From 6703b8065ccaa0acb50380736f25780e3a8e549d Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 30 Jan 2022 12:49:28 +0000
Subject: Abort pre-registration SASL attempts when the user fully connects.

This makes InspIRCd work more like other IRC servers which implement
the recommended behaviour from the sasl-3.1 specification:

    If the client completes registration (with CAP END, NICK, USER
    and any other necessary messages) while the SASL authentication
    is still in progress, the server SHOULD abort it and send a 906
    numeric, then register the client without authentication.

Thanks to @aaronmdjones and @edk0 for finding and reporting this.
---
 src/modules/m_sasl.cpp | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

(limited to 'src/modules')

diff --git a/src/modules/m_sasl.cpp b/src/modules/m_sasl.cpp
index 20f2dba90..69d33e25c 100644
--- a/src/modules/m_sasl.cpp
+++ b/src/modules/m_sasl.cpp
@@ -281,6 +281,12 @@ class SaslAuthenticator
 		return this->state;
 	}
 
+	void Abort()
+	{
+		this->state = SASL_DONE;
+		this->result = SASL_ABORT;
+	}
+
 	bool SendClientMessage(const std::vector<std::string>& parameters)
 	{
 		if (this->state != SASL_COMM)
@@ -290,15 +296,14 @@ class SaslAuthenticator
 
 		if (parameters[0].c_str()[0] == '*')
 		{
-			this->state = SASL_DONE;
-			this->result = SASL_ABORT;
+			this->Abort();
 			return false;
 		}
 
 		return true;
 	}
 
-	void AnnounceState(void)
+	void AnnounceState()
 	{
 		if (this->state_announced)
 			return;
@@ -451,6 +456,21 @@ class ModuleSASL : public Module
 		servertracker.Reset();
 	}
 
+	void OnUserConnect(LocalUser* user) CXX11_OVERRIDE
+	{
+		// If the client completes registration (with CAP END, NICK, USER and
+		// any other necessary messages) while the SASL authentication is still
+		// in progress, the server SHOULD abort it and send a 906 numeric, then
+		// register the client without authentication.
+		SaslAuthenticator* saslauth = authExt.get(user);
+		if (saslauth)
+		{
+			saslauth->Abort();
+			saslauth->AnnounceState();
+			authExt.unset(user);
+		}
+	}
+
 	void OnDecodeMetaData(Extensible* target, const std::string& extname, const std::string& extdata) CXX11_OVERRIDE
 	{
 		if ((target == NULL) && (extname == "saslmechlist"))
-- 
cgit v1.3.1-10-gc9f91