Conversation
|
It's also not correct to assume the nick and account name are the same. IMO the account name should be a new setting. The nick is probably the best default in general, though one might want to use the username here for compatibility with existing users of node-irc. |
SASL PLAIN's payload is authzid\0authcid\0password. onAuthenticate() was using opt.userName (the IRC ident sent via USER) for both identity fields instead of the account being authenticated. Networks that validate the account name (e.g. Libera Chat) reject this with err_saslfail even when the password is correct, since the ident and the NickServ account rarely match. Default to this.nick (the connecting nick, backed by state.currentNick which is set before registration) for both identity fields, since that matches most networks/services. The nick and the account name aren't guaranteed to be the same everywhere though, so add an optional `saslAccount` opt to override it explicitly for setups where they differ.
nbuechner
force-pushed
the
pr-sasl-plain-authcid
branch
from
September 13, 2026 13:52
81197ca to
aa15946
Compare
Author
|
Good point, thanks - updated to default to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
onAuthenticate()'s SASL PLAIN implementation builds the payload asopt.userName + '\0' + opt.userName + '\0' + opt.password. Per the SASL PLAINmechanism, this payload should be
authzid\0authcid\0password, where theauthcid is the account/nick being authenticated as - not
opt.userName, whichis the separate IRC ident sent via the
USERcommand.On networks that validate the identity against the given account (e.g. Libera
Chat), this causes SASL to fail with
err_saslfaileven when the password iscorrect, since the configured ident and the actual NickServ account name
essentially never match. The client falls back to registering without SASL,
so it isn't fully broken, but it never gets a successful SASL handshake (and
whatever the server grants for it, e.g. Libera's SASL-based cloak).
Fix
Use
this.nick(backed bystate.currentNick, which is set from therequested nick before registration begins) for both the authzid and authcid
fields instead of
opt.userName.Testing
Confirmed against a live matrix-appservice-irc deployment connecting to
Libera Chat: before this fix, every connection logged
err_saslfailand fellback to unauthenticated registration; after this fix (with a valid stored
password), SASL succeeds on the first attempt (
900/903fromSaslServ/services, noerr_saslfail).yarn test:unitpasses (one pre-existing, unrelated failure intest-irc.spec.ts's "part reasons" test reproduces identically onmasterwithout this change).