From a41812db1ab6d93880929b508d5d781be35a5b7e Mon Sep 17 00:00:00 2001
From: Sadie Powell <sadie@witchery.services>
Date: Tue, 14 Jan 2025 13:26:52 +0000
Subject: [PATCH] Drop the backup fingerprints if linked using the 1205
 protocol.

---
 src/modules/m_spanningtree/compat.cpp | 30 ++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/src/modules/m_spanningtree/compat.cpp b/src/modules/m_spanningtree/compat.cpp
index df6db4bf1..252813f60 100644
--- a/src/modules/m_spanningtree/compat.cpp
+++ b/src/modules/m_spanningtree/compat.cpp
@@ -68,7 +68,35 @@ void TreeSocket::WriteLine(const std::string& original_line)
 	std::string command(line, cmdstart, cmdend - cmdstart);
 	if (proto_version == PROTO_INSPIRCD_3)
 	{
-		if (irc::equals(command, "FHOST") || irc::equals(command, "FIDENT"))
+		if (irc::equals(command, "ENCAP"))
+		{
+			// :<sid> ENCAP <server> <real-command>
+			auto serverend = NextToken(line, cmdend);
+			auto actualcmdend = NextToken(line, serverend);
+			if (actualcmdend != std::string::npos)
+			{
+				std::string realcommand(line, serverend + 1, actualcmdend - serverend - 1);
+				if (irc::equals(realcommand, "SASL"))
+				{
+					auto suidend = NextToken(line, actualcmdend);
+					auto tuidend = NextToken(line, suidend);
+					auto flagend = NextToken(line, tuidend);
+					if (flagend != std::string::npos)
+					{
+						std::string flag(line, tuidend + 1, flagend - tuidend - 1);
+						if (irc::equals(flag, "S"))
+						{
+							// SASL <uid> <uid> S <mech> <fp> [<fp>]+
+							auto mechend = NextToken(line, flagend);
+							auto fpend = NextToken(line, mechend);
+							if (fpend != std::string::npos)
+								line.erase(fpend); // Multiple fingerprints in ssl_cert was introduced in PROTO_INSPIRCD_4; drop it.
+						}
+					}
+				}
+			}
+		}
+		else if (irc::equals(command, "FHOST") || irc::equals(command, "FIDENT"))
 		{
 			// FIDENT/FHOST has two parameters in v4; drop the real username/hostname.
 			// :<sid> FIDENT|FHOST <display|*> <real|*>