SASL PLAIN fails with correct details. #509

New Issue

2026-10-05T04:26:01+02:00

adam commented

2026-10-05 04:26:01 +02:00

On freenode I have recently got messages on PLAIN mechanism failing even if I have correct details.

Username: Mikaela
Password: <288 characters> (run pwgen -s 288).

288 is currently the maximum password length with Atheme on freenode and probably other networks using recent Atheme. I have confirmed that the password is correct by copy-pasting it to /ns identify.

This seems like some artificial limit in ZNC. I also reproduced this with HexChat without ZNC in the middle and @TingPing said that HexChat has limit and the current limits are at https://github.com/hexchat/hexchat/issues/1296.

On freenode I have recently got messages on PLAIN mechanism failing even if I have correct details. - Username: Mikaela - Password: <288 characters> (run `pwgen -s 288`). 288 is currently the maximum password length with Atheme on freenode and probably other networks using recent Atheme. I have confirmed that the password is correct by copy-pasting it to `/ns identify`. This seems like some artificial limit in ZNC. I also reproduced this with HexChat without ZNC in the middle and @TingPing said that HexChat has limit and the current limits are at https://github.com/hexchat/hexchat/issues/1296.

adam closed this issue

2026-10-05 04:26:01 +02:00

adam commented

2026-10-05 04:26:02 +02:00

I have now also reproduced this issue with Limnoria (CC: @ProgVal) and I am wondering if this is not limit in ZNC, but SASL for some reason having lower limit than 288 characters.

I have now also reproduced this issue with Limnoria (CC: @ProgVal) and I am wondering if this is not limit in ZNC, but SASL for some reason having lower limit than 288 characters.

adam commented

2026-10-05 04:26:02 +02:00

I believe there is some maximum limitation for password and this is not ZNC issue.

I believe there is some maximum limitation for password and this is not ZNC issue.

adam commented

2026-10-05 04:26:03 +02:00

I found this issue while digging around a similar issue in HexChat. There is no artificial limit inherent to SASL PLAIN; however, it appears many clients do not implement the specification's requirement to split SASL messages into chunks of at most 400 bytes. Given a sufficiently long AUTHENTICATE message, such as the one generated by your example, failing to split will result in a SASL failure.

This appears to be the relevant part of the code:

https://github.com/znc/znc/blob/e415d9f58c63a7390c0691e589d849531411ebef/modules/sasl.cpp#L196-L206

I found this issue while digging around a similar issue in HexChat. There is no artificial limit inherent to SASL PLAIN; however, it appears many clients do not implement [the specification's requirement to split SASL messages into chunks of at most 400 bytes][sasl-authenticate]. Given a sufficiently long AUTHENTICATE message, such as the one generated by your example, failing to split will result in a SASL failure. This appears to be the relevant part of the code: https://github.com/znc/znc/blob/e415d9f58c63a7390c0691e589d849531411ebef/modules/sasl.cpp#L196-L206 [sasl-authenticate]: https://ircv3.net/specs/extensions/sasl-3.1.html#the-authenticate-command

adam commented

2026-10-05 04:26:04 +02:00

Similar issue exists in sopel-irc/sopel#975

Similar issue exists in sopel-irc/sopel#975

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#509