link}",
- "Confirm now": "Confirmar ahora"
+ "Confirm now": "Confirmar ahora",
+ "… and \u0002{more}\u0002 more; showing the first {cap}.": "… y \u0002{more}\u0002 más; mostrando los primeros {cap}."
 }

lang/es.json

@@ -1365,5 +1365,6 @@
  "Added \u0002{count}\u0002 channels to your auto-join list.": "\u0002{count}\u0002 canales añadidos a tu lista de auto-unión.",
  "Unknown AJOIN command \u0002{other}\u0002. Use \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 or \u0002LIST\u0002.": "Comando AJOIN desconocido \u0002{other}\u0002. Usa \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 o \u0002LIST\u0002.",
  "Or confirm in one click: {link}": "O confirma con un clic: {link}",
- "Confirm now": "Confirmar ahora"
+ "Confirm now": "Confirmar ahora",
+ "… and \u0002{more}\u0002 more; showing the first {cap}.": "… y \u0002{more}\u0002 más; mostrando los primeros {cap}."
 }

lang/fr.json

@@ -1365,5 +1365,6 @@
  "Added \u0002{count}\u0002 channels to your auto-join list.": "\u0002{count}\u0002 salons ajoutés à votre liste d'auto-join.",
  "Unknown AJOIN command \u0002{other}\u0002. Use \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 or \u0002LIST\u0002.": "Commande AJOIN inconnue \u0002{other}\u0002. Utilisez \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 ou \u0002LIST\u0002.",
  "Or confirm in one click: {link}": "Ou confirmez en un clic : {link}",
- "Confirm now": "Confirmer maintenant"
+ "Confirm now": "Confirmer maintenant",
+ "… and \u0002{more}\u0002 more; showing the first {cap}.": "… et \u0002{more}\u0002 de plus ; affichage des {cap} premiers."
 }

lang/pt-br.json

@@ -1365,5 +1365,6 @@
  "Added \u0002{count}\u0002 channels to your auto-join list.": "\u0002{count}\u0002 canais adicionados à sua lista de auto-entrada.",
  "Unknown AJOIN command \u0002{other}\u0002. Use \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 or \u0002LIST\u0002.": "Comando AJOIN desconhecido \u0002{other}\u0002. Use \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 ou \u0002LIST\u0002.",
  "Or confirm in one click: {link}": "Ou confirme com um clique: {link}",
- "Confirm now": "Confirmar agora"
+ "Confirm now": "Confirmar agora",
+ "… and \u0002{more}\u0002 more; showing the first {cap}.": "… e mais \u0002{more}\u0002; mostrando os primeiros {cap}."
 }

lang/pt.json

@@ -1365,5 +1365,6 @@
  "Added \u0002{count}\u0002 channels to your auto-join list.": "\u0002{count}\u0002 canais adicionados à sua lista de auto-entrada.",
  "Unknown AJOIN command \u0002{other}\u0002. Use \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 or \u0002LIST\u0002.": "Comando AJOIN desconhecido \u0002{other}\u0002. Use \u0002ADD\u0002, \u0002ADDALL\u0002, \u0002DEL\u0002 ou \u0002LIST\u0002.",
  "Or confirm in one click: {link}": "Ou confirme com um clique: {link}",
- "Confirm now": "Confirmar agora"
+ "Confirm now": "Confirmar agora",
+ "… and \u0002{more}\u0002 more; showing the first {cap}.": "… e mais \u0002{more}\u0002; a mostrar os primeiros {cap}."
 }

modules/hostserv/src/list.rs

@@ -11,8 +11,11 @@ pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &dyn Store) {
         return;
     }
     ctx.notice(me, from.uid, t!(ctx, "Assigned vhosts ({count}):", count = vhosts.len()));
-    for v in &vhosts {
+    for v in vhosts.iter().take(echo_api::LIST_CAP) {
         let temp = if v.expires.is_some() { t!(ctx, ", temporary") } else { String::new() };
         ctx.notice(me, from.uid, t!(ctx, "  \x02{account}\x02 — {host} (by {setter}{temp})", account = v.account, host = v.host, setter = v.setter, temp = temp));
     }
+    if vhosts.len() > echo_api::LIST_CAP {
+        ctx.notice(me, from.uid, t!(ctx, "… and \x02{more}\x02 more; showing the first {cap}.", more = vhosts.len() - echo_api::LIST_CAP, cap = echo_api::LIST_CAP));
+    }
 }

modules/nickserv/src/logout.rs

@@ -3,11 +3,12 @@ use echo_api::t;
 
 // LOGOUT: log out and rename to a guest nick (prefix + a per-logout sequence).
 pub fn handle(me: &str, guest_nick: &str, guest_seq: &mut u32, from: &Sender, ctx: &mut ServiceCtx, net: &dyn NetView, db: &dyn Store) {
-    if from.account.is_none() {
+    let Some(account) = from.account else {
         ctx.notice(me, from.uid, "You're not logged in.");
         return;
-    }
+    };
     let guest = echo_api::next_guest_nick(guest_nick, guest_seq, net, db);
+    ctx.actions.extend(echo_api::vhost_restore_actions(net, db, from.uid, account));
     ctx.logout(from.uid);
     ctx.force_nick(from.uid, &guest);
     ctx.notice(me, from.uid, t!(ctx, "You're now logged out. Your nick is now \x02{guest}\x02.", guest = guest));

modules/operserv/src/forbid.rs

@@ -45,9 +45,12 @@ pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db:
                 return;
             }
             ctx.notice(me, from.uid, "Registration bans:");
-            for f in &forbids {
+            for f in forbids.iter().take(echo_api::LIST_CAP) {
                 ctx.notice(me, from.uid, t!(ctx, "  [{kind}] \x02{mask}\x02 by {setter} ({when}) — {reason}", kind = f.kind.wire(), mask = f.mask, setter = f.setter, when = human_time(f.ts), reason = f.reason));
             }
+            if forbids.len() > echo_api::LIST_CAP {
+                ctx.notice(me, from.uid, t!(ctx, "… and \x02{more}\x02 more; showing the first {cap}.", more = forbids.len() - echo_api::LIST_CAP, cap = echo_api::LIST_CAP));
+            }
         }
         _ => ctx.notice(me, from.uid, "Syntax: FORBID ADD <NICK|CHAN|EMAIL> <mask> <reason> | DEL <NICK|CHAN|EMAIL> <mask> | LIST"),
     }

src/engine/db/store.rs

@@ -152,6 +152,9 @@ impl Store for Db {
             a.vhost.as_ref().filter(|v| v.expires.is_none_or(|e| e > now())).map(|v| VhostView { account: a.name.clone(), host: v.host.clone(), setter: v.setter.clone(), expires: v.expires })
         })
     }
+    fn active_vhost(&self, account: &str) -> Option<String> {
+        Db::active_vhost(self, account)
+    }
     fn vhosts(&self) -> Vec<VhostView> {
         Db::vhosts(self).into_iter().map(|(account, host, setter, expires)| VhostView { account, host, setter, expires }).collect()
     }

src/engine/mod.rs

@@ -767,6 +767,9 @@ impl Engine {
         if let Some(action) = self.feed("SESS", format!("{} logged out of \x02{account}\x02 ({reason})", self.who(uid))) {
             self.emit_irc(action);
         }
+        for act in echo_api::vhost_restore_actions(&self.network, &self.db, uid, account) {
+            self.emit_irc(act);
+        }
         self.network.clear_account(uid);
         self.emit_irc(NetAction::Metadata { target: uid.to_string(), key: "accountname".to_string(), value: String::new() });
         if let Some(ns) = self.nick_service.clone() {

src/engine/tests.rs

@@ -5240,6 +5240,24 @@
         assert_eq!(e.db.unread_memos("bob"), 1, "no extra memo when online");
     }
 
+    // Logging out reverses a services vhost, restoring the connect-time host (the
+    // cloak we were given at UserConnect), not the real host.
+    #[test]
+    fn logout_restores_the_connect_host_over_a_vhost() {
+        let path = std::env::temp_dir().join("echo-logout-vhost.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        db.register("alice", "sesame", None).unwrap();
+        db.set_vhost("alice", "cool.vhost", "admin", None).unwrap();
+        let ns = NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 };
+        let mut e = Engine::new(vec![Box::new(ns)], db);
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "alice".into(), host: "cloak.host".into(), ip: "0.0.0.0".into() });
+        e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "IDENTIFY sesame".into() });
+        let out = e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "LOGOUT".into() });
+        assert!(out.iter().any(|a| matches!(a, NetAction::SetHost { uid, host } if uid == "000AAAAAB" && host == "cloak.host")), "logout restores the cloak: {out:?}");
+    }
+
     // ChanServ SET: description and founder transfer, founder-gated.
     #[test]
     fn chanserv_set() {