Revert "ircv3 STS: advertise sts= (port on plaintext, duration/preload on tls) — the modern tls-upgrade cap"

This reverts commit e0b22a34d0.

src/config.rs

@@ -76,9 +76,6 @@ pub struct Config {
     pub dnsbl_reason: String,          // ban reason for a DNSBL hit
     pub sasl_server: String,           // linked services server that handles SASL ("" = none)
     pub webirc: Vec<(String, String, String)>, // web gateways: (password, name, ip-mask)
-    pub sts_duration: u64, // IRCv3 STS: seconds a client must keep using TLS (0 = STS off)
-    pub sts_port: u16,     // TLS port to advertise in STS (0 = derive from bind_tls)
-    pub sts_preload: bool, // STS preload flag
 }
 
 impl Default for Config {
@@ -107,9 +104,6 @@ impl Default for Config {
             dnsbl_reason: "Your host is listed in a DNS blocklist".to_string(),
             sasl_server: String::new(),
             webirc: Vec::new(),
-            sts_duration: 0,
-            sts_port: 0,
-            sts_preload: false,
         }
     }
 }
@@ -243,9 +237,6 @@ impl Config {
                 "dnsbl_action" => c.dnsbl_action = v.to_ascii_lowercase(),
                 "dnsbl_reason" => c.dnsbl_reason = v.to_string(),
                 "sasl_server" | "sasl_target" => c.sasl_server = v.to_string(),
-                "sts_duration" => c.sts_duration = v.parse().unwrap_or(0),
-                "sts_port" => c.sts_port = v.parse().unwrap_or(0),
-                "sts_preload" => c.sts_preload = matches!(v, "on" | "yes" | "true" | "1"),
                 "webirc" => {
                     // webirc = <password> [gateway-name] [ip-mask]
                     let mut it = v.split_whitespace();
@@ -258,16 +249,5 @@ impl Config {
                 _ => {}
             }
         }
-        // STS advertises a TLS port to insecure clients; default it to the TLS listener's.
-        if c.sts_duration > 0 && c.sts_port == 0 {
-            if let Some(p) = c
-                .bind_tls
-                .as_deref()
-                .and_then(|b| b.rsplit(':').next())
-                .and_then(|p| p.parse::<u16>().ok())
-            {
-                c.sts_port = p;
-            }
-        }
     }
 }

src/coremods/core_rehash.rs

@@ -67,9 +67,6 @@ impl Command for Rehash {
                 s.dnsbl_action = fresh.dnsbl_action;
                 s.dnsbl_reason = fresh.dnsbl_reason;
                 s.sasl_server = fresh.sasl_server;
-                s.sts_duration = fresh.sts_duration;
-                s.sts_port = fresh.sts_port;
-                s.sts_preload = fresh.sts_preload;
                 s.announce("Server configuration reloaded.");
                 s.numeric(uid, RPL_REHASHING, &format!("{path} :Rehashing"));
             }

src/coremods/core_user.rs

@@ -124,12 +124,14 @@ impl Command for Cap {
                     u.cap = true; // hold registration until CAP END
                     u.cap_302 |= cap302;
                 }
-                let mut caps = Caps::ls_line(cap302, secure);
+                s.send(
-                if let Some(sts) = s.sts_token(secure) {
+                    uid,
-                    caps.push(' ');
+                    format!(
-                    caps.push_str(&sts); // IRCv3 STS — advertised, not REQ-able
+                        ":{} CAP {who} LS :{}",
-                }
+                        s.name,
-                s.send(uid, format!(":{} CAP {who} LS :{caps}", s.name));
+                        Caps::ls_line(cap302, secure)
+                    ),
+                );
             }
             "REQ" => {
                 if let Some(u) = s.users.get_mut(&uid) {

src/server.rs

@@ -144,9 +144,6 @@ pub struct Server {
     pub dnsbl_reason: String,                      // ban reason on a DNSBL hit
     pub sasl_server: String,                       // services server that handles SASL
     pub webirc: Vec<(String, String, String)>,     // web gateways: (password, name, ip-mask)
-    pub sts_duration: u64,                         // IRCv3 STS: TLS-only duration (0 = off)
-    pub sts_port: u16,                             // STS TLS port advertised to insecure clients
-    pub sts_preload: bool,                         // STS preload flag
     // labeled-response: while Some((uid, buf)), that client's own responses are
     // diverted into `buf` instead of the socket, so `on_line` can wrap them with
     // the command's `label` (single tag, BATCH, or ACK). RefCell because the
@@ -196,9 +193,6 @@ impl Server {
             dnsbl_reason: cfg.dnsbl_reason,
             sasl_server: cfg.sasl_server,
             webirc: cfg.webirc,
-            sts_duration: cfg.sts_duration,
-            sts_port: cfg.sts_port,
-            sts_preload: cfg.sts_preload,
             label_capture: RefCell::new(None),
             history: HashMap::new(),
             read_markers: HashMap::new(),
@@ -256,26 +250,6 @@ impl Server {
         }
     }
 
-    /// The IRCv3 `sts=` cap value for a connection, or `None` when STS is off.
-    /// Insecure clients get `port=<tlsport>` (reconnect over TLS); secure clients
-    /// get `duration=<n>[,preload]` (remember to always use TLS).
-    pub fn sts_token(&self, secure: bool) -> Option<String> {
-        if self.sts_duration == 0 {
-            return None;
-        }
-        if secure {
-            let mut v = format!("sts=duration={}", self.sts_duration);
-            if self.sts_preload {
-                v.push_str(",preload");
-            }
-            Some(v)
-        } else if self.sts_port != 0 {
-            Some(format!("sts=port={}", self.sts_port))
-        } else {
-            None
-        }
-    }
-
     /// The read-marker identity for `uid`: their account when logged in (so markers
     /// are shared across their devices and survive reconnects), else a per-session
     /// key. `remove_user` prunes the session key on disconnect.