Simple SASL implementation does NOT require a library.

It's defined by https://www.rfc-editor.org/rfc/rfc4616 and doesn't provide any security.

It's just a string to send to the server, with a base64 representation of user and password.

Secrets stored in Vault

• nickserv username and password: secrets/nasqueron/odderon/nickserv
• direct SASL plain base64 of those: secrets/nasqueron/odderon/sasl

SASL authentication

I've a functional proof of concept:

• C function to concatenate username, NUL, username, NUL, password (don't use strcpy, but memcpy to avoid NUL-termination C strings)
• session with openssl s_client -connect sodium.libera.chat:6697

C source code is available at P331.

SASL authentication workflow:

• ask capability to the server
• announce the SASL mechanism used
• send authentication payload

This is to do before the NICK and USER commands.

Quick connection test

$ CAP REQ :SASL
:sodium.libera.chat CAP * ACK :SASL
CAP END
AUTHENTICATE PLAIN
AUTHENTICATE <base64 payload>
:sodium.libera.chat 900 * *!unknown@host-85-26-29-78.dynamic.voo.be odderon :You are now logged in as odderon
:sodium.libera.chat 903 * :SASL authentication successful

Note Nickserv confirmation at 900, and confirmation at 903. Those are RAW code an IRC client should handle.

Darkbot implementation

Nickserv authentication was done by running perform.ini content at init time.

Similarly, we could provide a preinit (chmod 400) file with the CAP and AUTHENTICATE commands.

Another solution is to provide a correct configuration file and add the P331 code to darkbot source code.

We can avoid to link against OpenSSL using P332: it's the wpa supplicant base64 methods, from the FreeBSD source code.

Blocked by T1870 to test correctly this.

I don't know what's happen with darkbot 7, but with 6f6 it works like a charm:

00:30:43 -!- odderon [dereckson@windriver.nasqueron.org]
00:30:43 -!-  ircname  : Download me from http://darkbot.net 1
00:30:43 -!-  channels : #pentacle
00:30:43 -!-  server   : erbium.libera.chat [Frankfurt, DE]
00:30:43 -!-  hostname : 51.159.18.59
00:30:43 -!-  idle     : 0 days 0 hours 0 mins 56 secs [signon: Mon May 15 00:29:47 2023]
00:30:43 -!-  account  : odderon

So solution is rollback to 6f6 and publish SASL patch against that version.

Next step is to actually deploy the SASL credential from secrets/nasqueron/odderon/nickserv

An issue is we don't currently have Eglide on the Nasqueron private network, and so Vault isn't available there.

As such, a local Vault on Eglide could be useful.

Credentials. Secrets provisioned to Eglide Vault under kv/service/odderon/nickserv.

Nexts steps.

• Rebuild darkbot with SASL change on Eglide
• Add configuration file provisioning in roles/shellserver/odderon