unofficial mirror of bug-gnu-emacs@gnu.org 
 help / color / mirror / code / Atom feed
* bug#29108: 25.3; ERC SASL support
@ 2017-11-01 20:07 Alex Branham
  2017-11-10  2:24 ` Noam Postavsky
                   ` (2 more replies)
  0 siblings, 3 replies; 54+ messages in thread
From: Alex Branham @ 2017-11-01 20:07 UTC (permalink / raw)
  To: 29108

Since freenode requires SASL support if you're connecting from certain networks, it would be nice if ERC supported connecting via SASL. There seems to have been some work on this a few years ago: https://github.com/jane-lx/erc-sasl

Thanks!

In GNU Emacs 25.3.1 (x86_64-pc-linux-gnu, GTK+ Version 3.22.19)
 of 2017-09-16 built on juergen
Windowing system distributor 'The X.Org Foundation', version 11.0.11905000
Configured using:
 'configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/lib
 --localstatedir=/var --with-x-toolkit=gtk3 --with-xft --with-modules
 'CFLAGS=-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong
 -fno-plt' CPPFLAGS=-D_FORTIFY_SOURCE=2
 LDFLAGS=-Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now'

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GCONF GSETTINGS
NOTIFY ACL GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS GTK3 X11 MODULES

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix






^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2017-11-01 20:07 bug#29108: 25.3; ERC SASL support Alex Branham
@ 2017-11-10  2:24 ` Noam Postavsky
  2019-10-23  9:24   ` Lars Ingebrigtsen
  2021-07-28 16:59 ` Ulrich Mueller
  2022-09-18 18:32 ` bug#29108: [J.P.] Add "non-IRCv3" SASL to ERC J.P.
  2 siblings, 1 reply; 54+ messages in thread
From: Noam Postavsky @ 2017-11-10  2:24 UTC (permalink / raw)
  To: Alex Branham; +Cc: 29108

severity 29108 wishlist
quit

Alex Branham <alex.branham@gmail.com> writes:

> Since freenode requires SASL support if you're connecting from certain
> networks, it would be nice if ERC supported connecting via SASL. There
> seems to have been some work on this a few years ago:
> https://github.com/jane-lx/erc-sasl

That copyright for that code may or may not be assignable to Emacs, cf
https://github.com/jane-lx/erc-sasl/issues/2.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2017-11-10  2:24 ` Noam Postavsky
@ 2019-10-23  9:24   ` Lars Ingebrigtsen
  2019-10-23 10:34     ` Alex Branham
  0 siblings, 1 reply; 54+ messages in thread
From: Lars Ingebrigtsen @ 2019-10-23  9:24 UTC (permalink / raw)
  To: Noam Postavsky; +Cc: Alex Branham, 29108

Noam Postavsky <npostavs@users.sourceforge.net> writes:

>> Since freenode requires SASL support if you're connecting from certain
>> networks, it would be nice if ERC supported connecting via SASL. There
>> seems to have been some work on this a few years ago:
>> https://github.com/jane-lx/erc-sasl
>
> That copyright for that code may or may not be assignable to Emacs, cf
> https://github.com/jane-lx/erc-sasl/issues/2.

SASL support in Emacs would be nice.  That URL 404s now, but there are
other copies of it out there.  The primary author (Joseph Gay) does have
copyright assignments on file, but does anybody know the provenance of
the file?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2019-10-23  9:24   ` Lars Ingebrigtsen
@ 2019-10-23 10:34     ` Alex Branham
  2019-10-23 11:19       ` Lars Ingebrigtsen
  0 siblings, 1 reply; 54+ messages in thread
From: Alex Branham @ 2019-10-23 10:34 UTC (permalink / raw)
  To: Lars Ingebrigtsen; +Cc: 29108, Noam Postavsky

On Wed 23 Oct 2019 at 11:24, Lars Ingebrigtsen <larsi@gnus.org> wrote:

> Noam Postavsky <npostavs@users.sourceforge.net> writes:
>
>>> Since freenode requires SASL support if you're connecting from certain
>>> networks, it would be nice if ERC supported connecting via SASL. There
>>> seems to have been some work on this a few years ago:
>>> https://github.com/jane-lx/erc-sasl
>>
>> That copyright for that code may or may not be assignable to Emacs, cf
>> https://github.com/jane-lx/erc-sasl/issues/2.
>
> SASL support in Emacs would be nice.  That URL 404s now, but there are
> other copies of it out there.  The primary author (Joseph Gay) does have
> copyright assignments on file, but does anybody know the provenance of
> the file?

Here's one copy: https://gitlab.com/psachin/erc-sasl/blob/master/erc-sasl.el





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2019-10-23 10:34     ` Alex Branham
@ 2019-10-23 11:19       ` Lars Ingebrigtsen
  2019-10-23 12:19         ` Stefan Kangas
  2019-11-02 14:10         ` Stefan Kangas
  0 siblings, 2 replies; 54+ messages in thread
From: Lars Ingebrigtsen @ 2019-10-23 11:19 UTC (permalink / raw)
  To: Alex Branham; +Cc: 29108, Noam Postavsky

Alex Branham <alex.branham@gmail.com> writes:

> Here's one copy: https://gitlab.com/psachin/erc-sasl/blob/master/erc-sasl.el

Could somebody get in touch with the original author, or check whether
what's in there is the same as the original author wrote?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2019-10-23 11:19       ` Lars Ingebrigtsen
@ 2019-10-23 12:19         ` Stefan Kangas
  2019-10-23 12:57           ` Noam Postavsky
  2019-11-02 14:10         ` Stefan Kangas
  1 sibling, 1 reply; 54+ messages in thread
From: Stefan Kangas @ 2019-10-23 12:19 UTC (permalink / raw)
  To: Joseph Gay; +Cc: Alex Branham, 29108, Lars Ingebrigtsen, Noam Postavsky

Hi Joseph,

We are looking into adding SASL support to ERC in Emacs, which would
be a useful feature for our users.  We note that you have done some
previous work in this area (erc-sasl.el), and that you already have
copyright assignments for Emacs on file.

The best link we could find for erc-sasl.el was this:
https://gitlab.com/psachin/erc-sasl/blob/master/erc-sasl.el

Could you please help us by answering these two questions:

1. Would you have any objections if we included your code in Emacs?
2. Is the code on the link above the code written by you, or has it
been changed since? Are you the sole contributor to that file?

I've included our recent discussion about this below for your
information.  Thanks in advance.

Best regards,
Stefan Kangas


Den ons 23 okt. 2019 kl 13:54 skrev Lars Ingebrigtsen <larsi@gnus.org>:
>
> Alex Branham <alex.branham@gmail.com> writes:
>
> > Here's one copy: https://gitlab.com/psachin/erc-sasl/blob/master/erc-sasl.el
>
> Could somebody get in touch with the original author, or check whether
> what's in there is the same as the original author wrote?
>
> --
> (domestic pets only, the antidote for overdose, milk.)
>    bloggy blog: http://lars.ingebrigtsen.no
>
>
>





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2019-10-23 12:19         ` Stefan Kangas
@ 2019-10-23 12:57           ` Noam Postavsky
  2019-10-23 13:32             ` Stefan Kangas
  0 siblings, 1 reply; 54+ messages in thread
From: Noam Postavsky @ 2019-10-23 12:57 UTC (permalink / raw)
  To: Stefan Kangas
  Cc: Alex Branham, Jane Gay, 29108, Lars Ingebrigtsen, Noam Postavsky

Stefan Kangas <stefan@marxist.se> writes:

> Hi Joseph,

I think they're called Jane now.  The original repository indeed seems
to be gone, but it was already under username jane-lx which still
exists, see <https://github.com/jane-lx/> and the linked
<https://medium.com/@jane.lx.gay>.

> We are looking into adding SASL support to ERC in Emacs, which would
> be a useful feature for our users.  We note that you have done some
> previous work in this area (erc-sasl.el), and that you already have
> copyright assignments for Emacs on file.
>
> The best link we could find for erc-sasl.el was this:
> https://gitlab.com/psachin/erc-sasl/blob/master/erc-sasl.el
>
> Could you please help us by answering these two questions:
>
> 1. Would you have any objections if we included your code in Emacs?
> 2. Is the code on the link above the code written by you, or has it
> been changed since? Are you the sole contributor to that file?
>
> I've included our recent discussion about this below for your
> information.  Thanks in advance.
>
> Best regards,
> Stefan Kangas





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2019-10-23 12:57           ` Noam Postavsky
@ 2019-10-23 13:32             ` Stefan Kangas
  0 siblings, 0 replies; 54+ messages in thread
From: Stefan Kangas @ 2019-10-23 13:32 UTC (permalink / raw)
  To: Noam Postavsky
  Cc: Alex Branham, Jane Gay, 29108, Lars Ingebrigtsen, Noam Postavsky

Noam Postavsky <npostavs@gmail.com> writes:

> > Hi Joseph,
>
> I think they're called Jane now.

Thanks, sorry for the mistake.  I carelessly used what was available
in the file, which I suppose was an old copy.

Best regards,
Stefan Kangas





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2019-10-23 11:19       ` Lars Ingebrigtsen
  2019-10-23 12:19         ` Stefan Kangas
@ 2019-11-02 14:10         ` Stefan Kangas
  2020-08-03  9:39           ` Lars Ingebrigtsen
  1 sibling, 1 reply; 54+ messages in thread
From: Stefan Kangas @ 2019-11-02 14:10 UTC (permalink / raw)
  To: gilleylen; +Cc: Alex Branham, 29108, Lars Ingebrigtsen, Noam Postavsky

[ysph@psy.ai bounced. Trying another email address.]

Hi,

We are looking into adding SASL support to ERC in Emacs, which would
be a useful feature for our users.  We note that you have done some
previous work in this area (erc-sasl.el), and that you already have
copyright assignments for Emacs on file.

We note that this link is dead:
https://github.com/jane-lx/erc-sasl

The best link we could find for erc-sasl.el was this:
https://gitlab.com/psachin/erc-sasl/blob/master/erc-sasl.el

Could you please help us by answering these two questions:

1. Would you have any objections if we included your code in Emacs?
2. Is the code in the second link above the code written by you, or
has it been changed since?  Are you the sole contributor to that file?

I've included our recent discussion about this below for your
information.  Thanks in advance.

Best regards,
Stefan Kangas

Lars Ingebrigtsen <larsi@gnus.org> writes:
>
> Alex Branham <alex.branham@gmail.com> writes:
>
> > Here's one copy: https://gitlab.com/psachin/erc-sasl/blob/master/erc-sasl.el
>
> Could somebody get in touch with the original author, or check whether
> what's in there is the same as the original author wrote?





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2019-11-02 14:10         ` Stefan Kangas
@ 2020-08-03  9:39           ` Lars Ingebrigtsen
  0 siblings, 0 replies; 54+ messages in thread
From: Lars Ingebrigtsen @ 2020-08-03  9:39 UTC (permalink / raw)
  To: Stefan Kangas; +Cc: Alex Branham, gilleylen, 29108, Noam Postavsky

Stefan Kangas <stefan@marxist.se> writes:

> The best link we could find for erc-sasl.el was this:
> https://gitlab.com/psachin/erc-sasl/blob/master/erc-sasl.el
>
> Could you please help us by answering these two questions:
>
> 1. Would you have any objections if we included your code in Emacs?
> 2. Is the code in the second link above the code written by you, or
> has it been changed since?  Are you the sole contributor to that file?

This was more than half a year ago, so I'm guessing there won't be a
response here.  So it seems unlikely that we'll make more progress here,
and I'm closing this bug report.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2017-11-01 20:07 bug#29108: 25.3; ERC SASL support Alex Branham
  2017-11-10  2:24 ` Noam Postavsky
@ 2021-07-28 16:59 ` Ulrich Mueller
  2021-07-28 17:21   ` Eli Zaretskii
                     ` (2 more replies)
  2022-09-18 18:32 ` bug#29108: [J.P.] Add "non-IRCv3" SASL to ERC J.P.
  2 siblings, 3 replies; 54+ messages in thread
From: Ulrich Mueller @ 2021-07-28 16:59 UTC (permalink / raw)
  To: 29108

ERC is a little behind the times by not supporting SASL, so please
pretty please can we have this?

Not sure if it helps, but archive.org has a partial copy of the original
git repository:
https://web.archive.org/web/20180611034438if_/https://github.com/jane-lx/erc-sasl

Most importantly, it does have erc-sasl.el which AFAICS is the only
relevant file.

There also is a fork of the repository on Github:
https://github.com/suhailshergill/erc-sasl

Apparently it has no additional commits beyond the original repository
and erc-sasl.el is identical to the one found at archive.org.

Looking at commit history, there are 4 commits in 2012 (all by
Joseph Gay). Their parent is commit 9497cc9 which is also the tip of the
ERC repository at https://git.savannah.gnu.org/cgit/erc.git.

Would this be enough for inclusion in Emacs, given that erc-sasl.el has
a GPL license notice and that copyright papers for the author are on
file (or at least message #13 says so)?





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2021-07-28 16:59 ` Ulrich Mueller
@ 2021-07-28 17:21   ` Eli Zaretskii
  2021-07-28 22:42   ` J.P.
  2021-08-09  9:59   ` J.P.
  2 siblings, 0 replies; 54+ messages in thread
From: Eli Zaretskii @ 2021-07-28 17:21 UTC (permalink / raw)
  To: Ulrich Mueller; +Cc: 29108

> From: Ulrich Mueller <ulm@gentoo.org>
> Date: Wed, 28 Jul 2021 18:59:34 +0200
> 
> There also is a fork of the repository on Github:
> https://github.com/suhailshergill/erc-sasl
> 
> Apparently it has no additional commits beyond the original repository
> and erc-sasl.el is identical to the one found at archive.org.
> 
> Looking at commit history, there are 4 commits in 2012 (all by
> Joseph Gay). Their parent is commit 9497cc9 which is also the tip of the
> ERC repository at https://git.savannah.gnu.org/cgit/erc.git.
> 
> Would this be enough for inclusion in Emacs, given that erc-sasl.el has
> a GPL license notice and that copyright papers for the author are on
> file (or at least message #13 says so)?

AFAIU, we'd need to hear from Joseph that he agrees to contribute his
code to Emacs.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2021-07-28 16:59 ` Ulrich Mueller
  2021-07-28 17:21   ` Eli Zaretskii
@ 2021-07-28 22:42   ` J.P.
  2021-08-09  9:59   ` J.P.
  2 siblings, 0 replies; 54+ messages in thread
From: J.P. @ 2021-07-28 22:42 UTC (permalink / raw)
  To: Ulrich Mueller; +Cc: 29108

Ulrich Mueller <ulm@gentoo.org> writes:

> ERC is a little behind the times by not supporting SASL, so please
> pretty please can we have this?

Hi Ulrich,

I have a patch for this that I'll be introducing in the next few days as
part of a larger change set bringing much needed life support to ERC
generally. It lays the foundation for moving us to IRCv3.

If you would like a preview, you can check this out [1].

> Not sure if it helps, but archive.org has a partial copy of the original
> git repository:
> https://web.archive.org/web/20180611034438if_/https://github.com/jane-lx/erc-sasl

I'm well acquainted with this patch. IMO, it's a hack, but nothing wrong
with that [2].

If you'd like to take what I have for a spin, please follow the steps
posted here [3], except change the bug number in all URLs from 48598 to
99999. The stuff there is a bit stale (many improvements since), but
I'll be updating it all shortly.

More to follow in the next 72 or so. Please stay tuned.

Thanks,
J.P.


[1] https://gitlab.com/jpneverwas/erc-v3/-/blob/master/erc-v3-sasl.el

[2] Some info posted to #erc about this a few months back:

    *** #erc was created on 2021-05-19 07:01:11
    <neverwas> Okay people, so I redid my rather horrendous joke of an
               SASL extension using the upstream sasl.el library and was
               able to implement all of the recommended mechanisms
               currently in use or soon to be. Turns out alphachat is
               running the latest atheme, so I signed up and
               successfully validated against its service (and captured
               logs) for both SCRAM-SHA-256 and
               ECDSA-NIST256P-CHALLENGE.
                      a                                        [14:07]
    <neverwas> The main ugly point right now is I'm currently shelling
               out to openssl for the latter (ecdsa). I see two possible
               ways around this. The first is adding
               gnutls_privkey_sign_hash() and anything it requires to
               src/gnutls.c. The other is shelling out to a comparable
               gnutls-based command-line tool. After a cursory search, I
               was unable to find one that does the job. Anyone here
               familiar with that suite?
    <neverwas> So once we add the basic v3 building blocks for CAP and
               its subcommands to ERC proper (and a couple tiny sasl.el
               patches I'll open soon), adding full featured SASL
               support should go pretty smoothly. Unlike how rcirc and
               Circe (and the older non-GNU ERC patches) do things, this
               approach properly delegates to a black-box service for
               the subprotocol, which is the way rfc4422 designed it.
                                                               [14:08]
    <neverwas> This makes it super easy to add other mechanisms in the
               future. All the gory details are hidden away behind the
               sasl.el-provided state machine, so you just feed it
               whatever arrives from the server, and it coughs out the
               next thing to send. Take a look if you want:
               https://gitlab.com/jpneverwas/erc-v3/-/blob/master/erc-v3-sasl.el
               (replace "blob" with "raw" for no JS)

[3] https://lists.gnu.org/archive/html/emacs-erc/2021-06/msg00019.html





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2021-07-28 16:59 ` Ulrich Mueller
  2021-07-28 17:21   ` Eli Zaretskii
  2021-07-28 22:42   ` J.P.
@ 2021-08-09  9:59   ` J.P.
  2021-08-09 10:22     ` Ulrich Mueller
                       ` (2 more replies)
  2 siblings, 3 replies; 54+ messages in thread
From: J.P. @ 2021-08-09  9:59 UTC (permalink / raw)
  To: Ulrich Mueller; +Cc: 29108

Hi Ulrich,

Ulrich Mueller <ulm@gentoo.org> writes:

> ERC is a little behind the times by not supporting SASL, so please
> pretty please can we have this?

If you're still interested in SASL, please try installing these patches
[1] and maybe do something like the following:

Connect to InspIRCd's testnet:

  (require 'erc)
  (erc-toggle-debug-irc-protocol)
  (push 'v3 erc-modules)
  (erc-tls :server "testnet.inspircd.org"
           :port 6697
           :nick "my-nick"
           :full-name "My Nick")

And register with anope nick services:

  ERC> /msg NickServ REGISTER password123 fake@fake.example.org

  ERC> /quit

Then connect again (the client certs should be real, in preparation for
the next demo):

  (push 'sasl erc-v3-extensions)
  (setq erc-v3-sasl-mechanism 'plain)
  (erc-tls :server "testnet.inspircd.org"
           :port 6697
           :nick "my-nick"
           :password "password123"
           :full-name "My Nick"
           :client-certificate (list "/tmp/key.pem" "/tmp/cert.pem"))

Look for this in the server buffer:

  *** Account status for my-nick: logged in as my-nick

Then do:

  ERC> /msg NickServ CERT ADD

  ERC> /quit

This time, using EXTERNAL (note the lack of a password):

  (setq erc-v3-sasl-mechanism 'external)
  (erc-tls :server "testnet.inspircd.org"
           :port 6697
           :nick "my-nick"
           :full-name "My Nick"
           :client-certificate (list "/tmp/key.pem" "/tmp/cert.pem"))

Once again, note the success message. The fancier mechanisms also work.
Let me know if you have any questions. Thanks.


[1] https://jpneverwas.gitlab.io/erc-tools/49860/patches.tar.gz

    Alternative, package.el-based option in footnote #2 of this post:

    https://lists.gnu.org/archive/html/emacs-erc/2021-08/msg00002.html





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2021-08-09  9:59   ` J.P.
@ 2021-08-09 10:22     ` Ulrich Mueller
  2021-08-09 10:56       ` J.P.
  2021-08-09 12:39       ` J.P.
  2021-08-23 13:47     ` J.P.
       [not found]     ` <87o89oi87g.fsf@neverwas.me>
  2 siblings, 2 replies; 54+ messages in thread
From: Ulrich Mueller @ 2021-08-09 10:22 UTC (permalink / raw)
  To: J.P.; +Cc: 29108

>>>>> On Mon, 09 Aug 2021, J P wrote:

> If you're still interested in SASL, please try installing these patches
> [1] and maybe do something like the following:

> [1] https://jpneverwas.gitlab.io/erc-tools/49860/patches.tar.gz

Sorry for the delay. On top of what version do these patches apply?
I have tried with current master and with the 27.2 release but patches
fail for both.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2021-08-09 10:22     ` Ulrich Mueller
@ 2021-08-09 10:56       ` J.P.
  2021-08-09 12:39       ` J.P.
  1 sibling, 0 replies; 54+ messages in thread
From: J.P. @ 2021-08-09 10:56 UTC (permalink / raw)
  To: Ulrich Mueller; +Cc: 29108

Ulrich Mueller <ulm@gentoo.org> writes:

> Sorry for the delay. On top of what version do these patches apply?
> I have tried with current master and with the 27.2 release but patches
> fail for both.

Sorry about that. This recent commit on master caught me off guard:

  commit 3b7b181bded1bddb2505eda1224a5631cbf04c1b
  Mattias Engdegård ~ 9 Aug 2021 05:50:18 -0400 (EDT)
  Use string-search instead of string-match[-p]

I have a CI rebaser job set up, but it only runs once a day. Let me do
this one manually. Can you maybe check again in a few hours? I'd also
like to incorporate some churn related to the eql specializer change.
Thanks.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2021-08-09 10:22     ` Ulrich Mueller
  2021-08-09 10:56       ` J.P.
@ 2021-08-09 12:39       ` J.P.
  1 sibling, 0 replies; 54+ messages in thread
From: J.P. @ 2021-08-09 12:39 UTC (permalink / raw)
  To: Ulrich Mueller; +Cc: 29108

Okay, they should apply cleanly now atop:

  commit aeec97fae0ccfcc4dc406a5e0e4c0a94b834cac4 (origin/master)
  Author: Mattias Engdegård <mattiase@acm.org>
  Date:   Mon Aug 9 12:09:49 2021 +0200

      Fix variable binding in calendar (bug#49945)

      * lisp/calendar/cal-tex.el (cal-tex-week-hours,
      cal-tex-daily-page): Use `let*` instead of `let`.

Same link as before. Apologies again for the false start.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2021-08-09  9:59   ` J.P.
  2021-08-09 10:22     ` Ulrich Mueller
@ 2021-08-23 13:47     ` J.P.
       [not found]     ` <87o89oi87g.fsf@neverwas.me>
  2 siblings, 0 replies; 54+ messages in thread
From: J.P. @ 2021-08-23 13:47 UTC (permalink / raw)
  To: Ulrich Mueller; +Cc: 29108, emacs-erc

Hi Ulrich,

"J.P." <jp@neverwas.me> writes:

> Then connect again (the client certs should be real, in preparation for
> the next demo):
>
>   (push 'sasl erc-v3-extensions)
>   (setq erc-v3-sasl-mechanism 'plain)
>   (erc-tls :server "testnet.inspircd.org"
>            :port 6697
>            :nick "my-nick"
>            :password "password123"
>             ^~~~~~~~~~~~~~~~~~~~~~~ gone
>            :full-name "My Nick"

I've changed things up a tad after realizing that appropriating the
dialed password parameter was a dumb idea. I guess in zealously adhering
to tradition (by mimicking erc-services.el, in this case), I also left
common sense at the door (yet again).

To clarify, I'm not talking about collisions with the legacy

  PASS my-nick:password123

authentication scheme, for which there still remains dwindling support
among public networks. That's mostly a nonissue because SASL supplants
that entirely.

Instead, I'm thinking of actual server (connection) passwords, even
though they're basically unheard of with public networks. And I suppose
there's also the possibility of the rare proxy wanting a piece of the
PASS action for its own wacky purposes, something like a

  PASS my-account@my-device/some-config-id:unused

preceding an SASL exchange moments later. (I haven't actually seen such
a thing in the wild, but it strikes me as plausible. Crazy?)

Anyway, since personal/enterprise IRC servers may still use actual
connection passwords, we've got to leave the `erc-tls' :password param
alone and introduce a separate SASL password option. Hope that's clear.

Also, in keeping with this policy, I've decided to discourage automatic
nick use for account user names. This also defies the ERC services API
but is nevertheless correct, IMO. So it's now

  (setq erc-v3-sasl-user "my-nick"
        erc-v3-sasl-password "password123")

or similar via M-x customize. BTW, auth source is consulted if you leave
the password out.

> This time, using EXTERNAL (note the lack of a password):
>
>   (setq erc-v3-sasl-mechanism 'external)

In other news, EXTERNAL usage hasn't changed, though I'm wondering if we
should maybe add a warning when tried in conjunction with TLS1.2 (or
lower). Any idea if sub-1.3 is even possible on a modern Emacs and if
so, whether a warning after the fact would suffice? Something like a

  (when (version< (substring (plist-get (gnutls-peer-status proc)
                                        :protocol)
                             3)
                  "1.3")
    (erc-display-error-notice nil "Warning: ..."))

except nicer perhaps? No idea. (@Lars or someone TLS savvy.)

Last side note: I'm thinking of moving the RPL_LOGGEDIN 900 handler out
of the erc-v3-sasl library or maybe instead defining a default that the
library can override when it loads. The reason is that some servers use
these numerics for confirming account authentication with the legacy
user:pass syntax noted above. And if we're trying to make sessions
account aware, this would accommodate people who for some reason still
want that user:pass stuff with v3 in lieu of SASL.

Anyway, when you have a sec, please try (again?) with these changes.
Thanks.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]     ` <87o89oi87g.fsf@neverwas.me>
@ 2021-08-23 14:01       ` Lars Ingebrigtsen
       [not found]       ` <87zgt8s1jt.fsf@gnus.org>
  1 sibling, 0 replies; 54+ messages in thread
From: Lars Ingebrigtsen @ 2021-08-23 14:01 UTC (permalink / raw)
  To: J.P.; +Cc: Ulrich Mueller, 29108, emacs-erc

"J.P." <jp@neverwas.me> writes:

> In other news, EXTERNAL usage hasn't changed, though I'm wondering if we
> should maybe add a warning when tried in conjunction with TLS1.2 (or
> lower). Any idea if sub-1.3 is even possible on a modern Emacs and if
> so, whether a warning after the fact would suffice? Something like a
>
>   (when (version< (substring (plist-get (gnutls-peer-status proc)
>                                         :protocol)
>                              3)
>                   "1.3")
>     (erc-display-error-notice nil "Warning: ..."))
>
> except nicer perhaps? No idea. (@Lars or someone TLS savvy.)

I think that's up to the Network Security Manager level -- the user can
customise this there.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]       ` <87zgt8s1jt.fsf@gnus.org>
@ 2021-08-24 13:42         ` J.P.
  0 siblings, 0 replies; 54+ messages in thread
From: J.P. @ 2021-08-24 13:42 UTC (permalink / raw)
  To: Lars Ingebrigtsen; +Cc: Ulrich Mueller, 29108, emacs-erc

Lars Ingebrigtsen <larsi@gnus.org> writes:

> I think that's up to the Network Security Manager level -- the user can
> customise this there.

Hi Lars, my apologies. I obviously wasn't being very clear but was
telepathically referring to client certs being transmitted in the clear
for TLS versions less than 1.3. I'm not sure any `nsm-protocol-check--*'
functions screen for this specifically because it's probably/rightly
considered less of a security issue and more of a minor personal-hygiene
matter.

And not that I'm privy to much in core IRC circles, but I suspect the
occasional smattering of attention paid to this topic can be chalked up
to bored devs just having a say about more exciting things like
dissidents and tracking. So for ERC's purposes, I guess there's little
sense in warning about what's probably just an iffy corner case in the
end. Thanks, and sorry for the distraction.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: [J.P.] Add "non-IRCv3" SASL to ERC
  2017-11-01 20:07 bug#29108: 25.3; ERC SASL support Alex Branham
  2017-11-10  2:24 ` Noam Postavsky
  2021-07-28 16:59 ` Ulrich Mueller
@ 2022-09-18 18:32 ` J.P.
  2022-09-20  6:07   ` bug#29108: 25.3; ERC SASL support J.P.
       [not found]   ` <875yhifujk.fsf_-_@neverwas.me>
  2 siblings, 2 replies; 54+ messages in thread
From: J.P. @ 2022-09-18 18:32 UTC (permalink / raw)
  To: 29108; +Cc: emacs-erc

[-- Attachment #1: Type: text/plain, Size: 277 bytes --]

Resending (last attempt thwarted by archive police).

-------------------- Start of forwarded message --------------------
From: "J.P." <jp@neverwas.me>
To: 29108@debbugs.gnu.org
Cc: emacs-erc@gnu.org
Subject: Add "non-IRCv3" SASL to ERC
Date: Sun, 18 Sep 2022 07:09:45 -0700


[-- Attachment #2.1: Type: text/plain, Size: 988 bytes --]

Hi people,

As my prior comments on this matter may suggest, I've long been in favor
of holding SASL hostage until we can get a full CAP 3.2 implementation
in place. However, I'm ready to bow to public pressure on this and
entertain a partial (hack) implementation, in part because I now
recognize that a valid use case may yet exist for wanting SASL alone
without proper capability negotiation (even after that's eventually
introduced [1]).

I therefore offer this compromise reluctantly and still fear that going
this route will only prolong our complacency and further delay the sort
of meaningful evolution our client desperately needs.

Thanks,
J.P.

P.S. Our ELPA recipe would need updating before these changes could
land.

[1] Speaking of which, various aspects of the attached bug set may
    benefit from additional context. And for that, I'd kindly direct you
    to bug#49860, whose WIP patches can be found here:

    https://emacs-erc.gitlab.io/bugs/49860/patches.tar.gz 



[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2.2: 0001-Support-local-ERC-modules-in-erc-mode-buffers.patch --]
[-- Type: text/x-patch, Size: 10741 bytes --]

From fd268c1302f15d19200483569d9db68d052643f6 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 12 Jul 2021 03:44:28 -0700
Subject: [PATCH 1/3] Support local ERC modules in erc-mode buffers

* lisp/erc/erc.el (erc-migrate-modules): add some missing mappings.
(erc--module-name-migrations, erc--features-to-modules,
erc--modules-to-features): add alists to support simplified
module-name migrations.
(erc-update-modules): Change return value to a list of minor-mode
commands for local modules that need deferred activation, if any.  Use
`custom-variable-p' to detect flavor.  Currently, all modules are
global, meaning so are their accompanying minor modes.
(erc-open): Defer enabling of local modules via `erc-update-modules'
until after buffer is initialized with other local vars.  Also defer
major mode hooks so they can detect things like whether the buffer is
a server or target buffer.
(define-erc-modules): Don't enable local modules (minor modes) unless
`erc-mode' is the major mode. And don't disable them unless the minor
mode is actually active.  Also, don't mutate `erc-modules' when
dealing with a local module.  It's believed that the original authors
wanted this functionality.
---
 lisp/erc/erc.el            | 108 ++++++++++++++++++++++++-------------
 test/lisp/erc/erc-tests.el |  47 ++++++++++++++++
 2 files changed, 119 insertions(+), 36 deletions(-)

diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 151d75e7ce..89fc226599 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1390,7 +1390,9 @@ define-erc-module
 
 This will define a minor mode called erc-NAME-mode, possibly
 an alias erc-ALIAS-mode, as well as the helper functions
-erc-NAME-enable, and erc-NAME-disable.
+erc-NAME-enable, and erc-NAME-disable.  Beware that for global
+modules, these helpers, as well as the minor-mode toggle, all mutate
+the user option `erc-modules'.
 
 Example:
 
@@ -1426,16 +1428,21 @@ define-erc-module
          ,(format "Enable ERC %S mode."
                   name)
          (interactive)
-         (add-to-list 'erc-modules (quote ,name))
-         (setq ,mode t)
-         ,@enable-body)
+         (unless ,local-p
+           (cl-pushnew (erc--normalize-module-symbol ',name) erc-modules))
+         (when (or ,(not local-p) (eq major-mode 'erc-mode))
+           (setq ,mode t)
+           ,@enable-body))
        (defun ,disable ()
          ,(format "Disable ERC %S mode."
                   name)
          (interactive)
-         (setq erc-modules (delq (quote ,name) erc-modules))
-         (setq ,mode nil)
-         ,@disable-body)
+         (unless ,local-p
+           (setq erc-modules (delq (erc--normalize-module-symbol ',name)
+                                   erc-modules)))
+         (when (or ,(not local-p) ,mode)
+           (setq ,mode nil)
+           ,@disable-body))
        ,(when (and alias (not (eq name alias)))
           `(defalias
              ',(intern
@@ -2029,14 +2036,40 @@ erc-default-nicks
 (defvar-local erc-nick-change-attempt-count 0
   "Used to keep track of how many times an attempt at changing nick is made.")
 
+(defconst erc--features-to-modules
+  '((erc-pcomplete completion pcomplete)
+    (erc-capab capab-identify)
+    (erc-join autojoin)
+    (erc-page page ctcp-page)
+    (erc-sound sound ctcp-sound)
+    (erc-stamp stamp timestamp)
+    (erc-services services nickserv))
+  "Migration alist mapping a library feature to module names.
+Keys need not be unique: a library may define more than one
+module.")
+
+(defconst erc--modules-to-features
+  (cl-loop for (feature . names) in erc--features-to-modules
+           append (mapcar (lambda (name) (cons name feature)) names))
+  "Migration alist mapping a module's name to library feature.")
+
+(defconst erc--module-name-migrations
+  (let (pairs)
+    (pcase-dolist (`(,_ ,canonical . ,rest) erc--features-to-modules)
+      (dolist (obsolete rest)
+        (push (cons obsolete canonical) pairs)))
+    pairs)
+  "Association list of obsolete module names to canonical names.")
+
+(defun erc--normalize-module-symbol (module)
+  "Canonicalize symbol MODULE for `erc-modules'."
+  (or (cdr (assq module erc--module-name-migrations)) module))
+
 (defun erc-migrate-modules (mods)
   "Migrate old names of ERC modules to new ones."
   ;; modify `transforms' to specify what needs to be changed
   ;; each item is in the format '(old . new)
-  (let ((transforms '((pcomplete . completion))))
-    (delete-dups
-     (mapcar (lambda (m) (or (cdr (assoc m transforms)) m))
-             mods))))
+  (delete-dups (mapcar #'erc--normalize-module-symbol mods)))
 
 (defcustom erc-modules '(netsplit fill button match track completion readonly
                                   networks ring autojoin noncommands irccontrols
@@ -2115,27 +2148,22 @@ erc-modules
   :group 'erc)
 
 (defun erc-update-modules ()
-  "Run this to enable erc-foo-mode for all modules in `erc-modules'."
-  (let (req)
+  "Enable global minor mode for all global modules in `erc-modules'.
+Return minor-mode commands for all local modules, possibly for
+deferred invocation, as done by `erc-open' whenever a new ERC
+buffer is created.  Local modules were introduced in ERC 5.6."
+  (let (local-modules)
     (dolist (mod erc-modules)
-      (setq req (concat "erc-" (symbol-name mod)))
-      (cond
-       ;; yuck. perhaps we should bring the filenames into sync?
-       ((string= req "erc-capab-identify")
-        (setq req "erc-capab"))
-       ((string= req "erc-completion")
-        (setq req "erc-pcomplete"))
-       ((string= req "erc-pcomplete")
-        (setq mod 'completion))
-       ((string= req "erc-autojoin")
-        (setq req "erc-join")))
-      (condition-case nil
-          (require (intern req))
-        (error nil))
+      (require (or (alist-get mod erc--modules-to-features)
+                   (intern (concat "erc-" (symbol-name mod))))
+               nil 'noerror) ; some modules don't have a corresponding feature
       (let ((sym (intern-soft (concat "erc-" (symbol-name mod) "-mode"))))
-        (if (fboundp sym)
+        (unless (and sym (fboundp sym))
+          (error "`%s' is not a known ERC module" mod))
+        (if (custom-variable-p sym)
             (funcall sym 1)
-          (error "`%s' is not a known ERC module" mod))))))
+          (push sym local-modules))))
+    local-modules))
 
 (defun erc-setup-buffer (buffer)
   "Consults `erc-join-buffer' to find out how to display `BUFFER'."
@@ -2191,18 +2219,22 @@ erc-open
   (let* ((target (and channel (erc--target-from-string channel)))
          (buffer (erc-get-buffer-create server port nil target id))
          (old-buffer (current-buffer))
-         old-point
+         (old-recon-count erc-server-reconnect-count)
+         (old-point nil)
+         (delayed-modules nil)
          (continued-session (and erc--server-reconnecting
                                  (with-suppressed-warnings
                                      ((obsolete erc-reuse-buffers))
                                    erc-reuse-buffers))))
     (when connect (run-hook-with-args 'erc-before-connect server port nick))
-    (erc-update-modules)
     (set-buffer buffer)
     (setq old-point (point))
-    (let ((old-recon-count erc-server-reconnect-count))
-      (erc-mode)
-      (setq erc-server-reconnect-count old-recon-count))
+    (setq delayed-modules (erc-update-modules))
+
+    (delay-mode-hooks (erc-mode))
+
+    (setq erc-server-reconnect-count old-recon-count)
+
     (when (setq erc-server-connected (not connect))
       (setq erc-server-announced-name
             (buffer-local-value 'erc-server-announced-name old-buffer)))
@@ -2265,6 +2297,12 @@ erc-open
     (setq erc-dbuf
           (when erc-log-p
             (get-buffer-create (concat "*ERC-DEBUG: " server "*"))))
+
+    (erc-determine-parameters server port nick full-name user passwd)
+
+    (save-excursion (run-mode-hooks))
+    (dolist (mod delayed-modules) (funcall mod +1))
+
     ;; set up prompt
     (unless continued-session
       (goto-char (point-max))
@@ -2276,8 +2314,6 @@ erc-open
       (erc-display-prompt)
       (goto-char (point-max)))
 
-    (erc-determine-parameters server port nick full-name user passwd)
-
     ;; Saving log file on exit
     (run-hook-with-args 'erc-connect-pre-hook buffer)
 
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index 55efe2fd2d..cbaa20fa67 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -975,4 +975,51 @@ erc-message
     (kill-buffer "ExampleNet")
     (kill-buffer "#chan")))
 
+(ert-deftest erc-migrate-modules ()
+  (should (equal (erc-migrate-modules '(autojoin timestamp button))
+                 '(autojoin stamp button)))
+  ;; Default unchanged
+  (should (equal (erc-migrate-modules erc-modules) erc-modules)))
+
+(ert-deftest erc-update-modules ()
+  (let* (calls
+         (erc-modules '(fake-foo fake-bar)))
+    (cl-letf (((symbol-function 'require)
+               (lambda (s &rest _) (push s calls)))
+              ((symbol-function 'erc-fake-foo-mode)
+               (lambda (n) (push (cons 'fake-foo n) calls)))
+              ;; Here, foo is a global module (minor mode)
+              ((get 'erc-fake-foo-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-fake-bar-mode)
+               (lambda (n) (push (cons 'fake-bar n) calls)))
+              ((symbol-function 'erc-autojoin-mode)
+               (lambda (n) (push (cons 'autojoin n) calls)))
+              ((get 'erc-autojoin-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-networks-mode)
+               (lambda (n) (push (cons 'networks n) calls)))
+              ((symbol-function 'erc-completion-mode)
+               (lambda (n) (push (cons 'completion n) calls)))
+              ((get 'erc-completion-mode 'standard-value) #'ignore))
+
+      (ert-info ("Locals")
+        (should (equal (erc-update-modules)
+                       '(erc-fake-bar-mode)))
+        ;; Bar still required
+        (should (equal (nreverse calls) '(erc-fake-foo
+                                          (fake-foo . 1)
+                                          erc-fake-bar)))
+        (setq calls nil))
+
+      (ert-info ("Module name overrides")
+        (setq erc-modules '(completion autojoin networks))
+        (should-not (erc-update-modules)) ; no locals
+        (should (equal (nreverse calls)
+                       '(erc-pcomplete
+                         (completion . 1)
+                         erc-join
+                         (autojoin . 1)
+                         erc-networks
+                         (networks . 1))))
+        (setq calls nil)))))
+
 ;;; erc-tests.el ends here
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2.3: 0002-Make-erc-login-generic.patch --]
[-- Type: text/x-patch, Size: 1965 bytes --]

From 2b3d432ec5210dadd91576da143825a1d6e4d190 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:49:23 -0700
Subject: [PATCH 2/3] Make erc-login generic

* lisp/erc/erc-backend (erc--register-connection): Add new generic
function that's just a wrapper for `erc-login' by default.
(erc-process-sentinel, erc-server-connect): Call
`erc--register-connection' instead of `erc-login'.
---
 lisp/erc/erc-backend.el | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index df9efe4b0c..25c4481d1d 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -532,6 +532,10 @@ erc-open-network-stream
   (let ((p (plist-put parameters :nowait t)))
     (apply #'open-network-stream name buffer host service p)))
 
+(cl-defmethod erc--register-connection ()
+  "Perform opening IRC protocol exchange with server."
+  (erc-login))
+
 (defun erc-server-connect (server port buffer &optional client-certificate)
   "Perform the connection and login using the specified SERVER and PORT.
 We will store server variables in the buffer given by BUFFER.
@@ -580,7 +584,7 @@ erc-server-connect
         ;; waiting for a non-blocking connect - keep the user informed
         (erc-display-message nil nil buffer "Opening connection..\n")
       (message "%s...done" msg)
-      (erc-login)) ))
+      (erc--register-connection))))
 
 (defun erc-server-reconnect ()
   "Reestablish the current IRC connection.
@@ -758,7 +762,7 @@ erc-process-sentinel
                   cproc (process-status cproc) event erc-server-quitting))
         (if (string-match "^open" event)
             ;; newly opened connection (no wait)
-            (erc-login)
+            (erc--register-connection)
           ;; assume event is 'failed
           (erc-with-all-buffers-of-server cproc nil
                                           (setq erc-server-connected nil))
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2.4: 0003-Add-non-IRCv3-SASL-module-to-ERC.patch --]
[-- Type: text/x-patch, Size: 61049 bytes --]

From dde968397a20d7a27db2e04efc78737693c88d5e Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:37:13 -0700
Subject: [PATCH 3/3] Add non-IRCv3 SASL module to ERC

* lisp/erc/erc-compat.el (erc-compat--scram--client-final-message):
Add partial authorization support via own variant of
`sasl-scram--client-final-message'.

* lisp/erc/erc-sasl.el: New file.
* test/lisp/erc/erc-sasl-tests.el: New file.
* test/lisp/erc/erc-scenarios-sasl.el: New file.
* test/lisp/erc/resources/sasl/plain-failed.eld: New file.
* test/lisp/erc/resources/sasl/plain.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-1.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-256.eld: New file.
* test/lisp/erc/resources/sasl/external.eld: New file.
---
 lisp/erc/erc-compat.el                        |  83 +++
 lisp/erc/erc-sasl.el                          | 483 ++++++++++++++++++
 test/lisp/erc/erc-sasl-tests.el               | 295 +++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 161 ++++++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  35 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 ++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 ++
 9 files changed, 1200 insertions(+)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 8a00e711ac..8ba061d5ac 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -156,6 +156,89 @@ erc-subseq
 		 (setq i (1+ i) start (1+ start)))
 	       res))))))
 
+
+;;;; SASL
+
+(declare-function sasl-step-data "sasl" (step))
+(declare-function sasl-error "sasl" (datum))
+(declare-function sasl-client-property "sasl" (client property))
+(declare-function sasl-client-set-property "sasl" (client property value))
+(declare-function sasl-mechanism-name "sasl" (mechanism))
+(declare-function sasl-client-name "sasl" (client))
+(declare-function sasl-client-mechanism "sasl" (client))
+(declare-function sasl-read-passphrase "sasl" (prompt))
+(declare-function decode-hex-string "hex-util" (string))
+(declare-function rfc2104-hash "rfc2104" (hash block-length hash-length
+                                               key text))
+(declare-function cl-mapcar "cl-lib" (cl-func cl-x &rest cl-rest))
+
+;; This is `sasl-scram--client-final-message' from sasl-scram-rfc,
+;; with the NO-LINE-BREAK argument of `base64-encode-string' set to t.
+;; The only other substantial change is the addition of authz support.
+;; If adopted by Emacs 29, this can dropped when ERC no longer
+;; supports Emacs 28.  Unfortunately, advising `base64-encode-string'
+;; won't work because the byte compiler precomputes the result when
+;; all inputs are constants, as they are in the unpatched version.
+;; Changes from the latter are marked with a "; *n", comment below.
+;; See older versions of lisp/erc/erc-sasl.el if needing a
+;; side-by-side diff.  This also inlines the internal function
+;; `sasl-scram--client-first-message-bare' and takes various liberties
+;; with formatting.
+
+(defun erc-compat--scram--client-final-message
+    (hash-fun block-length hash-length client step)
+  (unless (string-match
+           "^r=\\([^,]+\\),s=\\([^,]+\\),i=\\([0-9]+\\)\\(?:$\\|,\\)"
+           (sasl-step-data step))
+    (sasl-error "Unexpected server response"))
+  (let* ((hmac-fun
+          (lambda (text key)
+            (decode-hex-string
+             (rfc2104-hash hash-fun block-length hash-length key text))))
+         (step-data (sasl-step-data step))
+         (nonce (match-string 1 step-data))
+         (salt-base64 (match-string 2 step-data))
+         (iteration-count (string-to-number (match-string 3 step-data)))
+         (c-nonce (sasl-client-property client 'c-nonce))
+         (cbind-input
+          (if (string-prefix-p c-nonce nonce)
+              (or (sasl-client-property client 'gs2-header) "n,,") ; *1
+            (sasl-error "Invalid nonce from server")))
+         (client-final-message-without-proof
+          (concat "c=" (base64-encode-string cbind-input t) "," ; *2
+                  "r=" nonce))
+         (password
+          (sasl-read-passphrase
+           (format "%s passphrase for %s: "
+                   (sasl-mechanism-name (sasl-client-mechanism client))
+                   (sasl-client-name client))))
+         (salt (base64-decode-string salt-base64))
+         (string-xor (lambda (a b)
+                       (apply #'unibyte-string (cl-mapcar #'logxor a b))))
+         (salted-password (let ((digest (concat salt (string 0 0 0 1)))
+                                (xored nil))
+                            (dotimes (_i iteration-count xored)
+                              (setq digest (funcall hmac-fun digest password))
+                              (setq xored (if (null xored)
+                                              digest
+                                            (funcall string-xor xored
+                                                     digest))))))
+         (client-key (funcall hmac-fun "Client Key" salted-password))
+         (stored-key (decode-hex-string (funcall hash-fun client-key)))
+         (auth-message (concat "n=" (sasl-client-name client)
+                               ",r=" c-nonce "," step-data
+                               "," client-final-message-without-proof))
+         (client-signature (funcall hmac-fun
+                                    (encode-coding-string auth-message 'utf-8)
+                                    stored-key))
+         (client-proof (funcall string-xor client-key client-signature))
+         (client-final-message
+          (concat client-final-message-without-proof ","
+                  "p=" (base64-encode-string client-proof t)))) ; *3
+    (sasl-client-set-property client 'auth-message auth-message)
+    (sasl-client-set-property client 'salted-password salted-password)
+    client-final-message))
+
 (provide 'erc-compat)
 
 ;;; erc-compat.el ends here
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
new file mode 100644
index 0000000000..6cd9a928d8
--- /dev/null
+++ b/lisp/erc/erc-sasl.el
@@ -0,0 +1,483 @@
+;;; erc-sasl.el --- SASL for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published
+;; by the Free Software Foundation, either version 3 of the License,
+;; or (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;; WARNING: this is a naive/hack (non-IRCv3) implementation of SASL.
+;; Please see bug#49860, which adds full 3.2 capability negotiation.
+
+;; Various ERC implementations of the PLAIN mechanism have surfaced
+;; over the years, the first possibly being:
+;;
+;; https://lists.gnu.org/archive/html/erc-discuss/2012-02/msg00001.html
+;;
+;; This module would not exist without this and other pioneering
+;; efforts.
+;;
+;; FIXME move the following to doc/misc/erc.texi
+;;
+;; Regardless of the mechanism or server, you'll likely have to be
+;; registered before first use.  Refer to the network's own
+;; instructions for details.  If you're new to IRC and using a
+;; bouncer, know that you almost certainly won't be needing SASL for
+;; the client -> bouncer connection.
+;;
+;; Note that `sasl' is a "local" ERC module (effectively introduced in
+;; ERC 5.5).  This means invoking `erc-sasl-mode' manually or calling
+;; `erc-update-modules' won't do any good.  Instead, simply add `sasl'
+;; to `erc-modules' or `let'-bind it while calling `erc-tls', and SASL
+;; will be enabled for the current connection.  But before that,
+;; please explore all custom options that pertain to your chosen
+;; mechanism.
+;;
+;; Password-based mechanisms:
+;;
+;;   Here, "password" refers to your account password, which is
+;;   usually your NickServ password.  This often differs from any
+;;   connection (server) password given to `erc-tls' via its :password
+;;   arg.  To make this work, customize both `erc-sasl-user' and
+;;   `erc-sasl-password' or bind them when invoking `erc-tls'.
+;;
+;;   When `erc-sasl-password' is a string, it's used unconditionally.
+;;   When it's a non-nil symbol, like Libera.Chat, it's used as the
+;;   host param in an auth-source query.  When it's nil and a session
+;;   ID is on file (see `erc-tls'), the ID is instead used for the
+;;   host param.  The value of `erc-sasl-user' is always specified for
+;;   the user (login) param.  See the info node "(erc) Connecting" for
+;;   specifics.
+;;
+;;   If no password can be determined, a non-nil connection password
+;;   will be tried (but this may change, so please don't rely on it).
+;;
+;; EXTERNAL (with Client TLS Certificate):
+;;
+;;   1. Specify the `:client-certificate' param when opening a new
+;;      connection, which is typically done by calling `emacs-tls'.
+;;      See (info "(erc) Connecting").
+;;
+;;   2. Ensure you've registered your fingerprint with the network and
+;;      (re)connect.  The fingerprint is usually a SHA1 or SHA256
+;;      digest in either "normalized" or "openssl" forms.  The first
+;;      is lowercase without delims ("deadbeef") and the second
+;;      uppercase with colon seps ("DE:AD:BE:EF").
+;;
+;;   There's no reason to send your password after registering.  Note
+;;   that most ircds will allow you to authenticate with a client cert
+;;   but without the hassle of SASL (meaning you may not need this
+;;   module).
+;;
+;; ECDSA-NIST256P-CHALLENGE:
+;;
+;;   Use something else if at all possible.  This currently requires
+;;   the openssl command-line utility.  On servers running Atheme
+;;   services, add your public key with NickServ like so:
+;;
+;;   /msg NickServ set property
+;;     pubkey AgGZmlYTUjJlea/BVz7yrjJ6gysiAPaQxzeUzTH4hd5j
+;;
+;;   (You may not need the "property" subcommand.)
+;;
+;;
+;; TODO
+;;
+;; - Implement pseudo PASSWORD mechanism that chooses the strongest
+;;   available mechanism for you.
+;;
+;; - Maybe provide explicit authz.  Currently, there's only an obscure
+;;   customizable function option for SCRAM and nothing for plain.
+
+;;; Code:
+(require 'erc-backend)
+(require 'rx)
+(require 'sasl)
+(require 'sasl-scram-rfc)
+(require 'sasl-scram-sha256 nil t)
+
+(defgroup erc-sasl nil
+  "SASL for ERC."
+  :group 'erc
+  :package-version '(ERC . "5.4")) ; FIXME increment on next release
+
+(defcustom erc-sasl-mechanism nil
+  "SASL mechanism to connect with.
+Note that any value other than nil or `external' likely requires
+`erc-sasl-user' and `erc-sasl-password'."
+  :type '(choice (const nil)
+                 (const plain)
+                 (const external)
+                 (const scram-sha-1)
+                 (const scram-sha-256)
+                 (const scram-sha-512)
+                 (const ecdsa-nist256p-challenge)))
+
+(defcustom erc-sasl-user nil
+  "Optional account username to send when authenticating.
+This is also referred to as the authentication identity, or
+\"authcid\".  When nil, applicable mechanisms will use the
+session's current nick."
+  :type '(choice string (const nil)))
+
+(defcustom erc-sasl-password nil
+  "Optional account password to send when authenticating.
+When the value is a string, it's used unconditionally.  As a
+special case, when the value is a non-nil symbol, it's used as
+the value of the `:host' field in an auth-source query, provided
+`erc-sasl-auth-source-function' is set to a function.  When
+nil, a non-nil \"session password\" will be tried, likely one
+given as the `:password' argument to `erc-tls'.  As a last
+resort, the user will be prompted for input."
+  :type '(choice (const nil) string symbol))
+
+(defcustom erc-sasl-auth-source-function nil
+  "Function to query auth-source for an SASL password.
+Called with keyword params known to `auth-source-search', which
+may include a non-nil `erc-sasl-user' for the `:user' field
+and a non-nil `erc-sasl-password' for the `:host' field, when
+the latter option is a symbol instead of a string.  In return,
+ERC expects a string to send as the SASL password, or nil, to
+move on to the next approach, as described in the doc string for
+the option `erc-sasl-password'.  See info node `(erc)
+Connecting' for details on ERC's auth-source integration."
+  :type '(choice (const erc-auth-source-search)
+                 (const nil)
+                 function))
+
+(defcustom erc-sasl-ecdsa-private-key nil
+  "Private signing key file for ECDSA-NIST256P-CHALLENGE."
+  :type '(choice (const nil) string))
+
+(defcustom erc-sasl-scram-authzid-function nil
+  "Function for retrieving authorization for SCRAM GSS-API header.
+Passed current SASL client object as the sole argument (see
+function `sasl-make-client')."
+  :type '(choice (const nil) function))
+
+
+;; Analogous to what erc-backend does to persist opening params.
+(defvar-local erc-sasl--options nil)
+
+;; Session-local (server buffer) SASL subproto state
+(defvar-local erc-sasl--state nil)
+
+(cl-defstruct erc-sasl--state
+  "Holder for client object and subproto state."
+  (client nil :type vector)
+  (step nil :type vector)
+  (pending nil :type string))
+
+(defun erc-sasl--read-password (prompt)
+  "Return configured option or server password.
+PROMPT is passed to `read-passwd' if necessary."
+  ;; Copying prevent `sasl-plain-response' from clobbering
+  (if-let
+      ((found
+        (or (and-let* ((pass (alist-get 'password erc-sasl--options))
+                       ((stringp pass))
+                       (pass)))
+            (and erc-sasl-auth-source-function
+                 (let ((user (alist-get 'user erc-sasl--options))
+                       (host (alist-get 'password erc-sasl--options)))
+                   (apply erc-sasl-auth-source-function
+                          `(,@(and user (list :user user))
+                            ,@(and host (list :host (symbol-name host)))))))
+            erc-session-password)))
+      (copy-sequence found)
+    (read-passwd prompt)))
+
+(defun erc-sasl--plain-response (client steps)
+  "Call `sasl-plain-response' with CLIENT and STEPS."
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (sasl-plain-response client steps)))
+
+(defun erc-sasl--scram-client-first-message (client _step)
+  "Prepare CLIENT's first message."
+  (let* ((c-nonce (sasl-unique-id))
+         (fn (alist-get 'scram-authzid-function erc-sasl--options))
+         (authzid (and fn (concat "a=" (funcall fn client))))
+         (gs2-header (concat "n," authzid ",")))
+    (sasl-client-set-property client 'c-nonce c-nonce)
+    (sasl-client-set-property client 'gs2-header gs2-header)
+    (concat gs2-header (sasl-scram--client-first-message-bare client))))
+
+(declare-function erc-compat--scram--client-final-message "erc-compat"
+                  (hash-fun block-length hash-length client step))
+
+(defun erc-sasl--scram-sha-hack-client-final-message (&rest args)
+  "Call `sasl-scram--client-final-message' with args.
+Pass HASH-FUN, BLOCK-LENGTH, HASH-LENGTH, CLIENT, and STEP
+directly upstream."
+  ;; In the future (29+), we'll hopefully be able to call
+  ;; `sasl-scram--client-final-message' directly
+  (require 'erc-compat)
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (apply #'erc-compat--scram--client-final-message args)))
+
+(defun erc-sasl--scram-sha-1-client-final-message (client step)
+  "Prepare CLIENT's final message with STEP."
+  (erc-sasl--scram-sha-hack-client-final-message 'sha1 64 20 client step))
+
+(defun erc-sasl--scram-sha-256-client-final-message (client step)
+  "Prepare CLIENT's final message with STEP."
+  (erc-sasl--scram-sha-hack-client-final-message 'sasl-scram-sha256 64 32
+                                                    client step))
+
+(defun erc-sasl--scram-sha512 (object &optional start end binary)
+  "Pass OBJECT, START, END, and BINARY to `secure-hash'."
+  (secure-hash 'sha512 object start end binary))
+
+(defun erc-sasl--scram-sha-512-client-final-message (client step)
+  "Prepare CLIENT's final message with STEP."
+  (erc-sasl--scram-sha-hack-client-final-message
+   #'erc-sasl--scram-sha512 128 64 client step))
+
+(defun erc-sasl--scram-sha-512-authenticate-server (client step)
+  "Call `sasl-scram--authenticate-server' with CLIENT and STEP."
+  (sasl-scram--authenticate-server
+   #'erc-sasl--scram-sha512 128 64 client step))
+
+(defun erc-sasl--ecdsa-first (client _step)
+  "Return CLIENT name."
+  (sasl-client-name client))
+
+;; FIXME do this with gnutls somehow
+(defun erc-sasl--ecdsa-sign (_client step)
+  "Return signed challenge for CLIENT and STEP."
+  (let ((challenge (sasl-step-data step)))
+    (with-temp-buffer
+      (set-buffer-multibyte nil)
+      (insert challenge)
+      (call-process-region (point-min) (point-max)
+                           "openssl" 'delete t nil "pkeyutl" "-inkey"
+                           (alist-get 'ecdsa-private-key erc-sasl--options)
+                           "-sign")
+      (buffer-string))))
+
+;; This API may seem roundabout, but the "template method" here is
+;; one that we provide, namely `erc-sasl--authenticate-handler'.
+
+(pcase-dolist
+    (`(,name . ,steps)
+     '(("PLAIN"
+        erc-sasl--plain-response)
+       ("EXTERNAL"
+        ignore)
+       ("SCRAM-SHA-1"
+        erc-sasl--scram-client-first-message
+        erc-sasl--scram-sha-1-client-final-message
+        sasl-scram-sha-1-authenticate-server)
+       ("SCRAM-SHA-256"
+        erc-sasl--scram-client-first-message
+        erc-sasl--scram-sha-256-client-final-message
+        sasl-scram-sha-256-authenticate-server)
+       ("SCRAM-SHA-512"
+        erc-sasl--scram-client-first-message
+        erc-sasl--scram-sha-512-client-final-message
+        erc-sasl--scram-sha-512-authenticate-server)
+       ("ECDSA-NIST256P-CHALLENGE"
+        erc-sasl--ecdsa-first
+        erc-sasl--ecdsa-sign)))
+  (let ((feature (intern (concat "erc-sasl-" (downcase name)))))
+    (put feature 'sasl-mechanism (sasl-make-mechanism name steps))
+    (provide feature)))
+
+(cl-defgeneric erc-sasl--create-client (mechanism)
+  "Create and return a new SASL client object for MECHANISM."
+  (let ((sasl-mechanism-alist (copy-sequence sasl-mechanism-alist))
+        (sasl-mechanisms sasl-mechanisms)
+        (name (upcase (symbol-name mechanism)))
+        (feature (intern (concat "erc-sasl-" (symbol-name mechanism)))))
+    (setf (alist-get name sasl-mechanism-alist nil nil #'equal) `(,feature))
+    (cl-pushnew name sasl-mechanisms :test #'equal)
+    (sasl-make-client (sasl-find-mechanism `(,name))
+                      (or (alist-get 'user erc-sasl--options)
+                          (erc-downcase (erc-current-nick)))
+                      "N/A" "N/A")))
+
+;; Oragono doesn't like when authzid (if present) does not match
+;; the authcid.  TODO see if this still true.
+
+(cl-defmethod erc-sasl--create-client ((_m (eql plain)))
+  "Create and return new SASL PLAIN client object.
+See message breakdown at
+https://tools.ietf.org/html/rfc4616#section-2."
+  (let* ((sans (remq (assoc "PLAIN" sasl-mechanism-alist)
+                     sasl-mechanism-alist))
+         (sasl-mechanism-alist (cons '("PLAIN" erc-sasl-plain) sans))
+         (authc (or (alist-get 'user erc-sasl--options)
+                    (erc-downcase (erc-current-nick))))
+         (port (if (numberp erc-session-port)
+                   (number-to-string erc-session-port)
+                 "0"))
+         ;; In most cases, `erc-server-announced-name' won't be known.
+         (host (or erc-server-announced-name erc-session-server))
+         (mech (sasl-find-mechanism '("PLAIN")))
+         (client (sasl-make-client mech authc port host)))
+    (sasl-client-set-property client 'authenticator-name authc)
+    client))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-256)))
+  "Create a SCRAM-SHA-256 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-512)))
+  "Create a SCRAM-SHA-512 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((_ (eql ecdsa-nist256p-challenge)))
+  "Create a ECDSA-NIST256P-CHALLENGE client."
+  (unless (executable-find "openssl")
+    (user-error "Could not find openssl command-line utility"))
+  (unless (and (alist-get 'ecdsa-private-key erc-sasl--options)
+               (file-exists-p (alist-get 'ecdsa-private-key
+                                         erc-sasl--options)))
+    (user-error "Could not find `erc-sasl-ecdsa-private-key'"))
+  (cl-call-next-method))
+
+(defun erc-sasl--init ()
+  (setq erc-sasl--state (make-erc-sasl--state)
+        erc-sasl--options `((user . ,erc-sasl-user)
+                            (password . ,erc-sasl-password)
+                            (mechanism . ,erc-sasl-mechanism)
+                            (ecdsa-private-key . ,erc-sasl-ecdsa-private-key)
+                            (scram-authzid-function
+                             . ,erc-sasl-scram-authzid-function))))
+
+(defun erc-sasl--mechanism-offered-p (offered)
+  "Non-nil when mechanism OFFERED by server."
+  (string-match-p (rx-to-string
+                   `(: (| bot ",")
+                       ,(symbol-name
+                         (alist-get 'mechanism erc-sasl--options))
+                       (| eot ",")))
+                  (downcase offered)))
+
+(defun erc-sasl--add-hook ()
+  (add-hook 'erc-server-AUTHENTICATE-functions
+            #'erc-sasl--authenticate-handler 0 t))
+
+(defun erc-sasl--remove-hook ()
+  (remove-hook 'erc-server-AUTHENTICATE-functions
+               #'erc-sasl--authenticate-handler t))
+
+(defun erc-sasl--authenticate-handler (_proc parsed)
+  "Handle PARSED `erc-response' from server.
+Maybe transition to next state."
+  (if-let* ((response (car (erc-response.command-args parsed)))
+            ((= 400 (length response))))
+      (cl-callf (lambda (s) (concat s response))
+          (erc-sasl--state-pending erc-sasl--state))
+    (cl-assert response t)
+    (when (string= "+" response)
+      (setq response ""))
+    (setf response (base64-decode-string
+                    (concat (erc-sasl--state-pending erc-sasl--state) response))
+          (erc-sasl--state-pending erc-sasl--state) nil)
+    ;; The server is done sending, so our turn
+    (let ((client (erc-sasl--state-client erc-sasl--state))
+          (step (erc-sasl--state-step erc-sasl--state))
+          data)
+      (when step
+        (sasl-step-set-data step response))
+      (setq step (setf (erc-sasl--state-step erc-sasl--state)
+                       (sasl-next-step client step))
+            data (sasl-step-data step))
+      (when (string= data "")
+        (setq data nil))
+      (when data
+        (setq data (base64-encode-string data t)))
+      ;; No need for : because no spaces (right?)
+      (erc-server-send (concat "AUTHENTICATE " (or data "+"))))))
+
+(erc-define-catalog
+ 'english
+ '((s902 . "ERR_NICKLOCKED nick %n unavailable: %s")
+   (s904 . "ERR_SASLFAIL (authentication failed) %s")
+   (s905 . "ERR SASLTOOLONG (credentials too long) %s")
+   (s906 . "ERR_SASLABORTED (authentication aborted) %s")
+   (s907 . "ERR_SASLALREADY (already authenticated) %s")
+   (s908 . "RPL_SASLMECHS (unsupported mechanism %m) %s")))
+
+(define-erc-module sasl nil
+  "Non-IRCv3 (dumb) SASL support for ERC.
+Needless to say, this doesn't solicit or validate a suite of
+supported mechanisms.  See bug#49860 for a full, CAP 3.2-aware
+implementation, currently a WIP as of ERC 5.5."
+  ((unless erc--target
+     (erc-sasl--add-hook)
+     (erc-sasl--init)
+     (let* ((mech (alist-get 'mechanism erc-sasl--options))
+            (client (erc-sasl--create-client mech)))
+       (unless client
+         (erc-display-error-notice nil (format "Unknown mechanism: %s" mech))
+         (erc-error "Unknown mechanism: %s" mech))
+       (setf (erc-sasl--state-client erc-sasl--state) client))))
+  ((erc-sasl--remove-hook)
+   (kill-local-variable 'erc-sasl--options))
+  'local)
+
+;; FIXME use generic mechanism instead of hooks after bug#49860.
+(define-erc-response-handler (AUTHENTICATE)
+  "Maybe authenticate to server." nil)
+
+;; FIXME do something decisive here
+(define-erc-response-handler (902)
+  "Handle a ERR_NICKLOCKED response." nil
+  (let ((nick (car (erc-response.command-args parsed)))
+        (msg (erc-response.contents parsed)))
+    (erc-display-message parsed '(notice error) 'active 's902 ?n nick ?s msg)))
+
+(define-erc-response-handler (903)
+  "Handle a RPL_SASLSUCCESS response." nil
+  (when erc-sasl-mode
+    (unless erc-server-connected
+      (erc-server-send "CAP END")))
+  (erc-handle-unknown-server-response proc parsed))
+
+(define-erc-response-handler (904 905 906 907 908)
+  "Handle various SASL-related error responses." nil
+  (let* ((msg (intern (format "s%s" (erc-response.command parsed))))
+         (args `(parsed (notice error) active ,msg
+                        ,@(when (string= "908" (erc-response.command parsed))
+                            (list '?m
+                                  (alist-get 'mechanism erc-sasl--options)))
+                        ?s ,(erc-response.contents parsed))))
+    (apply #'erc-display-message args))
+  (when (member (erc-response.command parsed) '("904" "905" "906"))
+    (run-hook-with-args 'erc-quit-hook proc)
+    (delete-process proc)
+    (erc-error "Disconnected from %s; please review SASL settings" proc)))
+
+(cl-defmethod erc--register-connection (&context (erc-sasl-mode (eql t)))
+  "Send speculative/pipelined CAP and AUTHENTICATE and hope for the best."
+  (erc-server-send "CAP REQ :sasl")
+  (erc-login)
+  (let* ((c (erc-sasl--state-client erc-sasl--state))
+         (m (sasl-mechanism-name (sasl-client-mechanism c))))
+    (erc-server-send (format "AUTHENTICATE %s" m))))
+
+(provide 'erc-sasl)
+;;; erc-sasl.el ends here
+;;
+;; Local Variables:
+;; generated-autoload-file: "erc-loaddefs.el"
+;; End:
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
new file mode 100644
index 0000000000..5171a5d6b8
--- /dev/null
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -0,0 +1,295 @@
+;;; erc-sasl-tests.el --- Tests for erc-sasl.  -*- lexical-binding:t -*-
+
+;; Copyright (C) 2020-2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation, either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;;; Code:
+
+(require 'ert-x)
+(require 'erc-sasl)
+
+(ert-deftest erc-sasl--mechanism-offered-p ()
+  (let ((erc-sasl--options '((mechanism . external))))
+    (should (erc-sasl--mechanism-offered-p "foo,external"))
+    (should (erc-sasl--mechanism-offered-p "external,bar"))
+    (should (erc-sasl--mechanism-offered-p "foo,external,bar"))
+    (should-not (erc-sasl--mechanism-offered-p "fooexternal"))
+    (should-not (erc-sasl--mechanism-offered-p "externalbar"))))
+
+(ert-deftest erc-sasl--read-password ()
+  (ert-info ("Explicit erc-sasl-password")
+    (let ((erc-sasl--options '((password . "foo"))))
+      (should (string= (erc-sasl--read-password nil) "foo"))))
+
+  (ert-info ("Fallback to erc-session-password")
+    (let ((erc-session-password "bar")
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar")))
+    (let ((erc-session-password "bar")
+          (erc-sasl--options '((user . "tester") (password)))
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar"))))
+
+  (let* ((entries (list
+                   "machine GNU/chat port 6697 user bob password spam"
+                   "machine FSF.chat port 6697 user bob password sesame"
+                   "machine MyHost port irc password 123"))
+         (netrc-file (make-temp-file "auth-source-test" nil nil
+                                     (mapconcat 'identity entries "\n")))
+         (auth-sources (list netrc-file))
+         (erc-session-server "irc.gnu.org")
+         (erc-session-port 6697)
+         ;;
+         (erc-sasl-auth-source-function #'erc-auth-source-search)
+         erc-server-announced-name ; too early
+         auth-source-do-cache)
+
+    (unwind-protect
+        (ert-info ("Auth source")
+
+          (ert-info ("Symbol as password specifies machine")
+            (let ((erc-sasl--options '((user . "bob")
+                                       (password . FSF.chat)))
+                  (erc-networks--id (make-erc-networks--id)))
+              (should (string= (erc-sasl--read-password nil) "sesame"))))
+
+          (ert-info ("Use session ID when password empty")
+            (let ((erc-sasl--options '((user . "bob") (password)))
+                  (erc-networks--id (erc-networks--id-create 'GNU/chat)))
+              (should (string= (erc-sasl--read-password nil) "spam")))))
+
+      (delete-file netrc-file))
+
+    (ert-info ("Prompt when search fails and server password null")
+      (let ((erc-sasl-auth-source-function #'ignore))
+        (should (string= (ert-simulate-keys "baz\r"
+                           (erc-sasl--read-password "pwd:"))
+                         "baz"))))))
+
+(ert-deftest erc-sasl-create-client--plain ()
+  (let* ((erc-session-password "password123")
+         (erc-server-current-nick "tester")
+         (erc-session-port 1667)
+         (erc-session-server "localhost")
+         (client (erc-sasl--create-client 'plain))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [erc-sasl--plain-response
+                                 "\0tester\0password123"])
+                   (format "%S" result)))
+    (should (string= (sasl-step-data result) "\0tester\0password123"))
+    (should-not (sasl-next-step client result)))
+  (should (equal (assoc-default "PLAIN" sasl-mechanism-alist) '(sasl-plain))))
+
+(ert-deftest erc-sasl-create-client--external ()
+  (let* ((erc-server-current-nick "tester")
+         (client (erc-sasl--create-client 'external))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [ignore nil]) (format "%S" result)))
+    (should-not (sasl-step-data result))
+    (should-not (sasl-next-step client result)))
+  (should-not (member "EXTERNAL" sasl-mechanisms))
+  (should-not (assoc-default "EXTERNAL" sasl-mechanism-alist)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-1 ()
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((scram-authzid-function . sasl-client-name)))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-1))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S" `[erc-sasl--scram-client-first-message
+                                      ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                          "s=5mJO6d4rjCnsBU1X,"
+                          "i=4096"))
+            (req (concat "c=bixhPWppbGxlcyw=,"
+                         "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                         "p=OVUhgPu8wEm2cDoVLfaHzVUYPWU=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-1-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=ZWR23c9MJir0ZgfGf5jEtLOn6Ng="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256 ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((scram-authzid-function . sasl-client-name)))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S" `[erc-sasl--scram-client-first-message
+                                      ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                   "s=MTk2M2VkMzM5ZmU0NDRiYmI0MzIyOGVhN2YwNzYwNmI=,"
+                   "i=4096"))
+            (req (concat
+                  "c=bixhPWppbGxlcyw=,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                  "p=1vDesVBzJmv0lX0Ae1kHFtdVHkC6j4gISKVqaR45HFg=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=gUePTYSZN9xgcE06KSyKO9fUmSwH26qifoapXyEs75s="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S" `[erc-sasl--scram-client-first-message
+                                      ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                   "s=ZTg1MmE1YmFhZGI1NDcyMjk3NzYwZmRjZDM3Y2I1OTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                  "p=LP4sjJrjJKp5qTsARyZCppXpKLu4FMM284hNESPvGhI=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=847WXfnmReGyE1qlq1And6R4bPBNROTZ7EMS/QrJtUM="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-512--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha512"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-512))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S" `[erc-sasl--scram-client-first-message
+                                      ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                   "s=YzMzOWZiY2U0YzcwNDA0M2I4ZGE2M2ZjOTBjODExZTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                  "p=vMBb9tKxFAfBtel087/GLbo4objAIYr1wM+mFv/jYLKXE"
+                  "NUF0vynm81qQbywQE5ScqFFdAfwYMZq/lj4s0V1OA==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format
+                        "%S" `[erc-sasl--scram-sha-512-client-final-message
+                               ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp (concat "v=Va7NIvt8wCdhvxnv+bZriSxGoto6On5EVnRHO/ece8zs0"
+                          "qpQassdqir1Zlwh3e3EmBq+kcSy+ClNCsbzBpXe/w==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(defconst erc-sasl-tests-ecdsa-key-file "
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIIJueQ3W2IrGbe9wKdOI75yGS7PYZSj6W4tg854hlsvmoAoGCCqGSM49
+AwEHoUQDQgAEAZmaVhNSMmV5r8FXPvKuMnqDKyIA9pDHN5TNMfiF3mMeikGgK10W
+IRX9cyi2wdYg9mUUYyh9GKdBCYHGUJAiCA==
+-----END EC PRIVATE KEY-----
+")
+
+(ert-deftest erc-sasl-create-client-ecdsa ()
+  (unless (executable-find "openssl")
+    (ert-skip "System lacks openssl"))
+  (let* ((erc-server-current-nick "jilles")
+         (keyfile (make-temp-file "ecdsa_key.pem" nil nil
+                                  erc-sasl-tests-ecdsa-key-file))
+         (erc-sasl--options `((ecdsa-private-key . ,keyfile)))
+         (client (erc-sasl--create-client 'ecdsa-nist256p-challenge))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (should (equal (format "%S" [erc-sasl--ecdsa-first "jilles"])
+                     (format "%S" step)))
+      (should (string= (sasl-step-data step) "jilles")))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat "\0\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20"
+                          "\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        ;; FIXME this is dumb
+        (should (<= 68 (length (sasl-step-data step)) 72))))
+    (should-not (sasl-next-step client step))
+    (delete-file keyfile)))
+
+;;; erc-sasl-tests.el ends here
diff --git a/test/lisp/erc/erc-scenarios-sasl.el b/test/lisp/erc/erc-scenarios-sasl.el
new file mode 100644
index 0000000000..b4f926b54c
--- /dev/null
+++ b/test/lisp/erc/erc-scenarios-sasl.el
@@ -0,0 +1,161 @@
+;;; erc-scenarios-sasl.el --- SASL tests for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; This program is free software: you can redistribute it and/or
+;; modify it under the terms of the GNU General Public License as
+;; published by the Free Software Foundation, either version 3 of the
+;; License, or (at your option) any later version.
+;;
+;; This program is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program.  If not, see
+;; <https://www.gnu.org/licenses/>.
+
+;;; Code:
+
+(require 'ert-x)
+(eval-and-compile
+  (let ((load-path (cons (ert-resource-directory) load-path)))
+    (require 'erc-scenarios-common)))
+
+(declare-function sasl-client-name "sasl" (client))
+
+(require 'erc-scenarios-common)
+(require 'erc-sasl)
+
+(ert-deftest erc-scenarios-sasl--plain ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'plain)
+       (erc-sasl-password "password123")
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "This server is in debug mode")
+        ;; Regression "\0\0\0\0 ..." caused by (fillarray passphrase 0)
+        (should (string= erc-sasl-password "password123"))))))
+
+(ert-deftest erc-scenarios-sasl--external ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'external))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'external)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "903 * Authentication successful")
+        (funcall expect 10 "This server is in debug mode")))))
+
+(ert-deftest erc-scenarios-sasl--plain-fail ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain-failed))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "wrong")
+       (erc-sasl-mechanism 'plain)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter))
+       (buf nil))
+
+    (ert-info ("Connect")
+      (setq buf (erc :server "127.0.0.1"
+                     :port port
+                     :nick "tester"
+                     :user "tester"
+                     :full-name "tester"))
+      (let ((err (should-error
+                  (with-current-buffer buf
+                    (funcall expect 20 "Connection failed!")))))
+        (should (string-search "please review" (cadr err)))
+        (with-current-buffer buf
+          (funcall expect 10 "Opening connection")
+          (funcall expect 20 "SASL authentication failed")
+          (should-not (erc-server-process-alive)))))))
+
+(defun erc-scenarios--common--sasl (mech zfunc)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t mech))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-scram-authzid-function zfunc)
+       (erc-sasl-password "sesame")
+       (erc-sasl-mechanism mech)
+       (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+       (sasl-unique-id-function (lambda () (pop mock-rvs)))
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "jilles"
+                                :full-name "jilles")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "jaguar"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "jaguar"
+        (funcall expect 10 "Found your hostname")
+        (funcall expect 20 "marked as being away")))))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-1 ()
+  :tags '(:expensive-test)
+  (erc-scenarios--common--sasl 'scram-sha-1 #'sasl-client-name))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-256 ()
+  :tags '(:expensive-test)
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (erc-scenarios--common--sasl 'scram-sha-256 nil))
+
+;;; erc-scenarios-sasl.el ends here
diff --git a/test/lisp/erc/resources/sasl/external.eld b/test/lisp/erc/resources/sasl/external.eld
new file mode 100644
index 0000000000..2cd237ec4d
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/external.eld
@@ -0,0 +1,33 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester"))
+
+((auth-req 3.2 "AUTHENTICATE EXTERNAL")
+ (0.0 ":irc.example.org CAP * ACK :sasl")
+ (0.0 "AUTHENTICATE +"))
+
+((auth-noop 3.2 "AUTHENTICATE +")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/plain-failed.eld b/test/lisp/erc/resources/sasl/plain-failed.eld
new file mode 100644
index 0000000000..336700290c
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain-failed.eld
@@ -0,0 +1,16 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.foonet.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.foonet.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.foonet.org CAP * ACK :cap-notify sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.foonet.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgB3cm9uZw==")
+ (0.0 ":irc.foonet.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.foonet.org 904 * :SASL authentication failed: Invalid account credentials"))
+
+((cap-end 3.2 "CAP END"))
diff --git a/test/lisp/erc/resources/sasl/plain.eld b/test/lisp/erc/resources/sasl/plain.eld
new file mode 100644
index 0000000000..9c6ce3feeb
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain.eld
@@ -0,0 +1,35 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.example.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.example.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.example.org CAP * ACK :sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.example.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgBwYXNzd29yZDEyMw==")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-1.eld b/test/lisp/erc/resources/sasl/scram-sha-1.eld
new file mode 100644
index 0000000000..49980e9e12
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-1.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-1")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE bixhPWppbGxlcyxuPWppbGxlcyxyPWM1UnFMQ1p5MEw0ZkdrS0FaMGh1akZCcw==")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNYUW9LY2l2cUN3OWlEWlBTcGIscz01bUpPNmQ0cmpDbnNCVTFYLGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXhoUFdwcGJHeGxjeXc9LHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzWFFvS2NpdnFDdzlpRFpQU3BiLHA9T1ZVaGdQdTh3RW0yY0RvVkxmYUh6VlVZUFdVPQ==")
+ (0 "AUTHENTICATE dj1aV1IyM2M5TUppcjBaZ2ZHZjVqRXRMT242Tmc9"))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-256.eld b/test/lisp/erc/resources/sasl/scram-sha-256.eld
new file mode 100644
index 0000000000..74de9a23ec
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-256.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-256")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE biwsbj1qaWxsZXMscj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnM=")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNkNDA2N2YwYWZkYjU0YzNkYmQ0ZmU2NDViODRjYWUzNyxzPVpUZzFNbUUxWW1GaFpHSTFORGN5TWprM056WXdabVJqWkRNM1kySTFPVE09LGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXdzLHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzZDQwNjdmMGFmZGI1NGMzZGJkNGZlNjQ1Yjg0Y2FlMzcscD1MUDRzakpyakpLcDVxVHNBUnlaQ3BwWHBLTHU0Rk1NMjg0aE5FU1B2R2hJPQ==")
+ (0 "AUTHENTICATE dj04NDdXWGZubVJlR3lFMXFscTFBbmQ2UjRiUEJOUk9UWjdFTVMvUXJKdFVNPQ=="))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
-- 
2.37.2


[-- Attachment #3: Type: text/plain, Size: 67 bytes --]

-------------------- End of forwarded message --------------------

^ permalink raw reply related	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2022-09-18 18:32 ` bug#29108: [J.P.] Add "non-IRCv3" SASL to ERC J.P.
@ 2022-09-20  6:07   ` J.P.
       [not found]   ` <875yhifujk.fsf_-_@neverwas.me>
  1 sibling, 0 replies; 54+ messages in thread
From: J.P. @ 2022-09-20  6:07 UTC (permalink / raw)
  To: 29108; +Cc: emacs-erc

[-- Attachment #1: Type: text/plain, Size: 182 bytes --]

v2. Reworked to more faithfully align with original sasl.el design.
Added dedicated authz user option and related patch for
sasl-scram-rfc.el (to be offered in separate bug report).

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0000-v1-v2.diff --]
[-- Type: text/x-patch, Size: 17969 bytes --]

From b2e7df6b097b4b203860189dd59219909959c016 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 19 Sep 2022 22:55:25 -0700
Subject: [PATCH 0/4] *** NOT A PATCH ***

*** BLURB HERE ***

F. Jason Park (4):
  Add GS2 authorization to sasl-scram-rfc
  Support local ERC modules in erc-mode buffers
  Make erc-login generic
  Add non-IRCv3 SASL module to ERC

 lisp/erc/erc-backend.el                       |   8 +-
 lisp/erc/erc-compat.el                        | 104 ++++
 lisp/erc/erc-sasl.el                          | 477 ++++++++++++++++++
 lisp/erc/erc.el                               | 108 ++--
 lisp/net/sasl-scram-rfc.el                    |  21 +-
 test/lisp/erc/erc-sasl-tests.el               | 299 +++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 161 ++++++
 test/lisp/erc/erc-tests.el                    |  47 ++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  35 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 ++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 ++
 13 files changed, 1358 insertions(+), 45 deletions(-)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

Interdiff:
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 8ba061d5ac..3123f64b88 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -167,25 +167,46 @@ erc-subseq
 (declare-function sasl-client-name "sasl" (client))
 (declare-function sasl-client-mechanism "sasl" (client))
 (declare-function sasl-read-passphrase "sasl" (prompt))
+(declare-function sasl-unique-id "sasl" nil)
 (declare-function decode-hex-string "hex-util" (string))
 (declare-function rfc2104-hash "rfc2104" (hash block-length hash-length
                                                key text))
+(declare-function sasl-scram--client-first-message-bare "sasl-scram-rfc"
+                  (client))
 (declare-function cl-mapcar "cl-lib" (cl-func cl-x &rest cl-rest))
 
+(defun erc-compat--sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
+(defun erc-compat--sasl-scram-client-first-message (client _step)
+  (let ((c-nonce (sasl-unique-id)))
+    (sasl-client-set-property client 'c-nonce c-nonce))
+  (concat (erc-compat--sasl-scram-construct-gs2-header client)
+          (sasl-scram--client-first-message-bare client)))
+
 ;; This is `sasl-scram--client-final-message' from sasl-scram-rfc,
-;; with the NO-LINE-BREAK argument of `base64-encode-string' set to t.
+;; with the NO-LINE-BREAK argument of `base64-encode-string' set to t
+;; because https://www.rfc-editor.org/rfc/rfc5802#section-2.1 says:
+;;
+;;  > The use of base64 in SCRAM is restricted to the canonical form
+;;  > with no whitespace.
+;;
+;; Unfortunately, advising `base64-encode-string' won't work
+;; because the byte compiler precomputes the result when all inputs
+;; are constants, as they are in the unpatched version.
+;;
 ;; The only other substantial change is the addition of authz support.
-;; If adopted by Emacs 29, this can dropped when ERC no longer
-;; supports Emacs 28.  Unfortunately, advising `base64-encode-string'
-;; won't work because the byte compiler precomputes the result when
-;; all inputs are constants, as they are in the unpatched version.
-;; Changes from the latter are marked with a "; *n", comment below.
-;; See older versions of lisp/erc/erc-sasl.el if needing a
+;; This can be dropped if adopted by Emacs 29 and `compat'.  Changes
+;; proposed for 29 are marked with a "; *n", comment below.  See older
+;; versions of lisp/erc/erc-v3-sasl.el (bug#49860) if needing a true
 ;; side-by-side diff.  This also inlines the internal function
 ;; `sasl-scram--client-first-message-bare' and takes various liberties
 ;; with formatting.
 
-(defun erc-compat--scram--client-final-message
+(defun erc-compat--sasl-scram--client-final-message
     (hash-fun block-length hash-length client step)
   (unless (string-match
            "^r=\\([^,]+\\),s=\\([^,]+\\),i=\\([0-9]+\\)\\(?:$\\|,\\)"
@@ -202,7 +223,7 @@ erc-compat--scram--client-final-message
          (c-nonce (sasl-client-property client 'c-nonce))
          (cbind-input
           (if (string-prefix-p c-nonce nonce)
-              (or (sasl-client-property client 'gs2-header) "n,,") ; *1
+              (erc-compat--sasl-scram-construct-gs2-header client) ; *1
             (sasl-error "Invalid nonce from server")))
          (client-final-message-without-proof
           (concat "c=" (base64-encode-string cbind-input t) "," ; *2
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
index 6cd9a928d8..bd27934125 100644
--- a/lisp/erc/erc-sasl.el
+++ b/lisp/erc/erc-sasl.el
@@ -162,11 +162,11 @@ erc-sasl-ecdsa-private-key
   "Private signing key file for ECDSA-NIST256P-CHALLENGE."
   :type '(choice (const nil) string))
 
-(defcustom erc-sasl-scram-authzid-function nil
-  "Function for retrieving authorization for SCRAM GSS-API header.
-Passed current SASL client object as the sole argument (see
-function `sasl-make-client')."
-  :type '(choice (const nil) function))
+(defcustom erc-sasl-authzid nil
+  "SASL authorization identity.
+Generally unneeded for normal use.  Some test frameworks and
+aberrant servers may want this to match `erc-sasl-user'."
+  :type '(choice (const nil) string))
 
 
 ;; Analogous to what erc-backend does to persist opening params.
@@ -205,17 +205,7 @@ erc-sasl--plain-response
   (let ((sasl-read-passphrase #'erc-sasl--read-password))
     (sasl-plain-response client steps)))
 
-(defun erc-sasl--scram-client-first-message (client _step)
-  "Prepare CLIENT's first message."
-  (let* ((c-nonce (sasl-unique-id))
-         (fn (alist-get 'scram-authzid-function erc-sasl--options))
-         (authzid (and fn (concat "a=" (funcall fn client))))
-         (gs2-header (concat "n," authzid ",")))
-    (sasl-client-set-property client 'c-nonce c-nonce)
-    (sasl-client-set-property client 'gs2-header gs2-header)
-    (concat gs2-header (sasl-scram--client-first-message-bare client))))
-
-(declare-function erc-compat--scram--client-final-message "erc-compat"
+(declare-function erc-compat--sasl-scram--client-final-message "erc-compat"
                   (hash-fun block-length hash-length client step))
 
 (defun erc-sasl--scram-sha-hack-client-final-message (&rest args)
@@ -226,7 +216,7 @@ erc-sasl--scram-sha-hack-client-final-message
   ;; `sasl-scram--client-final-message' directly
   (require 'erc-compat)
   (let ((sasl-read-passphrase #'erc-sasl--read-password))
-    (apply #'erc-compat--scram--client-final-message args)))
+    (apply #'erc-compat--sasl-scram--client-final-message args)))
 
 (defun erc-sasl--scram-sha-1-client-final-message (client step)
   "Prepare CLIENT's final message with STEP."
@@ -278,15 +268,15 @@ erc-sasl--ecdsa-sign
        ("EXTERNAL"
         ignore)
        ("SCRAM-SHA-1"
-        erc-sasl--scram-client-first-message
+        erc-compat--sasl-scram-client-first-message
         erc-sasl--scram-sha-1-client-final-message
         sasl-scram-sha-1-authenticate-server)
        ("SCRAM-SHA-256"
-        erc-sasl--scram-client-first-message
+        erc-compat--sasl-scram-client-first-message
         erc-sasl--scram-sha-256-client-final-message
         sasl-scram-sha-256-authenticate-server)
        ("SCRAM-SHA-512"
-        erc-sasl--scram-client-first-message
+        erc-compat--sasl-scram-client-first-message
         erc-sasl--scram-sha-512-client-final-message
         erc-sasl--scram-sha-512-authenticate-server)
        ("ECDSA-NIST256P-CHALLENGE"
@@ -301,13 +291,17 @@ erc-sasl--create-client
   (let ((sasl-mechanism-alist (copy-sequence sasl-mechanism-alist))
         (sasl-mechanisms sasl-mechanisms)
         (name (upcase (symbol-name mechanism)))
-        (feature (intern (concat "erc-sasl-" (symbol-name mechanism)))))
+        (feature (intern (concat "erc-sasl-" (symbol-name mechanism))))
+        client)
     (setf (alist-get name sasl-mechanism-alist nil nil #'equal) `(,feature))
     (cl-pushnew name sasl-mechanisms :test #'equal)
-    (sasl-make-client (sasl-find-mechanism `(,name))
-                      (or (alist-get 'user erc-sasl--options)
-                          (erc-downcase (erc-current-nick)))
-                      "N/A" "N/A")))
+    (setq client (sasl-make-client (sasl-find-mechanism `(,name))
+                                   (or (alist-get 'user erc-sasl--options)
+                                       (erc-downcase (erc-current-nick)))
+                                   "N/A" "N/A"))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
 
 ;; Oragono doesn't like when authzid (if present) does not match
 ;; the authcid.  TODO see if this still true.
@@ -328,7 +322,8 @@ erc-sasl--create-client
          (host (or erc-server-announced-name erc-session-server))
          (mech (sasl-find-mechanism '("PLAIN")))
          (client (sasl-make-client mech authc port host)))
-    (sasl-client-set-property client 'authenticator-name authc)
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
     client))
 
 (cl-defmethod erc-sasl--create-client ((m (eql scram-sha-256)))
@@ -359,8 +354,7 @@ erc-sasl--init
                             (password . ,erc-sasl-password)
                             (mechanism . ,erc-sasl-mechanism)
                             (ecdsa-private-key . ,erc-sasl-ecdsa-private-key)
-                            (scram-authzid-function
-                             . ,erc-sasl-scram-authzid-function))))
+                            (authzid . ,erc-sasl-authzid))))
 
 (defun erc-sasl--mechanism-offered-p (offered)
   "Non-nil when mechanism OFFERED by server."
diff --git a/lisp/net/sasl-scram-rfc.el b/lisp/net/sasl-scram-rfc.el
index ee52ed6e07..f7a2e42541 100644
--- a/lisp/net/sasl-scram-rfc.el
+++ b/lisp/net/sasl-scram-rfc.el
@@ -45,14 +45,21 @@
 
 ;;; Generic for SCRAM-*
 
+(defvar sasl-scram-gs2-header-function 'sasl-scram-construct-gs2-header
+  "Function to create GS2 header.
+See https://www.rfc-editor.org/rfc/rfc5801#section-4.")
+
+(defun sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
 (defun sasl-scram-client-first-message (client _step)
   (let ((c-nonce (sasl-unique-id)))
     (sasl-client-set-property client 'c-nonce c-nonce))
   (concat
-   ;; n = client doesn't support channel binding
-   "n,"
-   ;; TODO: where would we get authorization id from?
-   ","
+   (funcall sasl-scram-gs2-header-function client)
    (sasl-scram--client-first-message-bare client)))
 
 (defun sasl-scram--client-first-message-bare (client)
@@ -77,11 +84,11 @@ sasl-scram--client-final-message
 
 	 (c-nonce (sasl-client-property client 'c-nonce))
 	 ;; no channel binding, no authorization id
-	 (cbind-input "n,,"))
+         (cbind-input (funcall sasl-scram-gs2-header-function client)))
     (unless (string-prefix-p c-nonce nonce)
       (sasl-error "Invalid nonce from server"))
     (let* ((client-final-message-without-proof
-	    (concat "c=" (base64-encode-string cbind-input) ","
+            (concat "c=" (base64-encode-string cbind-input t) ","
 		    "r=" nonce))
 	   (password
 	    ;; TODO: either apply saslprep or disallow non-ASCII characters
@@ -113,7 +120,7 @@ sasl-scram--client-final-message
 	   (client-proof (funcall string-xor client-key client-signature))
 	   (client-final-message
 	    (concat client-final-message-without-proof ","
-		    "p=" (base64-encode-string client-proof))))
+                    "p=" (base64-encode-string client-proof t))))
       (sasl-client-set-property client 'auth-message auth-message)
       (sasl-client-set-property client 'salted-password salted-password)
       client-final-message)))
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
index 5171a5d6b8..beac287a6e 100644
--- a/test/lisp/erc/erc-sasl-tests.el
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -109,15 +109,16 @@ erc-sasl-create-client--external
 (ert-deftest erc-sasl-create-client--scram-sha-1 ()
   (let* ((erc-server-current-nick "jilles")
          (erc-session-password "sesame")
-         (erc-sasl--options '((scram-authzid-function . sasl-client-name)))
+         (erc-sasl--options '((authzid . "jilles")))
          (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
          (sasl-unique-id-function (lambda () (pop mock-rvs)))
          (client (erc-sasl--create-client 'scram-sha-1))
          (step (sasl-next-step client nil)))
     (ert-info ("Client's initial request")
       (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
-        (should (equal (format "%S" `[erc-sasl--scram-client-first-message
-                                      ,req])
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
                        (format "%S" step)))
         (should (string= (sasl-step-data step) req))))
     (ert-info ("Server's initial response")
@@ -146,15 +147,16 @@ erc-sasl-create-client--scram-sha-256
     (ert-skip "Emacs lacks sasl-scram-sha256"))
   (let* ((erc-server-current-nick "jilles")
          (erc-session-password "sesame")
-         (erc-sasl--options '((scram-authzid-function . sasl-client-name)))
+         (erc-sasl--options '((authzid . "jilles")))
          (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
          (sasl-unique-id-function (lambda () (pop mock-rvs)))
          (client (erc-sasl--create-client 'scram-sha-256))
          (step (sasl-next-step client nil)))
     (ert-info ("Client's initial request")
       (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
-        (should (equal (format "%S" `[erc-sasl--scram-client-first-message
-                                      ,req])
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
                        (format "%S" step)))
         (should (string= (sasl-step-data step) req))))
     (ert-info ("Server's initial response")
@@ -191,8 +193,9 @@ erc-sasl-create-client--scram-sha-256--no-authzid
          (step (sasl-next-step client nil)))
     (ert-info ("Client's initial request")
       (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
-        (should (equal (format "%S" `[erc-sasl--scram-client-first-message
-                                      ,req])
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
                        (format "%S" step)))
         (should (string= (sasl-step-data step) req))))
     (ert-info ("Server's initial response")
@@ -229,8 +232,9 @@ erc-sasl-create-client--scram-sha-512--no-authzid
          (step (sasl-next-step client nil)))
     (ert-info ("Client's initial request")
       (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
-        (should (equal (format "%S" `[erc-sasl--scram-client-first-message
-                                      ,req])
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
                        (format "%S" step)))
         (should (string= (sasl-step-data step) req))))
     (ert-info ("Server's initial response")
diff --git a/test/lisp/erc/erc-scenarios-sasl.el b/test/lisp/erc/erc-scenarios-sasl.el
index b4f926b54c..3ff7cc805d 100644
--- a/test/lisp/erc/erc-scenarios-sasl.el
+++ b/test/lisp/erc/erc-scenarios-sasl.el
@@ -118,7 +118,7 @@ erc-scenarios-sasl--plain-fail
           (funcall expect 20 "SASL authentication failed")
           (should-not (erc-server-process-alive)))))))
 
-(defun erc-scenarios--common--sasl (mech zfunc)
+(defun erc-scenarios--common--sasl (mech)
   (erc-scenarios-common-with-cleanup
       ((erc-scenarios-common-dialog "sasl")
        (erc-d-linger-secs 0.5)
@@ -126,7 +126,6 @@ erc-scenarios--common--sasl
        (dumb-server (erc-d-run "localhost" t mech))
        (port (process-contact dumb-server :service))
        (erc-modules (cons 'sasl erc-modules))
-       (erc-sasl-scram-authzid-function zfunc)
        (erc-sasl-password "sesame")
        (erc-sasl-mechanism mech)
        (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
@@ -150,12 +149,13 @@ erc-scenarios--common--sasl
 
 (ert-deftest erc-scenarios-sasl--scram-sha-1 ()
   :tags '(:expensive-test)
-  (erc-scenarios--common--sasl 'scram-sha-1 #'sasl-client-name))
+  (let ((erc-sasl-authzid "jilles"))
+    (erc-scenarios--common--sasl 'scram-sha-1)))
 
 (ert-deftest erc-scenarios-sasl--scram-sha-256 ()
   :tags '(:expensive-test)
   (unless (featurep 'sasl-scram-sha256)
     (ert-skip "Emacs lacks sasl-scram-sha256"))
-  (erc-scenarios--common--sasl 'scram-sha-256 nil))
+  (erc-scenarios--common--sasl 'scram-sha-256))
 
 ;;; erc-scenarios-sasl.el ends here
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: 0001-Add-GS2-authorization-to-sasl-scram-rfc.patch --]
[-- Type: text/x-patch, Size: 2949 bytes --]

From 91e33541457a55e2e509d800cd8b9f97702e706d Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 19 Sep 2022 21:28:52 -0700
Subject: [PATCH 1/4] Add GS2 authorization to sasl-scram-rfc

* lisp/net/sasl-scram-rfc.el (sasl-scram-fs2-header-function,
sasl-scram-construct-gs2-header): Add new variable and default
function for determining a SCRAM GSS-API message header.
(sasl-scram-client-first-message): Use gs2-header function.
(sasl-scram--client-final-message): Use dedicated gs2-header function.
Also remove whitespace when base64-encoding, as per RFC 5802.
---
 lisp/net/sasl-scram-rfc.el | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/lisp/net/sasl-scram-rfc.el b/lisp/net/sasl-scram-rfc.el
index ee52ed6e07..f7a2e42541 100644
--- a/lisp/net/sasl-scram-rfc.el
+++ b/lisp/net/sasl-scram-rfc.el
@@ -45,14 +45,21 @@
 
 ;;; Generic for SCRAM-*
 
+(defvar sasl-scram-gs2-header-function 'sasl-scram-construct-gs2-header
+  "Function to create GS2 header.
+See https://www.rfc-editor.org/rfc/rfc5801#section-4.")
+
+(defun sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
 (defun sasl-scram-client-first-message (client _step)
   (let ((c-nonce (sasl-unique-id)))
     (sasl-client-set-property client 'c-nonce c-nonce))
   (concat
-   ;; n = client doesn't support channel binding
-   "n,"
-   ;; TODO: where would we get authorization id from?
-   ","
+   (funcall sasl-scram-gs2-header-function client)
    (sasl-scram--client-first-message-bare client)))
 
 (defun sasl-scram--client-first-message-bare (client)
@@ -77,11 +84,11 @@ sasl-scram--client-final-message
 
 	 (c-nonce (sasl-client-property client 'c-nonce))
 	 ;; no channel binding, no authorization id
-	 (cbind-input "n,,"))
+         (cbind-input (funcall sasl-scram-gs2-header-function client)))
     (unless (string-prefix-p c-nonce nonce)
       (sasl-error "Invalid nonce from server"))
     (let* ((client-final-message-without-proof
-	    (concat "c=" (base64-encode-string cbind-input) ","
+            (concat "c=" (base64-encode-string cbind-input t) ","
 		    "r=" nonce))
 	   (password
 	    ;; TODO: either apply saslprep or disallow non-ASCII characters
@@ -113,7 +120,7 @@ sasl-scram--client-final-message
 	   (client-proof (funcall string-xor client-key client-signature))
 	   (client-final-message
 	    (concat client-final-message-without-proof ","
-		    "p=" (base64-encode-string client-proof))))
+                    "p=" (base64-encode-string client-proof t))))
       (sasl-client-set-property client 'auth-message auth-message)
       (sasl-client-set-property client 'salted-password salted-password)
       client-final-message)))
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #4: 0002-Support-local-ERC-modules-in-erc-mode-buffers.patch --]
[-- Type: text/x-patch, Size: 10741 bytes --]

From b88bcadffba84b64ae91d45b84736313ac49dfef Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 12 Jul 2021 03:44:28 -0700
Subject: [PATCH 2/4] Support local ERC modules in erc-mode buffers

* lisp/erc/erc.el (erc-migrate-modules): add some missing mappings.
(erc--module-name-migrations, erc--features-to-modules,
erc--modules-to-features): add alists to support simplified
module-name migrations.
(erc-update-modules): Change return value to a list of minor-mode
commands for local modules that need deferred activation, if any.  Use
`custom-variable-p' to detect flavor.  Currently, all modules are
global, meaning so are their accompanying minor modes.
(erc-open): Defer enabling of local modules via `erc-update-modules'
until after buffer is initialized with other local vars.  Also defer
major mode hooks so they can detect things like whether the buffer is
a server or target buffer.
(define-erc-modules): Don't enable local modules (minor modes) unless
`erc-mode' is the major mode. And don't disable them unless the minor
mode is actually active.  Also, don't mutate `erc-modules' when
dealing with a local module.  It's believed that the original authors
wanted this functionality.
---
 lisp/erc/erc.el            | 108 ++++++++++++++++++++++++-------------
 test/lisp/erc/erc-tests.el |  47 ++++++++++++++++
 2 files changed, 119 insertions(+), 36 deletions(-)

diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 20f22c896f..8fa9d0c8a3 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1390,7 +1390,9 @@ define-erc-module
 
 This will define a minor mode called erc-NAME-mode, possibly
 an alias erc-ALIAS-mode, as well as the helper functions
-erc-NAME-enable, and erc-NAME-disable.
+erc-NAME-enable, and erc-NAME-disable.  Beware that for global
+modules, these helpers, as well as the minor-mode toggle, all mutate
+the user option `erc-modules'.
 
 Example:
 
@@ -1426,16 +1428,21 @@ define-erc-module
          ,(format "Enable ERC %S mode."
                   name)
          (interactive)
-         (add-to-list 'erc-modules (quote ,name))
-         (setq ,mode t)
-         ,@enable-body)
+         (unless ,local-p
+           (cl-pushnew (erc--normalize-module-symbol ',name) erc-modules))
+         (when (or ,(not local-p) (eq major-mode 'erc-mode))
+           (setq ,mode t)
+           ,@enable-body))
        (defun ,disable ()
          ,(format "Disable ERC %S mode."
                   name)
          (interactive)
-         (setq erc-modules (delq (quote ,name) erc-modules))
-         (setq ,mode nil)
-         ,@disable-body)
+         (unless ,local-p
+           (setq erc-modules (delq (erc--normalize-module-symbol ',name)
+                                   erc-modules)))
+         (when (or ,(not local-p) ,mode)
+           (setq ,mode nil)
+           ,@disable-body))
        ,(when (and alias (not (eq name alias)))
           `(defalias
              ',(intern
@@ -2030,14 +2037,40 @@ erc-default-nicks
 (defvar-local erc-nick-change-attempt-count 0
   "Used to keep track of how many times an attempt at changing nick is made.")
 
+(defconst erc--features-to-modules
+  '((erc-pcomplete completion pcomplete)
+    (erc-capab capab-identify)
+    (erc-join autojoin)
+    (erc-page page ctcp-page)
+    (erc-sound sound ctcp-sound)
+    (erc-stamp stamp timestamp)
+    (erc-services services nickserv))
+  "Migration alist mapping a library feature to module names.
+Keys need not be unique: a library may define more than one
+module.")
+
+(defconst erc--modules-to-features
+  (cl-loop for (feature . names) in erc--features-to-modules
+           append (mapcar (lambda (name) (cons name feature)) names))
+  "Migration alist mapping a module's name to library feature.")
+
+(defconst erc--module-name-migrations
+  (let (pairs)
+    (pcase-dolist (`(,_ ,canonical . ,rest) erc--features-to-modules)
+      (dolist (obsolete rest)
+        (push (cons obsolete canonical) pairs)))
+    pairs)
+  "Association list of obsolete module names to canonical names.")
+
+(defun erc--normalize-module-symbol (module)
+  "Canonicalize symbol MODULE for `erc-modules'."
+  (or (cdr (assq module erc--module-name-migrations)) module))
+
 (defun erc-migrate-modules (mods)
   "Migrate old names of ERC modules to new ones."
   ;; modify `transforms' to specify what needs to be changed
   ;; each item is in the format '(old . new)
-  (let ((transforms '((pcomplete . completion))))
-    (delete-dups
-     (mapcar (lambda (m) (or (cdr (assoc m transforms)) m))
-             mods))))
+  (delete-dups (mapcar #'erc--normalize-module-symbol mods)))
 
 (defcustom erc-modules '(netsplit fill button match track completion readonly
                                   networks ring autojoin noncommands irccontrols
@@ -2116,27 +2149,22 @@ erc-modules
   :group 'erc)
 
 (defun erc-update-modules ()
-  "Run this to enable erc-foo-mode for all modules in `erc-modules'."
-  (let (req)
+  "Enable global minor mode for all global modules in `erc-modules'.
+Return minor-mode commands for all local modules, possibly for
+deferred invocation, as done by `erc-open' whenever a new ERC
+buffer is created.  Local modules were introduced in ERC 5.6."
+  (let (local-modules)
     (dolist (mod erc-modules)
-      (setq req (concat "erc-" (symbol-name mod)))
-      (cond
-       ;; yuck. perhaps we should bring the filenames into sync?
-       ((string= req "erc-capab-identify")
-        (setq req "erc-capab"))
-       ((string= req "erc-completion")
-        (setq req "erc-pcomplete"))
-       ((string= req "erc-pcomplete")
-        (setq mod 'completion))
-       ((string= req "erc-autojoin")
-        (setq req "erc-join")))
-      (condition-case nil
-          (require (intern req))
-        (error nil))
+      (require (or (alist-get mod erc--modules-to-features)
+                   (intern (concat "erc-" (symbol-name mod))))
+               nil 'noerror) ; some modules don't have a corresponding feature
       (let ((sym (intern-soft (concat "erc-" (symbol-name mod) "-mode"))))
-        (if (fboundp sym)
+        (unless (and sym (fboundp sym))
+          (error "`%s' is not a known ERC module" mod))
+        (if (custom-variable-p sym)
             (funcall sym 1)
-          (error "`%s' is not a known ERC module" mod))))))
+          (push sym local-modules))))
+    local-modules))
 
 (defun erc-setup-buffer (buffer)
   "Consults `erc-join-buffer' to find out how to display `BUFFER'."
@@ -2192,18 +2220,22 @@ erc-open
   (let* ((target (and channel (erc--target-from-string channel)))
          (buffer (erc-get-buffer-create server port nil target id))
          (old-buffer (current-buffer))
-         old-point
+         (old-recon-count erc-server-reconnect-count)
+         (old-point nil)
+         (delayed-modules nil)
          (continued-session (and erc--server-reconnecting
                                  (with-suppressed-warnings
                                      ((obsolete erc-reuse-buffers))
                                    erc-reuse-buffers))))
     (when connect (run-hook-with-args 'erc-before-connect server port nick))
-    (erc-update-modules)
     (set-buffer buffer)
     (setq old-point (point))
-    (let ((old-recon-count erc-server-reconnect-count))
-      (erc-mode)
-      (setq erc-server-reconnect-count old-recon-count))
+    (setq delayed-modules (erc-update-modules))
+
+    (delay-mode-hooks (erc-mode))
+
+    (setq erc-server-reconnect-count old-recon-count)
+
     (when (setq erc-server-connected (not connect))
       (setq erc-server-announced-name
             (buffer-local-value 'erc-server-announced-name old-buffer)))
@@ -2266,6 +2298,12 @@ erc-open
     (setq erc-dbuf
           (when erc-log-p
             (get-buffer-create (concat "*ERC-DEBUG: " server "*"))))
+
+    (erc-determine-parameters server port nick full-name user passwd)
+
+    (save-excursion (run-mode-hooks))
+    (dolist (mod delayed-modules) (funcall mod +1))
+
     ;; set up prompt
     (unless continued-session
       (goto-char (point-max))
@@ -2277,8 +2315,6 @@ erc-open
       (erc-display-prompt)
       (goto-char (point-max)))
 
-    (erc-determine-parameters server port nick full-name user passwd)
-
     ;; Saving log file on exit
     (run-hook-with-args 'erc-connect-pre-hook buffer)
 
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index b2ed29e80e..d3d319ab22 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -975,4 +975,51 @@ erc-message
     (kill-buffer "ExampleNet")
     (kill-buffer "#chan")))
 
+(ert-deftest erc-migrate-modules ()
+  (should (equal (erc-migrate-modules '(autojoin timestamp button))
+                 '(autojoin stamp button)))
+  ;; Default unchanged
+  (should (equal (erc-migrate-modules erc-modules) erc-modules)))
+
+(ert-deftest erc-update-modules ()
+  (let* (calls
+         (erc-modules '(fake-foo fake-bar)))
+    (cl-letf (((symbol-function 'require)
+               (lambda (s &rest _) (push s calls)))
+              ((symbol-function 'erc-fake-foo-mode)
+               (lambda (n) (push (cons 'fake-foo n) calls)))
+              ;; Here, foo is a global module (minor mode)
+              ((get 'erc-fake-foo-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-fake-bar-mode)
+               (lambda (n) (push (cons 'fake-bar n) calls)))
+              ((symbol-function 'erc-autojoin-mode)
+               (lambda (n) (push (cons 'autojoin n) calls)))
+              ((get 'erc-autojoin-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-networks-mode)
+               (lambda (n) (push (cons 'networks n) calls)))
+              ((symbol-function 'erc-completion-mode)
+               (lambda (n) (push (cons 'completion n) calls)))
+              ((get 'erc-completion-mode 'standard-value) #'ignore))
+
+      (ert-info ("Locals")
+        (should (equal (erc-update-modules)
+                       '(erc-fake-bar-mode)))
+        ;; Bar still required
+        (should (equal (nreverse calls) '(erc-fake-foo
+                                          (fake-foo . 1)
+                                          erc-fake-bar)))
+        (setq calls nil))
+
+      (ert-info ("Module name overrides")
+        (setq erc-modules '(completion autojoin networks))
+        (should-not (erc-update-modules)) ; no locals
+        (should (equal (nreverse calls)
+                       '(erc-pcomplete
+                         (completion . 1)
+                         erc-join
+                         (autojoin . 1)
+                         erc-networks
+                         (networks . 1))))
+        (setq calls nil)))))
+
 ;;; erc-tests.el ends here
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #5: 0003-Make-erc-login-generic.patch --]
[-- Type: text/x-patch, Size: 1965 bytes --]

From 1d59baf98f0b9fe4178b18eeaa7ad79f48b14ee7 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:49:23 -0700
Subject: [PATCH 3/4] Make erc-login generic

* lisp/erc/erc-backend (erc--register-connection): Add new generic
function that's just a wrapper for `erc-login' by default.
(erc-process-sentinel, erc-server-connect): Call
`erc--register-connection' instead of `erc-login'.
---
 lisp/erc/erc-backend.el | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index df9efe4b0c..25c4481d1d 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -532,6 +532,10 @@ erc-open-network-stream
   (let ((p (plist-put parameters :nowait t)))
     (apply #'open-network-stream name buffer host service p)))
 
+(cl-defmethod erc--register-connection ()
+  "Perform opening IRC protocol exchange with server."
+  (erc-login))
+
 (defun erc-server-connect (server port buffer &optional client-certificate)
   "Perform the connection and login using the specified SERVER and PORT.
 We will store server variables in the buffer given by BUFFER.
@@ -580,7 +584,7 @@ erc-server-connect
         ;; waiting for a non-blocking connect - keep the user informed
         (erc-display-message nil nil buffer "Opening connection..\n")
       (message "%s...done" msg)
-      (erc-login)) ))
+      (erc--register-connection))))
 
 (defun erc-server-reconnect ()
   "Reestablish the current IRC connection.
@@ -758,7 +762,7 @@ erc-process-sentinel
                   cproc (process-status cproc) event erc-server-quitting))
         (if (string-match "^open" event)
             ;; newly opened connection (no wait)
-            (erc-login)
+            (erc--register-connection)
           ;; assume event is 'failed
           (erc-with-all-buffers-of-server cproc nil
                                           (setq erc-server-connected nil))
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #6: 0004-Add-non-IRCv3-SASL-module-to-ERC.patch --]
[-- Type: text/x-patch, Size: 61899 bytes --]

From b2e7df6b097b4b203860189dd59219909959c016 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:37:13 -0700
Subject: [PATCH 4/4] Add non-IRCv3 SASL module to ERC

* lisp/erc/erc-compat.el (erc-compat--sasl-scram-construct-gs2-header,
erc-compat--sasl-scram-client-first-message,
erc-compat--sasl-scram--client-final-message): Add minimal
authorization support via own variant of
`sasl-scram--client-final-message' and supporting sasl-scram-rfc
functions introduced in Emacs 29.

* lisp/erc/erc-sasl.el: New file.
* test/lisp/erc/erc-sasl-tests.el: New file.
* test/lisp/erc/erc-scenarios-sasl.el: New file.
* test/lisp/erc/resources/sasl/plain-failed.eld: New file.
* test/lisp/erc/resources/sasl/plain.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-1.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-256.eld: New file.
* test/lisp/erc/resources/sasl/external.eld: New file.
---
 lisp/erc/erc-compat.el                        | 104 ++++
 lisp/erc/erc-sasl.el                          | 477 ++++++++++++++++++
 test/lisp/erc/erc-sasl-tests.el               | 299 +++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 161 ++++++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  35 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 ++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 ++
 9 files changed, 1219 insertions(+)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 8a00e711ac..3123f64b88 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -156,6 +156,110 @@ erc-subseq
 		 (setq i (1+ i) start (1+ start)))
 	       res))))))
 
+
+;;;; SASL
+
+(declare-function sasl-step-data "sasl" (step))
+(declare-function sasl-error "sasl" (datum))
+(declare-function sasl-client-property "sasl" (client property))
+(declare-function sasl-client-set-property "sasl" (client property value))
+(declare-function sasl-mechanism-name "sasl" (mechanism))
+(declare-function sasl-client-name "sasl" (client))
+(declare-function sasl-client-mechanism "sasl" (client))
+(declare-function sasl-read-passphrase "sasl" (prompt))
+(declare-function sasl-unique-id "sasl" nil)
+(declare-function decode-hex-string "hex-util" (string))
+(declare-function rfc2104-hash "rfc2104" (hash block-length hash-length
+                                               key text))
+(declare-function sasl-scram--client-first-message-bare "sasl-scram-rfc"
+                  (client))
+(declare-function cl-mapcar "cl-lib" (cl-func cl-x &rest cl-rest))
+
+(defun erc-compat--sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
+(defun erc-compat--sasl-scram-client-first-message (client _step)
+  (let ((c-nonce (sasl-unique-id)))
+    (sasl-client-set-property client 'c-nonce c-nonce))
+  (concat (erc-compat--sasl-scram-construct-gs2-header client)
+          (sasl-scram--client-first-message-bare client)))
+
+;; This is `sasl-scram--client-final-message' from sasl-scram-rfc,
+;; with the NO-LINE-BREAK argument of `base64-encode-string' set to t
+;; because https://www.rfc-editor.org/rfc/rfc5802#section-2.1 says:
+;;
+;;  > The use of base64 in SCRAM is restricted to the canonical form
+;;  > with no whitespace.
+;;
+;; Unfortunately, advising `base64-encode-string' won't work
+;; because the byte compiler precomputes the result when all inputs
+;; are constants, as they are in the unpatched version.
+;;
+;; The only other substantial change is the addition of authz support.
+;; This can be dropped if adopted by Emacs 29 and `compat'.  Changes
+;; proposed for 29 are marked with a "; *n", comment below.  See older
+;; versions of lisp/erc/erc-v3-sasl.el (bug#49860) if needing a true
+;; side-by-side diff.  This also inlines the internal function
+;; `sasl-scram--client-first-message-bare' and takes various liberties
+;; with formatting.
+
+(defun erc-compat--sasl-scram--client-final-message
+    (hash-fun block-length hash-length client step)
+  (unless (string-match
+           "^r=\\([^,]+\\),s=\\([^,]+\\),i=\\([0-9]+\\)\\(?:$\\|,\\)"
+           (sasl-step-data step))
+    (sasl-error "Unexpected server response"))
+  (let* ((hmac-fun
+          (lambda (text key)
+            (decode-hex-string
+             (rfc2104-hash hash-fun block-length hash-length key text))))
+         (step-data (sasl-step-data step))
+         (nonce (match-string 1 step-data))
+         (salt-base64 (match-string 2 step-data))
+         (iteration-count (string-to-number (match-string 3 step-data)))
+         (c-nonce (sasl-client-property client 'c-nonce))
+         (cbind-input
+          (if (string-prefix-p c-nonce nonce)
+              (erc-compat--sasl-scram-construct-gs2-header client) ; *1
+            (sasl-error "Invalid nonce from server")))
+         (client-final-message-without-proof
+          (concat "c=" (base64-encode-string cbind-input t) "," ; *2
+                  "r=" nonce))
+         (password
+          (sasl-read-passphrase
+           (format "%s passphrase for %s: "
+                   (sasl-mechanism-name (sasl-client-mechanism client))
+                   (sasl-client-name client))))
+         (salt (base64-decode-string salt-base64))
+         (string-xor (lambda (a b)
+                       (apply #'unibyte-string (cl-mapcar #'logxor a b))))
+         (salted-password (let ((digest (concat salt (string 0 0 0 1)))
+                                (xored nil))
+                            (dotimes (_i iteration-count xored)
+                              (setq digest (funcall hmac-fun digest password))
+                              (setq xored (if (null xored)
+                                              digest
+                                            (funcall string-xor xored
+                                                     digest))))))
+         (client-key (funcall hmac-fun "Client Key" salted-password))
+         (stored-key (decode-hex-string (funcall hash-fun client-key)))
+         (auth-message (concat "n=" (sasl-client-name client)
+                               ",r=" c-nonce "," step-data
+                               "," client-final-message-without-proof))
+         (client-signature (funcall hmac-fun
+                                    (encode-coding-string auth-message 'utf-8)
+                                    stored-key))
+         (client-proof (funcall string-xor client-key client-signature))
+         (client-final-message
+          (concat client-final-message-without-proof ","
+                  "p=" (base64-encode-string client-proof t)))) ; *3
+    (sasl-client-set-property client 'auth-message auth-message)
+    (sasl-client-set-property client 'salted-password salted-password)
+    client-final-message))
+
 (provide 'erc-compat)
 
 ;;; erc-compat.el ends here
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
new file mode 100644
index 0000000000..bd27934125
--- /dev/null
+++ b/lisp/erc/erc-sasl.el
@@ -0,0 +1,477 @@
+;;; erc-sasl.el --- SASL for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published
+;; by the Free Software Foundation, either version 3 of the License,
+;; or (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;; WARNING: this is a naive/hack (non-IRCv3) implementation of SASL.
+;; Please see bug#49860, which adds full 3.2 capability negotiation.
+
+;; Various ERC implementations of the PLAIN mechanism have surfaced
+;; over the years, the first possibly being:
+;;
+;; https://lists.gnu.org/archive/html/erc-discuss/2012-02/msg00001.html
+;;
+;; This module would not exist without this and other pioneering
+;; efforts.
+;;
+;; FIXME move the following to doc/misc/erc.texi
+;;
+;; Regardless of the mechanism or server, you'll likely have to be
+;; registered before first use.  Refer to the network's own
+;; instructions for details.  If you're new to IRC and using a
+;; bouncer, know that you almost certainly won't be needing SASL for
+;; the client -> bouncer connection.
+;;
+;; Note that `sasl' is a "local" ERC module (effectively introduced in
+;; ERC 5.5).  This means invoking `erc-sasl-mode' manually or calling
+;; `erc-update-modules' won't do any good.  Instead, simply add `sasl'
+;; to `erc-modules' or `let'-bind it while calling `erc-tls', and SASL
+;; will be enabled for the current connection.  But before that,
+;; please explore all custom options that pertain to your chosen
+;; mechanism.
+;;
+;; Password-based mechanisms:
+;;
+;;   Here, "password" refers to your account password, which is
+;;   usually your NickServ password.  This often differs from any
+;;   connection (server) password given to `erc-tls' via its :password
+;;   arg.  To make this work, customize both `erc-sasl-user' and
+;;   `erc-sasl-password' or bind them when invoking `erc-tls'.
+;;
+;;   When `erc-sasl-password' is a string, it's used unconditionally.
+;;   When it's a non-nil symbol, like Libera.Chat, it's used as the
+;;   host param in an auth-source query.  When it's nil and a session
+;;   ID is on file (see `erc-tls'), the ID is instead used for the
+;;   host param.  The value of `erc-sasl-user' is always specified for
+;;   the user (login) param.  See the info node "(erc) Connecting" for
+;;   specifics.
+;;
+;;   If no password can be determined, a non-nil connection password
+;;   will be tried (but this may change, so please don't rely on it).
+;;
+;; EXTERNAL (with Client TLS Certificate):
+;;
+;;   1. Specify the `:client-certificate' param when opening a new
+;;      connection, which is typically done by calling `emacs-tls'.
+;;      See (info "(erc) Connecting").
+;;
+;;   2. Ensure you've registered your fingerprint with the network and
+;;      (re)connect.  The fingerprint is usually a SHA1 or SHA256
+;;      digest in either "normalized" or "openssl" forms.  The first
+;;      is lowercase without delims ("deadbeef") and the second
+;;      uppercase with colon seps ("DE:AD:BE:EF").
+;;
+;;   There's no reason to send your password after registering.  Note
+;;   that most ircds will allow you to authenticate with a client cert
+;;   but without the hassle of SASL (meaning you may not need this
+;;   module).
+;;
+;; ECDSA-NIST256P-CHALLENGE:
+;;
+;;   Use something else if at all possible.  This currently requires
+;;   the openssl command-line utility.  On servers running Atheme
+;;   services, add your public key with NickServ like so:
+;;
+;;   /msg NickServ set property
+;;     pubkey AgGZmlYTUjJlea/BVz7yrjJ6gysiAPaQxzeUzTH4hd5j
+;;
+;;   (You may not need the "property" subcommand.)
+;;
+;;
+;; TODO
+;;
+;; - Implement pseudo PASSWORD mechanism that chooses the strongest
+;;   available mechanism for you.
+;;
+;; - Maybe provide explicit authz.  Currently, there's only an obscure
+;;   customizable function option for SCRAM and nothing for plain.
+
+;;; Code:
+(require 'erc-backend)
+(require 'rx)
+(require 'sasl)
+(require 'sasl-scram-rfc)
+(require 'sasl-scram-sha256 nil t)
+
+(defgroup erc-sasl nil
+  "SASL for ERC."
+  :group 'erc
+  :package-version '(ERC . "5.4")) ; FIXME increment on next release
+
+(defcustom erc-sasl-mechanism nil
+  "SASL mechanism to connect with.
+Note that any value other than nil or `external' likely requires
+`erc-sasl-user' and `erc-sasl-password'."
+  :type '(choice (const nil)
+                 (const plain)
+                 (const external)
+                 (const scram-sha-1)
+                 (const scram-sha-256)
+                 (const scram-sha-512)
+                 (const ecdsa-nist256p-challenge)))
+
+(defcustom erc-sasl-user nil
+  "Optional account username to send when authenticating.
+This is also referred to as the authentication identity, or
+\"authcid\".  When nil, applicable mechanisms will use the
+session's current nick."
+  :type '(choice string (const nil)))
+
+(defcustom erc-sasl-password nil
+  "Optional account password to send when authenticating.
+When the value is a string, it's used unconditionally.  As a
+special case, when the value is a non-nil symbol, it's used as
+the value of the `:host' field in an auth-source query, provided
+`erc-sasl-auth-source-function' is set to a function.  When
+nil, a non-nil \"session password\" will be tried, likely one
+given as the `:password' argument to `erc-tls'.  As a last
+resort, the user will be prompted for input."
+  :type '(choice (const nil) string symbol))
+
+(defcustom erc-sasl-auth-source-function nil
+  "Function to query auth-source for an SASL password.
+Called with keyword params known to `auth-source-search', which
+may include a non-nil `erc-sasl-user' for the `:user' field
+and a non-nil `erc-sasl-password' for the `:host' field, when
+the latter option is a symbol instead of a string.  In return,
+ERC expects a string to send as the SASL password, or nil, to
+move on to the next approach, as described in the doc string for
+the option `erc-sasl-password'.  See info node `(erc)
+Connecting' for details on ERC's auth-source integration."
+  :type '(choice (const erc-auth-source-search)
+                 (const nil)
+                 function))
+
+(defcustom erc-sasl-ecdsa-private-key nil
+  "Private signing key file for ECDSA-NIST256P-CHALLENGE."
+  :type '(choice (const nil) string))
+
+(defcustom erc-sasl-authzid nil
+  "SASL authorization identity.
+Generally unneeded for normal use.  Some test frameworks and
+aberrant servers may want this to match `erc-sasl-user'."
+  :type '(choice (const nil) string))
+
+
+;; Analogous to what erc-backend does to persist opening params.
+(defvar-local erc-sasl--options nil)
+
+;; Session-local (server buffer) SASL subproto state
+(defvar-local erc-sasl--state nil)
+
+(cl-defstruct erc-sasl--state
+  "Holder for client object and subproto state."
+  (client nil :type vector)
+  (step nil :type vector)
+  (pending nil :type string))
+
+(defun erc-sasl--read-password (prompt)
+  "Return configured option or server password.
+PROMPT is passed to `read-passwd' if necessary."
+  ;; Copying prevent `sasl-plain-response' from clobbering
+  (if-let
+      ((found
+        (or (and-let* ((pass (alist-get 'password erc-sasl--options))
+                       ((stringp pass))
+                       (pass)))
+            (and erc-sasl-auth-source-function
+                 (let ((user (alist-get 'user erc-sasl--options))
+                       (host (alist-get 'password erc-sasl--options)))
+                   (apply erc-sasl-auth-source-function
+                          `(,@(and user (list :user user))
+                            ,@(and host (list :host (symbol-name host)))))))
+            erc-session-password)))
+      (copy-sequence found)
+    (read-passwd prompt)))
+
+(defun erc-sasl--plain-response (client steps)
+  "Call `sasl-plain-response' with CLIENT and STEPS."
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (sasl-plain-response client steps)))
+
+(declare-function erc-compat--sasl-scram--client-final-message "erc-compat"
+                  (hash-fun block-length hash-length client step))
+
+(defun erc-sasl--scram-sha-hack-client-final-message (&rest args)
+  "Call `sasl-scram--client-final-message' with args.
+Pass HASH-FUN, BLOCK-LENGTH, HASH-LENGTH, CLIENT, and STEP
+directly upstream."
+  ;; In the future (29+), we'll hopefully be able to call
+  ;; `sasl-scram--client-final-message' directly
+  (require 'erc-compat)
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (apply #'erc-compat--sasl-scram--client-final-message args)))
+
+(defun erc-sasl--scram-sha-1-client-final-message (client step)
+  "Prepare CLIENT's final message with STEP."
+  (erc-sasl--scram-sha-hack-client-final-message 'sha1 64 20 client step))
+
+(defun erc-sasl--scram-sha-256-client-final-message (client step)
+  "Prepare CLIENT's final message with STEP."
+  (erc-sasl--scram-sha-hack-client-final-message 'sasl-scram-sha256 64 32
+                                                    client step))
+
+(defun erc-sasl--scram-sha512 (object &optional start end binary)
+  "Pass OBJECT, START, END, and BINARY to `secure-hash'."
+  (secure-hash 'sha512 object start end binary))
+
+(defun erc-sasl--scram-sha-512-client-final-message (client step)
+  "Prepare CLIENT's final message with STEP."
+  (erc-sasl--scram-sha-hack-client-final-message
+   #'erc-sasl--scram-sha512 128 64 client step))
+
+(defun erc-sasl--scram-sha-512-authenticate-server (client step)
+  "Call `sasl-scram--authenticate-server' with CLIENT and STEP."
+  (sasl-scram--authenticate-server
+   #'erc-sasl--scram-sha512 128 64 client step))
+
+(defun erc-sasl--ecdsa-first (client _step)
+  "Return CLIENT name."
+  (sasl-client-name client))
+
+;; FIXME do this with gnutls somehow
+(defun erc-sasl--ecdsa-sign (_client step)
+  "Return signed challenge for CLIENT and STEP."
+  (let ((challenge (sasl-step-data step)))
+    (with-temp-buffer
+      (set-buffer-multibyte nil)
+      (insert challenge)
+      (call-process-region (point-min) (point-max)
+                           "openssl" 'delete t nil "pkeyutl" "-inkey"
+                           (alist-get 'ecdsa-private-key erc-sasl--options)
+                           "-sign")
+      (buffer-string))))
+
+;; This API may seem roundabout, but the "template method" here is
+;; one that we provide, namely `erc-sasl--authenticate-handler'.
+
+(pcase-dolist
+    (`(,name . ,steps)
+     '(("PLAIN"
+        erc-sasl--plain-response)
+       ("EXTERNAL"
+        ignore)
+       ("SCRAM-SHA-1"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-1-client-final-message
+        sasl-scram-sha-1-authenticate-server)
+       ("SCRAM-SHA-256"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-256-client-final-message
+        sasl-scram-sha-256-authenticate-server)
+       ("SCRAM-SHA-512"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-512-client-final-message
+        erc-sasl--scram-sha-512-authenticate-server)
+       ("ECDSA-NIST256P-CHALLENGE"
+        erc-sasl--ecdsa-first
+        erc-sasl--ecdsa-sign)))
+  (let ((feature (intern (concat "erc-sasl-" (downcase name)))))
+    (put feature 'sasl-mechanism (sasl-make-mechanism name steps))
+    (provide feature)))
+
+(cl-defgeneric erc-sasl--create-client (mechanism)
+  "Create and return a new SASL client object for MECHANISM."
+  (let ((sasl-mechanism-alist (copy-sequence sasl-mechanism-alist))
+        (sasl-mechanisms sasl-mechanisms)
+        (name (upcase (symbol-name mechanism)))
+        (feature (intern (concat "erc-sasl-" (symbol-name mechanism))))
+        client)
+    (setf (alist-get name sasl-mechanism-alist nil nil #'equal) `(,feature))
+    (cl-pushnew name sasl-mechanisms :test #'equal)
+    (setq client (sasl-make-client (sasl-find-mechanism `(,name))
+                                   (or (alist-get 'user erc-sasl--options)
+                                       (erc-downcase (erc-current-nick)))
+                                   "N/A" "N/A"))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+;; Oragono doesn't like when authzid (if present) does not match
+;; the authcid.  TODO see if this still true.
+
+(cl-defmethod erc-sasl--create-client ((_m (eql plain)))
+  "Create and return new SASL PLAIN client object.
+See message breakdown at
+https://tools.ietf.org/html/rfc4616#section-2."
+  (let* ((sans (remq (assoc "PLAIN" sasl-mechanism-alist)
+                     sasl-mechanism-alist))
+         (sasl-mechanism-alist (cons '("PLAIN" erc-sasl-plain) sans))
+         (authc (or (alist-get 'user erc-sasl--options)
+                    (erc-downcase (erc-current-nick))))
+         (port (if (numberp erc-session-port)
+                   (number-to-string erc-session-port)
+                 "0"))
+         ;; In most cases, `erc-server-announced-name' won't be known.
+         (host (or erc-server-announced-name erc-session-server))
+         (mech (sasl-find-mechanism '("PLAIN")))
+         (client (sasl-make-client mech authc port host)))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-256)))
+  "Create a SCRAM-SHA-256 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-512)))
+  "Create a SCRAM-SHA-512 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((_ (eql ecdsa-nist256p-challenge)))
+  "Create a ECDSA-NIST256P-CHALLENGE client."
+  (unless (executable-find "openssl")
+    (user-error "Could not find openssl command-line utility"))
+  (unless (and (alist-get 'ecdsa-private-key erc-sasl--options)
+               (file-exists-p (alist-get 'ecdsa-private-key
+                                         erc-sasl--options)))
+    (user-error "Could not find `erc-sasl-ecdsa-private-key'"))
+  (cl-call-next-method))
+
+(defun erc-sasl--init ()
+  (setq erc-sasl--state (make-erc-sasl--state)
+        erc-sasl--options `((user . ,erc-sasl-user)
+                            (password . ,erc-sasl-password)
+                            (mechanism . ,erc-sasl-mechanism)
+                            (ecdsa-private-key . ,erc-sasl-ecdsa-private-key)
+                            (authzid . ,erc-sasl-authzid))))
+
+(defun erc-sasl--mechanism-offered-p (offered)
+  "Non-nil when mechanism OFFERED by server."
+  (string-match-p (rx-to-string
+                   `(: (| bot ",")
+                       ,(symbol-name
+                         (alist-get 'mechanism erc-sasl--options))
+                       (| eot ",")))
+                  (downcase offered)))
+
+(defun erc-sasl--add-hook ()
+  (add-hook 'erc-server-AUTHENTICATE-functions
+            #'erc-sasl--authenticate-handler 0 t))
+
+(defun erc-sasl--remove-hook ()
+  (remove-hook 'erc-server-AUTHENTICATE-functions
+               #'erc-sasl--authenticate-handler t))
+
+(defun erc-sasl--authenticate-handler (_proc parsed)
+  "Handle PARSED `erc-response' from server.
+Maybe transition to next state."
+  (if-let* ((response (car (erc-response.command-args parsed)))
+            ((= 400 (length response))))
+      (cl-callf (lambda (s) (concat s response))
+          (erc-sasl--state-pending erc-sasl--state))
+    (cl-assert response t)
+    (when (string= "+" response)
+      (setq response ""))
+    (setf response (base64-decode-string
+                    (concat (erc-sasl--state-pending erc-sasl--state) response))
+          (erc-sasl--state-pending erc-sasl--state) nil)
+    ;; The server is done sending, so our turn
+    (let ((client (erc-sasl--state-client erc-sasl--state))
+          (step (erc-sasl--state-step erc-sasl--state))
+          data)
+      (when step
+        (sasl-step-set-data step response))
+      (setq step (setf (erc-sasl--state-step erc-sasl--state)
+                       (sasl-next-step client step))
+            data (sasl-step-data step))
+      (when (string= data "")
+        (setq data nil))
+      (when data
+        (setq data (base64-encode-string data t)))
+      ;; No need for : because no spaces (right?)
+      (erc-server-send (concat "AUTHENTICATE " (or data "+"))))))
+
+(erc-define-catalog
+ 'english
+ '((s902 . "ERR_NICKLOCKED nick %n unavailable: %s")
+   (s904 . "ERR_SASLFAIL (authentication failed) %s")
+   (s905 . "ERR SASLTOOLONG (credentials too long) %s")
+   (s906 . "ERR_SASLABORTED (authentication aborted) %s")
+   (s907 . "ERR_SASLALREADY (already authenticated) %s")
+   (s908 . "RPL_SASLMECHS (unsupported mechanism %m) %s")))
+
+(define-erc-module sasl nil
+  "Non-IRCv3 (dumb) SASL support for ERC.
+Needless to say, this doesn't solicit or validate a suite of
+supported mechanisms.  See bug#49860 for a full, CAP 3.2-aware
+implementation, currently a WIP as of ERC 5.5."
+  ((unless erc--target
+     (erc-sasl--add-hook)
+     (erc-sasl--init)
+     (let* ((mech (alist-get 'mechanism erc-sasl--options))
+            (client (erc-sasl--create-client mech)))
+       (unless client
+         (erc-display-error-notice nil (format "Unknown mechanism: %s" mech))
+         (erc-error "Unknown mechanism: %s" mech))
+       (setf (erc-sasl--state-client erc-sasl--state) client))))
+  ((erc-sasl--remove-hook)
+   (kill-local-variable 'erc-sasl--options))
+  'local)
+
+;; FIXME use generic mechanism instead of hooks after bug#49860.
+(define-erc-response-handler (AUTHENTICATE)
+  "Maybe authenticate to server." nil)
+
+;; FIXME do something decisive here
+(define-erc-response-handler (902)
+  "Handle a ERR_NICKLOCKED response." nil
+  (let ((nick (car (erc-response.command-args parsed)))
+        (msg (erc-response.contents parsed)))
+    (erc-display-message parsed '(notice error) 'active 's902 ?n nick ?s msg)))
+
+(define-erc-response-handler (903)
+  "Handle a RPL_SASLSUCCESS response." nil
+  (when erc-sasl-mode
+    (unless erc-server-connected
+      (erc-server-send "CAP END")))
+  (erc-handle-unknown-server-response proc parsed))
+
+(define-erc-response-handler (904 905 906 907 908)
+  "Handle various SASL-related error responses." nil
+  (let* ((msg (intern (format "s%s" (erc-response.command parsed))))
+         (args `(parsed (notice error) active ,msg
+                        ,@(when (string= "908" (erc-response.command parsed))
+                            (list '?m
+                                  (alist-get 'mechanism erc-sasl--options)))
+                        ?s ,(erc-response.contents parsed))))
+    (apply #'erc-display-message args))
+  (when (member (erc-response.command parsed) '("904" "905" "906"))
+    (run-hook-with-args 'erc-quit-hook proc)
+    (delete-process proc)
+    (erc-error "Disconnected from %s; please review SASL settings" proc)))
+
+(cl-defmethod erc--register-connection (&context (erc-sasl-mode (eql t)))
+  "Send speculative/pipelined CAP and AUTHENTICATE and hope for the best."
+  (erc-server-send "CAP REQ :sasl")
+  (erc-login)
+  (let* ((c (erc-sasl--state-client erc-sasl--state))
+         (m (sasl-mechanism-name (sasl-client-mechanism c))))
+    (erc-server-send (format "AUTHENTICATE %s" m))))
+
+(provide 'erc-sasl)
+;;; erc-sasl.el ends here
+;;
+;; Local Variables:
+;; generated-autoload-file: "erc-loaddefs.el"
+;; End:
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
new file mode 100644
index 0000000000..beac287a6e
--- /dev/null
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -0,0 +1,299 @@
+;;; erc-sasl-tests.el --- Tests for erc-sasl.  -*- lexical-binding:t -*-
+
+;; Copyright (C) 2020-2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation, either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;;; Code:
+
+(require 'ert-x)
+(require 'erc-sasl)
+
+(ert-deftest erc-sasl--mechanism-offered-p ()
+  (let ((erc-sasl--options '((mechanism . external))))
+    (should (erc-sasl--mechanism-offered-p "foo,external"))
+    (should (erc-sasl--mechanism-offered-p "external,bar"))
+    (should (erc-sasl--mechanism-offered-p "foo,external,bar"))
+    (should-not (erc-sasl--mechanism-offered-p "fooexternal"))
+    (should-not (erc-sasl--mechanism-offered-p "externalbar"))))
+
+(ert-deftest erc-sasl--read-password ()
+  (ert-info ("Explicit erc-sasl-password")
+    (let ((erc-sasl--options '((password . "foo"))))
+      (should (string= (erc-sasl--read-password nil) "foo"))))
+
+  (ert-info ("Fallback to erc-session-password")
+    (let ((erc-session-password "bar")
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar")))
+    (let ((erc-session-password "bar")
+          (erc-sasl--options '((user . "tester") (password)))
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar"))))
+
+  (let* ((entries (list
+                   "machine GNU/chat port 6697 user bob password spam"
+                   "machine FSF.chat port 6697 user bob password sesame"
+                   "machine MyHost port irc password 123"))
+         (netrc-file (make-temp-file "auth-source-test" nil nil
+                                     (mapconcat 'identity entries "\n")))
+         (auth-sources (list netrc-file))
+         (erc-session-server "irc.gnu.org")
+         (erc-session-port 6697)
+         ;;
+         (erc-sasl-auth-source-function #'erc-auth-source-search)
+         erc-server-announced-name ; too early
+         auth-source-do-cache)
+
+    (unwind-protect
+        (ert-info ("Auth source")
+
+          (ert-info ("Symbol as password specifies machine")
+            (let ((erc-sasl--options '((user . "bob")
+                                       (password . FSF.chat)))
+                  (erc-networks--id (make-erc-networks--id)))
+              (should (string= (erc-sasl--read-password nil) "sesame"))))
+
+          (ert-info ("Use session ID when password empty")
+            (let ((erc-sasl--options '((user . "bob") (password)))
+                  (erc-networks--id (erc-networks--id-create 'GNU/chat)))
+              (should (string= (erc-sasl--read-password nil) "spam")))))
+
+      (delete-file netrc-file))
+
+    (ert-info ("Prompt when search fails and server password null")
+      (let ((erc-sasl-auth-source-function #'ignore))
+        (should (string= (ert-simulate-keys "baz\r"
+                           (erc-sasl--read-password "pwd:"))
+                         "baz"))))))
+
+(ert-deftest erc-sasl-create-client--plain ()
+  (let* ((erc-session-password "password123")
+         (erc-server-current-nick "tester")
+         (erc-session-port 1667)
+         (erc-session-server "localhost")
+         (client (erc-sasl--create-client 'plain))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [erc-sasl--plain-response
+                                 "\0tester\0password123"])
+                   (format "%S" result)))
+    (should (string= (sasl-step-data result) "\0tester\0password123"))
+    (should-not (sasl-next-step client result)))
+  (should (equal (assoc-default "PLAIN" sasl-mechanism-alist) '(sasl-plain))))
+
+(ert-deftest erc-sasl-create-client--external ()
+  (let* ((erc-server-current-nick "tester")
+         (client (erc-sasl--create-client 'external))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [ignore nil]) (format "%S" result)))
+    (should-not (sasl-step-data result))
+    (should-not (sasl-next-step client result)))
+  (should-not (member "EXTERNAL" sasl-mechanisms))
+  (should-not (assoc-default "EXTERNAL" sasl-mechanism-alist)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-1 ()
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-1))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                          "s=5mJO6d4rjCnsBU1X,"
+                          "i=4096"))
+            (req (concat "c=bixhPWppbGxlcyw=,"
+                         "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                         "p=OVUhgPu8wEm2cDoVLfaHzVUYPWU=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-1-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=ZWR23c9MJir0ZgfGf5jEtLOn6Ng="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256 ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                   "s=MTk2M2VkMzM5ZmU0NDRiYmI0MzIyOGVhN2YwNzYwNmI=,"
+                   "i=4096"))
+            (req (concat
+                  "c=bixhPWppbGxlcyw=,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                  "p=1vDesVBzJmv0lX0Ae1kHFtdVHkC6j4gISKVqaR45HFg=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=gUePTYSZN9xgcE06KSyKO9fUmSwH26qifoapXyEs75s="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                   "s=ZTg1MmE1YmFhZGI1NDcyMjk3NzYwZmRjZDM3Y2I1OTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                  "p=LP4sjJrjJKp5qTsARyZCppXpKLu4FMM284hNESPvGhI=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=847WXfnmReGyE1qlq1And6R4bPBNROTZ7EMS/QrJtUM="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-512--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha512"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-512))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                   "s=YzMzOWZiY2U0YzcwNDA0M2I4ZGE2M2ZjOTBjODExZTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                  "p=vMBb9tKxFAfBtel087/GLbo4objAIYr1wM+mFv/jYLKXE"
+                  "NUF0vynm81qQbywQE5ScqFFdAfwYMZq/lj4s0V1OA==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format
+                        "%S" `[erc-sasl--scram-sha-512-client-final-message
+                               ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp (concat "v=Va7NIvt8wCdhvxnv+bZriSxGoto6On5EVnRHO/ece8zs0"
+                          "qpQassdqir1Zlwh3e3EmBq+kcSy+ClNCsbzBpXe/w==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(defconst erc-sasl-tests-ecdsa-key-file "
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIIJueQ3W2IrGbe9wKdOI75yGS7PYZSj6W4tg854hlsvmoAoGCCqGSM49
+AwEHoUQDQgAEAZmaVhNSMmV5r8FXPvKuMnqDKyIA9pDHN5TNMfiF3mMeikGgK10W
+IRX9cyi2wdYg9mUUYyh9GKdBCYHGUJAiCA==
+-----END EC PRIVATE KEY-----
+")
+
+(ert-deftest erc-sasl-create-client-ecdsa ()
+  (unless (executable-find "openssl")
+    (ert-skip "System lacks openssl"))
+  (let* ((erc-server-current-nick "jilles")
+         (keyfile (make-temp-file "ecdsa_key.pem" nil nil
+                                  erc-sasl-tests-ecdsa-key-file))
+         (erc-sasl--options `((ecdsa-private-key . ,keyfile)))
+         (client (erc-sasl--create-client 'ecdsa-nist256p-challenge))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (should (equal (format "%S" [erc-sasl--ecdsa-first "jilles"])
+                     (format "%S" step)))
+      (should (string= (sasl-step-data step) "jilles")))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat "\0\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20"
+                          "\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        ;; FIXME this is dumb
+        (should (<= 68 (length (sasl-step-data step)) 72))))
+    (should-not (sasl-next-step client step))
+    (delete-file keyfile)))
+
+;;; erc-sasl-tests.el ends here
diff --git a/test/lisp/erc/erc-scenarios-sasl.el b/test/lisp/erc/erc-scenarios-sasl.el
new file mode 100644
index 0000000000..3ff7cc805d
--- /dev/null
+++ b/test/lisp/erc/erc-scenarios-sasl.el
@@ -0,0 +1,161 @@
+;;; erc-scenarios-sasl.el --- SASL tests for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; This program is free software: you can redistribute it and/or
+;; modify it under the terms of the GNU General Public License as
+;; published by the Free Software Foundation, either version 3 of the
+;; License, or (at your option) any later version.
+;;
+;; This program is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program.  If not, see
+;; <https://www.gnu.org/licenses/>.
+
+;;; Code:
+
+(require 'ert-x)
+(eval-and-compile
+  (let ((load-path (cons (ert-resource-directory) load-path)))
+    (require 'erc-scenarios-common)))
+
+(declare-function sasl-client-name "sasl" (client))
+
+(require 'erc-scenarios-common)
+(require 'erc-sasl)
+
+(ert-deftest erc-scenarios-sasl--plain ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'plain)
+       (erc-sasl-password "password123")
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "This server is in debug mode")
+        ;; Regression "\0\0\0\0 ..." caused by (fillarray passphrase 0)
+        (should (string= erc-sasl-password "password123"))))))
+
+(ert-deftest erc-scenarios-sasl--external ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'external))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'external)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "903 * Authentication successful")
+        (funcall expect 10 "This server is in debug mode")))))
+
+(ert-deftest erc-scenarios-sasl--plain-fail ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain-failed))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "wrong")
+       (erc-sasl-mechanism 'plain)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter))
+       (buf nil))
+
+    (ert-info ("Connect")
+      (setq buf (erc :server "127.0.0.1"
+                     :port port
+                     :nick "tester"
+                     :user "tester"
+                     :full-name "tester"))
+      (let ((err (should-error
+                  (with-current-buffer buf
+                    (funcall expect 20 "Connection failed!")))))
+        (should (string-search "please review" (cadr err)))
+        (with-current-buffer buf
+          (funcall expect 10 "Opening connection")
+          (funcall expect 20 "SASL authentication failed")
+          (should-not (erc-server-process-alive)))))))
+
+(defun erc-scenarios--common--sasl (mech)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t mech))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "sesame")
+       (erc-sasl-mechanism mech)
+       (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+       (sasl-unique-id-function (lambda () (pop mock-rvs)))
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "jilles"
+                                :full-name "jilles")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "jaguar"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "jaguar"
+        (funcall expect 10 "Found your hostname")
+        (funcall expect 20 "marked as being away")))))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-1 ()
+  :tags '(:expensive-test)
+  (let ((erc-sasl-authzid "jilles"))
+    (erc-scenarios--common--sasl 'scram-sha-1)))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-256 ()
+  :tags '(:expensive-test)
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (erc-scenarios--common--sasl 'scram-sha-256))
+
+;;; erc-scenarios-sasl.el ends here
diff --git a/test/lisp/erc/resources/sasl/external.eld b/test/lisp/erc/resources/sasl/external.eld
new file mode 100644
index 0000000000..2cd237ec4d
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/external.eld
@@ -0,0 +1,33 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester"))
+
+((auth-req 3.2 "AUTHENTICATE EXTERNAL")
+ (0.0 ":irc.example.org CAP * ACK :sasl")
+ (0.0 "AUTHENTICATE +"))
+
+((auth-noop 3.2 "AUTHENTICATE +")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/plain-failed.eld b/test/lisp/erc/resources/sasl/plain-failed.eld
new file mode 100644
index 0000000000..336700290c
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain-failed.eld
@@ -0,0 +1,16 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.foonet.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.foonet.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.foonet.org CAP * ACK :cap-notify sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.foonet.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgB3cm9uZw==")
+ (0.0 ":irc.foonet.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.foonet.org 904 * :SASL authentication failed: Invalid account credentials"))
+
+((cap-end 3.2 "CAP END"))
diff --git a/test/lisp/erc/resources/sasl/plain.eld b/test/lisp/erc/resources/sasl/plain.eld
new file mode 100644
index 0000000000..9c6ce3feeb
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain.eld
@@ -0,0 +1,35 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.example.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.example.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.example.org CAP * ACK :sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.example.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgBwYXNzd29yZDEyMw==")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-1.eld b/test/lisp/erc/resources/sasl/scram-sha-1.eld
new file mode 100644
index 0000000000..49980e9e12
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-1.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-1")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE bixhPWppbGxlcyxuPWppbGxlcyxyPWM1UnFMQ1p5MEw0ZkdrS0FaMGh1akZCcw==")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNYUW9LY2l2cUN3OWlEWlBTcGIscz01bUpPNmQ0cmpDbnNCVTFYLGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXhoUFdwcGJHeGxjeXc9LHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzWFFvS2NpdnFDdzlpRFpQU3BiLHA9T1ZVaGdQdTh3RW0yY0RvVkxmYUh6VlVZUFdVPQ==")
+ (0 "AUTHENTICATE dj1aV1IyM2M5TUppcjBaZ2ZHZjVqRXRMT242Tmc9"))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-256.eld b/test/lisp/erc/resources/sasl/scram-sha-256.eld
new file mode 100644
index 0000000000..74de9a23ec
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-256.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-256")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE biwsbj1qaWxsZXMscj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnM=")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNkNDA2N2YwYWZkYjU0YzNkYmQ0ZmU2NDViODRjYWUzNyxzPVpUZzFNbUUxWW1GaFpHSTFORGN5TWprM056WXdabVJqWkRNM1kySTFPVE09LGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXdzLHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzZDQwNjdmMGFmZGI1NGMzZGJkNGZlNjQ1Yjg0Y2FlMzcscD1MUDRzakpyakpLcDVxVHNBUnlaQ3BwWHBLTHU0Rk1NMjg0aE5FU1B2R2hJPQ==")
+ (0 "AUTHENTICATE dj04NDdXWGZubVJlR3lFMXFscTFBbmQ2UjRiUEJOUk9UWjdFTVMvUXJKdFVNPQ=="))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
-- 
2.37.2


^ permalink raw reply related	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]   ` <875yhifujk.fsf_-_@neverwas.me>
@ 2022-09-21 13:13     ` J.P.
  2022-10-14  3:05       ` J.P.
       [not found]       ` <878rljxfxs.fsf@neverwas.me>
  0 siblings, 2 replies; 54+ messages in thread
From: J.P. @ 2022-09-21 13:13 UTC (permalink / raw)
  To: 29108; +Cc: emacs-erc

[-- Attachment #1: Type: text/plain, Size: 61 bytes --]

v3. Updated Info manual. Revised some sloppy error handling.

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0000-v2-v3.diff --]
[-- Type: text/x-patch, Size: 22716 bytes --]

From 1bf236e6f3ffd2097bc4c9cc54ad6a049aa8c1c4 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Wed, 21 Sep 2022 00:25:49 -0700
Subject: [PATCH 0/4] *** NOT A PATCH ***

*** BLURB HERE ***

F. Jason Park (4):
  Add GS2 authorization to sasl-scram-rfc
  Support local ERC modules in erc-mode buffers
  Make erc-login generic
  Add non-IRCv3 SASL module to ERC

 doc/misc/erc.texi                             | 143 +++++-
 lisp/erc/erc-backend.el                       |   8 +-
 lisp/erc/erc-compat.el                        | 104 +++++
 lisp/erc/erc-sasl.el                          | 418 ++++++++++++++++++
 lisp/erc/erc.el                               | 108 +++--
 lisp/net/sasl-scram-rfc.el                    |  21 +-
 test/lisp/erc/erc-sasl-tests.el               | 300 +++++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 161 +++++++
 test/lisp/erc/erc-tests.el                    |  47 ++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  35 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 ++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 ++
 14 files changed, 1442 insertions(+), 46 deletions(-)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

Interdiff:
diff --git a/doc/misc/erc.texi b/doc/misc/erc.texi
index 3db83197f9..3b7af0fb1b 100644
--- a/doc/misc/erc.texi
+++ b/doc/misc/erc.texi
@@ -78,6 +78,7 @@ Top
 Advanced Usage
 
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL.
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 
@@ -478,6 +479,10 @@ Modules
 @item ring
 Enable an input history
 
+@cindex modules, sasl
+@item sasl
+Enable SASL authentication
+
 @cindex modules, scrolltobottom
 @item scrolltobottom
 Scroll to the bottom of the buffer
@@ -525,6 +530,7 @@ Advanced Usage
 
 @menu
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 @end menu
@@ -842,6 +848,7 @@ Connecting
 @noindent
 For details, @pxref{Top,,auth-source, auth, Emacs auth-source Library}.
 
+@anchor{ERC auth-source functions}
 @defopt erc-auth-source-server-function
 @end defopt
 @defopt erc-auth-source-services-function
@@ -854,7 +861,8 @@ Connecting
 @code{:user} is the ``desired'' nickname rather than the current one.
 Generalized names, like @code{:user} and @code{:host}, are always used
 over back-end specific ones, like @code{:login} or @code{:machine}.
-ERC expects a string to use as the secret or nil, if the search fails.
+ERC expects a string to use as the secret or @code{nil}, if the search
+fails.
 
 @findex erc-auth-source-search
 The default value for all three options is the function
@@ -915,6 +923,139 @@ Connecting
 make the most sense, but any reasonably printable object is
 acceptable.
 
+@node SASL
+@section Authenticating via SASL
+@cindex SASL
+
+@strong{Warning:} ERC's SASL offering is currently limited by a lack
+of support for proper IRCv3 capability negotiation.  In most cases,
+this shouldn't affect your ability to authenticate.  If you run into
+trouble, please contact us (@pxref{Getting Help and Reporting Bugs}).
+
+Regardless of the mechanism or the network, you'll likely have to be
+registered before first use.  Please refer to the network's own
+instructions for details.  If you're new to IRC and using a bouncer,
+know that you almost certainly won't be needing SASL for the
+@samp{client -> bouncer} connection.
+
+Note that @code{sasl} is a ``local'' ERC module.  This means invoking
+@code{erc-sasl-mode} manually or calling @code{erc-update-modules}
+won't do any good.  Instead, simply add @code{sasl} to
+@code{erc-modules} (or @code{let}-bind it while calling
+@code{erc-tls}), and SASL will be enabled for the current connection.
+But before that, please explore all custom options pertaining to your
+chosen mechanism.
+
+@defopt erc-sasl-mechanism
+The name of an SASL subprotocol type as a @emph{lowercase} symbol.
+
+@var{plain} and @var{scram} (``password-based''):
+
+@indentedblock
+Here, ``password'' refers to your account password, which is usually
+your @samp{NickServ} password.  This often differs from any connection
+(server) password given to @code{erc-tls} via its @code{:password}
+parameter.  To make this work, customize both @code{erc-sasl-user} and
+@code{erc-sasl-password} or bind them when invoking @code{erc-tls}.
+
+When @code{erc-sasl-password} is a string, it's used unconditionally.
+When it's a non-@code{nil} symbol, like @samp{Libera.Chat}, it's used
+as the @code{:host} param in an auth-source query.  When it's
+@code{nil} and a session ID is on file, the ID is used instead for the
+@code{:host} param (@pxref{Network Identifier}).  The value of
+@code{erc-sasl-user} is always specified for the @code{:user}
+(@code{:login}) param.
+
+If a password can't be determined, a non-@code{nil} server
+(connection) password will be tried.  (This may change, however, so
+please don't rely on it.)
+@end indentedblock
+
+@var{external} (via Client TLS Certificate):
+
+@indentedblock
+You'll want to specify the @code{:client-certificate} param when
+opening a new connection, which is typically done by calling
+@code{emacs-tls}.  But before that, ensure you've registered your
+fingerprint with the network.  The fingerprint is usually a SHA1 or
+SHA256 digest in either "normalized" or "openssl" forms.  The first is
+lowercase without delims (@samp{deadbeef}) and the second uppercase
+with colon seps (@samp{DE:AD:BE:EF}).
+
+Additional considerations:
+@enumerate
+@item
+There's no reason to send your password after registering.
+@item
+Most IRCds will allow you to authenticate with a client cert but
+without the hassle of SASL (meaning you may not need this module).
+@item
+Technically, @var{EXTERNAL} merely indicates that an out-of-band mode
+of authentication is in effect (being deferred to), so depending on
+the specific application or service, there's an off chance client
+certs aren't involved.
+@end enumerate
+@end indentedblock
+
+@var{ecdsa-nist256p-challenge}:
+
+@indentedblock
+This mechanism is quite complicated and currently requires the
+presence of the external @samp{openssl} command-line utility, so
+please use something else if at all possible.  Ignoring that, specify
+your key file (e.g., @samp{~/pki/mykey.pem}) as the value of
+@code{erc-sasl-password}, and then configure your network settings.
+On servers running Atheme services, you can add your public key with
+@samp{NickServ} like so:
+
+@example
+ERC> /msg NickServ set property \
+     pubkey AgGZmlYTUjJlea/BVz7yrjJ6gysiAPaQxzeUzTH4hd5j
+
+@end example
+(You may be able to omit the @samp{property} subcommand.)
+@end indentedblock
+
+@end defopt
+
+@defopt erc-sasl-user
+Your network account name, typically the same one registered with
+nickname services.  Specify this when your @samp{NickServ} account
+name differs from the nick you're connecting with.
+@end defopt
+
+@defopt erc-sasl-password
+Optional account password to send when authenticating.
+
+If you specify a string, it'll be considered authoritative and
+accepted at face value.  If you instead give a non-@code{nil} symbol,
+it'll be passed as the value of the @code{:host} field in an
+auth-source query, provided @code{erc-sasl-auth-source-function} is
+set to a function.  If you set this to @code{nil}, a non-@code{nil}
+``session password'' will be tried, likely whatever you gave as the
+@var{password} argument to @code{erc-tls}.  As a last resort, you'll
+be prompted for input.
+
+Note that when @code{erc-sasl-mechanism} is set to
+@code{ecdsa-nist256p-challenge}, this option should hold the file name
+of your key, which is typically in PEM format.
+@end defopt
+
+@defopt erc-sasl-auth-source-function
+This is nearly identical to the other ERC @samp{auth-source} function
+options (@pxref{ERC auth-source functions}) except that the default
+value here is @code{nil}, meaning you have to set it to something like
+@code{erc-auth-source-search} for queries to be performed.
+@end defopt
+
+@defopt erc-sasl-authzid
+In the rarest of circumstances, a network may want you to specify a
+specific role or assume an alternate identity.  In most cases, this
+happens because the server is buggy or misconfigured.  If you suspect
+such a thing, please contact your network operator.  Otherwise, just
+leave this set to @code{nil}.
+@end defopt
+
 
 @node Sample Configuration
 @section Sample Configuration
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
index bd27934125..d237ab73a8 100644
--- a/lisp/erc/erc-sasl.el
+++ b/lisp/erc/erc-sasl.el
@@ -19,9 +19,9 @@
 
 ;;; Commentary:
 
-;; WARNING: this is a naive/hack (non-IRCv3) implementation of SASL.
-;; Please see bug#49860, which adds full 3.2 capability negotiation.
-
+;; WARNING: this is a (non-IRCv3) implementation of SASL.  Please see
+;; bug#49860, which adds full 3.2 capability negotiation.
+;;
 ;; Various ERC implementations of the PLAIN mechanism have surfaced
 ;; over the years, the first possibly being:
 ;;
@@ -30,77 +30,14 @@
 ;; This module would not exist without this and other pioneering
 ;; efforts.
 ;;
-;; FIXME move the following to doc/misc/erc.texi
-;;
-;; Regardless of the mechanism or server, you'll likely have to be
-;; registered before first use.  Refer to the network's own
-;; instructions for details.  If you're new to IRC and using a
-;; bouncer, know that you almost certainly won't be needing SASL for
-;; the client -> bouncer connection.
-;;
-;; Note that `sasl' is a "local" ERC module (effectively introduced in
-;; ERC 5.5).  This means invoking `erc-sasl-mode' manually or calling
-;; `erc-update-modules' won't do any good.  Instead, simply add `sasl'
-;; to `erc-modules' or `let'-bind it while calling `erc-tls', and SASL
-;; will be enabled for the current connection.  But before that,
-;; please explore all custom options that pertain to your chosen
-;; mechanism.
-;;
-;; Password-based mechanisms:
-;;
-;;   Here, "password" refers to your account password, which is
-;;   usually your NickServ password.  This often differs from any
-;;   connection (server) password given to `erc-tls' via its :password
-;;   arg.  To make this work, customize both `erc-sasl-user' and
-;;   `erc-sasl-password' or bind them when invoking `erc-tls'.
-;;
-;;   When `erc-sasl-password' is a string, it's used unconditionally.
-;;   When it's a non-nil symbol, like Libera.Chat, it's used as the
-;;   host param in an auth-source query.  When it's nil and a session
-;;   ID is on file (see `erc-tls'), the ID is instead used for the
-;;   host param.  The value of `erc-sasl-user' is always specified for
-;;   the user (login) param.  See the info node "(erc) Connecting" for
-;;   specifics.
-;;
-;;   If no password can be determined, a non-nil connection password
-;;   will be tried (but this may change, so please don't rely on it).
-;;
-;; EXTERNAL (with Client TLS Certificate):
-;;
-;;   1. Specify the `:client-certificate' param when opening a new
-;;      connection, which is typically done by calling `emacs-tls'.
-;;      See (info "(erc) Connecting").
-;;
-;;   2. Ensure you've registered your fingerprint with the network and
-;;      (re)connect.  The fingerprint is usually a SHA1 or SHA256
-;;      digest in either "normalized" or "openssl" forms.  The first
-;;      is lowercase without delims ("deadbeef") and the second
-;;      uppercase with colon seps ("DE:AD:BE:EF").
-;;
-;;   There's no reason to send your password after registering.  Note
-;;   that most ircds will allow you to authenticate with a client cert
-;;   but without the hassle of SASL (meaning you may not need this
-;;   module).
-;;
-;; ECDSA-NIST256P-CHALLENGE:
+;; TODO:
 ;;
-;;   Use something else if at all possible.  This currently requires
-;;   the openssl command-line utility.  On servers running Atheme
-;;   services, add your public key with NickServ like so:
-;;
-;;   /msg NickServ set property
-;;     pubkey AgGZmlYTUjJlea/BVz7yrjJ6gysiAPaQxzeUzTH4hd5j
-;;
-;;   (You may not need the "property" subcommand.)
-;;
-;;
-;; TODO
+;; - Find a way to obfuscate the password in memory (via something
+;; - like `auth-source--obfuscate'); it's currently visible in
+;; - backtraces.
 ;;
 ;; - Implement pseudo PASSWORD mechanism that chooses the strongest
 ;;   available mechanism for you.
-;;
-;; - Maybe provide explicit authz.  Currently, there's only an obscure
-;;   customizable function option for SCRAM and nothing for plain.
 
 ;;; Code:
 (require 'erc-backend)
@@ -141,7 +78,11 @@ erc-sasl-password
 `erc-sasl-auth-source-function' is set to a function.  When
 nil, a non-nil \"session password\" will be tried, likely one
 given as the `:password' argument to `erc-tls'.  As a last
-resort, the user will be prompted for input."
+resort, the user will be prompted for input.
+
+Note that when `erc-sasl-mechanism' is set to
+`ecdsa-nist256p-challenge', this option should hold the file name
+of the key, which is typically in PEM format."
   :type '(choice (const nil) string symbol))
 
 (defcustom erc-sasl-auth-source-function nil
@@ -158,10 +99,6 @@ erc-sasl-auth-source-function
                  (const nil)
                  function))
 
-(defcustom erc-sasl-ecdsa-private-key nil
-  "Private signing key file for ECDSA-NIST256P-CHALLENGE."
-  :type '(choice (const nil) string))
-
 (defcustom erc-sasl-authzid nil
   "SASL authorization identity.
 Generally unneeded for normal use.  Some test frameworks and
@@ -246,7 +183,7 @@ erc-sasl--ecdsa-first
   (sasl-client-name client))
 
 ;; FIXME do this with gnutls somehow
-(defun erc-sasl--ecdsa-sign (_client step)
+(defun erc-sasl--ecdsa-sign (client step)
   "Return signed challenge for CLIENT and STEP."
   (let ((challenge (sasl-step-data step)))
     (with-temp-buffer
@@ -254,7 +191,7 @@ erc-sasl--ecdsa-sign
       (insert challenge)
       (call-process-region (point-min) (point-max)
                            "openssl" 'delete t nil "pkeyutl" "-inkey"
-                           (alist-get 'ecdsa-private-key erc-sasl--options)
+                           (sasl-client-property client 'ecdsa-keyfile)
                            "-sign")
       (buffer-string))))
 
@@ -342,18 +279,18 @@ erc-sasl--create-client
   "Create a ECDSA-NIST256P-CHALLENGE client."
   (unless (executable-find "openssl")
     (user-error "Could not find openssl command-line utility"))
-  (unless (and (alist-get 'ecdsa-private-key erc-sasl--options)
-               (file-exists-p (alist-get 'ecdsa-private-key
-                                         erc-sasl--options)))
-    (user-error "Could not find `erc-sasl-ecdsa-private-key'"))
-  (cl-call-next-method))
+  (let ((keyfile (cdr (assq 'password erc-sasl--options))))
+    (unless (and keyfile (file-exists-p keyfile))
+      (user-error "`erc-sasl-password' does not point to ECDSA keyfile"))
+    (let ((client (cl-call-next-method)))
+      (sasl-client-set-property client 'ecdsa-keyfile keyfile)
+      client)))
 
 (defun erc-sasl--init ()
   (setq erc-sasl--state (make-erc-sasl--state)
         erc-sasl--options `((user . ,erc-sasl-user)
                             (password . ,erc-sasl-password)
                             (mechanism . ,erc-sasl-mechanism)
-                            (ecdsa-private-key . ,erc-sasl-ecdsa-private-key)
                             (authzid . ,erc-sasl-authzid))))
 
 (defun erc-sasl--mechanism-offered-p (offered)
@@ -365,14 +302,6 @@ erc-sasl--mechanism-offered-p
                        (| eot ",")))
                   (downcase offered)))
 
-(defun erc-sasl--add-hook ()
-  (add-hook 'erc-server-AUTHENTICATE-functions
-            #'erc-sasl--authenticate-handler 0 t))
-
-(defun erc-sasl--remove-hook ()
-  (remove-hook 'erc-server-AUTHENTICATE-functions
-               #'erc-sasl--authenticate-handler t))
-
 (defun erc-sasl--authenticate-handler (_proc parsed)
   "Handle PARSED `erc-response' from server.
 Maybe transition to next state."
@@ -417,7 +346,8 @@ sasl
 supported mechanisms.  See bug#49860 for a full, CAP 3.2-aware
 implementation, currently a WIP as of ERC 5.5."
   ((unless erc--target
-     (erc-sasl--add-hook)
+     (add-hook 'erc-server-AUTHENTICATE-functions
+               #'erc-sasl--authenticate-handler 0 t)
      (erc-sasl--init)
      (let* ((mech (alist-get 'mechanism erc-sasl--options))
             (client (erc-sasl--create-client mech)))
@@ -425,7 +355,8 @@ sasl
          (erc-display-error-notice nil (format "Unknown mechanism: %s" mech))
          (erc-error "Unknown mechanism: %s" mech))
        (setf (erc-sasl--state-client erc-sasl--state) client))))
-  ((erc-sasl--remove-hook)
+  ((remove-hook 'erc-server-AUTHENTICATE-functions
+                #'erc-sasl--authenticate-handler t)
    (kill-local-variable 'erc-sasl--options))
   'local)
 
@@ -433,12 +364,17 @@ sasl
 (define-erc-response-handler (AUTHENTICATE)
   "Maybe authenticate to server." nil)
 
-;; FIXME do something decisive here
+(defun erc-sasl--destroy (proc)
+  (run-hook-with-args 'erc-quit-hook proc)
+  (delete-process proc)
+  (erc-error "Disconnected from %s; please review SASL settings" proc))
+
 (define-erc-response-handler (902)
   "Handle a ERR_NICKLOCKED response." nil
-  (let ((nick (car (erc-response.command-args parsed)))
-        (msg (erc-response.contents parsed)))
-    (erc-display-message parsed '(notice error) 'active 's902 ?n nick ?s msg)))
+  (erc-display-message parsed '(notice error) 'active 's902
+                       ?n (car (erc-response.command-args parsed))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
 
 (define-erc-response-handler (903)
   "Handle a RPL_SASLSUCCESS response." nil
@@ -447,19 +383,24 @@ sasl
       (erc-server-send "CAP END")))
   (erc-handle-unknown-server-response proc parsed))
 
-(define-erc-response-handler (904 905 906 907 908)
+(define-erc-response-handler (907)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's907
+                       ?s (erc-response.contents parsed)))
+
+(define-erc-response-handler (904 905 906)
   "Handle various SASL-related error responses." nil
-  (let* ((msg (intern (format "s%s" (erc-response.command parsed))))
-         (args `(parsed (notice error) active ,msg
-                        ,@(when (string= "908" (erc-response.command parsed))
-                            (list '?m
-                                  (alist-get 'mechanism erc-sasl--options)))
-                        ?s ,(erc-response.contents parsed))))
-    (apply #'erc-display-message args))
-  (when (member (erc-response.command parsed) '("904" "905" "906"))
-    (run-hook-with-args 'erc-quit-hook proc)
-    (delete-process proc)
-    (erc-error "Disconnected from %s; please review SASL settings" proc)))
+  (erc-display-message parsed '(notice error) 'active
+                       (intern (format "s%s" (erc-response.command parsed)))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(define-erc-response-handler (908)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's908
+                       '?m (alist-get 'mechanism erc-sasl--options)
+                       '?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
 
 (cl-defmethod erc--register-connection (&context (erc-sasl-mode (eql t)))
   "Send speculative/pipelined CAP and AUTHENTICATE and hope for the best."
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
index beac287a6e..c54acc4d28 100644
--- a/test/lisp/erc/erc-sasl-tests.el
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -276,24 +276,25 @@ erc-sasl-tests-ecdsa-key-file
 (ert-deftest erc-sasl-create-client-ecdsa ()
   (unless (executable-find "openssl")
     (ert-skip "System lacks openssl"))
-  (let* ((erc-server-current-nick "jilles")
-         (keyfile (make-temp-file "ecdsa_key.pem" nil nil
-                                  erc-sasl-tests-ecdsa-key-file))
-         (erc-sasl--options `((ecdsa-private-key . ,keyfile)))
-         (client (erc-sasl--create-client 'ecdsa-nist256p-challenge))
-         (step (sasl-next-step client nil)))
-    (ert-info ("Client's initial request")
-      (should (equal (format "%S" [erc-sasl--ecdsa-first "jilles"])
-                     (format "%S" step)))
-      (should (string= (sasl-step-data step) "jilles")))
-    (ert-info ("Server's initial response")
-      (let ((resp (concat "\0\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20"
-                          "\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37")))
-        (sasl-step-set-data step resp)
-        (setq step (sasl-next-step client step))
-        ;; FIXME this is dumb
-        (should (<= 68 (length (sasl-step-data step)) 72))))
-    (should-not (sasl-next-step client step))
-    (delete-file keyfile)))
+  (ert-with-temp-file keyfile
+    :prefix "ecdsa_key"
+    :suffix ".pem"
+    :text erc-sasl-tests-ecdsa-key-file
+    (let* ((erc-server-current-nick "jilles")
+           (erc-sasl--options `((password . ,keyfile)))
+           (client (erc-sasl--create-client 'ecdsa-nist256p-challenge))
+           (step (sasl-next-step client nil)))
+      (ert-info ("Client's initial request")
+        (should (equal (format "%S" [erc-sasl--ecdsa-first "jilles"])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) "jilles")))
+      (ert-info ("Server's initial response")
+        (let ((resp (concat "\0\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20"
+                            "\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37")))
+          (sasl-step-set-data step resp)
+          (setq step (sasl-next-step client step))
+          ;; FIXME this is dumb
+          (should (<= 68 (length (sasl-step-data step)) 72))))
+      (should-not (sasl-next-step client step)))))
 
 ;;; erc-sasl-tests.el ends here
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: 0001-Add-GS2-authorization-to-sasl-scram-rfc.patch --]
[-- Type: text/x-patch, Size: 2949 bytes --]

From e01d4d3e620e53629c35952bf705c9e08eafda63 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 19 Sep 2022 21:28:52 -0700
Subject: [PATCH 1/4] Add GS2 authorization to sasl-scram-rfc

* lisp/net/sasl-scram-rfc.el (sasl-scram-fs2-header-function,
sasl-scram-construct-gs2-header): Add new variable and default
function for determining a SCRAM GSS-API message header.
(sasl-scram-client-first-message): Use gs2-header function.
(sasl-scram--client-final-message): Use dedicated gs2-header function.
Also remove whitespace when base64-encoding, as per RFC 5802.
---
 lisp/net/sasl-scram-rfc.el | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/lisp/net/sasl-scram-rfc.el b/lisp/net/sasl-scram-rfc.el
index ee52ed6e07..f7a2e42541 100644
--- a/lisp/net/sasl-scram-rfc.el
+++ b/lisp/net/sasl-scram-rfc.el
@@ -45,14 +45,21 @@
 
 ;;; Generic for SCRAM-*
 
+(defvar sasl-scram-gs2-header-function 'sasl-scram-construct-gs2-header
+  "Function to create GS2 header.
+See https://www.rfc-editor.org/rfc/rfc5801#section-4.")
+
+(defun sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
 (defun sasl-scram-client-first-message (client _step)
   (let ((c-nonce (sasl-unique-id)))
     (sasl-client-set-property client 'c-nonce c-nonce))
   (concat
-   ;; n = client doesn't support channel binding
-   "n,"
-   ;; TODO: where would we get authorization id from?
-   ","
+   (funcall sasl-scram-gs2-header-function client)
    (sasl-scram--client-first-message-bare client)))
 
 (defun sasl-scram--client-first-message-bare (client)
@@ -77,11 +84,11 @@ sasl-scram--client-final-message
 
 	 (c-nonce (sasl-client-property client 'c-nonce))
 	 ;; no channel binding, no authorization id
-	 (cbind-input "n,,"))
+         (cbind-input (funcall sasl-scram-gs2-header-function client)))
     (unless (string-prefix-p c-nonce nonce)
       (sasl-error "Invalid nonce from server"))
     (let* ((client-final-message-without-proof
-	    (concat "c=" (base64-encode-string cbind-input) ","
+            (concat "c=" (base64-encode-string cbind-input t) ","
 		    "r=" nonce))
 	   (password
 	    ;; TODO: either apply saslprep or disallow non-ASCII characters
@@ -113,7 +120,7 @@ sasl-scram--client-final-message
 	   (client-proof (funcall string-xor client-key client-signature))
 	   (client-final-message
 	    (concat client-final-message-without-proof ","
-		    "p=" (base64-encode-string client-proof))))
+                    "p=" (base64-encode-string client-proof t))))
       (sasl-client-set-property client 'auth-message auth-message)
       (sasl-client-set-property client 'salted-password salted-password)
       client-final-message)))
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #4: 0002-Support-local-ERC-modules-in-erc-mode-buffers.patch --]
[-- Type: text/x-patch, Size: 10741 bytes --]

From 757442444bbe520c0e2124a1363dacde559b4c2d Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 12 Jul 2021 03:44:28 -0700
Subject: [PATCH 2/4] Support local ERC modules in erc-mode buffers

* lisp/erc/erc.el (erc-migrate-modules): add some missing mappings.
(erc--module-name-migrations, erc--features-to-modules,
erc--modules-to-features): add alists to support simplified
module-name migrations.
(erc-update-modules): Change return value to a list of minor-mode
commands for local modules that need deferred activation, if any.  Use
`custom-variable-p' to detect flavor.  Currently, all modules are
global, meaning so are their accompanying minor modes.
(erc-open): Defer enabling of local modules via `erc-update-modules'
until after buffer is initialized with other local vars.  Also defer
major mode hooks so they can detect things like whether the buffer is
a server or target buffer.
(define-erc-modules): Don't enable local modules (minor modes) unless
`erc-mode' is the major mode. And don't disable them unless the minor
mode is actually active.  Also, don't mutate `erc-modules' when
dealing with a local module.  It's believed that the original authors
wanted this functionality.
---
 lisp/erc/erc.el            | 108 ++++++++++++++++++++++++-------------
 test/lisp/erc/erc-tests.el |  47 ++++++++++++++++
 2 files changed, 119 insertions(+), 36 deletions(-)

diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 20f22c896f..8fa9d0c8a3 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1390,7 +1390,9 @@ define-erc-module
 
 This will define a minor mode called erc-NAME-mode, possibly
 an alias erc-ALIAS-mode, as well as the helper functions
-erc-NAME-enable, and erc-NAME-disable.
+erc-NAME-enable, and erc-NAME-disable.  Beware that for global
+modules, these helpers, as well as the minor-mode toggle, all mutate
+the user option `erc-modules'.
 
 Example:
 
@@ -1426,16 +1428,21 @@ define-erc-module
          ,(format "Enable ERC %S mode."
                   name)
          (interactive)
-         (add-to-list 'erc-modules (quote ,name))
-         (setq ,mode t)
-         ,@enable-body)
+         (unless ,local-p
+           (cl-pushnew (erc--normalize-module-symbol ',name) erc-modules))
+         (when (or ,(not local-p) (eq major-mode 'erc-mode))
+           (setq ,mode t)
+           ,@enable-body))
        (defun ,disable ()
          ,(format "Disable ERC %S mode."
                   name)
          (interactive)
-         (setq erc-modules (delq (quote ,name) erc-modules))
-         (setq ,mode nil)
-         ,@disable-body)
+         (unless ,local-p
+           (setq erc-modules (delq (erc--normalize-module-symbol ',name)
+                                   erc-modules)))
+         (when (or ,(not local-p) ,mode)
+           (setq ,mode nil)
+           ,@disable-body))
        ,(when (and alias (not (eq name alias)))
           `(defalias
              ',(intern
@@ -2030,14 +2037,40 @@ erc-default-nicks
 (defvar-local erc-nick-change-attempt-count 0
   "Used to keep track of how many times an attempt at changing nick is made.")
 
+(defconst erc--features-to-modules
+  '((erc-pcomplete completion pcomplete)
+    (erc-capab capab-identify)
+    (erc-join autojoin)
+    (erc-page page ctcp-page)
+    (erc-sound sound ctcp-sound)
+    (erc-stamp stamp timestamp)
+    (erc-services services nickserv))
+  "Migration alist mapping a library feature to module names.
+Keys need not be unique: a library may define more than one
+module.")
+
+(defconst erc--modules-to-features
+  (cl-loop for (feature . names) in erc--features-to-modules
+           append (mapcar (lambda (name) (cons name feature)) names))
+  "Migration alist mapping a module's name to library feature.")
+
+(defconst erc--module-name-migrations
+  (let (pairs)
+    (pcase-dolist (`(,_ ,canonical . ,rest) erc--features-to-modules)
+      (dolist (obsolete rest)
+        (push (cons obsolete canonical) pairs)))
+    pairs)
+  "Association list of obsolete module names to canonical names.")
+
+(defun erc--normalize-module-symbol (module)
+  "Canonicalize symbol MODULE for `erc-modules'."
+  (or (cdr (assq module erc--module-name-migrations)) module))
+
 (defun erc-migrate-modules (mods)
   "Migrate old names of ERC modules to new ones."
   ;; modify `transforms' to specify what needs to be changed
   ;; each item is in the format '(old . new)
-  (let ((transforms '((pcomplete . completion))))
-    (delete-dups
-     (mapcar (lambda (m) (or (cdr (assoc m transforms)) m))
-             mods))))
+  (delete-dups (mapcar #'erc--normalize-module-symbol mods)))
 
 (defcustom erc-modules '(netsplit fill button match track completion readonly
                                   networks ring autojoin noncommands irccontrols
@@ -2116,27 +2149,22 @@ erc-modules
   :group 'erc)
 
 (defun erc-update-modules ()
-  "Run this to enable erc-foo-mode for all modules in `erc-modules'."
-  (let (req)
+  "Enable global minor mode for all global modules in `erc-modules'.
+Return minor-mode commands for all local modules, possibly for
+deferred invocation, as done by `erc-open' whenever a new ERC
+buffer is created.  Local modules were introduced in ERC 5.6."
+  (let (local-modules)
     (dolist (mod erc-modules)
-      (setq req (concat "erc-" (symbol-name mod)))
-      (cond
-       ;; yuck. perhaps we should bring the filenames into sync?
-       ((string= req "erc-capab-identify")
-        (setq req "erc-capab"))
-       ((string= req "erc-completion")
-        (setq req "erc-pcomplete"))
-       ((string= req "erc-pcomplete")
-        (setq mod 'completion))
-       ((string= req "erc-autojoin")
-        (setq req "erc-join")))
-      (condition-case nil
-          (require (intern req))
-        (error nil))
+      (require (or (alist-get mod erc--modules-to-features)
+                   (intern (concat "erc-" (symbol-name mod))))
+               nil 'noerror) ; some modules don't have a corresponding feature
       (let ((sym (intern-soft (concat "erc-" (symbol-name mod) "-mode"))))
-        (if (fboundp sym)
+        (unless (and sym (fboundp sym))
+          (error "`%s' is not a known ERC module" mod))
+        (if (custom-variable-p sym)
             (funcall sym 1)
-          (error "`%s' is not a known ERC module" mod))))))
+          (push sym local-modules))))
+    local-modules))
 
 (defun erc-setup-buffer (buffer)
   "Consults `erc-join-buffer' to find out how to display `BUFFER'."
@@ -2192,18 +2220,22 @@ erc-open
   (let* ((target (and channel (erc--target-from-string channel)))
          (buffer (erc-get-buffer-create server port nil target id))
          (old-buffer (current-buffer))
-         old-point
+         (old-recon-count erc-server-reconnect-count)
+         (old-point nil)
+         (delayed-modules nil)
          (continued-session (and erc--server-reconnecting
                                  (with-suppressed-warnings
                                      ((obsolete erc-reuse-buffers))
                                    erc-reuse-buffers))))
     (when connect (run-hook-with-args 'erc-before-connect server port nick))
-    (erc-update-modules)
     (set-buffer buffer)
     (setq old-point (point))
-    (let ((old-recon-count erc-server-reconnect-count))
-      (erc-mode)
-      (setq erc-server-reconnect-count old-recon-count))
+    (setq delayed-modules (erc-update-modules))
+
+    (delay-mode-hooks (erc-mode))
+
+    (setq erc-server-reconnect-count old-recon-count)
+
     (when (setq erc-server-connected (not connect))
       (setq erc-server-announced-name
             (buffer-local-value 'erc-server-announced-name old-buffer)))
@@ -2266,6 +2298,12 @@ erc-open
     (setq erc-dbuf
           (when erc-log-p
             (get-buffer-create (concat "*ERC-DEBUG: " server "*"))))
+
+    (erc-determine-parameters server port nick full-name user passwd)
+
+    (save-excursion (run-mode-hooks))
+    (dolist (mod delayed-modules) (funcall mod +1))
+
     ;; set up prompt
     (unless continued-session
       (goto-char (point-max))
@@ -2277,8 +2315,6 @@ erc-open
       (erc-display-prompt)
       (goto-char (point-max)))
 
-    (erc-determine-parameters server port nick full-name user passwd)
-
     ;; Saving log file on exit
     (run-hook-with-args 'erc-connect-pre-hook buffer)
 
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index b2ed29e80e..d3d319ab22 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -975,4 +975,51 @@ erc-message
     (kill-buffer "ExampleNet")
     (kill-buffer "#chan")))
 
+(ert-deftest erc-migrate-modules ()
+  (should (equal (erc-migrate-modules '(autojoin timestamp button))
+                 '(autojoin stamp button)))
+  ;; Default unchanged
+  (should (equal (erc-migrate-modules erc-modules) erc-modules)))
+
+(ert-deftest erc-update-modules ()
+  (let* (calls
+         (erc-modules '(fake-foo fake-bar)))
+    (cl-letf (((symbol-function 'require)
+               (lambda (s &rest _) (push s calls)))
+              ((symbol-function 'erc-fake-foo-mode)
+               (lambda (n) (push (cons 'fake-foo n) calls)))
+              ;; Here, foo is a global module (minor mode)
+              ((get 'erc-fake-foo-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-fake-bar-mode)
+               (lambda (n) (push (cons 'fake-bar n) calls)))
+              ((symbol-function 'erc-autojoin-mode)
+               (lambda (n) (push (cons 'autojoin n) calls)))
+              ((get 'erc-autojoin-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-networks-mode)
+               (lambda (n) (push (cons 'networks n) calls)))
+              ((symbol-function 'erc-completion-mode)
+               (lambda (n) (push (cons 'completion n) calls)))
+              ((get 'erc-completion-mode 'standard-value) #'ignore))
+
+      (ert-info ("Locals")
+        (should (equal (erc-update-modules)
+                       '(erc-fake-bar-mode)))
+        ;; Bar still required
+        (should (equal (nreverse calls) '(erc-fake-foo
+                                          (fake-foo . 1)
+                                          erc-fake-bar)))
+        (setq calls nil))
+
+      (ert-info ("Module name overrides")
+        (setq erc-modules '(completion autojoin networks))
+        (should-not (erc-update-modules)) ; no locals
+        (should (equal (nreverse calls)
+                       '(erc-pcomplete
+                         (completion . 1)
+                         erc-join
+                         (autojoin . 1)
+                         erc-networks
+                         (networks . 1))))
+        (setq calls nil)))))
+
 ;;; erc-tests.el ends here
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #5: 0003-Make-erc-login-generic.patch --]
[-- Type: text/x-patch, Size: 1965 bytes --]

From db17807f146c6d4803efac742d31177279fdc551 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:49:23 -0700
Subject: [PATCH 3/4] Make erc-login generic

* lisp/erc/erc-backend (erc--register-connection): Add new generic
function that's just a wrapper for `erc-login' by default.
(erc-process-sentinel, erc-server-connect): Call
`erc--register-connection' instead of `erc-login'.
---
 lisp/erc/erc-backend.el | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index df9efe4b0c..25c4481d1d 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -532,6 +532,10 @@ erc-open-network-stream
   (let ((p (plist-put parameters :nowait t)))
     (apply #'open-network-stream name buffer host service p)))
 
+(cl-defmethod erc--register-connection ()
+  "Perform opening IRC protocol exchange with server."
+  (erc-login))
+
 (defun erc-server-connect (server port buffer &optional client-certificate)
   "Perform the connection and login using the specified SERVER and PORT.
 We will store server variables in the buffer given by BUFFER.
@@ -580,7 +584,7 @@ erc-server-connect
         ;; waiting for a non-blocking connect - keep the user informed
         (erc-display-message nil nil buffer "Opening connection..\n")
       (message "%s...done" msg)
-      (erc-login)) ))
+      (erc--register-connection))))
 
 (defun erc-server-reconnect ()
   "Reestablish the current IRC connection.
@@ -758,7 +762,7 @@ erc-process-sentinel
                   cproc (process-status cproc) event erc-server-quitting))
         (if (string-match "^open" event)
             ;; newly opened connection (no wait)
-            (erc-login)
+            (erc--register-connection)
           ;; assume event is 'failed
           (erc-with-all-buffers-of-server cproc nil
                                           (setq erc-server-connected nil))
-- 
2.37.2


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #6: 0004-Add-non-IRCv3-SASL-module-to-ERC.patch --]
[-- Type: text/x-patch, Size: 66611 bytes --]

From 1bf236e6f3ffd2097bc4c9cc54ad6a049aa8c1c4 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:37:13 -0700
Subject: [PATCH 4/4] Add non-IRCv3 SASL module to ERC

* lisp/erc/erc-compat.el (erc-compat--sasl-scram-construct-gs2-header,
erc-compat--sasl-scram-client-first-message,
erc-compat--sasl-scram--client-final-message): Add minimal
authorization support via own variant of
`sasl-scram--client-final-message' and supporting sasl-scram-rfc
functions introduced in Emacs 29.

* lisp/erc/erc-sasl.el: New file.
* test/lisp/erc/erc-sasl-tests.el: New file.
* test/lisp/erc/erc-scenarios-sasl.el: New file.
* test/lisp/erc/resources/sasl/plain-failed.eld: New file.
* test/lisp/erc/resources/sasl/plain.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-1.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-256.eld: New file.
* test/lisp/erc/resources/sasl/external.eld: New file.
---
 doc/misc/erc.texi                             | 143 +++++-
 lisp/erc/erc-compat.el                        | 104 +++++
 lisp/erc/erc-sasl.el                          | 418 ++++++++++++++++++
 test/lisp/erc/erc-sasl-tests.el               | 300 +++++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 161 +++++++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  35 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 ++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 ++
 10 files changed, 1303 insertions(+), 1 deletion(-)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

diff --git a/doc/misc/erc.texi b/doc/misc/erc.texi
index 3db83197f9..3b7af0fb1b 100644
--- a/doc/misc/erc.texi
+++ b/doc/misc/erc.texi
@@ -78,6 +78,7 @@ Top
 Advanced Usage
 
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL.
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 
@@ -478,6 +479,10 @@ Modules
 @item ring
 Enable an input history
 
+@cindex modules, sasl
+@item sasl
+Enable SASL authentication
+
 @cindex modules, scrolltobottom
 @item scrolltobottom
 Scroll to the bottom of the buffer
@@ -525,6 +530,7 @@ Advanced Usage
 
 @menu
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 @end menu
@@ -842,6 +848,7 @@ Connecting
 @noindent
 For details, @pxref{Top,,auth-source, auth, Emacs auth-source Library}.
 
+@anchor{ERC auth-source functions}
 @defopt erc-auth-source-server-function
 @end defopt
 @defopt erc-auth-source-services-function
@@ -854,7 +861,8 @@ Connecting
 @code{:user} is the ``desired'' nickname rather than the current one.
 Generalized names, like @code{:user} and @code{:host}, are always used
 over back-end specific ones, like @code{:login} or @code{:machine}.
-ERC expects a string to use as the secret or nil, if the search fails.
+ERC expects a string to use as the secret or @code{nil}, if the search
+fails.
 
 @findex erc-auth-source-search
 The default value for all three options is the function
@@ -915,6 +923,139 @@ Connecting
 make the most sense, but any reasonably printable object is
 acceptable.
 
+@node SASL
+@section Authenticating via SASL
+@cindex SASL
+
+@strong{Warning:} ERC's SASL offering is currently limited by a lack
+of support for proper IRCv3 capability negotiation.  In most cases,
+this shouldn't affect your ability to authenticate.  If you run into
+trouble, please contact us (@pxref{Getting Help and Reporting Bugs}).
+
+Regardless of the mechanism or the network, you'll likely have to be
+registered before first use.  Please refer to the network's own
+instructions for details.  If you're new to IRC and using a bouncer,
+know that you almost certainly won't be needing SASL for the
+@samp{client -> bouncer} connection.
+
+Note that @code{sasl} is a ``local'' ERC module.  This means invoking
+@code{erc-sasl-mode} manually or calling @code{erc-update-modules}
+won't do any good.  Instead, simply add @code{sasl} to
+@code{erc-modules} (or @code{let}-bind it while calling
+@code{erc-tls}), and SASL will be enabled for the current connection.
+But before that, please explore all custom options pertaining to your
+chosen mechanism.
+
+@defopt erc-sasl-mechanism
+The name of an SASL subprotocol type as a @emph{lowercase} symbol.
+
+@var{plain} and @var{scram} (``password-based''):
+
+@indentedblock
+Here, ``password'' refers to your account password, which is usually
+your @samp{NickServ} password.  This often differs from any connection
+(server) password given to @code{erc-tls} via its @code{:password}
+parameter.  To make this work, customize both @code{erc-sasl-user} and
+@code{erc-sasl-password} or bind them when invoking @code{erc-tls}.
+
+When @code{erc-sasl-password} is a string, it's used unconditionally.
+When it's a non-@code{nil} symbol, like @samp{Libera.Chat}, it's used
+as the @code{:host} param in an auth-source query.  When it's
+@code{nil} and a session ID is on file, the ID is used instead for the
+@code{:host} param (@pxref{Network Identifier}).  The value of
+@code{erc-sasl-user} is always specified for the @code{:user}
+(@code{:login}) param.
+
+If a password can't be determined, a non-@code{nil} server
+(connection) password will be tried.  (This may change, however, so
+please don't rely on it.)
+@end indentedblock
+
+@var{external} (via Client TLS Certificate):
+
+@indentedblock
+You'll want to specify the @code{:client-certificate} param when
+opening a new connection, which is typically done by calling
+@code{emacs-tls}.  But before that, ensure you've registered your
+fingerprint with the network.  The fingerprint is usually a SHA1 or
+SHA256 digest in either "normalized" or "openssl" forms.  The first is
+lowercase without delims (@samp{deadbeef}) and the second uppercase
+with colon seps (@samp{DE:AD:BE:EF}).
+
+Additional considerations:
+@enumerate
+@item
+There's no reason to send your password after registering.
+@item
+Most IRCds will allow you to authenticate with a client cert but
+without the hassle of SASL (meaning you may not need this module).
+@item
+Technically, @var{EXTERNAL} merely indicates that an out-of-band mode
+of authentication is in effect (being deferred to), so depending on
+the specific application or service, there's an off chance client
+certs aren't involved.
+@end enumerate
+@end indentedblock
+
+@var{ecdsa-nist256p-challenge}:
+
+@indentedblock
+This mechanism is quite complicated and currently requires the
+presence of the external @samp{openssl} command-line utility, so
+please use something else if at all possible.  Ignoring that, specify
+your key file (e.g., @samp{~/pki/mykey.pem}) as the value of
+@code{erc-sasl-password}, and then configure your network settings.
+On servers running Atheme services, you can add your public key with
+@samp{NickServ} like so:
+
+@example
+ERC> /msg NickServ set property \
+     pubkey AgGZmlYTUjJlea/BVz7yrjJ6gysiAPaQxzeUzTH4hd5j
+
+@end example
+(You may be able to omit the @samp{property} subcommand.)
+@end indentedblock
+
+@end defopt
+
+@defopt erc-sasl-user
+Your network account name, typically the same one registered with
+nickname services.  Specify this when your @samp{NickServ} account
+name differs from the nick you're connecting with.
+@end defopt
+
+@defopt erc-sasl-password
+Optional account password to send when authenticating.
+
+If you specify a string, it'll be considered authoritative and
+accepted at face value.  If you instead give a non-@code{nil} symbol,
+it'll be passed as the value of the @code{:host} field in an
+auth-source query, provided @code{erc-sasl-auth-source-function} is
+set to a function.  If you set this to @code{nil}, a non-@code{nil}
+``session password'' will be tried, likely whatever you gave as the
+@var{password} argument to @code{erc-tls}.  As a last resort, you'll
+be prompted for input.
+
+Note that when @code{erc-sasl-mechanism} is set to
+@code{ecdsa-nist256p-challenge}, this option should hold the file name
+of your key, which is typically in PEM format.
+@end defopt
+
+@defopt erc-sasl-auth-source-function
+This is nearly identical to the other ERC @samp{auth-source} function
+options (@pxref{ERC auth-source functions}) except that the default
+value here is @code{nil}, meaning you have to set it to something like
+@code{erc-auth-source-search} for queries to be performed.
+@end defopt
+
+@defopt erc-sasl-authzid
+In the rarest of circumstances, a network may want you to specify a
+specific role or assume an alternate identity.  In most cases, this
+happens because the server is buggy or misconfigured.  If you suspect
+such a thing, please contact your network operator.  Otherwise, just
+leave this set to @code{nil}.
+@end defopt
+
 
 @node Sample Configuration
 @section Sample Configuration
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 8a00e711ac..3123f64b88 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -156,6 +156,110 @@ erc-subseq
 		 (setq i (1+ i) start (1+ start)))
 	       res))))))
 
+
+;;;; SASL
+
+(declare-function sasl-step-data "sasl" (step))
+(declare-function sasl-error "sasl" (datum))
+(declare-function sasl-client-property "sasl" (client property))
+(declare-function sasl-client-set-property "sasl" (client property value))
+(declare-function sasl-mechanism-name "sasl" (mechanism))
+(declare-function sasl-client-name "sasl" (client))
+(declare-function sasl-client-mechanism "sasl" (client))
+(declare-function sasl-read-passphrase "sasl" (prompt))
+(declare-function sasl-unique-id "sasl" nil)
+(declare-function decode-hex-string "hex-util" (string))
+(declare-function rfc2104-hash "rfc2104" (hash block-length hash-length
+                                               key text))
+(declare-function sasl-scram--client-first-message-bare "sasl-scram-rfc"
+                  (client))
+(declare-function cl-mapcar "cl-lib" (cl-func cl-x &rest cl-rest))
+
+(defun erc-compat--sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
+(defun erc-compat--sasl-scram-client-first-message (client _step)
+  (let ((c-nonce (sasl-unique-id)))
+    (sasl-client-set-property client 'c-nonce c-nonce))
+  (concat (erc-compat--sasl-scram-construct-gs2-header client)
+          (sasl-scram--client-first-message-bare client)))
+
+;; This is `sasl-scram--client-final-message' from sasl-scram-rfc,
+;; with the NO-LINE-BREAK argument of `base64-encode-string' set to t
+;; because https://www.rfc-editor.org/rfc/rfc5802#section-2.1 says:
+;;
+;;  > The use of base64 in SCRAM is restricted to the canonical form
+;;  > with no whitespace.
+;;
+;; Unfortunately, advising `base64-encode-string' won't work
+;; because the byte compiler precomputes the result when all inputs
+;; are constants, as they are in the unpatched version.
+;;
+;; The only other substantial change is the addition of authz support.
+;; This can be dropped if adopted by Emacs 29 and `compat'.  Changes
+;; proposed for 29 are marked with a "; *n", comment below.  See older
+;; versions of lisp/erc/erc-v3-sasl.el (bug#49860) if needing a true
+;; side-by-side diff.  This also inlines the internal function
+;; `sasl-scram--client-first-message-bare' and takes various liberties
+;; with formatting.
+
+(defun erc-compat--sasl-scram--client-final-message
+    (hash-fun block-length hash-length client step)
+  (unless (string-match
+           "^r=\\([^,]+\\),s=\\([^,]+\\),i=\\([0-9]+\\)\\(?:$\\|,\\)"
+           (sasl-step-data step))
+    (sasl-error "Unexpected server response"))
+  (let* ((hmac-fun
+          (lambda (text key)
+            (decode-hex-string
+             (rfc2104-hash hash-fun block-length hash-length key text))))
+         (step-data (sasl-step-data step))
+         (nonce (match-string 1 step-data))
+         (salt-base64 (match-string 2 step-data))
+         (iteration-count (string-to-number (match-string 3 step-data)))
+         (c-nonce (sasl-client-property client 'c-nonce))
+         (cbind-input
+          (if (string-prefix-p c-nonce nonce)
+              (erc-compat--sasl-scram-construct-gs2-header client) ; *1
+            (sasl-error "Invalid nonce from server")))
+         (client-final-message-without-proof
+          (concat "c=" (base64-encode-string cbind-input t) "," ; *2
+                  "r=" nonce))
+         (password
+          (sasl-read-passphrase
+           (format "%s passphrase for %s: "
+                   (sasl-mechanism-name (sasl-client-mechanism client))
+                   (sasl-client-name client))))
+         (salt (base64-decode-string salt-base64))
+         (string-xor (lambda (a b)
+                       (apply #'unibyte-string (cl-mapcar #'logxor a b))))
+         (salted-password (let ((digest (concat salt (string 0 0 0 1)))
+                                (xored nil))
+                            (dotimes (_i iteration-count xored)
+                              (setq digest (funcall hmac-fun digest password))
+                              (setq xored (if (null xored)
+                                              digest
+                                            (funcall string-xor xored
+                                                     digest))))))
+         (client-key (funcall hmac-fun "Client Key" salted-password))
+         (stored-key (decode-hex-string (funcall hash-fun client-key)))
+         (auth-message (concat "n=" (sasl-client-name client)
+                               ",r=" c-nonce "," step-data
+                               "," client-final-message-without-proof))
+         (client-signature (funcall hmac-fun
+                                    (encode-coding-string auth-message 'utf-8)
+                                    stored-key))
+         (client-proof (funcall string-xor client-key client-signature))
+         (client-final-message
+          (concat client-final-message-without-proof ","
+                  "p=" (base64-encode-string client-proof t)))) ; *3
+    (sasl-client-set-property client 'auth-message auth-message)
+    (sasl-client-set-property client 'salted-password salted-password)
+    client-final-message))
+
 (provide 'erc-compat)
 
 ;;; erc-compat.el ends here
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
new file mode 100644
index 0000000000..d237ab73a8
--- /dev/null
+++ b/lisp/erc/erc-sasl.el
@@ -0,0 +1,418 @@
+;;; erc-sasl.el --- SASL for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published
+;; by the Free Software Foundation, either version 3 of the License,
+;; or (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;; WARNING: this is a (non-IRCv3) implementation of SASL.  Please see
+;; bug#49860, which adds full 3.2 capability negotiation.
+;;
+;; Various ERC implementations of the PLAIN mechanism have surfaced
+;; over the years, the first possibly being:
+;;
+;; https://lists.gnu.org/archive/html/erc-discuss/2012-02/msg00001.html
+;;
+;; This module would not exist without this and other pioneering
+;; efforts.
+;;
+;; TODO:
+;;
+;; - Find a way to obfuscate the password in memory (via something
+;; - like `auth-source--obfuscate'); it's currently visible in
+;; - backtraces.
+;;
+;; - Implement pseudo PASSWORD mechanism that chooses the strongest
+;;   available mechanism for you.
+
+;;; Code:
+(require 'erc-backend)
+(require 'rx)
+(require 'sasl)
+(require 'sasl-scram-rfc)
+(require 'sasl-scram-sha256 nil t)
+
+(defgroup erc-sasl nil
+  "SASL for ERC."
+  :group 'erc
+  :package-version '(ERC . "5.4")) ; FIXME increment on next release
+
+(defcustom erc-sasl-mechanism nil
+  "SASL mechanism to connect with.
+Note that any value other than nil or `external' likely requires
+`erc-sasl-user' and `erc-sasl-password'."
+  :type '(choice (const nil)
+                 (const plain)
+                 (const external)
+                 (const scram-sha-1)
+                 (const scram-sha-256)
+                 (const scram-sha-512)
+                 (const ecdsa-nist256p-challenge)))
+
+(defcustom erc-sasl-user nil
+  "Optional account username to send when authenticating.
+This is also referred to as the authentication identity, or
+\"authcid\".  When nil, applicable mechanisms will use the
+session's current nick."
+  :type '(choice string (const nil)))
+
+(defcustom erc-sasl-password nil
+  "Optional account password to send when authenticating.
+When the value is a string, it's used unconditionally.  As a
+special case, when the value is a non-nil symbol, it's used as
+the value of the `:host' field in an auth-source query, provided
+`erc-sasl-auth-source-function' is set to a function.  When
+nil, a non-nil \"session password\" will be tried, likely one
+given as the `:password' argument to `erc-tls'.  As a last
+resort, the user will be prompted for input.
+
+Note that when `erc-sasl-mechanism' is set to
+`ecdsa-nist256p-challenge', this option should hold the file name
+of the key, which is typically in PEM format."
+  :type '(choice (const nil) string symbol))
+
+(defcustom erc-sasl-auth-source-function nil
+  "Function to query auth-source for an SASL password.
+Called with keyword params known to `auth-source-search', which
+may include a non-nil `erc-sasl-user' for the `:user' field
+and a non-nil `erc-sasl-password' for the `:host' field, when
+the latter option is a symbol instead of a string.  In return,
+ERC expects a string to send as the SASL password, or nil, to
+move on to the next approach, as described in the doc string for
+the option `erc-sasl-password'.  See info node `(erc)
+Connecting' for details on ERC's auth-source integration."
+  :type '(choice (const erc-auth-source-search)
+                 (const nil)
+                 function))
+
+(defcustom erc-sasl-authzid nil
+  "SASL authorization identity.
+Generally unneeded for normal use.  Some test frameworks and
+aberrant servers may want this to match `erc-sasl-user'."
+  :type '(choice (const nil) string))
+
+
+;; Analogous to what erc-backend does to persist opening params.
+(defvar-local erc-sasl--options nil)
+
+;; Session-local (server buffer) SASL subproto state
+(defvar-local erc-sasl--state nil)
+
+(cl-defstruct erc-sasl--state
+  "Holder for client object and subproto state."
+  (client nil :type vector)
+  (step nil :type vector)
+  (pending nil :type string))
+
+(defun erc-sasl--read-password (prompt)
+  "Return configured option or server password.
+PROMPT is passed to `read-passwd' if necessary."
+  ;; Copying prevent `sasl-plain-response' from clobbering
+  (if-let
+      ((found
+        (or (and-let* ((pass (alist-get 'password erc-sasl--options))
+                       ((stringp pass))
+                       (pass)))
+            (and erc-sasl-auth-source-function
+                 (let ((user (alist-get 'user erc-sasl--options))
+                       (host (alist-get 'password erc-sasl--options)))
+                   (apply erc-sasl-auth-source-function
+                          `(,@(and user (list :user user))
+                            ,@(and host (list :host (symbol-name host)))))))
+            erc-session-password)))
+      (copy-sequence found)
+    (read-passwd prompt)))
+
+(defun erc-sasl--plain-response (client steps)
+  "Call `sasl-plain-response' with CLIENT and STEPS."
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (sasl-plain-response client steps)))
+
+(declare-function erc-compat--sasl-scram--client-final-message "erc-compat"
+                  (hash-fun block-length hash-length client step))
+
+(defun erc-sasl--scram-sha-hack-client-final-message (&rest args)
+  "Call `sasl-scram--client-final-message' with args.
+Pass HASH-FUN, BLOCK-LENGTH, HASH-LENGTH, CLIENT, and STEP
+directly upstream."
+  ;; In the future (29+), we'll hopefully be able to call
+  ;; `sasl-scram--client-final-message' directly
+  (require 'erc-compat)
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (apply #'erc-compat--sasl-scram--client-final-message args)))
+
+(defun erc-sasl--scram-sha-1-client-final-message (client step)
+  "Prepare CLIENT's final message with STEP."
+  (erc-sasl--scram-sha-hack-client-final-message 'sha1 64 20 client step))
+
+(defun erc-sasl--scram-sha-256-client-final-message (client step)
+  "Prepare CLIENT's final message with STEP."
+  (erc-sasl--scram-sha-hack-client-final-message 'sasl-scram-sha256 64 32
+                                                    client step))
+
+(defun erc-sasl--scram-sha512 (object &optional start end binary)
+  "Pass OBJECT, START, END, and BINARY to `secure-hash'."
+  (secure-hash 'sha512 object start end binary))
+
+(defun erc-sasl--scram-sha-512-client-final-message (client step)
+  "Prepare CLIENT's final message with STEP."
+  (erc-sasl--scram-sha-hack-client-final-message
+   #'erc-sasl--scram-sha512 128 64 client step))
+
+(defun erc-sasl--scram-sha-512-authenticate-server (client step)
+  "Call `sasl-scram--authenticate-server' with CLIENT and STEP."
+  (sasl-scram--authenticate-server
+   #'erc-sasl--scram-sha512 128 64 client step))
+
+(defun erc-sasl--ecdsa-first (client _step)
+  "Return CLIENT name."
+  (sasl-client-name client))
+
+;; FIXME do this with gnutls somehow
+(defun erc-sasl--ecdsa-sign (client step)
+  "Return signed challenge for CLIENT and STEP."
+  (let ((challenge (sasl-step-data step)))
+    (with-temp-buffer
+      (set-buffer-multibyte nil)
+      (insert challenge)
+      (call-process-region (point-min) (point-max)
+                           "openssl" 'delete t nil "pkeyutl" "-inkey"
+                           (sasl-client-property client 'ecdsa-keyfile)
+                           "-sign")
+      (buffer-string))))
+
+;; This API may seem roundabout, but the "template method" here is
+;; one that we provide, namely `erc-sasl--authenticate-handler'.
+
+(pcase-dolist
+    (`(,name . ,steps)
+     '(("PLAIN"
+        erc-sasl--plain-response)
+       ("EXTERNAL"
+        ignore)
+       ("SCRAM-SHA-1"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-1-client-final-message
+        sasl-scram-sha-1-authenticate-server)
+       ("SCRAM-SHA-256"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-256-client-final-message
+        sasl-scram-sha-256-authenticate-server)
+       ("SCRAM-SHA-512"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-512-client-final-message
+        erc-sasl--scram-sha-512-authenticate-server)
+       ("ECDSA-NIST256P-CHALLENGE"
+        erc-sasl--ecdsa-first
+        erc-sasl--ecdsa-sign)))
+  (let ((feature (intern (concat "erc-sasl-" (downcase name)))))
+    (put feature 'sasl-mechanism (sasl-make-mechanism name steps))
+    (provide feature)))
+
+(cl-defgeneric erc-sasl--create-client (mechanism)
+  "Create and return a new SASL client object for MECHANISM."
+  (let ((sasl-mechanism-alist (copy-sequence sasl-mechanism-alist))
+        (sasl-mechanisms sasl-mechanisms)
+        (name (upcase (symbol-name mechanism)))
+        (feature (intern (concat "erc-sasl-" (symbol-name mechanism))))
+        client)
+    (setf (alist-get name sasl-mechanism-alist nil nil #'equal) `(,feature))
+    (cl-pushnew name sasl-mechanisms :test #'equal)
+    (setq client (sasl-make-client (sasl-find-mechanism `(,name))
+                                   (or (alist-get 'user erc-sasl--options)
+                                       (erc-downcase (erc-current-nick)))
+                                   "N/A" "N/A"))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+;; Oragono doesn't like when authzid (if present) does not match
+;; the authcid.  TODO see if this still true.
+
+(cl-defmethod erc-sasl--create-client ((_m (eql plain)))
+  "Create and return new SASL PLAIN client object.
+See message breakdown at
+https://tools.ietf.org/html/rfc4616#section-2."
+  (let* ((sans (remq (assoc "PLAIN" sasl-mechanism-alist)
+                     sasl-mechanism-alist))
+         (sasl-mechanism-alist (cons '("PLAIN" erc-sasl-plain) sans))
+         (authc (or (alist-get 'user erc-sasl--options)
+                    (erc-downcase (erc-current-nick))))
+         (port (if (numberp erc-session-port)
+                   (number-to-string erc-session-port)
+                 "0"))
+         ;; In most cases, `erc-server-announced-name' won't be known.
+         (host (or erc-server-announced-name erc-session-server))
+         (mech (sasl-find-mechanism '("PLAIN")))
+         (client (sasl-make-client mech authc port host)))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-256)))
+  "Create a SCRAM-SHA-256 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-512)))
+  "Create a SCRAM-SHA-512 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((_ (eql ecdsa-nist256p-challenge)))
+  "Create a ECDSA-NIST256P-CHALLENGE client."
+  (unless (executable-find "openssl")
+    (user-error "Could not find openssl command-line utility"))
+  (let ((keyfile (cdr (assq 'password erc-sasl--options))))
+    (unless (and keyfile (file-exists-p keyfile))
+      (user-error "`erc-sasl-password' does not point to ECDSA keyfile"))
+    (let ((client (cl-call-next-method)))
+      (sasl-client-set-property client 'ecdsa-keyfile keyfile)
+      client)))
+
+(defun erc-sasl--init ()
+  (setq erc-sasl--state (make-erc-sasl--state)
+        erc-sasl--options `((user . ,erc-sasl-user)
+                            (password . ,erc-sasl-password)
+                            (mechanism . ,erc-sasl-mechanism)
+                            (authzid . ,erc-sasl-authzid))))
+
+(defun erc-sasl--mechanism-offered-p (offered)
+  "Non-nil when mechanism OFFERED by server."
+  (string-match-p (rx-to-string
+                   `(: (| bot ",")
+                       ,(symbol-name
+                         (alist-get 'mechanism erc-sasl--options))
+                       (| eot ",")))
+                  (downcase offered)))
+
+(defun erc-sasl--authenticate-handler (_proc parsed)
+  "Handle PARSED `erc-response' from server.
+Maybe transition to next state."
+  (if-let* ((response (car (erc-response.command-args parsed)))
+            ((= 400 (length response))))
+      (cl-callf (lambda (s) (concat s response))
+          (erc-sasl--state-pending erc-sasl--state))
+    (cl-assert response t)
+    (when (string= "+" response)
+      (setq response ""))
+    (setf response (base64-decode-string
+                    (concat (erc-sasl--state-pending erc-sasl--state) response))
+          (erc-sasl--state-pending erc-sasl--state) nil)
+    ;; The server is done sending, so our turn
+    (let ((client (erc-sasl--state-client erc-sasl--state))
+          (step (erc-sasl--state-step erc-sasl--state))
+          data)
+      (when step
+        (sasl-step-set-data step response))
+      (setq step (setf (erc-sasl--state-step erc-sasl--state)
+                       (sasl-next-step client step))
+            data (sasl-step-data step))
+      (when (string= data "")
+        (setq data nil))
+      (when data
+        (setq data (base64-encode-string data t)))
+      ;; No need for : because no spaces (right?)
+      (erc-server-send (concat "AUTHENTICATE " (or data "+"))))))
+
+(erc-define-catalog
+ 'english
+ '((s902 . "ERR_NICKLOCKED nick %n unavailable: %s")
+   (s904 . "ERR_SASLFAIL (authentication failed) %s")
+   (s905 . "ERR SASLTOOLONG (credentials too long) %s")
+   (s906 . "ERR_SASLABORTED (authentication aborted) %s")
+   (s907 . "ERR_SASLALREADY (already authenticated) %s")
+   (s908 . "RPL_SASLMECHS (unsupported mechanism %m) %s")))
+
+(define-erc-module sasl nil
+  "Non-IRCv3 (dumb) SASL support for ERC.
+Needless to say, this doesn't solicit or validate a suite of
+supported mechanisms.  See bug#49860 for a full, CAP 3.2-aware
+implementation, currently a WIP as of ERC 5.5."
+  ((unless erc--target
+     (add-hook 'erc-server-AUTHENTICATE-functions
+               #'erc-sasl--authenticate-handler 0 t)
+     (erc-sasl--init)
+     (let* ((mech (alist-get 'mechanism erc-sasl--options))
+            (client (erc-sasl--create-client mech)))
+       (unless client
+         (erc-display-error-notice nil (format "Unknown mechanism: %s" mech))
+         (erc-error "Unknown mechanism: %s" mech))
+       (setf (erc-sasl--state-client erc-sasl--state) client))))
+  ((remove-hook 'erc-server-AUTHENTICATE-functions
+                #'erc-sasl--authenticate-handler t)
+   (kill-local-variable 'erc-sasl--options))
+  'local)
+
+;; FIXME use generic mechanism instead of hooks after bug#49860.
+(define-erc-response-handler (AUTHENTICATE)
+  "Maybe authenticate to server." nil)
+
+(defun erc-sasl--destroy (proc)
+  (run-hook-with-args 'erc-quit-hook proc)
+  (delete-process proc)
+  (erc-error "Disconnected from %s; please review SASL settings" proc))
+
+(define-erc-response-handler (902)
+  "Handle a ERR_NICKLOCKED response." nil
+  (erc-display-message parsed '(notice error) 'active 's902
+                       ?n (car (erc-response.command-args parsed))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(define-erc-response-handler (903)
+  "Handle a RPL_SASLSUCCESS response." nil
+  (when erc-sasl-mode
+    (unless erc-server-connected
+      (erc-server-send "CAP END")))
+  (erc-handle-unknown-server-response proc parsed))
+
+(define-erc-response-handler (907)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's907
+                       ?s (erc-response.contents parsed)))
+
+(define-erc-response-handler (904 905 906)
+  "Handle various SASL-related error responses." nil
+  (erc-display-message parsed '(notice error) 'active
+                       (intern (format "s%s" (erc-response.command parsed)))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(define-erc-response-handler (908)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's908
+                       '?m (alist-get 'mechanism erc-sasl--options)
+                       '?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(cl-defmethod erc--register-connection (&context (erc-sasl-mode (eql t)))
+  "Send speculative/pipelined CAP and AUTHENTICATE and hope for the best."
+  (erc-server-send "CAP REQ :sasl")
+  (erc-login)
+  (let* ((c (erc-sasl--state-client erc-sasl--state))
+         (m (sasl-mechanism-name (sasl-client-mechanism c))))
+    (erc-server-send (format "AUTHENTICATE %s" m))))
+
+(provide 'erc-sasl)
+;;; erc-sasl.el ends here
+;;
+;; Local Variables:
+;; generated-autoload-file: "erc-loaddefs.el"
+;; End:
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
new file mode 100644
index 0000000000..c54acc4d28
--- /dev/null
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -0,0 +1,300 @@
+;;; erc-sasl-tests.el --- Tests for erc-sasl.  -*- lexical-binding:t -*-
+
+;; Copyright (C) 2020-2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation, either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;;; Code:
+
+(require 'ert-x)
+(require 'erc-sasl)
+
+(ert-deftest erc-sasl--mechanism-offered-p ()
+  (let ((erc-sasl--options '((mechanism . external))))
+    (should (erc-sasl--mechanism-offered-p "foo,external"))
+    (should (erc-sasl--mechanism-offered-p "external,bar"))
+    (should (erc-sasl--mechanism-offered-p "foo,external,bar"))
+    (should-not (erc-sasl--mechanism-offered-p "fooexternal"))
+    (should-not (erc-sasl--mechanism-offered-p "externalbar"))))
+
+(ert-deftest erc-sasl--read-password ()
+  (ert-info ("Explicit erc-sasl-password")
+    (let ((erc-sasl--options '((password . "foo"))))
+      (should (string= (erc-sasl--read-password nil) "foo"))))
+
+  (ert-info ("Fallback to erc-session-password")
+    (let ((erc-session-password "bar")
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar")))
+    (let ((erc-session-password "bar")
+          (erc-sasl--options '((user . "tester") (password)))
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar"))))
+
+  (let* ((entries (list
+                   "machine GNU/chat port 6697 user bob password spam"
+                   "machine FSF.chat port 6697 user bob password sesame"
+                   "machine MyHost port irc password 123"))
+         (netrc-file (make-temp-file "auth-source-test" nil nil
+                                     (mapconcat 'identity entries "\n")))
+         (auth-sources (list netrc-file))
+         (erc-session-server "irc.gnu.org")
+         (erc-session-port 6697)
+         ;;
+         (erc-sasl-auth-source-function #'erc-auth-source-search)
+         erc-server-announced-name ; too early
+         auth-source-do-cache)
+
+    (unwind-protect
+        (ert-info ("Auth source")
+
+          (ert-info ("Symbol as password specifies machine")
+            (let ((erc-sasl--options '((user . "bob")
+                                       (password . FSF.chat)))
+                  (erc-networks--id (make-erc-networks--id)))
+              (should (string= (erc-sasl--read-password nil) "sesame"))))
+
+          (ert-info ("Use session ID when password empty")
+            (let ((erc-sasl--options '((user . "bob") (password)))
+                  (erc-networks--id (erc-networks--id-create 'GNU/chat)))
+              (should (string= (erc-sasl--read-password nil) "spam")))))
+
+      (delete-file netrc-file))
+
+    (ert-info ("Prompt when search fails and server password null")
+      (let ((erc-sasl-auth-source-function #'ignore))
+        (should (string= (ert-simulate-keys "baz\r"
+                           (erc-sasl--read-password "pwd:"))
+                         "baz"))))))
+
+(ert-deftest erc-sasl-create-client--plain ()
+  (let* ((erc-session-password "password123")
+         (erc-server-current-nick "tester")
+         (erc-session-port 1667)
+         (erc-session-server "localhost")
+         (client (erc-sasl--create-client 'plain))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [erc-sasl--plain-response
+                                 "\0tester\0password123"])
+                   (format "%S" result)))
+    (should (string= (sasl-step-data result) "\0tester\0password123"))
+    (should-not (sasl-next-step client result)))
+  (should (equal (assoc-default "PLAIN" sasl-mechanism-alist) '(sasl-plain))))
+
+(ert-deftest erc-sasl-create-client--external ()
+  (let* ((erc-server-current-nick "tester")
+         (client (erc-sasl--create-client 'external))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [ignore nil]) (format "%S" result)))
+    (should-not (sasl-step-data result))
+    (should-not (sasl-next-step client result)))
+  (should-not (member "EXTERNAL" sasl-mechanisms))
+  (should-not (assoc-default "EXTERNAL" sasl-mechanism-alist)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-1 ()
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-1))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                          "s=5mJO6d4rjCnsBU1X,"
+                          "i=4096"))
+            (req (concat "c=bixhPWppbGxlcyw=,"
+                         "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                         "p=OVUhgPu8wEm2cDoVLfaHzVUYPWU=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-1-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=ZWR23c9MJir0ZgfGf5jEtLOn6Ng="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256 ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                   "s=MTk2M2VkMzM5ZmU0NDRiYmI0MzIyOGVhN2YwNzYwNmI=,"
+                   "i=4096"))
+            (req (concat
+                  "c=bixhPWppbGxlcyw=,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                  "p=1vDesVBzJmv0lX0Ae1kHFtdVHkC6j4gISKVqaR45HFg=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=gUePTYSZN9xgcE06KSyKO9fUmSwH26qifoapXyEs75s="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                   "s=ZTg1MmE1YmFhZGI1NDcyMjk3NzYwZmRjZDM3Y2I1OTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                  "p=LP4sjJrjJKp5qTsARyZCppXpKLu4FMM284hNESPvGhI=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=847WXfnmReGyE1qlq1And6R4bPBNROTZ7EMS/QrJtUM="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-512--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha512"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-512))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                   "s=YzMzOWZiY2U0YzcwNDA0M2I4ZGE2M2ZjOTBjODExZTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                  "p=vMBb9tKxFAfBtel087/GLbo4objAIYr1wM+mFv/jYLKXE"
+                  "NUF0vynm81qQbywQE5ScqFFdAfwYMZq/lj4s0V1OA==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format
+                        "%S" `[erc-sasl--scram-sha-512-client-final-message
+                               ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp (concat "v=Va7NIvt8wCdhvxnv+bZriSxGoto6On5EVnRHO/ece8zs0"
+                          "qpQassdqir1Zlwh3e3EmBq+kcSy+ClNCsbzBpXe/w==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(defconst erc-sasl-tests-ecdsa-key-file "
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIIJueQ3W2IrGbe9wKdOI75yGS7PYZSj6W4tg854hlsvmoAoGCCqGSM49
+AwEHoUQDQgAEAZmaVhNSMmV5r8FXPvKuMnqDKyIA9pDHN5TNMfiF3mMeikGgK10W
+IRX9cyi2wdYg9mUUYyh9GKdBCYHGUJAiCA==
+-----END EC PRIVATE KEY-----
+")
+
+(ert-deftest erc-sasl-create-client-ecdsa ()
+  (unless (executable-find "openssl")
+    (ert-skip "System lacks openssl"))
+  (ert-with-temp-file keyfile
+    :prefix "ecdsa_key"
+    :suffix ".pem"
+    :text erc-sasl-tests-ecdsa-key-file
+    (let* ((erc-server-current-nick "jilles")
+           (erc-sasl--options `((password . ,keyfile)))
+           (client (erc-sasl--create-client 'ecdsa-nist256p-challenge))
+           (step (sasl-next-step client nil)))
+      (ert-info ("Client's initial request")
+        (should (equal (format "%S" [erc-sasl--ecdsa-first "jilles"])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) "jilles")))
+      (ert-info ("Server's initial response")
+        (let ((resp (concat "\0\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20"
+                            "\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37")))
+          (sasl-step-set-data step resp)
+          (setq step (sasl-next-step client step))
+          ;; FIXME this is dumb
+          (should (<= 68 (length (sasl-step-data step)) 72))))
+      (should-not (sasl-next-step client step)))))
+
+;;; erc-sasl-tests.el ends here
diff --git a/test/lisp/erc/erc-scenarios-sasl.el b/test/lisp/erc/erc-scenarios-sasl.el
new file mode 100644
index 0000000000..3ff7cc805d
--- /dev/null
+++ b/test/lisp/erc/erc-scenarios-sasl.el
@@ -0,0 +1,161 @@
+;;; erc-scenarios-sasl.el --- SASL tests for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; This program is free software: you can redistribute it and/or
+;; modify it under the terms of the GNU General Public License as
+;; published by the Free Software Foundation, either version 3 of the
+;; License, or (at your option) any later version.
+;;
+;; This program is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program.  If not, see
+;; <https://www.gnu.org/licenses/>.
+
+;;; Code:
+
+(require 'ert-x)
+(eval-and-compile
+  (let ((load-path (cons (ert-resource-directory) load-path)))
+    (require 'erc-scenarios-common)))
+
+(declare-function sasl-client-name "sasl" (client))
+
+(require 'erc-scenarios-common)
+(require 'erc-sasl)
+
+(ert-deftest erc-scenarios-sasl--plain ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'plain)
+       (erc-sasl-password "password123")
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "This server is in debug mode")
+        ;; Regression "\0\0\0\0 ..." caused by (fillarray passphrase 0)
+        (should (string= erc-sasl-password "password123"))))))
+
+(ert-deftest erc-scenarios-sasl--external ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'external))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'external)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "903 * Authentication successful")
+        (funcall expect 10 "This server is in debug mode")))))
+
+(ert-deftest erc-scenarios-sasl--plain-fail ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain-failed))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "wrong")
+       (erc-sasl-mechanism 'plain)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter))
+       (buf nil))
+
+    (ert-info ("Connect")
+      (setq buf (erc :server "127.0.0.1"
+                     :port port
+                     :nick "tester"
+                     :user "tester"
+                     :full-name "tester"))
+      (let ((err (should-error
+                  (with-current-buffer buf
+                    (funcall expect 20 "Connection failed!")))))
+        (should (string-search "please review" (cadr err)))
+        (with-current-buffer buf
+          (funcall expect 10 "Opening connection")
+          (funcall expect 20 "SASL authentication failed")
+          (should-not (erc-server-process-alive)))))))
+
+(defun erc-scenarios--common--sasl (mech)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t mech))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "sesame")
+       (erc-sasl-mechanism mech)
+       (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+       (sasl-unique-id-function (lambda () (pop mock-rvs)))
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "jilles"
+                                :full-name "jilles")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "jaguar"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "jaguar"
+        (funcall expect 10 "Found your hostname")
+        (funcall expect 20 "marked as being away")))))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-1 ()
+  :tags '(:expensive-test)
+  (let ((erc-sasl-authzid "jilles"))
+    (erc-scenarios--common--sasl 'scram-sha-1)))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-256 ()
+  :tags '(:expensive-test)
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (erc-scenarios--common--sasl 'scram-sha-256))
+
+;;; erc-scenarios-sasl.el ends here
diff --git a/test/lisp/erc/resources/sasl/external.eld b/test/lisp/erc/resources/sasl/external.eld
new file mode 100644
index 0000000000..2cd237ec4d
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/external.eld
@@ -0,0 +1,33 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester"))
+
+((auth-req 3.2 "AUTHENTICATE EXTERNAL")
+ (0.0 ":irc.example.org CAP * ACK :sasl")
+ (0.0 "AUTHENTICATE +"))
+
+((auth-noop 3.2 "AUTHENTICATE +")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/plain-failed.eld b/test/lisp/erc/resources/sasl/plain-failed.eld
new file mode 100644
index 0000000000..336700290c
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain-failed.eld
@@ -0,0 +1,16 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.foonet.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.foonet.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.foonet.org CAP * ACK :cap-notify sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.foonet.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgB3cm9uZw==")
+ (0.0 ":irc.foonet.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.foonet.org 904 * :SASL authentication failed: Invalid account credentials"))
+
+((cap-end 3.2 "CAP END"))
diff --git a/test/lisp/erc/resources/sasl/plain.eld b/test/lisp/erc/resources/sasl/plain.eld
new file mode 100644
index 0000000000..9c6ce3feeb
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain.eld
@@ -0,0 +1,35 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.example.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.example.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.example.org CAP * ACK :sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.example.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgBwYXNzd29yZDEyMw==")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-1.eld b/test/lisp/erc/resources/sasl/scram-sha-1.eld
new file mode 100644
index 0000000000..49980e9e12
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-1.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-1")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE bixhPWppbGxlcyxuPWppbGxlcyxyPWM1UnFMQ1p5MEw0ZkdrS0FaMGh1akZCcw==")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNYUW9LY2l2cUN3OWlEWlBTcGIscz01bUpPNmQ0cmpDbnNCVTFYLGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXhoUFdwcGJHeGxjeXc9LHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzWFFvS2NpdnFDdzlpRFpQU3BiLHA9T1ZVaGdQdTh3RW0yY0RvVkxmYUh6VlVZUFdVPQ==")
+ (0 "AUTHENTICATE dj1aV1IyM2M5TUppcjBaZ2ZHZjVqRXRMT242Tmc9"))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-256.eld b/test/lisp/erc/resources/sasl/scram-sha-256.eld
new file mode 100644
index 0000000000..74de9a23ec
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-256.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-256")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE biwsbj1qaWxsZXMscj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnM=")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNkNDA2N2YwYWZkYjU0YzNkYmQ0ZmU2NDViODRjYWUzNyxzPVpUZzFNbUUxWW1GaFpHSTFORGN5TWprM056WXdabVJqWkRNM1kySTFPVE09LGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXdzLHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzZDQwNjdmMGFmZGI1NGMzZGJkNGZlNjQ1Yjg0Y2FlMzcscD1MUDRzakpyakpLcDVxVHNBUnlaQ3BwWHBLTHU0Rk1NMjg0aE5FU1B2R2hJPQ==")
+ (0 "AUTHENTICATE dj04NDdXWGZubVJlR3lFMXFscTFBbmQ2UjRiUEJOUk9UWjdFTVMvUXJKdFVNPQ=="))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
-- 
2.37.2


^ permalink raw reply related	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2022-09-21 13:13     ` J.P.
@ 2022-10-14  3:05       ` J.P.
       [not found]       ` <878rljxfxs.fsf@neverwas.me>
  1 sibling, 0 replies; 54+ messages in thread
From: J.P. @ 2022-10-14  3:05 UTC (permalink / raw)
  To: 29108; +Cc: emacs-erc

[-- Attachment #1: Type: text/plain, Size: 214 bytes --]

v4. Revised manual, doc strings. Fixed test. Note: these patches may not
be fully functional because the "actual" (WIP version) is based atop
bug#56340, whereas these have been modified to produce a smaller diff.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0000-v3-v4.diff --]
[-- Type: text/x-patch, Size: 20627 bytes --]

From 5e8fd5c54b46286565d938d9984c26d44f194bf0 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Thu, 13 Oct 2022 19:52:09 -0700
Subject: [PATCH 0/4] *** NOT A PATCH ***

*** BLURB HERE ***

F. Jason Park (4):
  Add GS2 authorization to sasl-scram-rfc
  Support local ERC modules in erc-mode buffers
  Make erc-login generic
  Add non-IRCv3 SASL module to ERC

 doc/misc/erc.texi                             | 138 +++++-
 lisp/erc/erc-backend.el                       |   8 +-
 lisp/erc/erc-compat.el                        | 104 +++++
 lisp/erc/erc-sasl.el                          | 396 ++++++++++++++++++
 lisp/erc/erc.el                               |  84 ++--
 lisp/net/sasl-scram-rfc.el                    |  21 +-
 test/lisp/erc/erc-sasl-tests.el               | 302 +++++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 161 +++++++
 test/lisp/erc/erc-tests.el                    |  47 +++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  35 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 +++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 +++
 14 files changed, 1400 insertions(+), 39 deletions(-)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

Interdiff:
diff --git a/doc/misc/erc.texi b/doc/misc/erc.texi
index 3b7af0fb1b..80b4171cdb 100644
--- a/doc/misc/erc.texi
+++ b/doc/misc/erc.texi
@@ -957,18 +957,6 @@ SASL
 (server) password given to @code{erc-tls} via its @code{:password}
 parameter.  To make this work, customize both @code{erc-sasl-user} and
 @code{erc-sasl-password} or bind them when invoking @code{erc-tls}.
-
-When @code{erc-sasl-password} is a string, it's used unconditionally.
-When it's a non-@code{nil} symbol, like @samp{Libera.Chat}, it's used
-as the @code{:host} param in an auth-source query.  When it's
-@code{nil} and a session ID is on file, the ID is used instead for the
-@code{:host} param (@pxref{Network Identifier}).  The value of
-@code{erc-sasl-user} is always specified for the @code{:user}
-(@code{:login}) param.
-
-If a password can't be determined, a non-@code{nil} server
-(connection) password will be tried.  (This may change, however, so
-please don't rely on it.)
 @end indentedblock
 
 @var{external} (via Client TLS Certificate):
@@ -1001,12 +989,11 @@ SASL
 
 @indentedblock
 This mechanism is quite complicated and currently requires the
-presence of the external @samp{openssl} command-line utility, so
-please use something else if at all possible.  Ignoring that, specify
-your key file (e.g., @samp{~/pki/mykey.pem}) as the value of
-@code{erc-sasl-password}, and then configure your network settings.
-On servers running Atheme services, you can add your public key with
-@samp{NickServ} like so:
+external @samp{openssl} executable, so please use something else if at
+all possible.  Ignoring that, specify your key file (e.g.,
+@samp{~/pki/mykey.pem}) as the value of @code{erc-sasl-password}, and
+then configure your network settings.  On servers running Atheme
+services, you can add your public key with @samp{NickServ} like so:
 
 @example
 ERC> /msg NickServ set property \
@@ -1019,26 +1006,34 @@ SASL
 @end defopt
 
 @defopt erc-sasl-user
-Your network account name, typically the same one registered with
-nickname services.  Specify this when your @samp{NickServ} account
-name differs from the nick you're connecting with.
+This should be your network account name, typically the same one
+registered with nickname services.  Specify this when your
+@samp{NickServ} account name differs from the nick you're connecting
+with.
 @end defopt
 
 @defopt erc-sasl-password
-Optional account password to send when authenticating.
-
-If you specify a string, it'll be considered authoritative and
-accepted at face value.  If you instead give a non-@code{nil} symbol,
-it'll be passed as the value of the @code{:host} field in an
-auth-source query, provided @code{erc-sasl-auth-source-function} is
-set to a function.  If you set this to @code{nil}, a non-@code{nil}
-``session password'' will be tried, likely whatever you gave as the
-@var{password} argument to @code{erc-tls}.  As a last resort, you'll
-be prompted for input.
-
-Note that when @code{erc-sasl-mechanism} is set to
-@code{ecdsa-nist256p-challenge}, this option should hold the file name
-of your key, which is typically in PEM format.
+For ``password-based'' mechanisms, ERC sends any nonempty string as
+the authentication password.
+
+If you instead give a non-@code{nil} symbol, like @samp{Libera.Chat},
+ERC will use it for the @code{:host} field in an auth-source query.
+Actually, the same goes for when this option is @code{nil} but an
+explicit session ID is already on file (@pxref{Network Identifier}).
+For all such queries, ERC specifies the value of @code{erc-sasl-user}
+for the @code{:user} (@code{:login}) param.  Keep in mind that none of
+this matters unless @code{erc-sasl-auth-source-function} holds a
+function (it's @code{nil} by default).
+
+Otherwise, if you set this option to @code{nil} (or the empty string)
+or if an auth-source lookup has failed, ERC will try a non-@code{nil}
+``server password'', likely whatever you gave as the @var{password}
+argument to @code{erc-tls}.  This fallback behavior may change,
+however, so please don't rely on it.  As a last resort, ERC will
+prompt you for input.
+
+Also, if your mechanism is @code{ecdsa-nist256p-challenge}, this
+option should instead hold the file name of your key.
 @end defopt
 
 @defopt erc-sasl-auth-source-function
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
index d237ab73a8..f36a305247 100644
--- a/lisp/erc/erc-sasl.el
+++ b/lisp/erc/erc-sasl.el
@@ -19,28 +19,24 @@
 
 ;;; Commentary:
 
-;; WARNING: this is a (non-IRCv3) implementation of SASL.  Please see
-;; bug#49860, which adds full 3.2 capability negotiation.
-;;
-;; Various ERC implementations of the PLAIN mechanism have surfaced
-;; over the years, the first possibly being:
+;; This "non-IRCv3" implementation resembles many others that have
+;; surfaced over the years, the first possibly being:
 ;;
 ;; https://lists.gnu.org/archive/html/erc-discuss/2012-02/msg00001.html
 ;;
-;; This module would not exist without this and other pioneering
-;; efforts.
+;; See options and Info manual for usage.
 ;;
 ;; TODO:
 ;;
 ;; - Find a way to obfuscate the password in memory (via something
-;; - like `auth-source--obfuscate'); it's currently visible in
-;; - backtraces.
+;;   like `auth-source--obfuscate'); it's currently visible in
+;;   backtraces.
 ;;
-;; - Implement pseudo PASSWORD mechanism that chooses the strongest
-;;   available mechanism for you.
+;; - Implement a proxy mechanism that chooses the strongest available
+;;   mechanism for you.  Requires CAP 3.2 (see bug#49860).
 
 ;;; Code:
-(require 'erc-backend)
+(require 'erc)
 (require 'rx)
 (require 'sasl)
 (require 'sasl-scram-rfc)
@@ -72,13 +68,13 @@ erc-sasl-user
 
 (defcustom erc-sasl-password nil
   "Optional account password to send when authenticating.
-When the value is a string, it's used unconditionally.  As a
-special case, when the value is a non-nil symbol, it's used as
-the value of the `:host' field in an auth-source query, provided
-`erc-sasl-auth-source-function' is set to a function.  When
-nil, a non-nil \"session password\" will be tried, likely one
-given as the `:password' argument to `erc-tls'.  As a last
-resort, the user will be prompted for input.
+When the value is a string, ERC uses it unconditionally for most
+mechanisms (see below).  As a special case, when the value is a
+non-nil symbol, ERC uses it as the value of the `:host' field in
+an auth-source query, provided `erc-sasl-auth-source-function' is
+set to a function.  When nil, ERC will try a non-nil \"session
+password\", likely one given as the `:password' argument to
+`erc-tls'.  As a last resort, ERC will prompt the user for input.
 
 Note that when `erc-sasl-mechanism' is set to
 `ecdsa-nist256p-challenge', this option should hold the file name
@@ -100,9 +96,7 @@ erc-sasl-auth-source-function
                  function))
 
 (defcustom erc-sasl-authzid nil
-  "SASL authorization identity.
-Generally unneeded for normal use.  Some test frameworks and
-aberrant servers may want this to match `erc-sasl-user'."
+  "SASL authorization identity, likely unneeded for everyday use."
   :type '(choice (const nil) string))
 
 
@@ -121,24 +115,22 @@ erc-sasl--state
 (defun erc-sasl--read-password (prompt)
   "Return configured option or server password.
 PROMPT is passed to `read-passwd' if necessary."
-  ;; Copying prevent `sasl-plain-response' from clobbering
-  (if-let
-      ((found
-        (or (and-let* ((pass (alist-get 'password erc-sasl--options))
-                       ((stringp pass))
-                       (pass)))
-            (and erc-sasl-auth-source-function
-                 (let ((user (alist-get 'user erc-sasl--options))
-                       (host (alist-get 'password erc-sasl--options)))
-                   (apply erc-sasl-auth-source-function
-                          `(,@(and user (list :user user))
-                            ,@(and host (list :host (symbol-name host)))))))
-            erc-session-password)))
-      (copy-sequence found)
-    (read-passwd prompt)))
+  (let* ((pass (alist-get 'password erc-sasl--options))
+         (found
+          (or (and (stringp pass) (not (string-empty-p pass)) pass)
+              (and erc-sasl-auth-source-function
+                   (let ((user (alist-get 'user erc-sasl--options))
+                         (host (or pass
+                                   (erc-networks--id-given erc-networks--id))))
+                     (apply erc-sasl-auth-source-function
+                            `(,@(and user (list :user user))
+                              ,@(and host (list :host (symbol-name host)))))))
+              erc-session-password)))
+    (if found
+        (copy-sequence found)
+      (read-passwd prompt))))
 
 (defun erc-sasl--plain-response (client steps)
-  "Call `sasl-plain-response' with CLIENT and STEPS."
   (let ((sasl-read-passphrase #'erc-sasl--read-password))
     (sasl-plain-response client steps)))
 
@@ -146,9 +138,6 @@ erc-sasl--plain-response
                   (hash-fun block-length hash-length client step))
 
 (defun erc-sasl--scram-sha-hack-client-final-message (&rest args)
-  "Call `sasl-scram--client-final-message' with args.
-Pass HASH-FUN, BLOCK-LENGTH, HASH-LENGTH, CLIENT, and STEP
-directly upstream."
   ;; In the future (29+), we'll hopefully be able to call
   ;; `sasl-scram--client-final-message' directly
   (require 'erc-compat)
@@ -156,27 +145,22 @@ erc-sasl--scram-sha-hack-client-final-message
     (apply #'erc-compat--sasl-scram--client-final-message args)))
 
 (defun erc-sasl--scram-sha-1-client-final-message (client step)
-  "Prepare CLIENT's final message with STEP."
   (erc-sasl--scram-sha-hack-client-final-message 'sha1 64 20 client step))
 
 (defun erc-sasl--scram-sha-256-client-final-message (client step)
-  "Prepare CLIENT's final message with STEP."
   (erc-sasl--scram-sha-hack-client-final-message 'sasl-scram-sha256 64 32
-                                                    client step))
+                                                 client step))
 
 (defun erc-sasl--scram-sha512 (object &optional start end binary)
-  "Pass OBJECT, START, END, and BINARY to `secure-hash'."
   (secure-hash 'sha512 object start end binary))
 
 (defun erc-sasl--scram-sha-512-client-final-message (client step)
-  "Prepare CLIENT's final message with STEP."
-  (erc-sasl--scram-sha-hack-client-final-message
-   #'erc-sasl--scram-sha512 128 64 client step))
+  (erc-sasl--scram-sha-hack-client-final-message #'erc-sasl--scram-sha512
+                                                 128 64 client step))
 
 (defun erc-sasl--scram-sha-512-authenticate-server (client step)
-  "Call `sasl-scram--authenticate-server' with CLIENT and STEP."
-  (sasl-scram--authenticate-server
-   #'erc-sasl--scram-sha512 128 64 client step))
+  (sasl-scram--authenticate-server #'erc-sasl--scram-sha512
+                                   128 64 client step))
 
 (defun erc-sasl--ecdsa-first (client _step)
   "Return CLIENT name."
@@ -184,7 +168,7 @@ erc-sasl--ecdsa-first
 
 ;; FIXME do this with gnutls somehow
 (defun erc-sasl--ecdsa-sign (client step)
-  "Return signed challenge for CLIENT and STEP."
+  "Return signed challenge for CLIENT and current STEP."
   (let ((challenge (sasl-step-data step)))
     (with-temp-buffer
       (set-buffer-multibyte nil)
@@ -195,9 +179,6 @@ erc-sasl--ecdsa-sign
                            "-sign")
       (buffer-string))))
 
-;; This API may seem roundabout, but the "template method" here is
-;; one that we provide, namely `erc-sasl--authenticate-handler'.
-
 (pcase-dolist
     (`(,name . ,steps)
      '(("PLAIN"
@@ -240,13 +221,9 @@ erc-sasl--create-client
                               (alist-get 'authzid erc-sasl--options))
     client))
 
-;; Oragono doesn't like when authzid (if present) does not match
-;; the authcid.  TODO see if this still true.
-
 (cl-defmethod erc-sasl--create-client ((_m (eql plain)))
-  "Create and return new SASL PLAIN client object.
-See message breakdown at
-https://tools.ietf.org/html/rfc4616#section-2."
+  "Create and return a new PLAIN client object."
+  ;; https://tools.ietf.org/html/rfc4616#section-2.
   (let* ((sans (remq (assoc "PLAIN" sasl-mechanism-alist)
                      sasl-mechanism-alist))
          (sasl-mechanism-alist (cons '("PLAIN" erc-sasl-plain) sans))
@@ -264,19 +241,19 @@ erc-sasl--create-client
     client))
 
 (cl-defmethod erc-sasl--create-client ((m (eql scram-sha-256)))
-  "Create a SCRAM-SHA-256 client."
+  "Create and return a new SCRAM-SHA-256 client."
   (unless (featurep 'sasl-scram-sha256)
     (user-error "SASL mechanism %s unsupported" m))
   (cl-call-next-method))
 
 (cl-defmethod erc-sasl--create-client ((m (eql scram-sha-512)))
-  "Create a SCRAM-SHA-512 client."
+  "Create and return a new SCRAM-SHA-512 client."
   (unless (featurep 'sasl-scram-sha256)
     (user-error "SASL mechanism %s unsupported" m))
   (cl-call-next-method))
 
 (cl-defmethod erc-sasl--create-client ((_ (eql ecdsa-nist256p-challenge)))
-  "Create a ECDSA-NIST256P-CHALLENGE client."
+  "Create and return a new ECDSA-NIST256P-CHALLENGE client."
   (unless (executable-find "openssl")
     (user-error "Could not find openssl command-line utility"))
   (let ((keyfile (cdr (assq 'password erc-sasl--options))))
@@ -286,6 +263,7 @@ erc-sasl--create-client
       (sasl-client-set-property client 'ecdsa-keyfile keyfile)
       client)))
 
+;; This stands alone because it's also used by bug#49860
 (defun erc-sasl--init ()
   (setq erc-sasl--state (make-erc-sasl--state)
         erc-sasl--options `((user . ,erc-sasl-user)
@@ -294,7 +272,7 @@ erc-sasl--init
                             (authzid . ,erc-sasl-authzid))))
 
 (defun erc-sasl--mechanism-offered-p (offered)
-  "Non-nil when mechanism OFFERED by server."
+  "Return non-nil when OFFERED appears among a list of mechanisms."
   (string-match-p (rx-to-string
                    `(: (| bot ",")
                        ,(symbol-name
@@ -341,10 +319,10 @@ erc-sasl--authenticate-handler
    (s908 . "RPL_SASLMECHS (unsupported mechanism %m) %s")))
 
 (define-erc-module sasl nil
-  "Non-IRCv3 (dumb) SASL support for ERC.
-Needless to say, this doesn't solicit or validate a suite of
-supported mechanisms.  See bug#49860 for a full, CAP 3.2-aware
-implementation, currently a WIP as of ERC 5.5."
+  "Non-IRCv3 SASL support for ERC.
+This doesn't solicit or validate a suite of supported mechanisms."
+  ;; See bug#49860 for a full, CAP 3.2-aware implementation, currently
+  ;; a WIP as of ERC 5.5.
   ((unless erc--target
      (add-hook 'erc-server-AUTHENTICATE-functions
                #'erc-sasl--authenticate-handler 0 t)
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 1778480df1..7c72085fea 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1390,9 +1390,7 @@ define-erc-module
 
 This will define a minor mode called erc-NAME-mode, possibly
 an alias erc-ALIAS-mode, as well as the helper functions
-erc-NAME-enable, and erc-NAME-disable.  Beware that for global
-modules, these helpers, as well as the minor-mode toggle, all mutate
-the user option `erc-modules'.
+erc-NAME-enable, and erc-NAME-disable.
 
 Example:
 
@@ -1428,21 +1426,16 @@ define-erc-module
          ,(format "Enable ERC %S mode."
                   name)
          (interactive)
-         (unless ,local-p
-           (cl-pushnew (erc--normalize-module-symbol ',name) erc-modules))
-         (when (or ,(not local-p) (eq major-mode 'erc-mode))
-           (setq ,mode t)
-           ,@enable-body))
+         (add-to-list 'erc-modules (quote ,name))
+         (setq ,mode t)
+         ,@enable-body)
        (defun ,disable ()
          ,(format "Disable ERC %S mode."
                   name)
          (interactive)
-         (unless ,local-p
-           (setq erc-modules (delq (erc--normalize-module-symbol ',name)
-                                   erc-modules)))
-         (when (or ,(not local-p) ,mode)
-           (setq ,mode nil)
-           ,@disable-body))
+         (setq erc-modules (delq (quote ,name) erc-modules))
+         (setq ,mode nil)
+         ,@disable-body)
        ,(when (and alias (not (eq name alias)))
           `(defalias
              ',(intern
@@ -2062,10 +2055,6 @@ erc--module-name-migrations
     pairs)
   "Association list of obsolete module names to canonical names.")
 
-(defun erc--normalize-module-symbol (module)
-  "Canonicalize symbol MODULE for `erc-modules'."
-  (or (cdr (assq module erc--module-name-migrations)) module))
-
 (defun erc-migrate-modules (mods)
   "Migrate old names of ERC modules to new ones."
   ;; modify `transforms' to specify what needs to be changed
@@ -2132,6 +2121,7 @@ erc-modules
     (const :tag "readonly: Make displayed lines read-only" readonly)
     (const :tag "replace: Replace text in messages" replace)
     (const :tag "ring: Enable an input history" ring)
+    (const :tag "sasl: Enable SASL authentication" sasl)
     (const :tag "scrolltobottom: Scroll to the bottom of the buffer"
            scrolltobottom)
     (const :tag "services: Identify to Nickserv (IRC Services) automatically"
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
index c54acc4d28..112303baf5 100644
--- a/test/lisp/erc/erc-sasl-tests.el
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -47,16 +47,18 @@ erc-sasl--read-password
       (should (string= (erc-sasl--read-password nil) "bar"))))
 
   (let* ((entries (list
-                   "machine GNU/chat port 6697 user bob password spam"
                    "machine FSF.chat port 6697 user bob password sesame"
+                   ;; This must come *after* ^, else *1 (below) always passes
+                   "machine GNU/chat port 6697 user bob password spam"
                    "machine MyHost port irc password 123"))
          (netrc-file (make-temp-file "auth-source-test" nil nil
                                      (mapconcat 'identity entries "\n")))
          (auth-sources (list netrc-file))
          (erc-session-server "irc.gnu.org")
          (erc-session-port 6697)
+         (erc-networks--id (erc-networks--id-create nil))
          ;;
-         (erc-sasl-auth-source-function #'erc-auth-source-search)
+         (erc-sasl-auth-source-function #'erc--auth-source-search)
          erc-server-announced-name ; too early
          auth-source-do-cache)
 
@@ -69,7 +71,7 @@ erc-sasl--read-password
                   (erc-networks--id (make-erc-networks--id)))
               (should (string= (erc-sasl--read-password nil) "sesame"))))
 
-          (ert-info ("Use session ID when password empty")
+          (ert-info ("Use session ID when password empty") ; *1
             (let ((erc-sasl--options '((user . "bob") (password)))
                   (erc-networks--id (erc-networks--id-create 'GNU/chat)))
               (should (string= (erc-sasl--read-password nil) "spam")))))
-- 
2.37.3


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: 0001-Add-GS2-authorization-to-sasl-scram-rfc.patch --]
[-- Type: text/x-patch, Size: 2949 bytes --]

From 98b02fb10e1cfa1b4d02bf1bc244633046dcbcbb Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 19 Sep 2022 21:28:52 -0700
Subject: [PATCH 1/4] Add GS2 authorization to sasl-scram-rfc

* lisp/net/sasl-scram-rfc.el (sasl-scram-fs2-header-function,
sasl-scram-construct-gs2-header): Add new variable and default
function for determining a SCRAM GSS-API message header.
(sasl-scram-client-first-message): Use gs2-header function.
(sasl-scram--client-final-message): Use dedicated gs2-header function.
Also remove whitespace when base64-encoding, as per RFC 5802.
---
 lisp/net/sasl-scram-rfc.el | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/lisp/net/sasl-scram-rfc.el b/lisp/net/sasl-scram-rfc.el
index ee52ed6e07..f7a2e42541 100644
--- a/lisp/net/sasl-scram-rfc.el
+++ b/lisp/net/sasl-scram-rfc.el
@@ -45,14 +45,21 @@
 
 ;;; Generic for SCRAM-*
 
+(defvar sasl-scram-gs2-header-function 'sasl-scram-construct-gs2-header
+  "Function to create GS2 header.
+See https://www.rfc-editor.org/rfc/rfc5801#section-4.")
+
+(defun sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
 (defun sasl-scram-client-first-message (client _step)
   (let ((c-nonce (sasl-unique-id)))
     (sasl-client-set-property client 'c-nonce c-nonce))
   (concat
-   ;; n = client doesn't support channel binding
-   "n,"
-   ;; TODO: where would we get authorization id from?
-   ","
+   (funcall sasl-scram-gs2-header-function client)
    (sasl-scram--client-first-message-bare client)))
 
 (defun sasl-scram--client-first-message-bare (client)
@@ -77,11 +84,11 @@ sasl-scram--client-final-message
 
 	 (c-nonce (sasl-client-property client 'c-nonce))
 	 ;; no channel binding, no authorization id
-	 (cbind-input "n,,"))
+         (cbind-input (funcall sasl-scram-gs2-header-function client)))
     (unless (string-prefix-p c-nonce nonce)
       (sasl-error "Invalid nonce from server"))
     (let* ((client-final-message-without-proof
-	    (concat "c=" (base64-encode-string cbind-input) ","
+            (concat "c=" (base64-encode-string cbind-input t) ","
 		    "r=" nonce))
 	   (password
 	    ;; TODO: either apply saslprep or disallow non-ASCII characters
@@ -113,7 +120,7 @@ sasl-scram--client-final-message
 	   (client-proof (funcall string-xor client-key client-signature))
 	   (client-final-message
 	    (concat client-final-message-without-proof ","
-		    "p=" (base64-encode-string client-proof))))
+                    "p=" (base64-encode-string client-proof t))))
       (sasl-client-set-property client 'auth-message auth-message)
       (sasl-client-set-property client 'salted-password salted-password)
       client-final-message)))
-- 
2.37.3


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #4: 0002-Support-local-ERC-modules-in-erc-mode-buffers.patch --]
[-- Type: text/x-patch, Size: 9263 bytes --]

From b9dfeb4e8f2c19a6218aaec12aafccc99a964676 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 12 Jul 2021 03:44:28 -0700
Subject: [PATCH 2/4] Support local ERC modules in erc-mode buffers

* lisp/erc/erc.el (erc-migrate-modules): add some missing mappings.
(erc--module-name-migrations, erc--features-to-modules,
erc--modules-to-features): add alists to support simplified
module-name migrations.
(erc-update-modules): Change return value to a list of minor-mode
commands for local modules that need deferred activation, if any.  Use
`custom-variable-p' to detect flavor.  Currently, all modules are
global, meaning so are their accompanying minor modes.
(erc-open): Defer enabling of local modules via `erc-update-modules'
until after buffer is initialized with other local vars.  Also defer
major mode hooks so they can detect things like whether the buffer is
a server or target buffer.

* lisp/erc/erc-common.el (define-erc-modules): Don't enable local
modules (minor modes) unless `erc-mode' is the major mode. And don't
disable them unless the minor mode is actually active.  Also, don't
mutate `erc-modules' when dealing with a local module.  It's believed
that the original authors wanted this functionality.
(erc--normalize-module-symbol): Add helper for `erc-migrate-modules'.
---
 lisp/erc/erc.el            | 83 +++++++++++++++++++++++++-------------
 test/lisp/erc/erc-tests.el | 47 +++++++++++++++++++++
 2 files changed, 101 insertions(+), 29 deletions(-)

diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index db39e341b2..2601ebfc70 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -2030,14 +2030,36 @@ erc-default-nicks
 (defvar-local erc-nick-change-attempt-count 0
   "Used to keep track of how many times an attempt at changing nick is made.")
 
+(defconst erc--features-to-modules
+  '((erc-pcomplete completion pcomplete)
+    (erc-capab capab-identify)
+    (erc-join autojoin)
+    (erc-page page ctcp-page)
+    (erc-sound sound ctcp-sound)
+    (erc-stamp stamp timestamp)
+    (erc-services services nickserv))
+  "Migration alist mapping a library feature to module names.
+Keys need not be unique: a library may define more than one
+module.")
+
+(defconst erc--modules-to-features
+  (cl-loop for (feature . names) in erc--features-to-modules
+           append (mapcar (lambda (name) (cons name feature)) names))
+  "Migration alist mapping a module's name to library feature.")
+
+(defconst erc--module-name-migrations
+  (let (pairs)
+    (pcase-dolist (`(,_ ,canonical . ,rest) erc--features-to-modules)
+      (dolist (obsolete rest)
+        (push (cons obsolete canonical) pairs)))
+    pairs)
+  "Association list of obsolete module names to canonical names.")
+
 (defun erc-migrate-modules (mods)
   "Migrate old names of ERC modules to new ones."
   ;; modify `transforms' to specify what needs to be changed
   ;; each item is in the format '(old . new)
-  (let ((transforms '((pcomplete . completion))))
-    (delete-dups
-     (mapcar (lambda (m) (or (cdr (assoc m transforms)) m))
-             mods))))
+  (delete-dups (mapcar #'erc--normalize-module-symbol mods)))
 
 (defcustom erc-modules '(netsplit fill button match track completion readonly
                                   networks ring autojoin noncommands irccontrols
@@ -2116,27 +2138,22 @@ erc-modules
   :group 'erc)
 
 (defun erc-update-modules ()
-  "Run this to enable erc-foo-mode for all modules in `erc-modules'."
-  (let (req)
+  "Enable global minor mode for all global modules in `erc-modules'.
+Return minor-mode commands for all local modules, possibly for
+deferred invocation, as done by `erc-open' whenever a new ERC
+buffer is created.  Local modules were introduced in ERC 5.6."
+  (let (local-modules)
     (dolist (mod erc-modules)
-      (setq req (concat "erc-" (symbol-name mod)))
-      (cond
-       ;; yuck. perhaps we should bring the filenames into sync?
-       ((string= req "erc-capab-identify")
-        (setq req "erc-capab"))
-       ((string= req "erc-completion")
-        (setq req "erc-pcomplete"))
-       ((string= req "erc-pcomplete")
-        (setq mod 'completion))
-       ((string= req "erc-autojoin")
-        (setq req "erc-join")))
-      (condition-case nil
-          (require (intern req))
-        (error nil))
+      (require (or (alist-get mod erc--modules-to-features)
+                   (intern (concat "erc-" (symbol-name mod))))
+               nil 'noerror) ; some modules don't have a corresponding feature
       (let ((sym (intern-soft (concat "erc-" (symbol-name mod) "-mode"))))
-        (if (fboundp sym)
+        (unless (and sym (fboundp sym))
+          (error "`%s' is not a known ERC module" mod))
+        (if (custom-variable-p sym)
             (funcall sym 1)
-          (error "`%s' is not a known ERC module" mod))))))
+          (push sym local-modules))))
+    local-modules))
 
 (defun erc-setup-buffer (buffer)
   "Consults `erc-join-buffer' to find out how to display `BUFFER'."
@@ -2192,18 +2209,22 @@ erc-open
   (let* ((target (and channel (erc--target-from-string channel)))
          (buffer (erc-get-buffer-create server port nil target id))
          (old-buffer (current-buffer))
-         old-point
+         (old-recon-count erc-server-reconnect-count)
+         (old-point nil)
+         (delayed-modules nil)
          (continued-session (and erc--server-reconnecting
                                  (with-suppressed-warnings
                                      ((obsolete erc-reuse-buffers))
                                    erc-reuse-buffers))))
     (when connect (run-hook-with-args 'erc-before-connect server port nick))
-    (erc-update-modules)
     (set-buffer buffer)
     (setq old-point (point))
-    (let ((old-recon-count erc-server-reconnect-count))
-      (erc-mode)
-      (setq erc-server-reconnect-count old-recon-count))
+    (setq delayed-modules (erc-update-modules))
+
+    (delay-mode-hooks (erc-mode))
+
+    (setq erc-server-reconnect-count old-recon-count)
+
     (when (setq erc-server-connected (not connect))
       (setq erc-server-announced-name
             (buffer-local-value 'erc-server-announced-name old-buffer)))
@@ -2266,6 +2287,12 @@ erc-open
     (setq erc-dbuf
           (when erc-log-p
             (get-buffer-create (concat "*ERC-DEBUG: " server "*"))))
+
+    (erc-determine-parameters server port nick full-name user passwd)
+
+    (save-excursion (run-mode-hooks))
+    (dolist (mod delayed-modules) (funcall mod +1))
+
     ;; set up prompt
     (unless continued-session
       (goto-char (point-max))
@@ -2277,8 +2304,6 @@ erc-open
       (erc-display-prompt)
       (goto-char (point-max)))
 
-    (erc-determine-parameters server port nick full-name user passwd)
-
     ;; Saving log file on exit
     (run-hook-with-args 'erc-connect-pre-hook buffer)
 
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index b2ed29e80e..d3d319ab22 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -975,4 +975,51 @@ erc-message
     (kill-buffer "ExampleNet")
     (kill-buffer "#chan")))
 
+(ert-deftest erc-migrate-modules ()
+  (should (equal (erc-migrate-modules '(autojoin timestamp button))
+                 '(autojoin stamp button)))
+  ;; Default unchanged
+  (should (equal (erc-migrate-modules erc-modules) erc-modules)))
+
+(ert-deftest erc-update-modules ()
+  (let* (calls
+         (erc-modules '(fake-foo fake-bar)))
+    (cl-letf (((symbol-function 'require)
+               (lambda (s &rest _) (push s calls)))
+              ((symbol-function 'erc-fake-foo-mode)
+               (lambda (n) (push (cons 'fake-foo n) calls)))
+              ;; Here, foo is a global module (minor mode)
+              ((get 'erc-fake-foo-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-fake-bar-mode)
+               (lambda (n) (push (cons 'fake-bar n) calls)))
+              ((symbol-function 'erc-autojoin-mode)
+               (lambda (n) (push (cons 'autojoin n) calls)))
+              ((get 'erc-autojoin-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-networks-mode)
+               (lambda (n) (push (cons 'networks n) calls)))
+              ((symbol-function 'erc-completion-mode)
+               (lambda (n) (push (cons 'completion n) calls)))
+              ((get 'erc-completion-mode 'standard-value) #'ignore))
+
+      (ert-info ("Locals")
+        (should (equal (erc-update-modules)
+                       '(erc-fake-bar-mode)))
+        ;; Bar still required
+        (should (equal (nreverse calls) '(erc-fake-foo
+                                          (fake-foo . 1)
+                                          erc-fake-bar)))
+        (setq calls nil))
+
+      (ert-info ("Module name overrides")
+        (setq erc-modules '(completion autojoin networks))
+        (should-not (erc-update-modules)) ; no locals
+        (should (equal (nreverse calls)
+                       '(erc-pcomplete
+                         (completion . 1)
+                         erc-join
+                         (autojoin . 1)
+                         erc-networks
+                         (networks . 1))))
+        (setq calls nil)))))
+
 ;;; erc-tests.el ends here
-- 
2.37.3


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #5: 0003-Make-erc-login-generic.patch --]
[-- Type: text/x-patch, Size: 1965 bytes --]

From 54fca49c044dee3ba0c5b5de27bce9f1eb44f41d Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:49:23 -0700
Subject: [PATCH 3/4] Make erc-login generic

* lisp/erc/erc-backend (erc--register-connection): Add new generic
function that's just a wrapper for `erc-login' by default.
(erc-process-sentinel, erc-server-connect): Call
`erc--register-connection' instead of `erc-login'.
---
 lisp/erc/erc-backend.el | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index df9efe4b0c..25c4481d1d 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -532,6 +532,10 @@ erc-open-network-stream
   (let ((p (plist-put parameters :nowait t)))
     (apply #'open-network-stream name buffer host service p)))
 
+(cl-defmethod erc--register-connection ()
+  "Perform opening IRC protocol exchange with server."
+  (erc-login))
+
 (defun erc-server-connect (server port buffer &optional client-certificate)
   "Perform the connection and login using the specified SERVER and PORT.
 We will store server variables in the buffer given by BUFFER.
@@ -580,7 +584,7 @@ erc-server-connect
         ;; waiting for a non-blocking connect - keep the user informed
         (erc-display-message nil nil buffer "Opening connection..\n")
       (message "%s...done" msg)
-      (erc-login)) ))
+      (erc--register-connection))))
 
 (defun erc-server-reconnect ()
   "Reestablish the current IRC connection.
@@ -758,7 +762,7 @@ erc-process-sentinel
                   cproc (process-status cproc) event erc-server-quitting))
         (if (string-match "^open" event)
             ;; newly opened connection (no wait)
-            (erc-login)
+            (erc--register-connection)
           ;; assume event is 'failed
           (erc-with-all-buffers-of-server cproc nil
                                           (setq erc-server-connected nil))
-- 
2.37.3


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #6: 0004-Add-non-IRCv3-SASL-module-to-ERC.patch --]
[-- Type: text/x-patch, Size: 66489 bytes --]

From 5e8fd5c54b46286565d938d9984c26d44f194bf0 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:37:13 -0700
Subject: [PATCH 4/4] Add non-IRCv3 SASL module to ERC

* lisp/erc/erc-compat.el (erc-compat--sasl-scram-construct-gs2-header,
erc-compat--sasl-scram-client-first-message,
erc-compat--sasl-scram--client-final-message): Add minimal
authorization support via own variant of
`sasl-scram--client-final-message' and supporting sasl-scram-rfc
functions introduced in Emacs 29.
* lisp/erc/erc.el (erc-modules): Add `sasl'.

* lisp/erc/erc-sasl.el: New file.
* test/lisp/erc/erc-sasl-tests.el: New file.
* test/lisp/erc/erc-scenarios-sasl.el: New file.
* test/lisp/erc/resources/sasl/plain-failed.eld: New file.
* test/lisp/erc/resources/sasl/plain.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-1.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-256.eld: New file.
* test/lisp/erc/resources/sasl/external.eld: New file.
---
 doc/misc/erc.texi                             | 138 +++++-
 lisp/erc/erc-compat.el                        | 104 +++++
 lisp/erc/erc-sasl.el                          | 396 ++++++++++++++++++
 lisp/erc/erc.el                               |   1 +
 test/lisp/erc/erc-sasl-tests.el               | 302 +++++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 161 +++++++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  35 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 +++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 +++
 11 files changed, 1279 insertions(+), 1 deletion(-)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

diff --git a/doc/misc/erc.texi b/doc/misc/erc.texi
index 3db83197f9..80b4171cdb 100644
--- a/doc/misc/erc.texi
+++ b/doc/misc/erc.texi
@@ -78,6 +78,7 @@ Top
 Advanced Usage
 
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL.
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 
@@ -478,6 +479,10 @@ Modules
 @item ring
 Enable an input history
 
+@cindex modules, sasl
+@item sasl
+Enable SASL authentication
+
 @cindex modules, scrolltobottom
 @item scrolltobottom
 Scroll to the bottom of the buffer
@@ -525,6 +530,7 @@ Advanced Usage
 
 @menu
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 @end menu
@@ -842,6 +848,7 @@ Connecting
 @noindent
 For details, @pxref{Top,,auth-source, auth, Emacs auth-source Library}.
 
+@anchor{ERC auth-source functions}
 @defopt erc-auth-source-server-function
 @end defopt
 @defopt erc-auth-source-services-function
@@ -854,7 +861,8 @@ Connecting
 @code{:user} is the ``desired'' nickname rather than the current one.
 Generalized names, like @code{:user} and @code{:host}, are always used
 over back-end specific ones, like @code{:login} or @code{:machine}.
-ERC expects a string to use as the secret or nil, if the search fails.
+ERC expects a string to use as the secret or @code{nil}, if the search
+fails.
 
 @findex erc-auth-source-search
 The default value for all three options is the function
@@ -915,6 +923,134 @@ Connecting
 make the most sense, but any reasonably printable object is
 acceptable.
 
+@node SASL
+@section Authenticating via SASL
+@cindex SASL
+
+@strong{Warning:} ERC's SASL offering is currently limited by a lack
+of support for proper IRCv3 capability negotiation.  In most cases,
+this shouldn't affect your ability to authenticate.  If you run into
+trouble, please contact us (@pxref{Getting Help and Reporting Bugs}).
+
+Regardless of the mechanism or the network, you'll likely have to be
+registered before first use.  Please refer to the network's own
+instructions for details.  If you're new to IRC and using a bouncer,
+know that you almost certainly won't be needing SASL for the
+@samp{client -> bouncer} connection.
+
+Note that @code{sasl} is a ``local'' ERC module.  This means invoking
+@code{erc-sasl-mode} manually or calling @code{erc-update-modules}
+won't do any good.  Instead, simply add @code{sasl} to
+@code{erc-modules} (or @code{let}-bind it while calling
+@code{erc-tls}), and SASL will be enabled for the current connection.
+But before that, please explore all custom options pertaining to your
+chosen mechanism.
+
+@defopt erc-sasl-mechanism
+The name of an SASL subprotocol type as a @emph{lowercase} symbol.
+
+@var{plain} and @var{scram} (``password-based''):
+
+@indentedblock
+Here, ``password'' refers to your account password, which is usually
+your @samp{NickServ} password.  This often differs from any connection
+(server) password given to @code{erc-tls} via its @code{:password}
+parameter.  To make this work, customize both @code{erc-sasl-user} and
+@code{erc-sasl-password} or bind them when invoking @code{erc-tls}.
+@end indentedblock
+
+@var{external} (via Client TLS Certificate):
+
+@indentedblock
+You'll want to specify the @code{:client-certificate} param when
+opening a new connection, which is typically done by calling
+@code{emacs-tls}.  But before that, ensure you've registered your
+fingerprint with the network.  The fingerprint is usually a SHA1 or
+SHA256 digest in either "normalized" or "openssl" forms.  The first is
+lowercase without delims (@samp{deadbeef}) and the second uppercase
+with colon seps (@samp{DE:AD:BE:EF}).
+
+Additional considerations:
+@enumerate
+@item
+There's no reason to send your password after registering.
+@item
+Most IRCds will allow you to authenticate with a client cert but
+without the hassle of SASL (meaning you may not need this module).
+@item
+Technically, @var{EXTERNAL} merely indicates that an out-of-band mode
+of authentication is in effect (being deferred to), so depending on
+the specific application or service, there's an off chance client
+certs aren't involved.
+@end enumerate
+@end indentedblock
+
+@var{ecdsa-nist256p-challenge}:
+
+@indentedblock
+This mechanism is quite complicated and currently requires the
+external @samp{openssl} executable, so please use something else if at
+all possible.  Ignoring that, specify your key file (e.g.,
+@samp{~/pki/mykey.pem}) as the value of @code{erc-sasl-password}, and
+then configure your network settings.  On servers running Atheme
+services, you can add your public key with @samp{NickServ} like so:
+
+@example
+ERC> /msg NickServ set property \
+     pubkey AgGZmlYTUjJlea/BVz7yrjJ6gysiAPaQxzeUzTH4hd5j
+
+@end example
+(You may be able to omit the @samp{property} subcommand.)
+@end indentedblock
+
+@end defopt
+
+@defopt erc-sasl-user
+This should be your network account name, typically the same one
+registered with nickname services.  Specify this when your
+@samp{NickServ} account name differs from the nick you're connecting
+with.
+@end defopt
+
+@defopt erc-sasl-password
+For ``password-based'' mechanisms, ERC sends any nonempty string as
+the authentication password.
+
+If you instead give a non-@code{nil} symbol, like @samp{Libera.Chat},
+ERC will use it for the @code{:host} field in an auth-source query.
+Actually, the same goes for when this option is @code{nil} but an
+explicit session ID is already on file (@pxref{Network Identifier}).
+For all such queries, ERC specifies the value of @code{erc-sasl-user}
+for the @code{:user} (@code{:login}) param.  Keep in mind that none of
+this matters unless @code{erc-sasl-auth-source-function} holds a
+function (it's @code{nil} by default).
+
+Otherwise, if you set this option to @code{nil} (or the empty string)
+or if an auth-source lookup has failed, ERC will try a non-@code{nil}
+``server password'', likely whatever you gave as the @var{password}
+argument to @code{erc-tls}.  This fallback behavior may change,
+however, so please don't rely on it.  As a last resort, ERC will
+prompt you for input.
+
+Also, if your mechanism is @code{ecdsa-nist256p-challenge}, this
+option should instead hold the file name of your key.
+@end defopt
+
+@defopt erc-sasl-auth-source-function
+This is nearly identical to the other ERC @samp{auth-source} function
+options (@pxref{ERC auth-source functions}) except that the default
+value here is @code{nil}, meaning you have to set it to something like
+@code{erc-auth-source-search} for queries to be performed.
+@end defopt
+
+@defopt erc-sasl-authzid
+In the rarest of circumstances, a network may want you to specify a
+specific role or assume an alternate identity.  In most cases, this
+happens because the server is buggy or misconfigured.  If you suspect
+such a thing, please contact your network operator.  Otherwise, just
+leave this set to @code{nil}.
+@end defopt
+
 
 @node Sample Configuration
 @section Sample Configuration
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 8a00e711ac..3123f64b88 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -156,6 +156,110 @@ erc-subseq
 		 (setq i (1+ i) start (1+ start)))
 	       res))))))
 
+
+;;;; SASL
+
+(declare-function sasl-step-data "sasl" (step))
+(declare-function sasl-error "sasl" (datum))
+(declare-function sasl-client-property "sasl" (client property))
+(declare-function sasl-client-set-property "sasl" (client property value))
+(declare-function sasl-mechanism-name "sasl" (mechanism))
+(declare-function sasl-client-name "sasl" (client))
+(declare-function sasl-client-mechanism "sasl" (client))
+(declare-function sasl-read-passphrase "sasl" (prompt))
+(declare-function sasl-unique-id "sasl" nil)
+(declare-function decode-hex-string "hex-util" (string))
+(declare-function rfc2104-hash "rfc2104" (hash block-length hash-length
+                                               key text))
+(declare-function sasl-scram--client-first-message-bare "sasl-scram-rfc"
+                  (client))
+(declare-function cl-mapcar "cl-lib" (cl-func cl-x &rest cl-rest))
+
+(defun erc-compat--sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
+(defun erc-compat--sasl-scram-client-first-message (client _step)
+  (let ((c-nonce (sasl-unique-id)))
+    (sasl-client-set-property client 'c-nonce c-nonce))
+  (concat (erc-compat--sasl-scram-construct-gs2-header client)
+          (sasl-scram--client-first-message-bare client)))
+
+;; This is `sasl-scram--client-final-message' from sasl-scram-rfc,
+;; with the NO-LINE-BREAK argument of `base64-encode-string' set to t
+;; because https://www.rfc-editor.org/rfc/rfc5802#section-2.1 says:
+;;
+;;  > The use of base64 in SCRAM is restricted to the canonical form
+;;  > with no whitespace.
+;;
+;; Unfortunately, advising `base64-encode-string' won't work
+;; because the byte compiler precomputes the result when all inputs
+;; are constants, as they are in the unpatched version.
+;;
+;; The only other substantial change is the addition of authz support.
+;; This can be dropped if adopted by Emacs 29 and `compat'.  Changes
+;; proposed for 29 are marked with a "; *n", comment below.  See older
+;; versions of lisp/erc/erc-v3-sasl.el (bug#49860) if needing a true
+;; side-by-side diff.  This also inlines the internal function
+;; `sasl-scram--client-first-message-bare' and takes various liberties
+;; with formatting.
+
+(defun erc-compat--sasl-scram--client-final-message
+    (hash-fun block-length hash-length client step)
+  (unless (string-match
+           "^r=\\([^,]+\\),s=\\([^,]+\\),i=\\([0-9]+\\)\\(?:$\\|,\\)"
+           (sasl-step-data step))
+    (sasl-error "Unexpected server response"))
+  (let* ((hmac-fun
+          (lambda (text key)
+            (decode-hex-string
+             (rfc2104-hash hash-fun block-length hash-length key text))))
+         (step-data (sasl-step-data step))
+         (nonce (match-string 1 step-data))
+         (salt-base64 (match-string 2 step-data))
+         (iteration-count (string-to-number (match-string 3 step-data)))
+         (c-nonce (sasl-client-property client 'c-nonce))
+         (cbind-input
+          (if (string-prefix-p c-nonce nonce)
+              (erc-compat--sasl-scram-construct-gs2-header client) ; *1
+            (sasl-error "Invalid nonce from server")))
+         (client-final-message-without-proof
+          (concat "c=" (base64-encode-string cbind-input t) "," ; *2
+                  "r=" nonce))
+         (password
+          (sasl-read-passphrase
+           (format "%s passphrase for %s: "
+                   (sasl-mechanism-name (sasl-client-mechanism client))
+                   (sasl-client-name client))))
+         (salt (base64-decode-string salt-base64))
+         (string-xor (lambda (a b)
+                       (apply #'unibyte-string (cl-mapcar #'logxor a b))))
+         (salted-password (let ((digest (concat salt (string 0 0 0 1)))
+                                (xored nil))
+                            (dotimes (_i iteration-count xored)
+                              (setq digest (funcall hmac-fun digest password))
+                              (setq xored (if (null xored)
+                                              digest
+                                            (funcall string-xor xored
+                                                     digest))))))
+         (client-key (funcall hmac-fun "Client Key" salted-password))
+         (stored-key (decode-hex-string (funcall hash-fun client-key)))
+         (auth-message (concat "n=" (sasl-client-name client)
+                               ",r=" c-nonce "," step-data
+                               "," client-final-message-without-proof))
+         (client-signature (funcall hmac-fun
+                                    (encode-coding-string auth-message 'utf-8)
+                                    stored-key))
+         (client-proof (funcall string-xor client-key client-signature))
+         (client-final-message
+          (concat client-final-message-without-proof ","
+                  "p=" (base64-encode-string client-proof t)))) ; *3
+    (sasl-client-set-property client 'auth-message auth-message)
+    (sasl-client-set-property client 'salted-password salted-password)
+    client-final-message))
+
 (provide 'erc-compat)
 
 ;;; erc-compat.el ends here
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
new file mode 100644
index 0000000000..f36a305247
--- /dev/null
+++ b/lisp/erc/erc-sasl.el
@@ -0,0 +1,396 @@
+;;; erc-sasl.el --- SASL for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published
+;; by the Free Software Foundation, either version 3 of the License,
+;; or (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;; This "non-IRCv3" implementation resembles many others that have
+;; surfaced over the years, the first possibly being:
+;;
+;; https://lists.gnu.org/archive/html/erc-discuss/2012-02/msg00001.html
+;;
+;; See options and Info manual for usage.
+;;
+;; TODO:
+;;
+;; - Find a way to obfuscate the password in memory (via something
+;;   like `auth-source--obfuscate'); it's currently visible in
+;;   backtraces.
+;;
+;; - Implement a proxy mechanism that chooses the strongest available
+;;   mechanism for you.  Requires CAP 3.2 (see bug#49860).
+
+;;; Code:
+(require 'erc)
+(require 'rx)
+(require 'sasl)
+(require 'sasl-scram-rfc)
+(require 'sasl-scram-sha256 nil t)
+
+(defgroup erc-sasl nil
+  "SASL for ERC."
+  :group 'erc
+  :package-version '(ERC . "5.4")) ; FIXME increment on next release
+
+(defcustom erc-sasl-mechanism nil
+  "SASL mechanism to connect with.
+Note that any value other than nil or `external' likely requires
+`erc-sasl-user' and `erc-sasl-password'."
+  :type '(choice (const nil)
+                 (const plain)
+                 (const external)
+                 (const scram-sha-1)
+                 (const scram-sha-256)
+                 (const scram-sha-512)
+                 (const ecdsa-nist256p-challenge)))
+
+(defcustom erc-sasl-user nil
+  "Optional account username to send when authenticating.
+This is also referred to as the authentication identity, or
+\"authcid\".  When nil, applicable mechanisms will use the
+session's current nick."
+  :type '(choice string (const nil)))
+
+(defcustom erc-sasl-password nil
+  "Optional account password to send when authenticating.
+When the value is a string, ERC uses it unconditionally for most
+mechanisms (see below).  As a special case, when the value is a
+non-nil symbol, ERC uses it as the value of the `:host' field in
+an auth-source query, provided `erc-sasl-auth-source-function' is
+set to a function.  When nil, ERC will try a non-nil \"session
+password\", likely one given as the `:password' argument to
+`erc-tls'.  As a last resort, ERC will prompt the user for input.
+
+Note that when `erc-sasl-mechanism' is set to
+`ecdsa-nist256p-challenge', this option should hold the file name
+of the key, which is typically in PEM format."
+  :type '(choice (const nil) string symbol))
+
+(defcustom erc-sasl-auth-source-function nil
+  "Function to query auth-source for an SASL password.
+Called with keyword params known to `auth-source-search', which
+may include a non-nil `erc-sasl-user' for the `:user' field
+and a non-nil `erc-sasl-password' for the `:host' field, when
+the latter option is a symbol instead of a string.  In return,
+ERC expects a string to send as the SASL password, or nil, to
+move on to the next approach, as described in the doc string for
+the option `erc-sasl-password'.  See info node `(erc)
+Connecting' for details on ERC's auth-source integration."
+  :type '(choice (const erc-auth-source-search)
+                 (const nil)
+                 function))
+
+(defcustom erc-sasl-authzid nil
+  "SASL authorization identity, likely unneeded for everyday use."
+  :type '(choice (const nil) string))
+
+
+;; Analogous to what erc-backend does to persist opening params.
+(defvar-local erc-sasl--options nil)
+
+;; Session-local (server buffer) SASL subproto state
+(defvar-local erc-sasl--state nil)
+
+(cl-defstruct erc-sasl--state
+  "Holder for client object and subproto state."
+  (client nil :type vector)
+  (step nil :type vector)
+  (pending nil :type string))
+
+(defun erc-sasl--read-password (prompt)
+  "Return configured option or server password.
+PROMPT is passed to `read-passwd' if necessary."
+  (let* ((pass (alist-get 'password erc-sasl--options))
+         (found
+          (or (and (stringp pass) (not (string-empty-p pass)) pass)
+              (and erc-sasl-auth-source-function
+                   (let ((user (alist-get 'user erc-sasl--options))
+                         (host (or pass
+                                   (erc-networks--id-given erc-networks--id))))
+                     (apply erc-sasl-auth-source-function
+                            `(,@(and user (list :user user))
+                              ,@(and host (list :host (symbol-name host)))))))
+              erc-session-password)))
+    (if found
+        (copy-sequence found)
+      (read-passwd prompt))))
+
+(defun erc-sasl--plain-response (client steps)
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (sasl-plain-response client steps)))
+
+(declare-function erc-compat--sasl-scram--client-final-message "erc-compat"
+                  (hash-fun block-length hash-length client step))
+
+(defun erc-sasl--scram-sha-hack-client-final-message (&rest args)
+  ;; In the future (29+), we'll hopefully be able to call
+  ;; `sasl-scram--client-final-message' directly
+  (require 'erc-compat)
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (apply #'erc-compat--sasl-scram--client-final-message args)))
+
+(defun erc-sasl--scram-sha-1-client-final-message (client step)
+  (erc-sasl--scram-sha-hack-client-final-message 'sha1 64 20 client step))
+
+(defun erc-sasl--scram-sha-256-client-final-message (client step)
+  (erc-sasl--scram-sha-hack-client-final-message 'sasl-scram-sha256 64 32
+                                                 client step))
+
+(defun erc-sasl--scram-sha512 (object &optional start end binary)
+  (secure-hash 'sha512 object start end binary))
+
+(defun erc-sasl--scram-sha-512-client-final-message (client step)
+  (erc-sasl--scram-sha-hack-client-final-message #'erc-sasl--scram-sha512
+                                                 128 64 client step))
+
+(defun erc-sasl--scram-sha-512-authenticate-server (client step)
+  (sasl-scram--authenticate-server #'erc-sasl--scram-sha512
+                                   128 64 client step))
+
+(defun erc-sasl--ecdsa-first (client _step)
+  "Return CLIENT name."
+  (sasl-client-name client))
+
+;; FIXME do this with gnutls somehow
+(defun erc-sasl--ecdsa-sign (client step)
+  "Return signed challenge for CLIENT and current STEP."
+  (let ((challenge (sasl-step-data step)))
+    (with-temp-buffer
+      (set-buffer-multibyte nil)
+      (insert challenge)
+      (call-process-region (point-min) (point-max)
+                           "openssl" 'delete t nil "pkeyutl" "-inkey"
+                           (sasl-client-property client 'ecdsa-keyfile)
+                           "-sign")
+      (buffer-string))))
+
+(pcase-dolist
+    (`(,name . ,steps)
+     '(("PLAIN"
+        erc-sasl--plain-response)
+       ("EXTERNAL"
+        ignore)
+       ("SCRAM-SHA-1"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-1-client-final-message
+        sasl-scram-sha-1-authenticate-server)
+       ("SCRAM-SHA-256"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-256-client-final-message
+        sasl-scram-sha-256-authenticate-server)
+       ("SCRAM-SHA-512"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-512-client-final-message
+        erc-sasl--scram-sha-512-authenticate-server)
+       ("ECDSA-NIST256P-CHALLENGE"
+        erc-sasl--ecdsa-first
+        erc-sasl--ecdsa-sign)))
+  (let ((feature (intern (concat "erc-sasl-" (downcase name)))))
+    (put feature 'sasl-mechanism (sasl-make-mechanism name steps))
+    (provide feature)))
+
+(cl-defgeneric erc-sasl--create-client (mechanism)
+  "Create and return a new SASL client object for MECHANISM."
+  (let ((sasl-mechanism-alist (copy-sequence sasl-mechanism-alist))
+        (sasl-mechanisms sasl-mechanisms)
+        (name (upcase (symbol-name mechanism)))
+        (feature (intern (concat "erc-sasl-" (symbol-name mechanism))))
+        client)
+    (setf (alist-get name sasl-mechanism-alist nil nil #'equal) `(,feature))
+    (cl-pushnew name sasl-mechanisms :test #'equal)
+    (setq client (sasl-make-client (sasl-find-mechanism `(,name))
+                                   (or (alist-get 'user erc-sasl--options)
+                                       (erc-downcase (erc-current-nick)))
+                                   "N/A" "N/A"))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+(cl-defmethod erc-sasl--create-client ((_m (eql plain)))
+  "Create and return a new PLAIN client object."
+  ;; https://tools.ietf.org/html/rfc4616#section-2.
+  (let* ((sans (remq (assoc "PLAIN" sasl-mechanism-alist)
+                     sasl-mechanism-alist))
+         (sasl-mechanism-alist (cons '("PLAIN" erc-sasl-plain) sans))
+         (authc (or (alist-get 'user erc-sasl--options)
+                    (erc-downcase (erc-current-nick))))
+         (port (if (numberp erc-session-port)
+                   (number-to-string erc-session-port)
+                 "0"))
+         ;; In most cases, `erc-server-announced-name' won't be known.
+         (host (or erc-server-announced-name erc-session-server))
+         (mech (sasl-find-mechanism '("PLAIN")))
+         (client (sasl-make-client mech authc port host)))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-256)))
+  "Create and return a new SCRAM-SHA-256 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-512)))
+  "Create and return a new SCRAM-SHA-512 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((_ (eql ecdsa-nist256p-challenge)))
+  "Create and return a new ECDSA-NIST256P-CHALLENGE client."
+  (unless (executable-find "openssl")
+    (user-error "Could not find openssl command-line utility"))
+  (let ((keyfile (cdr (assq 'password erc-sasl--options))))
+    (unless (and keyfile (file-exists-p keyfile))
+      (user-error "`erc-sasl-password' does not point to ECDSA keyfile"))
+    (let ((client (cl-call-next-method)))
+      (sasl-client-set-property client 'ecdsa-keyfile keyfile)
+      client)))
+
+;; This stands alone because it's also used by bug#49860
+(defun erc-sasl--init ()
+  (setq erc-sasl--state (make-erc-sasl--state)
+        erc-sasl--options `((user . ,erc-sasl-user)
+                            (password . ,erc-sasl-password)
+                            (mechanism . ,erc-sasl-mechanism)
+                            (authzid . ,erc-sasl-authzid))))
+
+(defun erc-sasl--mechanism-offered-p (offered)
+  "Return non-nil when OFFERED appears among a list of mechanisms."
+  (string-match-p (rx-to-string
+                   `(: (| bot ",")
+                       ,(symbol-name
+                         (alist-get 'mechanism erc-sasl--options))
+                       (| eot ",")))
+                  (downcase offered)))
+
+(defun erc-sasl--authenticate-handler (_proc parsed)
+  "Handle PARSED `erc-response' from server.
+Maybe transition to next state."
+  (if-let* ((response (car (erc-response.command-args parsed)))
+            ((= 400 (length response))))
+      (cl-callf (lambda (s) (concat s response))
+          (erc-sasl--state-pending erc-sasl--state))
+    (cl-assert response t)
+    (when (string= "+" response)
+      (setq response ""))
+    (setf response (base64-decode-string
+                    (concat (erc-sasl--state-pending erc-sasl--state) response))
+          (erc-sasl--state-pending erc-sasl--state) nil)
+    ;; The server is done sending, so our turn
+    (let ((client (erc-sasl--state-client erc-sasl--state))
+          (step (erc-sasl--state-step erc-sasl--state))
+          data)
+      (when step
+        (sasl-step-set-data step response))
+      (setq step (setf (erc-sasl--state-step erc-sasl--state)
+                       (sasl-next-step client step))
+            data (sasl-step-data step))
+      (when (string= data "")
+        (setq data nil))
+      (when data
+        (setq data (base64-encode-string data t)))
+      ;; No need for : because no spaces (right?)
+      (erc-server-send (concat "AUTHENTICATE " (or data "+"))))))
+
+(erc-define-catalog
+ 'english
+ '((s902 . "ERR_NICKLOCKED nick %n unavailable: %s")
+   (s904 . "ERR_SASLFAIL (authentication failed) %s")
+   (s905 . "ERR SASLTOOLONG (credentials too long) %s")
+   (s906 . "ERR_SASLABORTED (authentication aborted) %s")
+   (s907 . "ERR_SASLALREADY (already authenticated) %s")
+   (s908 . "RPL_SASLMECHS (unsupported mechanism %m) %s")))
+
+(define-erc-module sasl nil
+  "Non-IRCv3 SASL support for ERC.
+This doesn't solicit or validate a suite of supported mechanisms."
+  ;; See bug#49860 for a full, CAP 3.2-aware implementation, currently
+  ;; a WIP as of ERC 5.5.
+  ((unless erc--target
+     (add-hook 'erc-server-AUTHENTICATE-functions
+               #'erc-sasl--authenticate-handler 0 t)
+     (erc-sasl--init)
+     (let* ((mech (alist-get 'mechanism erc-sasl--options))
+            (client (erc-sasl--create-client mech)))
+       (unless client
+         (erc-display-error-notice nil (format "Unknown mechanism: %s" mech))
+         (erc-error "Unknown mechanism: %s" mech))
+       (setf (erc-sasl--state-client erc-sasl--state) client))))
+  ((remove-hook 'erc-server-AUTHENTICATE-functions
+                #'erc-sasl--authenticate-handler t)
+   (kill-local-variable 'erc-sasl--options))
+  'local)
+
+;; FIXME use generic mechanism instead of hooks after bug#49860.
+(define-erc-response-handler (AUTHENTICATE)
+  "Maybe authenticate to server." nil)
+
+(defun erc-sasl--destroy (proc)
+  (run-hook-with-args 'erc-quit-hook proc)
+  (delete-process proc)
+  (erc-error "Disconnected from %s; please review SASL settings" proc))
+
+(define-erc-response-handler (902)
+  "Handle a ERR_NICKLOCKED response." nil
+  (erc-display-message parsed '(notice error) 'active 's902
+                       ?n (car (erc-response.command-args parsed))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(define-erc-response-handler (903)
+  "Handle a RPL_SASLSUCCESS response." nil
+  (when erc-sasl-mode
+    (unless erc-server-connected
+      (erc-server-send "CAP END")))
+  (erc-handle-unknown-server-response proc parsed))
+
+(define-erc-response-handler (907)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's907
+                       ?s (erc-response.contents parsed)))
+
+(define-erc-response-handler (904 905 906)
+  "Handle various SASL-related error responses." nil
+  (erc-display-message parsed '(notice error) 'active
+                       (intern (format "s%s" (erc-response.command parsed)))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(define-erc-response-handler (908)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's908
+                       '?m (alist-get 'mechanism erc-sasl--options)
+                       '?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(cl-defmethod erc--register-connection (&context (erc-sasl-mode (eql t)))
+  "Send speculative/pipelined CAP and AUTHENTICATE and hope for the best."
+  (erc-server-send "CAP REQ :sasl")
+  (erc-login)
+  (let* ((c (erc-sasl--state-client erc-sasl--state))
+         (m (sasl-mechanism-name (sasl-client-mechanism c))))
+    (erc-server-send (format "AUTHENTICATE %s" m))))
+
+(provide 'erc-sasl)
+;;; erc-sasl.el ends here
+;;
+;; Local Variables:
+;; generated-autoload-file: "erc-loaddefs.el"
+;; End:
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 2601ebfc70..7c72085fea 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -2121,6 +2121,7 @@ erc-modules
     (const :tag "readonly: Make displayed lines read-only" readonly)
     (const :tag "replace: Replace text in messages" replace)
     (const :tag "ring: Enable an input history" ring)
+    (const :tag "sasl: Enable SASL authentication" sasl)
     (const :tag "scrolltobottom: Scroll to the bottom of the buffer"
            scrolltobottom)
     (const :tag "services: Identify to Nickserv (IRC Services) automatically"
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
new file mode 100644
index 0000000000..112303baf5
--- /dev/null
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -0,0 +1,302 @@
+;;; erc-sasl-tests.el --- Tests for erc-sasl.  -*- lexical-binding:t -*-
+
+;; Copyright (C) 2020-2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation, either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;;; Code:
+
+(require 'ert-x)
+(require 'erc-sasl)
+
+(ert-deftest erc-sasl--mechanism-offered-p ()
+  (let ((erc-sasl--options '((mechanism . external))))
+    (should (erc-sasl--mechanism-offered-p "foo,external"))
+    (should (erc-sasl--mechanism-offered-p "external,bar"))
+    (should (erc-sasl--mechanism-offered-p "foo,external,bar"))
+    (should-not (erc-sasl--mechanism-offered-p "fooexternal"))
+    (should-not (erc-sasl--mechanism-offered-p "externalbar"))))
+
+(ert-deftest erc-sasl--read-password ()
+  (ert-info ("Explicit erc-sasl-password")
+    (let ((erc-sasl--options '((password . "foo"))))
+      (should (string= (erc-sasl--read-password nil) "foo"))))
+
+  (ert-info ("Fallback to erc-session-password")
+    (let ((erc-session-password "bar")
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar")))
+    (let ((erc-session-password "bar")
+          (erc-sasl--options '((user . "tester") (password)))
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar"))))
+
+  (let* ((entries (list
+                   "machine FSF.chat port 6697 user bob password sesame"
+                   ;; This must come *after* ^, else *1 (below) always passes
+                   "machine GNU/chat port 6697 user bob password spam"
+                   "machine MyHost port irc password 123"))
+         (netrc-file (make-temp-file "auth-source-test" nil nil
+                                     (mapconcat 'identity entries "\n")))
+         (auth-sources (list netrc-file))
+         (erc-session-server "irc.gnu.org")
+         (erc-session-port 6697)
+         (erc-networks--id (erc-networks--id-create nil))
+         ;;
+         (erc-sasl-auth-source-function #'erc--auth-source-search)
+         erc-server-announced-name ; too early
+         auth-source-do-cache)
+
+    (unwind-protect
+        (ert-info ("Auth source")
+
+          (ert-info ("Symbol as password specifies machine")
+            (let ((erc-sasl--options '((user . "bob")
+                                       (password . FSF.chat)))
+                  (erc-networks--id (make-erc-networks--id)))
+              (should (string= (erc-sasl--read-password nil) "sesame"))))
+
+          (ert-info ("Use session ID when password empty") ; *1
+            (let ((erc-sasl--options '((user . "bob") (password)))
+                  (erc-networks--id (erc-networks--id-create 'GNU/chat)))
+              (should (string= (erc-sasl--read-password nil) "spam")))))
+
+      (delete-file netrc-file))
+
+    (ert-info ("Prompt when search fails and server password null")
+      (let ((erc-sasl-auth-source-function #'ignore))
+        (should (string= (ert-simulate-keys "baz\r"
+                           (erc-sasl--read-password "pwd:"))
+                         "baz"))))))
+
+(ert-deftest erc-sasl-create-client--plain ()
+  (let* ((erc-session-password "password123")
+         (erc-server-current-nick "tester")
+         (erc-session-port 1667)
+         (erc-session-server "localhost")
+         (client (erc-sasl--create-client 'plain))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [erc-sasl--plain-response
+                                 "\0tester\0password123"])
+                   (format "%S" result)))
+    (should (string= (sasl-step-data result) "\0tester\0password123"))
+    (should-not (sasl-next-step client result)))
+  (should (equal (assoc-default "PLAIN" sasl-mechanism-alist) '(sasl-plain))))
+
+(ert-deftest erc-sasl-create-client--external ()
+  (let* ((erc-server-current-nick "tester")
+         (client (erc-sasl--create-client 'external))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [ignore nil]) (format "%S" result)))
+    (should-not (sasl-step-data result))
+    (should-not (sasl-next-step client result)))
+  (should-not (member "EXTERNAL" sasl-mechanisms))
+  (should-not (assoc-default "EXTERNAL" sasl-mechanism-alist)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-1 ()
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-1))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                          "s=5mJO6d4rjCnsBU1X,"
+                          "i=4096"))
+            (req (concat "c=bixhPWppbGxlcyw=,"
+                         "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                         "p=OVUhgPu8wEm2cDoVLfaHzVUYPWU=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-1-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=ZWR23c9MJir0ZgfGf5jEtLOn6Ng="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256 ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                   "s=MTk2M2VkMzM5ZmU0NDRiYmI0MzIyOGVhN2YwNzYwNmI=,"
+                   "i=4096"))
+            (req (concat
+                  "c=bixhPWppbGxlcyw=,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                  "p=1vDesVBzJmv0lX0Ae1kHFtdVHkC6j4gISKVqaR45HFg=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=gUePTYSZN9xgcE06KSyKO9fUmSwH26qifoapXyEs75s="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                   "s=ZTg1MmE1YmFhZGI1NDcyMjk3NzYwZmRjZDM3Y2I1OTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                  "p=LP4sjJrjJKp5qTsARyZCppXpKLu4FMM284hNESPvGhI=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=847WXfnmReGyE1qlq1And6R4bPBNROTZ7EMS/QrJtUM="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-512--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha512"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-512))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                   "s=YzMzOWZiY2U0YzcwNDA0M2I4ZGE2M2ZjOTBjODExZTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                  "p=vMBb9tKxFAfBtel087/GLbo4objAIYr1wM+mFv/jYLKXE"
+                  "NUF0vynm81qQbywQE5ScqFFdAfwYMZq/lj4s0V1OA==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format
+                        "%S" `[erc-sasl--scram-sha-512-client-final-message
+                               ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp (concat "v=Va7NIvt8wCdhvxnv+bZriSxGoto6On5EVnRHO/ece8zs0"
+                          "qpQassdqir1Zlwh3e3EmBq+kcSy+ClNCsbzBpXe/w==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(defconst erc-sasl-tests-ecdsa-key-file "
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIIJueQ3W2IrGbe9wKdOI75yGS7PYZSj6W4tg854hlsvmoAoGCCqGSM49
+AwEHoUQDQgAEAZmaVhNSMmV5r8FXPvKuMnqDKyIA9pDHN5TNMfiF3mMeikGgK10W
+IRX9cyi2wdYg9mUUYyh9GKdBCYHGUJAiCA==
+-----END EC PRIVATE KEY-----
+")
+
+(ert-deftest erc-sasl-create-client-ecdsa ()
+  (unless (executable-find "openssl")
+    (ert-skip "System lacks openssl"))
+  (ert-with-temp-file keyfile
+    :prefix "ecdsa_key"
+    :suffix ".pem"
+    :text erc-sasl-tests-ecdsa-key-file
+    (let* ((erc-server-current-nick "jilles")
+           (erc-sasl--options `((password . ,keyfile)))
+           (client (erc-sasl--create-client 'ecdsa-nist256p-challenge))
+           (step (sasl-next-step client nil)))
+      (ert-info ("Client's initial request")
+        (should (equal (format "%S" [erc-sasl--ecdsa-first "jilles"])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) "jilles")))
+      (ert-info ("Server's initial response")
+        (let ((resp (concat "\0\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20"
+                            "\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37")))
+          (sasl-step-set-data step resp)
+          (setq step (sasl-next-step client step))
+          ;; FIXME this is dumb
+          (should (<= 68 (length (sasl-step-data step)) 72))))
+      (should-not (sasl-next-step client step)))))
+
+;;; erc-sasl-tests.el ends here
diff --git a/test/lisp/erc/erc-scenarios-sasl.el b/test/lisp/erc/erc-scenarios-sasl.el
new file mode 100644
index 0000000000..3ff7cc805d
--- /dev/null
+++ b/test/lisp/erc/erc-scenarios-sasl.el
@@ -0,0 +1,161 @@
+;;; erc-scenarios-sasl.el --- SASL tests for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; This program is free software: you can redistribute it and/or
+;; modify it under the terms of the GNU General Public License as
+;; published by the Free Software Foundation, either version 3 of the
+;; License, or (at your option) any later version.
+;;
+;; This program is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program.  If not, see
+;; <https://www.gnu.org/licenses/>.
+
+;;; Code:
+
+(require 'ert-x)
+(eval-and-compile
+  (let ((load-path (cons (ert-resource-directory) load-path)))
+    (require 'erc-scenarios-common)))
+
+(declare-function sasl-client-name "sasl" (client))
+
+(require 'erc-scenarios-common)
+(require 'erc-sasl)
+
+(ert-deftest erc-scenarios-sasl--plain ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'plain)
+       (erc-sasl-password "password123")
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "This server is in debug mode")
+        ;; Regression "\0\0\0\0 ..." caused by (fillarray passphrase 0)
+        (should (string= erc-sasl-password "password123"))))))
+
+(ert-deftest erc-scenarios-sasl--external ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'external))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'external)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "903 * Authentication successful")
+        (funcall expect 10 "This server is in debug mode")))))
+
+(ert-deftest erc-scenarios-sasl--plain-fail ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain-failed))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "wrong")
+       (erc-sasl-mechanism 'plain)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter))
+       (buf nil))
+
+    (ert-info ("Connect")
+      (setq buf (erc :server "127.0.0.1"
+                     :port port
+                     :nick "tester"
+                     :user "tester"
+                     :full-name "tester"))
+      (let ((err (should-error
+                  (with-current-buffer buf
+                    (funcall expect 20 "Connection failed!")))))
+        (should (string-search "please review" (cadr err)))
+        (with-current-buffer buf
+          (funcall expect 10 "Opening connection")
+          (funcall expect 20 "SASL authentication failed")
+          (should-not (erc-server-process-alive)))))))
+
+(defun erc-scenarios--common--sasl (mech)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t mech))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "sesame")
+       (erc-sasl-mechanism mech)
+       (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+       (sasl-unique-id-function (lambda () (pop mock-rvs)))
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "jilles"
+                                :full-name "jilles")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "jaguar"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "jaguar"
+        (funcall expect 10 "Found your hostname")
+        (funcall expect 20 "marked as being away")))))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-1 ()
+  :tags '(:expensive-test)
+  (let ((erc-sasl-authzid "jilles"))
+    (erc-scenarios--common--sasl 'scram-sha-1)))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-256 ()
+  :tags '(:expensive-test)
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (erc-scenarios--common--sasl 'scram-sha-256))
+
+;;; erc-scenarios-sasl.el ends here
diff --git a/test/lisp/erc/resources/sasl/external.eld b/test/lisp/erc/resources/sasl/external.eld
new file mode 100644
index 0000000000..2cd237ec4d
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/external.eld
@@ -0,0 +1,33 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester"))
+
+((auth-req 3.2 "AUTHENTICATE EXTERNAL")
+ (0.0 ":irc.example.org CAP * ACK :sasl")
+ (0.0 "AUTHENTICATE +"))
+
+((auth-noop 3.2 "AUTHENTICATE +")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/plain-failed.eld b/test/lisp/erc/resources/sasl/plain-failed.eld
new file mode 100644
index 0000000000..336700290c
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain-failed.eld
@@ -0,0 +1,16 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.foonet.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.foonet.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.foonet.org CAP * ACK :cap-notify sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.foonet.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgB3cm9uZw==")
+ (0.0 ":irc.foonet.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.foonet.org 904 * :SASL authentication failed: Invalid account credentials"))
+
+((cap-end 3.2 "CAP END"))
diff --git a/test/lisp/erc/resources/sasl/plain.eld b/test/lisp/erc/resources/sasl/plain.eld
new file mode 100644
index 0000000000..9c6ce3feeb
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain.eld
@@ -0,0 +1,35 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.example.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.example.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.example.org CAP * ACK :sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.example.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgBwYXNzd29yZDEyMw==")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-1.eld b/test/lisp/erc/resources/sasl/scram-sha-1.eld
new file mode 100644
index 0000000000..49980e9e12
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-1.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-1")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE bixhPWppbGxlcyxuPWppbGxlcyxyPWM1UnFMQ1p5MEw0ZkdrS0FaMGh1akZCcw==")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNYUW9LY2l2cUN3OWlEWlBTcGIscz01bUpPNmQ0cmpDbnNCVTFYLGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXhoUFdwcGJHeGxjeXc9LHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzWFFvS2NpdnFDdzlpRFpQU3BiLHA9T1ZVaGdQdTh3RW0yY0RvVkxmYUh6VlVZUFdVPQ==")
+ (0 "AUTHENTICATE dj1aV1IyM2M5TUppcjBaZ2ZHZjVqRXRMT242Tmc9"))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-256.eld b/test/lisp/erc/resources/sasl/scram-sha-256.eld
new file mode 100644
index 0000000000..74de9a23ec
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-256.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-256")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE biwsbj1qaWxsZXMscj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnM=")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNkNDA2N2YwYWZkYjU0YzNkYmQ0ZmU2NDViODRjYWUzNyxzPVpUZzFNbUUxWW1GaFpHSTFORGN5TWprM056WXdabVJqWkRNM1kySTFPVE09LGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXdzLHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzZDQwNjdmMGFmZGI1NGMzZGJkNGZlNjQ1Yjg0Y2FlMzcscD1MUDRzakpyakpLcDVxVHNBUnlaQ3BwWHBLTHU0Rk1NMjg0aE5FU1B2R2hJPQ==")
+ (0 "AUTHENTICATE dj04NDdXWGZubVJlR3lFMXFscTFBbmQ2UjRiUEJOUk9UWjdFTVMvUXJKdFVNPQ=="))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
-- 
2.37.3


^ permalink raw reply related	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]       ` <878rljxfxs.fsf@neverwas.me>
@ 2022-10-26 13:14         ` J.P.
       [not found]         ` <87k04m4th8.fsf@neverwas.me>
  1 sibling, 0 replies; 54+ messages in thread
From: J.P. @ 2022-10-26 13:14 UTC (permalink / raw)
  To: 29108; +Cc: emacs-erc, bandali

[-- Attachment #1: Type: text/plain, Size: 555 bytes --]

"J.P." <jp@neverwas.me> writes:

> Note: these patches may not be fully functional because the "actual"
> (WIP version) is based atop bug#56340, whereas these have been
> modified to produce a smaller diff.

I now realize that was probably just confusing (sorry), so I've attached
the full set with dependencies for clarity. I'd really like this thing
to see some daylight, so if anyone can find the time to take a quick
look, please do (Cc. bandali). I think most folks would agree that an
ERC without SASL in Emacs 29 would be less than ideal. Thanks.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0000-v4-v5.diff --]
[-- Type: text/x-patch, Size: 43949 bytes --]

From 27242c8becae2962972c2a6cfdf4de44d276184b Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Wed, 26 Oct 2022 00:58:17 -0700
Subject: [PATCH 0/5] *** NOT A PATCH ***

*** BLURB HERE ***

Dick R. Chiang (1):
  Move ERC's core dependencies to separate file

F. Jason Park (4):
  Add GS2 authorization to sasl-scram-rfc
  Support local ERC modules in erc-mode buffers
  Call erc-login indirectly via new generic wrapper
  Add non-IRCv3 SASL module to ERC

 doc/misc/erc.texi                             | 138 +++++-
 lisp/erc/erc-backend.el                       | 137 +++++-
 lisp/erc/erc-common.el                        | 283 +++++++++++
 lisp/erc/erc-compat.el                        | 116 +++++
 lisp/erc/erc-goodies.el                       |  18 +-
 lisp/erc/erc-networks.el                      |  28 +-
 lisp/erc/erc-sasl.el                          | 396 ++++++++++++++++
 lisp/erc/erc.el                               | 447 ++++--------------
 lisp/net/sasl-scram-rfc.el                    |  21 +-
 test/lisp/erc/erc-networks-tests.el           |   2 +-
 test/lisp/erc/erc-sasl-tests.el               | 302 ++++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 161 +++++++
 test/lisp/erc/erc-tests.el                    |  69 ++-
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  35 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 ++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 ++
 18 files changed, 1889 insertions(+), 407 deletions(-)
 create mode 100644 lisp/erc/erc-common.el
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

Interdiff:
diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index 25c4481d1d..fee29e7d05 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -99,24 +99,117 @@
 ;;; Code:
 
 (eval-when-compile (require 'cl-lib))
-;; There's a fairly strong mutual dependency between erc.el and erc-backend.el.
-;; Luckily, erc.el does not need erc-backend.el for macroexpansion whereas the
-;; reverse is true:
-(require 'erc)
+(require 'erc-common)
+
+(defvar erc--target)
+(defvar erc-auto-query)
+(defvar erc-channel-list)
+(defvar erc-channel-users)
+(defvar erc-default-nicks)
+(defvar erc-default-recipients)
+(defvar erc-format-nick-function)
+(defvar erc-format-query-as-channel-p)
+(defvar erc-hide-prompt)
+(defvar erc-input-marker)
+(defvar erc-insert-marker)
+(defvar erc-invitation)
+(defvar erc-join-buffer)
+(defvar erc-kill-buffer-on-part)
+(defvar erc-kill-server-buffer-on-quit)
+(defvar erc-log-p)
+(defvar erc-minibuffer-ignored)
+(defvar erc-networks--id)
+(defvar erc-nick)
+(defvar erc-nick-change-attempt-count)
+(defvar erc-prompt-for-channel-key)
+(defvar erc-prompt-hidden)
+(defvar erc-reuse-buffers)
+(defvar erc-verbose-server-ping)
+(defvar erc-whowas-on-nosuchnick)
+
+(declare-function erc--open-target "erc" (target))
+(declare-function erc--target-from-string "erc" (string))
+(declare-function erc-active-buffer "erc" nil)
+(declare-function erc-add-default-channel "erc" (channel))
+(declare-function erc-banlist-update "erc" (proc parsed))
+(declare-function erc-buffer-filter "erc" (predicate &optional proc))
+(declare-function erc-buffer-list-with-nick "erc" (nick proc))
+(declare-function erc-channel-begin-receiving-names "erc" nil)
+(declare-function erc-channel-end-receiving-names "erc" nil)
+(declare-function erc-channel-p "erc" (channel))
+(declare-function erc-channel-receive-names "erc" (names-string))
+(declare-function erc-cmd-JOIN "erc" (channel &optional key))
+(declare-function erc-connection-established "erc" (proc parsed))
+(declare-function erc-current-nick "erc" nil)
+(declare-function erc-current-nick-p "erc" (nick))
+(declare-function erc-current-time "erc" (&optional specified-time))
+(declare-function erc-default-target "erc" nil)
+(declare-function erc-delete-default-channel "erc" (channel &optional buffer))
+(declare-function erc-display-error-notice "erc" (parsed string))
+(declare-function erc-display-server-message "erc" (_proc parsed))
+(declare-function erc-emacs-time-to-erc-time "erc" (&optional specified-time))
+(declare-function erc-format-message "erc" (msg &rest args))
+(declare-function erc-format-privmessage "erc" (nick msg privp msgp))
+(declare-function erc-get-buffer "erc" (target &optional proc))
+(declare-function erc-handle-login "erc" nil)
+(declare-function erc-handle-user-status-change "erc" (type nlh &optional l))
+(declare-function erc-ignored-reply-p "erc" (msg tgt proc))
+(declare-function erc-ignored-user-p "erc" (spec))
+(declare-function erc-is-message-ctcp-and-not-action-p "erc" (message))
+(declare-function erc-is-message-ctcp-p "erc" (message))
+(declare-function erc-log-irc-protocol "erc" (string &optional outbound))
+(declare-function erc-login "erc" nil)
+(declare-function erc-make-notice "erc" (message))
+(declare-function erc-network "erc-networks" nil)
+(declare-function erc-networks--id-given "erc-networks" (arg &rest args))
+(declare-function erc-networks--id-reload "erc-networks" (arg &rest args))
+(declare-function erc-nickname-in-use "erc" (nick reason))
+(declare-function erc-parse-user "erc" (string))
+(declare-function erc-process-away "erc" (proc away-p))
+(declare-function erc-process-ctcp-query "erc" (proc parsed nick login host))
+(declare-function erc-query-buffer-p "erc" (&optional buffer))
+(declare-function erc-remove-channel-member "erc" (channel nick))
+(declare-function erc-remove-channel-users "erc" nil)
+(declare-function erc-remove-user "erc" (nick))
+(declare-function erc-sec-to-time "erc" (ns))
+(declare-function erc-server-buffer "erc" nil)
+(declare-function erc-set-active-buffer "erc" (buffer))
+(declare-function erc-set-current-nick "erc" (nick))
+(declare-function erc-set-modes "erc" (tgt mode-string))
+(declare-function erc-time-diff "erc" (t1 t2))
+(declare-function erc-trim-string "erc" (s))
+(declare-function erc-update-mode-line "erc" (&optional buffer))
+(declare-function erc-update-mode-line-buffer "erc" (buffer))
+(declare-function erc-wash-quit-reason "erc" (reason nick login host))
+
+(declare-function erc-display-message "erc"
+                  (parsed type buffer msg &rest args))
+(declare-function erc-get-buffer-create "erc"
+                  (server port target &optional tgt-info id))
+(declare-function erc-process-ctcp-reply "erc"
+                  (proc parsed nick login host msg))
+(declare-function erc-update-channel-topic "erc"
+                  (channel topic &optional modify))
+(declare-function erc-update-modes "erc"
+                  (tgt mode-string &optional _nick _host _login))
+(declare-function erc-update-user-nick "erc"
+                  (nick &optional new-nick host login full-name info))
+(declare-function erc-open "erc"
+                  (&optional server port nick full-name connect passwd tgt-list
+                             channel process client-certificate user id))
+(declare-function erc-update-channel-member "erc"
+                  (channel nick new-nick
+                           &optional add voice halfop op admin owner host
+                           login full-name info update-message-time))
 
 ;;;; Variables and options
 
+(defvar-local erc-session-password nil
+  "The password used for the current session.")
+
 (defvar erc-server-responses (make-hash-table :test #'equal)
   "Hash table mapping server responses to their handler hooks.")
 
-(cl-defstruct (erc-response (:conc-name erc-response.))
-  (unparsed "" :type string)
-  (sender "" :type string)
-  (command "" :type string)
-  (command-args '() :type list)
-  (contents "" :type string)
-  (tags '() :type list))
-
 ;;; User data
 
 (defvar-local erc-server-current-nick nil
@@ -1666,16 +1759,6 @@ erc--parse-isupport-value
          (split-string value ",")
        (list value)))))
 
-(defmacro erc--with-memoization (table &rest forms)
-  "Adapter to be migrated to erc-compat."
-  (declare (indent defun))
-  `(cond
-    ((fboundp 'with-memoization)
-     (with-memoization ,table ,@forms)) ; 29.1
-    ((fboundp 'cl--generic-with-memoization)
-     (cl--generic-with-memoization ,table ,@forms))
-    (t ,@forms)))
-
 (defun erc--get-isupport-entry (key &optional single)
   "Return an item for \"ISUPPORT\" token KEY, a symbol.
 When a lookup fails return nil.  Otherwise return a list whose
@@ -1685,7 +1768,7 @@ erc--get-isupport-entry
 primitive value."
   (if-let* ((table (or erc--isupport-params
                        (erc-with-server-buffer erc--isupport-params)))
-            (value (erc--with-memoization (gethash key table)
+            (value (erc-compat--with-memoization (gethash key table)
                      (when-let ((v (assoc (symbol-name key)
                                           erc-server-parameters)))
                        (if (cdr v)
diff --git a/lisp/erc/erc-common.el b/lisp/erc/erc-common.el
new file mode 100644
index 0000000000..90ea56108d
--- /dev/null
+++ b/lisp/erc/erc-common.el
@@ -0,0 +1,283 @@
+;;; erc-common.el --- Macros and types for ERC  -*- lexical-binding:t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; Maintainer: Amin Bandali <bandali@gnu.org>, F. Jason Park <jp@neverwas.me>
+;; Keywords: comm, IRC, chat, client, internet
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published
+;; by the Free Software Foundation, either version 3 of the License,
+;; or (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+;;; Code:
+
+(eval-when-compile (require 'cl-lib) (require 'subr-x))
+(require 'erc-compat)
+
+(defvar erc--casemapping-rfc1459)
+(defvar erc--casemapping-rfc1459-strict)
+(defvar erc--module-name-migrations)
+(defvar erc-channel-users)
+(defvar erc-dbuf)
+(defvar erc-log-p)
+(defvar erc-server-users)
+(defvar erc-session-server)
+
+(declare-function erc--get-isupport-entry "erc-backend" (key &optional single))
+(declare-function erc-get-buffer "erc" (target &optional proc))
+(declare-function erc-server-buffer "erc" nil)
+
+(cl-defstruct erc-input
+  string insertp sendp)
+
+(cl-defstruct (erc--input-split (:include erc-input))
+  lines cmdp)
+
+(cl-defstruct (erc-server-user (:type vector) :named)
+  ;; User data
+  nickname host login full-name info
+  ;; Buffers
+  ;;
+  ;; This is an alist of the form (BUFFER . CHANNEL-DATA), where
+  ;; CHANNEL-DATA is either nil or an erc-channel-user struct.
+  (buffers nil))
+
+(cl-defstruct (erc-channel-user (:type vector) :named)
+  voice halfop op admin owner
+  ;; Last message time (in the form of the return value of
+  ;; (current-time)
+  ;;
+  ;; This is useful for ordered name completion.
+  (last-message-time nil))
+
+(cl-defstruct erc--target
+  (string "" :type string :documentation "Received name of target.")
+  (symbol nil :type symbol :documentation "Case-mapped name as symbol."))
+
+;; At some point, it may make sense to add a query type with an
+;; account field, which may help support reassociation across
+;; reconnects and nick changes (likely requires v3 extensions).
+;;
+;; These channel variants should probably take on a `joined' field to
+;; track "joinedness", which `erc-server-JOIN', `erc-server-PART',
+;; etc. should toggle.  Functions like `erc--current-buffer-joined-p'
+;; may find it useful.
+
+(cl-defstruct (erc--target-channel (:include erc--target)))
+(cl-defstruct (erc--target-channel-local (:include erc--target-channel)))
+
+(cl-defstruct (erc-response (:conc-name erc-response.))
+  (unparsed "" :type string)
+  (sender "" :type string)
+  (command "" :type string)
+  (command-args '() :type list)
+  (contents "" :type string)
+  (tags '() :type list))
+
+(defun erc--normalize-module-symbol (module)
+  "Canonicalize symbol MODULE for `erc-modules'."
+  (or (cdr (assq module erc--module-name-migrations)) module))
+
+(defmacro define-erc-module (name alias doc enable-body disable-body
+                                  &optional local-p)
+  "Define a new minor mode using ERC conventions.
+Symbol NAME is the name of the module.
+Symbol ALIAS is the alias to use, or nil.
+DOC is the documentation string to use for the minor mode.
+ENABLE-BODY is a list of expressions used to enable the mode.
+DISABLE-BODY is a list of expressions used to disable the mode.
+If LOCAL-P is non-nil, the mode will be created as a buffer-local
+mode, rather than a global one.
+
+This will define a minor mode called erc-NAME-mode, possibly
+an alias erc-ALIAS-mode, as well as the helper functions
+erc-NAME-enable, and erc-NAME-disable.  Beware that for global
+modules, these helpers, as well as the minor-mode toggle, all mutate
+the user option `erc-modules'.
+
+Example:
+
+  ;;;###autoload(autoload \\='erc-replace-mode \"erc-replace\")
+  (define-erc-module replace nil
+    \"This mode replaces incoming text according to `erc-replace-alist'.\"
+    ((add-hook \\='erc-insert-modify-hook
+               #\\='erc-replace-insert))
+    ((remove-hook \\='erc-insert-modify-hook
+                  #\\='erc-replace-insert)))"
+  (declare (doc-string 3) (indent defun))
+  (let* ((sn (symbol-name name))
+         (mode (intern (format "erc-%s-mode" (downcase sn))))
+         (group (intern (format "erc-%s" (downcase sn))))
+         (enable (intern (format "erc-%s-enable" (downcase sn))))
+         (disable (intern (format "erc-%s-disable" (downcase sn)))))
+    `(progn
+       (define-minor-mode
+         ,mode
+         ,(format "Toggle ERC %S mode.
+With a prefix argument ARG, enable %s if ARG is positive,
+and disable it otherwise.  If called from Lisp, enable the mode
+if ARG is omitted or nil.
+%s" name name doc)
+         ;; FIXME: We don't know if this group exists, so this `:group' may
+         ;; actually just silence a valid warning about the fact that the var
+         ;; is not associated with any group.
+         :global ,(not local-p) :group (quote ,group)
+         (if ,mode
+             (,enable)
+           (,disable)))
+       (defun ,enable ()
+         ,(format "Enable ERC %S mode."
+                  name)
+         (interactive)
+         (unless ,local-p
+           (cl-pushnew (erc--normalize-module-symbol ',name) erc-modules))
+         (when (or ,(not local-p) (eq major-mode 'erc-mode))
+           (setq ,mode t)
+           ,@enable-body))
+       (defun ,disable ()
+         ,(format "Disable ERC %S mode."
+                  name)
+         (interactive)
+         (unless ,local-p
+           (setq erc-modules (delq (erc--normalize-module-symbol ',name)
+                                   erc-modules)))
+         (when (or ,(not local-p) ,mode)
+           (setq ,mode nil)
+           ,@disable-body))
+       ,(when (and alias (not (eq name alias)))
+          `(defalias
+             ',(intern
+                (format "erc-%s-mode"
+                        (downcase (symbol-name alias))))
+             #',mode))
+       ;; For find-function and find-variable.
+       (put ',mode    'definition-name ',name)
+       (put ',enable  'definition-name ',name)
+       (put ',disable 'definition-name ',name))))
+
+(defmacro erc-with-buffer (spec &rest body)
+  "Execute BODY in the buffer associated with SPEC.
+
+SPEC should have the form
+
+ (TARGET [PROCESS])
+
+If TARGET is a buffer, use it.  Otherwise, use the buffer
+matching TARGET in the process specified by PROCESS.
+
+If PROCESS is nil, use the current `erc-server-process'.
+See `erc-get-buffer' for details.
+
+See also `with-current-buffer'.
+
+\(fn (TARGET [PROCESS]) BODY...)"
+  (declare (indent 1) (debug ((form &optional form) body)))
+  (let ((buf (make-symbol "buf"))
+        (proc (make-symbol "proc"))
+        (target (make-symbol "target"))
+        (process (make-symbol "process")))
+    `(let* ((,target ,(car spec))
+            (,process ,(cadr spec))
+            (,buf (if (bufferp ,target)
+                      ,target
+                    (let ((,proc (or ,process
+                                     (and (processp erc-server-process)
+                                          erc-server-process))))
+                      (if (and ,target ,proc)
+                          (erc-get-buffer ,target ,proc))))))
+       (when (buffer-live-p ,buf)
+         (with-current-buffer ,buf
+           ,@body)))))
+
+(defmacro erc-with-server-buffer (&rest body)
+  "Execute BODY in the current ERC server buffer.
+If no server buffer exists, return nil."
+  (declare (indent 0) (debug (body)))
+  (let ((buffer (make-symbol "buffer")))
+    `(let ((,buffer (erc-server-buffer)))
+       (when (buffer-live-p ,buffer)
+         (with-current-buffer ,buffer
+           ,@body)))))
+
+(defmacro erc-with-all-buffers-of-server (process pred &rest forms)
+  "Execute FORMS in all buffers which have same process as this server.
+FORMS will be evaluated in all buffers having the process PROCESS and
+where PRED matches or in all buffers of the server process if PRED is
+nil."
+  (declare (indent 2) (debug (form form body)))
+  (macroexp-let2 nil pred pred
+    `(erc-buffer-filter (lambda ()
+                          (when (or (not ,pred) (funcall ,pred))
+                            ,@forms))
+                        ,process)))
+
+(defun erc-log-aux (string)
+  "Do the debug logging of STRING."
+  (let ((cb (current-buffer))
+        (point 1)
+        (was-eob nil)
+        (session-buffer (erc-server-buffer)))
+    (if session-buffer
+        (progn
+          (set-buffer session-buffer)
+          (if (not (and erc-dbuf (bufferp erc-dbuf) (buffer-live-p erc-dbuf)))
+              (progn
+                (setq erc-dbuf (get-buffer-create
+                                (concat "*ERC-DEBUG: "
+                                        erc-session-server "*")))))
+          (set-buffer erc-dbuf)
+          (setq point (point))
+          (setq was-eob (eobp))
+          (goto-char (point-max))
+          (insert (concat "** " string "\n"))
+          (if was-eob (goto-char (point-max))
+            (goto-char point))
+          (set-buffer cb))
+      (message "ERC: ** %s" string))))
+
+(define-inline erc-log (string)
+  "Logs STRING if logging is on (see `erc-log-p')."
+  (inline-quote
+   (when erc-log-p
+     (erc-log-aux ,string))))
+
+(defun erc-downcase (string)
+  "Return a downcased copy of STRING with properties.
+Use the CASEMAPPING ISUPPORT parameter to determine the style."
+  (let* ((mapping (erc--get-isupport-entry 'CASEMAPPING 'single))
+         (inhibit-read-only t))
+    (if (equal mapping "ascii")
+        (downcase string)
+      (with-temp-buffer
+        (insert string)
+        (translate-region (point-min) (point-max)
+                          (if (equal mapping "rfc1459-strict")
+                              erc--casemapping-rfc1459-strict
+                            erc--casemapping-rfc1459))
+        (buffer-string)))))
+
+(define-inline erc-get-channel-user (nick)
+  "Find NICK in the current buffer's `erc-channel-users' hash table."
+  (inline-quote (gethash (erc-downcase ,nick) erc-channel-users)))
+
+(define-inline erc-get-server-user (nick)
+  "Find NICK in the current server's `erc-server-users' hash table."
+  (inline-letevals (nick)
+    (inline-quote (erc-with-server-buffer
+                    (gethash (erc-downcase ,nick) erc-server-users)))))
+
+(provide 'erc-common)
+
+;;; erc-common.el ends here
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 3123f64b88..bc3e1dcfc6 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -260,6 +260,18 @@ erc-compat--sasl-scram--client-final-message
     (sasl-client-set-property client 'salted-password salted-password)
     client-final-message))
 
+
+;;;; Misc 29.1
+
+(defmacro erc-compat--with-memoization (table &rest forms)
+  (declare (indent defun))
+  (cond
+   ((fboundp 'with-memoization)
+    `(with-memoization ,table ,@forms)) ; 29.1
+   ((fboundp 'cl--generic-with-memoization)
+    `(cl--generic-with-memoization ,table ,@forms))
+   (t `(progn ,@forms))))
+
 (provide 'erc-compat)
 
 ;;; erc-compat.el ends here
diff --git a/lisp/erc/erc-goodies.el b/lisp/erc/erc-goodies.el
index 8fef23945d..1af83b58ba 100644
--- a/lisp/erc/erc-goodies.el
+++ b/lisp/erc/erc-goodies.el
@@ -29,10 +29,24 @@
 
 ;;; Code:
 
-(require 'erc)
-
 ;;; Imenu support
 
+(eval-when-compile (require 'cl-lib))
+(require 'erc-common)
+
+(defvar erc-controls-highlight-regexp)
+(defvar erc-controls-remove-regexp)
+(defvar erc-input-marker)
+(defvar erc-insert-marker)
+(defvar erc-server-process)
+(defvar erc-modules)
+(defvar erc-log-p)
+
+(declare-function erc-buffer-list "erc" (&optional predicate proc))
+(declare-function erc-error "erc" (&rest args))
+(declare-function erc-extract-command-from-line "erc" (line))
+(declare-function erc-beg-of-input-line "erc" nil)
+
 (defun erc-imenu-setup ()
   "Setup Imenu support in an ERC buffer."
   (setq-local imenu-create-index-function #'erc-create-imenu-index))
diff --git a/lisp/erc/erc-networks.el b/lisp/erc/erc-networks.el
index 2c8f8fb72b..667b0c3d76 100644
--- a/lisp/erc/erc-networks.el
+++ b/lisp/erc/erc-networks.el
@@ -39,8 +39,32 @@
 
 ;;; Code:
 
-(require 'erc)
 (eval-when-compile (require 'cl-lib))
+(require 'erc-common)
+
+(defvar erc--target)
+(defvar erc-insert-marker)
+(defvar erc-kill-buffer-hook)
+(defvar erc-kill-server-hook)
+(defvar erc-modules)
+(defvar erc-rename-buffers)
+(defvar erc-reuse-buffers)
+(defvar erc-server-announced-name)
+(defvar erc-server-connected)
+(defvar erc-server-parameters)
+(defvar erc-server-process)
+(defvar erc-session-server)
+
+(declare-function erc--default-target "erc" nil)
+(declare-function erc--get-isupport-entry "erc-backend" (key &optional single))
+(declare-function erc-buffer-filter "erc" (predicate &optional proc))
+(declare-function erc-current-nick "erc" nil)
+(declare-function erc-display-error-notice "erc" (parsed string))
+(declare-function erc-error "erc" (&rest args))
+(declare-function erc-get-buffer "erc" (target &optional proc))
+(declare-function erc-server-buffer "erc" nil)
+(declare-function erc-server-process-alive "erc-backend" (&optional buffer))
+(declare-function erc-set-active-buffer "erc" (buffer))
 
 ;; Variables
 
@@ -813,7 +837,7 @@ erc-networks--id-given
   (erc-networks--id-symbol nid))
 
 (cl-generic-define-context-rewriter erc-obsolete-var (var spec)
-  `((with-suppressed-warnings ((obsolete ,var)) ,var) ,spec))
+  `((with-suppressed-warnings ((obsolete ,var) (free-vars ,var)) ,var) ,spec))
 
 ;; As a catch-all, derive the symbol from the unquoted printed repr.
 (cl-defgeneric erc-networks--id-create (id)
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 7c72085fea..994504d72e 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -60,6 +60,9 @@
 
 (load "erc-loaddefs" 'noerror 'nomessage)
 
+(require 'erc-networks)
+(require 'erc-goodies)
+(require 'erc-backend)
 (require 'cl-lib)
 (require 'format-spec)
 (require 'pp)
@@ -69,8 +72,6 @@
 (require 'iso8601)
 (eval-when-compile (require 'subr-x))
 
-(require 'erc-compat)
-
 (defconst erc-version "5.4.1"
   "This version of ERC.")
 
@@ -132,29 +133,12 @@ erc-scripts
   "Running scripts at startup and with /LOAD."
   :group 'erc)
 
-;; Defined in erc-backend
-(defvar erc--server-last-reconnect-count)
-(defvar erc--server-reconnecting)
-(defvar erc-channel-members-changed-hook)
-(defvar erc-network)
-(defvar erc-networks--id)
-(defvar erc-server-367-functions)
-(defvar erc-server-announced-name)
-(defvar erc-server-connect-function)
-(defvar erc-server-connected)
-(defvar erc-server-current-nick)
-(defvar erc-server-lag)
-(defvar erc-server-last-sent-time)
-(defvar erc-server-process)
-(defvar erc-server-quitting)
-(defvar erc-server-reconnect-count)
-(defvar erc-server-reconnecting)
-(defvar erc-session-client-certificate)
-(defvar erc-session-connector)
-(defvar erc-session-port)
-(defvar erc-session-server)
-(defvar erc-session-user-full-name)
-(defvar erc-session-username)
+;; Forward declarations
+(defvar erc-message-parsed)
+
+(defvar tabbar--local-hlf)
+(defvar motif-version-string)
+(defvar gtk-version-string)
 
 ;; tunable connection and authentication parameters
 
@@ -349,9 +333,6 @@ erc-channel-hide-list
   :group 'erc-ignore
   :type 'erc-message-type)
 
-(defvar-local erc-session-password nil
-  "The password used for the current session.")
-
 (defcustom erc-disconnected-hook nil
   "Run this hook with arguments (NICK IP REASON) when disconnected.
 This happens before automatic reconnection.  Note, that
@@ -436,69 +417,14 @@ erc--casemapping-rfc1459-strict
    '((?\[ . ?\{) (?\] . ?\}) (?\\ . ?\|))
    (mapcar (lambda (c) (cons c (+ c 32))) "ABCDEFGHIJKLMNOPQRSTUVWXYZ")))
 
-(defun erc-downcase (string)
-  "Return a downcased copy of STRING with properties.
-Use the CASEMAPPING ISUPPORT parameter to determine the style."
-  (let* ((mapping (erc--get-isupport-entry 'CASEMAPPING 'single))
-         (inhibit-read-only t))
-    (if (equal mapping "ascii")
-        (downcase string)
-      (with-temp-buffer
-        (insert string)
-        (translate-region (point-min) (point-max)
-                          (if (equal mapping "rfc1459-strict")
-                              erc--casemapping-rfc1459-strict
-                            erc--casemapping-rfc1459))
-        (buffer-string)))))
-
-(defmacro erc-with-server-buffer (&rest body)
-  "Execute BODY in the current ERC server buffer.
-If no server buffer exists, return nil."
-  (declare (indent 0) (debug (body)))
-  (let ((buffer (make-symbol "buffer")))
-    `(let ((,buffer (erc-server-buffer)))
-       (when (buffer-live-p ,buffer)
-         (with-current-buffer ,buffer
-           ,@body)))))
-
-(cl-defstruct (erc-server-user (:type vector) :named)
-  ;; User data
-  nickname host login full-name info
-  ;; Buffers
-  ;;
-  ;; This is an alist of the form (BUFFER . CHANNEL-DATA), where
-  ;; CHANNEL-DATA is either nil or an erc-channel-user struct.
-  (buffers nil)
-  )
-
-(cl-defstruct (erc-channel-user (:type vector) :named)
-  voice halfop op admin owner
-  ;; Last message time (in the form of the return value of
-  ;; (current-time)
-  ;;
-  ;; This is useful for ordered name completion.
-  (last-message-time nil))
-
-(define-inline erc-get-channel-user (nick)
-  "Find NICK in the current buffer's `erc-channel-users' hash table."
-  (inline-quote (gethash (erc-downcase ,nick) erc-channel-users)))
-
-(define-inline erc-get-server-user (nick)
-  "Find NICK in the current server's `erc-server-users' hash table."
-  (inline-letevals (nick)
-    (inline-quote (erc-with-server-buffer
-		    (gethash (erc-downcase ,nick) erc-server-users)))))
-
-(define-inline erc-add-server-user (nick user)
+(defun erc-add-server-user (nick user)
   "This function is for internal use only.
 
 Adds USER with nickname NICK to the `erc-server-users' hash table."
-  (inline-letevals (nick user)
-    (inline-quote
-     (erc-with-server-buffer
-       (puthash (erc-downcase ,nick) ,user erc-server-users)))))
+  (erc-with-server-buffer
+    (puthash (erc-downcase nick) user erc-server-users)))
 
-(define-inline erc-remove-server-user (nick)
+(defun erc-remove-server-user (nick)
   "This function is for internal use only.
 
 Removes the user with nickname NICK from the `erc-server-users'
@@ -506,10 +432,8 @@ erc-remove-server-user
 `erc-channel-users' lists of other buffers.
 
 See also: `erc-remove-user'."
-  (inline-letevals (nick)
-    (inline-quote
-     (erc-with-server-buffer
-       (remhash (erc-downcase ,nick) erc-server-users)))))
+  (erc-with-server-buffer
+    (remhash (erc-downcase nick) erc-server-users)))
 
 (defun erc-change-user-nickname (user new-nick)
   "This function is for internal use only.
@@ -580,55 +504,45 @@ erc-remove-channel-users
              erc-channel-users)
     (clrhash erc-channel-users)))
 
-(define-inline erc-channel-user-owner-p (nick)
+(defun erc-channel-user-owner-p (nick)
   "Return non-nil if NICK is an owner of the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
-	  (hash-table-p erc-channel-users)
-	  (let ((cdata (erc-get-channel-user ,nick)))
-	    (and cdata (cdr cdata)
-		 (erc-channel-user-owner (cdr cdata))))))))
-
-(define-inline erc-channel-user-admin-p (nick)
+  (and nick
+       (hash-table-p erc-channel-users)
+       (let ((cdata (erc-get-channel-user nick)))
+         (and cdata (cdr cdata)
+              (erc-channel-user-owner (cdr cdata))))))
+
+(defun erc-channel-user-admin-p (nick)
   "Return non-nil if NICK is an admin in the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
+  (and nick
        (hash-table-p erc-channel-users)
-       (let ((cdata (erc-get-channel-user ,nick)))
+       (let ((cdata (erc-get-channel-user nick)))
          (and cdata (cdr cdata)
-              (erc-channel-user-admin (cdr cdata))))))))
+              (erc-channel-user-admin (cdr cdata))))))
 
-(define-inline erc-channel-user-op-p (nick)
+(defun erc-channel-user-op-p (nick)
   "Return non-nil if NICK is an operator in the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
+  (and nick
        (hash-table-p erc-channel-users)
-       (let ((cdata (erc-get-channel-user ,nick)))
+       (let ((cdata (erc-get-channel-user nick)))
          (and cdata (cdr cdata)
-              (erc-channel-user-op (cdr cdata))))))))
+              (erc-channel-user-op (cdr cdata))))))
 
-(define-inline erc-channel-user-halfop-p (nick)
+(defun erc-channel-user-halfop-p (nick)
   "Return non-nil if NICK is a half-operator in the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
+  (and nick
        (hash-table-p erc-channel-users)
-       (let ((cdata (erc-get-channel-user ,nick)))
+       (let ((cdata (erc-get-channel-user nick)))
          (and cdata (cdr cdata)
-              (erc-channel-user-halfop (cdr cdata))))))))
+              (erc-channel-user-halfop (cdr cdata))))))
 
-(define-inline erc-channel-user-voice-p (nick)
+(defun erc-channel-user-voice-p (nick)
   "Return non-nil if NICK has voice in the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
+  (and nick
        (hash-table-p erc-channel-users)
-       (let ((cdata (erc-get-channel-user ,nick)))
+       (let ((cdata (erc-get-channel-user nick)))
          (and cdata (cdr cdata)
-              (erc-channel-user-voice (cdr cdata))))))))
+              (erc-channel-user-voice (cdr cdata))))))
 
 (defun erc-get-channel-user-list ()
   "Return a list of users in the current channel.
@@ -1377,96 +1291,6 @@ erc-debug-log-file
 
 (defvar-local erc-dbuf nil)
 
-(defmacro define-erc-module (name alias doc enable-body disable-body
-                                  &optional local-p)
-  "Define a new minor mode using ERC conventions.
-Symbol NAME is the name of the module.
-Symbol ALIAS is the alias to use, or nil.
-DOC is the documentation string to use for the minor mode.
-ENABLE-BODY is a list of expressions used to enable the mode.
-DISABLE-BODY is a list of expressions used to disable the mode.
-If LOCAL-P is non-nil, the mode will be created as a buffer-local
-mode, rather than a global one.
-
-This will define a minor mode called erc-NAME-mode, possibly
-an alias erc-ALIAS-mode, as well as the helper functions
-erc-NAME-enable, and erc-NAME-disable.
-
-Example:
-
-  ;;;###autoload(autoload \\='erc-replace-mode \"erc-replace\")
-  (define-erc-module replace nil
-    \"This mode replaces incoming text according to `erc-replace-alist'.\"
-    ((add-hook \\='erc-insert-modify-hook
-               #\\='erc-replace-insert))
-    ((remove-hook \\='erc-insert-modify-hook
-                  #\\='erc-replace-insert)))"
-  (declare (doc-string 3) (indent defun))
-  (let* ((sn (symbol-name name))
-         (mode (intern (format "erc-%s-mode" (downcase sn))))
-         (group (intern (format "erc-%s" (downcase sn))))
-         (enable (intern (format "erc-%s-enable" (downcase sn))))
-         (disable (intern (format "erc-%s-disable" (downcase sn)))))
-    `(progn
-       (define-minor-mode
-        ,mode
-        ,(format "Toggle ERC %S mode.
-With a prefix argument ARG, enable %s if ARG is positive,
-and disable it otherwise.  If called from Lisp, enable the mode
-if ARG is omitted or nil.
-%s" name name doc)
-        ;; FIXME: We don't know if this group exists, so this `:group' may
-        ;; actually just silence a valid warning about the fact that the var
-        ;; is not associated with any group.
-        :global ,(not local-p) :group (quote ,group)
-        (if ,mode
-            (,enable)
-          (,disable)))
-       (defun ,enable ()
-         ,(format "Enable ERC %S mode."
-                  name)
-         (interactive)
-         (add-to-list 'erc-modules (quote ,name))
-         (setq ,mode t)
-         ,@enable-body)
-       (defun ,disable ()
-         ,(format "Disable ERC %S mode."
-                  name)
-         (interactive)
-         (setq erc-modules (delq (quote ,name) erc-modules))
-         (setq ,mode nil)
-         ,@disable-body)
-       ,(when (and alias (not (eq name alias)))
-          `(defalias
-             ',(intern
-                (format "erc-%s-mode"
-                        (downcase (symbol-name alias))))
-             #',mode))
-       ;; For find-function and find-variable.
-       (put ',mode    'definition-name ',name)
-       (put ',enable  'definition-name ',name)
-       (put ',disable 'definition-name ',name))))
-
-;; The rationale for favoring inheritance here (nicer dispatch) is
-;; kinda flimsy since there aren't yet any actual methods.
-
-(cl-defstruct erc--target
-  (string "" :type string :documentation "Received name of target.")
-  (symbol nil :type symbol :documentation "Case-mapped name as symbol."))
-
-;; These should probably take on a `joined' field to track joinedness,
-;; which should be toggled by `erc-server-JOIN', `erc-server-PART',
-;; etc.  Functions like `erc--current-buffer-joined-p' (bug#48598) may
-;; find it useful.
-
-(cl-defstruct (erc--target-channel (:include erc--target)))
-
-(cl-defstruct (erc--target-channel-local (:include erc--target-channel)))
-
-;; At some point, it may make sense to add a query type with an
-;; account field, which may help support reassociation across
-;; reconnects and nick changes (likely requires v3 extensions).
-
 (defun erc--target-from-string (string)
   "Construct an `erc--target' variant from STRING."
   (funcall (if (erc-channel-p string)
@@ -1516,12 +1340,6 @@ erc-once-with-server-event
     (add-hook hook fun nil t)
     fun))
 
-(define-inline erc-log (string)
-  "Logs STRING if logging is on (see `erc-log-p')."
-  (inline-quote
-   (when erc-log-p
-     (erc-log-aux ,string))))
-
 (defun erc-server-buffer ()
   "Return the server buffer for the current buffer's process.
 The buffer-local variable `erc-server-process' is used to find
@@ -1577,29 +1395,7 @@ erc-ison-p
                    (if erc-online-p "" "not "))
         erc-online-p))))
 
-(defun erc-log-aux (string)
-  "Do the debug logging of STRING."
-  (let ((cb (current-buffer))
-        (point 1)
-        (was-eob nil)
-        (session-buffer (erc-server-buffer)))
-    (if session-buffer
-        (progn
-          (set-buffer session-buffer)
-          (if (not (and erc-dbuf (bufferp erc-dbuf) (buffer-live-p erc-dbuf)))
-              (progn
-                (setq erc-dbuf (get-buffer-create
-                                (concat "*ERC-DEBUG: "
-                                        erc-session-server "*")))))
-          (set-buffer erc-dbuf)
-          (setq point (point))
-          (setq was-eob (eobp))
-          (goto-char (point-max))
-          (insert (concat "** " string "\n"))
-          (if was-eob (goto-char (point-max))
-            (goto-char point))
-          (set-buffer cb))
-      (message "ERC: ** %s" string))))
+
 
 ;; Last active buffer, to print server messages in the right place
 
@@ -1841,40 +1637,6 @@ erc-member-ignore-case
           (throw 'result list)
         (setq list (cdr list))))))
 
-(defmacro erc-with-buffer (spec &rest body)
-  "Execute BODY in the buffer associated with SPEC.
-
-SPEC should have the form
-
- (TARGET [PROCESS])
-
-If TARGET is a buffer, use it.  Otherwise, use the buffer
-matching TARGET in the process specified by PROCESS.
-
-If PROCESS is nil, use the current `erc-server-process'.
-See `erc-get-buffer' for details.
-
-See also `with-current-buffer'.
-
-\(fn (TARGET [PROCESS]) BODY...)"
-  (declare (indent 1) (debug ((form &optional form) body)))
-  (let ((buf (make-symbol "buf"))
-        (proc (make-symbol "proc"))
-        (target (make-symbol "target"))
-        (process (make-symbol "process")))
-    `(let* ((,target ,(car spec))
-            (,process ,(cadr spec))
-            (,buf (if (bufferp ,target)
-                      ,target
-                    (let ((,proc (or ,process
-                                     (and (processp erc-server-process)
-                                          erc-server-process))))
-                      (if (and ,target ,proc)
-                          (erc-get-buffer ,target ,proc))))))
-       (when (buffer-live-p ,buf)
-         (with-current-buffer ,buf
-           ,@body)))))
-
 (defun erc-get-buffer (target &optional proc)
   "Return the buffer matching TARGET in the process PROC.
 If PROC is not supplied, all processes are searched."
@@ -1921,18 +1683,6 @@ erc-buffer-list
     (setq predicate (lambda () t)))
   (erc-buffer-filter predicate proc))
 
-(defmacro erc-with-all-buffers-of-server (process pred &rest forms)
-  "Execute FORMS in all buffers which have same process as this server.
-FORMS will be evaluated in all buffers having the process PROCESS and
-where PRED matches or in all buffers of the server process if PRED is
-nil."
-  (declare (indent 1) (debug (form form body)))
-  (macroexp-let2 nil pred pred
-    `(erc-buffer-filter (lambda ()
-                          (when (or (not ,pred) (funcall ,pred))
-                            ,@forms))
-                        ,process)))
-
 (define-obsolete-function-alias 'erc-iswitchb #'erc-switch-to-buffer "25.1")
 (defun erc--switch-to-buffer (&optional arg)
   (read-buffer "Switch to ERC buffer: "
@@ -2903,8 +2653,6 @@ erc-lurker-cleanup-interval
 consumption of lurker state during long Emacs sessions and/or ERC
 sessions with large numbers of incoming PRIVMSGs.")
 
-(defvar erc-message-parsed)
-
 (defun erc-lurker-update-status (_message)
   "Update `erc-lurker-state' if necessary.
 
@@ -4116,9 +3864,6 @@ erc-cmd-SERVER
   t)
 (put 'erc-cmd-SERVER 'process-not-needed t)
 
-(defvar motif-version-string)
-(defvar gtk-version-string)
-
 (defun erc-cmd-SV ()
   "Say the current ERC and Emacs version into channel."
   (erc-send-message (format "I'm using ERC %s with GNU Emacs %s (%s%s)%s."
@@ -5375,6 +5120,12 @@ erc-parse-prefix
           (setq i (1+ i)))
         alist))))
 
+(defcustom erc-channel-members-changed-hook nil
+  "This hook is called every time the variable `channel-members' changes.
+The buffer where the change happened is current while this hook is called."
+  :group 'erc-hooks
+  :type 'hook)
+
 (defun erc-channel-receive-names (names-string)
   "This function is for internal use only.
 
@@ -5418,13 +5169,6 @@ erc-channel-receive-names
              name name t voice halfop op admin owner)))))
     (run-hooks 'erc-channel-members-changed-hook)))
 
-
-(defcustom erc-channel-members-changed-hook nil
-  "This hook is called every time the variable `channel-members' changes.
-The buffer where the change happened is current while this hook is called."
-  :group 'erc-hooks
-  :type 'hook)
-
 (defun erc-update-user-nick (nick &optional new-nick
                                   host login full-name info)
   "Update the stored user information for the user with nickname NICK.
@@ -6034,12 +5778,6 @@ erc-user-input
 (defvar erc-command-regexp "^/\\([A-Za-z']+\\)\\(\\s-+.*\\|\\s-*\\)$"
   "Regular expression used for matching commands in ERC.")
 
-(cl-defstruct erc-input
-  string insertp sendp)
-
-(cl-defstruct (erc--input-split (:include erc-input))
-  lines cmdp)
-
 (defun erc--discard-trailing-multiline-nulls (state)
   "Ensure last line of STATE's string is non-null.
 But only when `erc-send-whitespace-lines' is non-nil.  STATE is
@@ -6983,9 +6721,6 @@ erc-format-lag-time
           (t ""))))
 
 ;; erc-goodies is required at end of this file.
-(declare-function erc-controls-strip "erc-goodies" (str))
-
-(defvar tabbar--local-hlf)
 
 ;; FIXME when 29.1 is cut and `format-spec' is added to ELPA Compat,
 ;; remove the function invocations from the spec form below.
@@ -7474,12 +7209,4 @@ erc-handle-irc-url
 
 (provide 'erc)
 
-(require 'erc-backend)
-
-;; Deprecated. We might eventually stop requiring the goodies automatically.
-;; IMPORTANT: This require must appear _after_ the above (provide 'erc) to
-;; avoid a recursive require error when byte-compiling the entire package.
-(require 'erc-goodies)
-(require 'erc-networks)
-
 ;;; erc.el ends here
diff --git a/test/lisp/erc/erc-networks-tests.el b/test/lisp/erc/erc-networks-tests.el
index 66a334b709..32bdfa11ff 100644
--- a/test/lisp/erc/erc-networks-tests.el
+++ b/test/lisp/erc/erc-networks-tests.el
@@ -20,7 +20,7 @@
 ;;; Code:
 
 (require 'ert-x) ; cl-lib
-(require 'erc-networks)
+(require 'erc)
 
 (defun erc-networks-tests--create-dead-proc (&optional buf)
   (let ((p (start-process "true" (or buf (current-buffer)) "true")))
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index d3d319ab22..4646c35e25 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -24,7 +24,6 @@
 (require 'ert-x)
 (require 'erc)
 (require 'erc-ring)
-(require 'erc-networks)
 
 (ert-deftest erc--read-time-period ()
   (cl-letf (((symbol-function 'read-string) (lambda (&rest _) "")))
@@ -48,27 +47,6 @@ erc--read-time-period
   (cl-letf (((symbol-function 'read-string) (lambda (&rest _) "1d")))
     (should (equal (erc--read-time-period "foo: ") 86400))))
 
-(ert-deftest erc--meta--backend-dependencies ()
-  (with-temp-buffer
-    (insert-file-contents-literally
-     (concat (file-name-sans-extension (symbol-file 'erc)) ".el"))
-    (let ((beg (search-forward ";; Defined in erc-backend"))
-          (end (search-forward "\n\n"))
-          vars)
-      (save-excursion
-        (save-restriction
-          (narrow-to-region beg end)
-          (goto-char (point-min))
-          (with-syntax-table lisp-data-mode-syntax-table
-            (condition-case _
-                (while (push (cadr (read (current-buffer))) vars))
-              (end-of-file)))))
-      (should (= (point) end))
-      (dolist (var vars)
-        (setq var (concat "\\_<" (symbol-name var) "\\_>"))
-        (ert-info (var)
-          (should (save-excursion (search-forward-regexp var nil t))))))))
-
 (ert-deftest erc-with-all-buffers-of-server ()
   (let (proc-exnet
         proc-onet
-- 
2.37.3


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: 0001-Move-ERC-s-core-dependencies-to-separate-file.patch --]
[-- Type: text/x-patch, Size: 46973 bytes --]

From 2f66c3f4dcc41195e5578d6a9cf38d98fc1a05d2 Mon Sep 17 00:00:00 2001
From: dickmao <dick.r.chiang@gmail.com>
Date: Fri, 1 Jul 2022 11:06:51 -0400
Subject: [PATCH 1/5] Move ERC's core dependencies to separate file

Asking people to order require's is about as effective
as asking kids to keep off the grass.

* lisp/erc/erc-backend.el (erc--target, erc-auto-query,
erc-channel-list, erc-channel-users, erc-default-nicks,
erc-default-recipients, erc-format-nick-function,
erc-format-query-as-channel-p, erc-hide-prompt, erc-input-marker,
erc-insert-marker, erc-invitation, erc-join-buffer,
erc-kill-buffer-on-part, erc-kill-server-buffer-on-quit, erc-log-p,
erc-minibuffer-ignored, erc-networks--id, erc-nick,
erc-nick-change-attempt-count, erc-prompt-for-channel-key,
erc-prompt-hidden, erc-reuse-buffers, erc-verbose-server-ping,
erc-whowas-on-nosuchnick): Forward-declare variables.
(erc--open-target, erc--target-from-string, erc-active-buffer,
erc-add-default-channel, erc-banlist-update, erc-buffer-filter,
erc-buffer-list-with-nick, erc-channel-begin-receiving-names,
erc-channel-end-receiving-names, erc-channel-p,
erc-channel-receive-names, erc-cmd-JOIN, erc-connection-established,
erc-current-nick, erc-current-nick-p, erc-current-time,
erc-default-target, erc-delete-default-channel,
erc-display-error-notice, erc-display-server-message,
erc-emacs-time-to-erc-time, erc-format-message,
erc-format-privmessage, erc-get-buffer, erc-handle-login,
erc-handle-user-status-change, erc-ignored-reply-p,
erc-ignored-user-p, erc-is-message-ctcp-and-not-action-p,
erc-is-message-ctcp-p, erc-log-irc-protocol, erc-login,
erc-make-notice, erc-network, erc-networks--id-given,
erc-networks--id-reload, erc-nickname-in-use, erc-parse-user,
erc-process-away, erc-process-ctcp-query, erc-query-buffer-p,
erc-remove-channel-member, erc-remove-channel-users, erc-remove-user,
erc-sec-to-time, erc-server-buffer, erc-set-active-buffer,
erc-set-current-nick, erc-set-modes, erc-time-diff, erc-trim-string,
erc-update-mode-line, erc-update-mode-line-buffer,
erc-wash-quit-reason, erc-display-message, erc-get-buffer-create,
erc-process-ctcp-reply, erc-update-channel-topic, erc-update-modes,
erc-update-user-nick, erc-open, erc-update-channel-member):
Forward-declare functions.
(erc-response): Move to lisp/erc/erc-common.el.
(erc-compat--with-memoization): Use "erc-compat-" prefixed macro.

* lisp/erc/erc-common.el: New file.  Change indentation for
`erc-with-all-buffers-of-server' from 1 to 2.

* lisp/erc/erc-compat.el (erc-compat--with-memoization): Migrate macro
from `erc-common' and rename.

* lisp/erc/erc-goodies.el: Require `erc-common' instead of `erc'.
(erc-controls-highlight-regexp, erc-controls-remove-regexp,
erc-input-marker, erc-insert-marker, erc-server-process, erc-modules,
erc-log-p): Forward declare variables.
(erc-buffer-list, erc-error, erc-extract-command-from-line):
Forward-declare functions.

* lisp/erc/erc-networks.el (erc--target, erc-insert-marker,
erc-kill-buffer-hook, erc-kill-server-hook, erc-modules,
erc-rename-buffers, erc-reuse-buffers, erc-server-announced-name,
erc-server-connected, erc-server-parameters, erc-server-process,
erc-session-server): Forward declare variables.
(erc--default-target, erc--get-isupport-entry, erc-buffer-filter,
erc-current-nick, erc-display-error-notice, erc-error, erc-get-buffer,
erc-server-buffer, erc-server-process-alive): Forward-declare
functions.
(erc-obsolete-var): Also suppress free-variable warnings.

* lisp/erc/erc.el: Require `erc-networks', `erc-goodies', and
`erc-backend' at top of file.  Don't require `erc-compat'.
(erc--server-last-reconnect-count, erc--server-reconnecting,
erc-channel-members-changed-hook, erc-network, erc-networks--id,
erc-server-367-functions, erc-server-announced-name,
erc-server-connect-function, erc-server-connected,
erc-server-current-nick, erc-server-lag, erc-server-last-sent-time,
erc-server-process, erc-server-quitting, erc-server-reconnect-count,
erc-server-reconnecting, erc-session-client-certificate,
erc-session-connector, erc-session-port, erc-session-server,
erc-session-user-full-name) Remove superfluous forward declarations.
(erc-message-parsed, tabbar--local-hlf, motif-version-string):
Relocate forward declares to central location.
(erc-session-password): Move to `erc-backend'.
(erc-downcase, erc-with-server-buffer, erc-server-user,
erc-channel-user, erc-get-channel-user, erc-get-server-user): Move to
lisp/erc/erc-common.el.
(erc-add-server-user, erc-remove-server-user,
erc-channel-user-owner-p, erc-channel-user-admin-p,
erc-channel-user-op-p, erc-channel-user-halfop-p,
erc-channel-user-voice-p): Convert from inline functions to normal
functions.
(define-erc-module, erc--target, erc--target-channel,
erc--target-channel-local, erc-log, erc-log-aux, erc-with-buffer,
erc-with-all-buffers-of-server): Move to lisp/erc/erc-common.el.
(erc-channel-members-changed-hook): Relocate option to avoid compiler
warning.
(erc-input, erc--input-split): Move to lisp/erc/erc-common.el.
(erc-controls-strip): Remove forward declaration temporarily until
this file stops requiring `erc-goodies'.

* test/lisp/erc/erc-networks-tests.el: Require `erc' instead of
`erc-networks'.

* test/lisp/erc/erc.el (erc--meta--backend-dependencies): Remove
unused test.  Don't require `erc-networks'. Bug#56340.
---
 lisp/erc/erc-backend.el             | 129 ++++++++--
 lisp/erc/erc-common.el              | 271 +++++++++++++++++++++
 lisp/erc/erc-compat.el              |  12 +
 lisp/erc/erc-goodies.el             |  17 +-
 lisp/erc/erc-networks.el            |  28 ++-
 lisp/erc/erc.el                     | 363 ++++------------------------
 test/lisp/erc/erc-networks-tests.el |   2 +-
 test/lisp/erc/erc-tests.el          |  22 --
 8 files changed, 476 insertions(+), 368 deletions(-)
 create mode 100644 lisp/erc/erc-common.el

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index df9efe4b0c..026b34849a 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -99,24 +99,117 @@
 ;;; Code:
 
 (eval-when-compile (require 'cl-lib))
-;; There's a fairly strong mutual dependency between erc.el and erc-backend.el.
-;; Luckily, erc.el does not need erc-backend.el for macroexpansion whereas the
-;; reverse is true:
-(require 'erc)
+(require 'erc-common)
+
+(defvar erc--target)
+(defvar erc-auto-query)
+(defvar erc-channel-list)
+(defvar erc-channel-users)
+(defvar erc-default-nicks)
+(defvar erc-default-recipients)
+(defvar erc-format-nick-function)
+(defvar erc-format-query-as-channel-p)
+(defvar erc-hide-prompt)
+(defvar erc-input-marker)
+(defvar erc-insert-marker)
+(defvar erc-invitation)
+(defvar erc-join-buffer)
+(defvar erc-kill-buffer-on-part)
+(defvar erc-kill-server-buffer-on-quit)
+(defvar erc-log-p)
+(defvar erc-minibuffer-ignored)
+(defvar erc-networks--id)
+(defvar erc-nick)
+(defvar erc-nick-change-attempt-count)
+(defvar erc-prompt-for-channel-key)
+(defvar erc-prompt-hidden)
+(defvar erc-reuse-buffers)
+(defvar erc-verbose-server-ping)
+(defvar erc-whowas-on-nosuchnick)
+
+(declare-function erc--open-target "erc" (target))
+(declare-function erc--target-from-string "erc" (string))
+(declare-function erc-active-buffer "erc" nil)
+(declare-function erc-add-default-channel "erc" (channel))
+(declare-function erc-banlist-update "erc" (proc parsed))
+(declare-function erc-buffer-filter "erc" (predicate &optional proc))
+(declare-function erc-buffer-list-with-nick "erc" (nick proc))
+(declare-function erc-channel-begin-receiving-names "erc" nil)
+(declare-function erc-channel-end-receiving-names "erc" nil)
+(declare-function erc-channel-p "erc" (channel))
+(declare-function erc-channel-receive-names "erc" (names-string))
+(declare-function erc-cmd-JOIN "erc" (channel &optional key))
+(declare-function erc-connection-established "erc" (proc parsed))
+(declare-function erc-current-nick "erc" nil)
+(declare-function erc-current-nick-p "erc" (nick))
+(declare-function erc-current-time "erc" (&optional specified-time))
+(declare-function erc-default-target "erc" nil)
+(declare-function erc-delete-default-channel "erc" (channel &optional buffer))
+(declare-function erc-display-error-notice "erc" (parsed string))
+(declare-function erc-display-server-message "erc" (_proc parsed))
+(declare-function erc-emacs-time-to-erc-time "erc" (&optional specified-time))
+(declare-function erc-format-message "erc" (msg &rest args))
+(declare-function erc-format-privmessage "erc" (nick msg privp msgp))
+(declare-function erc-get-buffer "erc" (target &optional proc))
+(declare-function erc-handle-login "erc" nil)
+(declare-function erc-handle-user-status-change "erc" (type nlh &optional l))
+(declare-function erc-ignored-reply-p "erc" (msg tgt proc))
+(declare-function erc-ignored-user-p "erc" (spec))
+(declare-function erc-is-message-ctcp-and-not-action-p "erc" (message))
+(declare-function erc-is-message-ctcp-p "erc" (message))
+(declare-function erc-log-irc-protocol "erc" (string &optional outbound))
+(declare-function erc-login "erc" nil)
+(declare-function erc-make-notice "erc" (message))
+(declare-function erc-network "erc-networks" nil)
+(declare-function erc-networks--id-given "erc-networks" (arg &rest args))
+(declare-function erc-networks--id-reload "erc-networks" (arg &rest args))
+(declare-function erc-nickname-in-use "erc" (nick reason))
+(declare-function erc-parse-user "erc" (string))
+(declare-function erc-process-away "erc" (proc away-p))
+(declare-function erc-process-ctcp-query "erc" (proc parsed nick login host))
+(declare-function erc-query-buffer-p "erc" (&optional buffer))
+(declare-function erc-remove-channel-member "erc" (channel nick))
+(declare-function erc-remove-channel-users "erc" nil)
+(declare-function erc-remove-user "erc" (nick))
+(declare-function erc-sec-to-time "erc" (ns))
+(declare-function erc-server-buffer "erc" nil)
+(declare-function erc-set-active-buffer "erc" (buffer))
+(declare-function erc-set-current-nick "erc" (nick))
+(declare-function erc-set-modes "erc" (tgt mode-string))
+(declare-function erc-time-diff "erc" (t1 t2))
+(declare-function erc-trim-string "erc" (s))
+(declare-function erc-update-mode-line "erc" (&optional buffer))
+(declare-function erc-update-mode-line-buffer "erc" (buffer))
+(declare-function erc-wash-quit-reason "erc" (reason nick login host))
+
+(declare-function erc-display-message "erc"
+                  (parsed type buffer msg &rest args))
+(declare-function erc-get-buffer-create "erc"
+                  (server port target &optional tgt-info id))
+(declare-function erc-process-ctcp-reply "erc"
+                  (proc parsed nick login host msg))
+(declare-function erc-update-channel-topic "erc"
+                  (channel topic &optional modify))
+(declare-function erc-update-modes "erc"
+                  (tgt mode-string &optional _nick _host _login))
+(declare-function erc-update-user-nick "erc"
+                  (nick &optional new-nick host login full-name info))
+(declare-function erc-open "erc"
+                  (&optional server port nick full-name connect passwd tgt-list
+                             channel process client-certificate user id))
+(declare-function erc-update-channel-member "erc"
+                  (channel nick new-nick
+                           &optional add voice halfop op admin owner host
+                           login full-name info update-message-time))
 
 ;;;; Variables and options
 
+(defvar-local erc-session-password nil
+  "The password used for the current session.")
+
 (defvar erc-server-responses (make-hash-table :test #'equal)
   "Hash table mapping server responses to their handler hooks.")
 
-(cl-defstruct (erc-response (:conc-name erc-response.))
-  (unparsed "" :type string)
-  (sender "" :type string)
-  (command "" :type string)
-  (command-args '() :type list)
-  (contents "" :type string)
-  (tags '() :type list))
-
 ;;; User data
 
 (defvar-local erc-server-current-nick nil
@@ -1662,16 +1755,6 @@ erc--parse-isupport-value
          (split-string value ",")
        (list value)))))
 
-(defmacro erc--with-memoization (table &rest forms)
-  "Adapter to be migrated to erc-compat."
-  (declare (indent defun))
-  `(cond
-    ((fboundp 'with-memoization)
-     (with-memoization ,table ,@forms)) ; 29.1
-    ((fboundp 'cl--generic-with-memoization)
-     (cl--generic-with-memoization ,table ,@forms))
-    (t ,@forms)))
-
 (defun erc--get-isupport-entry (key &optional single)
   "Return an item for \"ISUPPORT\" token KEY, a symbol.
 When a lookup fails return nil.  Otherwise return a list whose
@@ -1681,7 +1764,7 @@ erc--get-isupport-entry
 primitive value."
   (if-let* ((table (or erc--isupport-params
                        (erc-with-server-buffer erc--isupport-params)))
-            (value (erc--with-memoization (gethash key table)
+            (value (erc-compat--with-memoization (gethash key table)
                      (when-let ((v (assoc (symbol-name key)
                                           erc-server-parameters)))
                        (if (cdr v)
diff --git a/lisp/erc/erc-common.el b/lisp/erc/erc-common.el
new file mode 100644
index 0000000000..d8aac36eab
--- /dev/null
+++ b/lisp/erc/erc-common.el
@@ -0,0 +1,271 @@
+;;; erc-common.el --- Macros and types for ERC  -*- lexical-binding:t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; Maintainer: Amin Bandali <bandali@gnu.org>, F. Jason Park <jp@neverwas.me>
+;; Keywords: comm, IRC, chat, client, internet
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published
+;; by the Free Software Foundation, either version 3 of the License,
+;; or (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+;;; Code:
+
+(eval-when-compile (require 'cl-lib) (require 'subr-x))
+(require 'erc-compat)
+
+(defvar erc--casemapping-rfc1459)
+(defvar erc--casemapping-rfc1459-strict)
+(defvar erc-channel-users)
+(defvar erc-dbuf)
+(defvar erc-log-p)
+(defvar erc-server-users)
+(defvar erc-session-server)
+
+(declare-function erc--get-isupport-entry "erc-backend" (key &optional single))
+(declare-function erc-get-buffer "erc" (target &optional proc))
+(declare-function erc-server-buffer "erc" nil)
+
+(cl-defstruct erc-input
+  string insertp sendp)
+
+(cl-defstruct (erc--input-split (:include erc-input))
+  lines cmdp)
+
+(cl-defstruct (erc-server-user (:type vector) :named)
+  ;; User data
+  nickname host login full-name info
+  ;; Buffers
+  ;;
+  ;; This is an alist of the form (BUFFER . CHANNEL-DATA), where
+  ;; CHANNEL-DATA is either nil or an erc-channel-user struct.
+  (buffers nil))
+
+(cl-defstruct (erc-channel-user (:type vector) :named)
+  voice halfop op admin owner
+  ;; Last message time (in the form of the return value of
+  ;; (current-time)
+  ;;
+  ;; This is useful for ordered name completion.
+  (last-message-time nil))
+
+(cl-defstruct erc--target
+  (string "" :type string :documentation "Received name of target.")
+  (symbol nil :type symbol :documentation "Case-mapped name as symbol."))
+
+;; At some point, it may make sense to add a query type with an
+;; account field, which may help support reassociation across
+;; reconnects and nick changes (likely requires v3 extensions).
+;;
+;; These channel variants should probably take on a `joined' field to
+;; track "joinedness", which `erc-server-JOIN', `erc-server-PART',
+;; etc. should toggle.  Functions like `erc--current-buffer-joined-p'
+;; may find it useful.
+
+(cl-defstruct (erc--target-channel (:include erc--target)))
+(cl-defstruct (erc--target-channel-local (:include erc--target-channel)))
+
+(cl-defstruct (erc-response (:conc-name erc-response.))
+  (unparsed "" :type string)
+  (sender "" :type string)
+  (command "" :type string)
+  (command-args '() :type list)
+  (contents "" :type string)
+  (tags '() :type list))
+
+(defmacro define-erc-module (name alias doc enable-body disable-body
+                                  &optional local-p)
+  "Define a new minor mode using ERC conventions.
+Symbol NAME is the name of the module.
+Symbol ALIAS is the alias to use, or nil.
+DOC is the documentation string to use for the minor mode.
+ENABLE-BODY is a list of expressions used to enable the mode.
+DISABLE-BODY is a list of expressions used to disable the mode.
+If LOCAL-P is non-nil, the mode will be created as a buffer-local
+mode, rather than a global one.
+
+This will define a minor mode called erc-NAME-mode, possibly
+an alias erc-ALIAS-mode, as well as the helper functions
+erc-NAME-enable, and erc-NAME-disable.
+
+Example:
+
+  ;;;###autoload(autoload \\='erc-replace-mode \"erc-replace\")
+  (define-erc-module replace nil
+    \"This mode replaces incoming text according to `erc-replace-alist'.\"
+    ((add-hook \\='erc-insert-modify-hook
+               #\\='erc-replace-insert))
+    ((remove-hook \\='erc-insert-modify-hook
+                  #\\='erc-replace-insert)))"
+  (declare (doc-string 3) (indent defun))
+  (let* ((sn (symbol-name name))
+         (mode (intern (format "erc-%s-mode" (downcase sn))))
+         (group (intern (format "erc-%s" (downcase sn))))
+         (enable (intern (format "erc-%s-enable" (downcase sn))))
+         (disable (intern (format "erc-%s-disable" (downcase sn)))))
+    `(progn
+       (define-minor-mode
+         ,mode
+         ,(format "Toggle ERC %S mode.
+With a prefix argument ARG, enable %s if ARG is positive,
+and disable it otherwise.  If called from Lisp, enable the mode
+if ARG is omitted or nil.
+%s" name name doc)
+         ;; FIXME: We don't know if this group exists, so this `:group' may
+         ;; actually just silence a valid warning about the fact that the var
+         ;; is not associated with any group.
+         :global ,(not local-p) :group (quote ,group)
+         (if ,mode
+             (,enable)
+           (,disable)))
+       (defun ,enable ()
+         ,(format "Enable ERC %S mode."
+                  name)
+         (interactive)
+         (add-to-list 'erc-modules (quote ,name))
+         (setq ,mode t)
+         ,@enable-body)
+       (defun ,disable ()
+         ,(format "Disable ERC %S mode."
+                  name)
+         (interactive)
+         (setq erc-modules (delq (quote ,name) erc-modules))
+         (setq ,mode nil)
+         ,@disable-body)
+       ,(when (and alias (not (eq name alias)))
+          `(defalias
+             ',(intern
+                (format "erc-%s-mode"
+                        (downcase (symbol-name alias))))
+             #',mode))
+       ;; For find-function and find-variable.
+       (put ',mode    'definition-name ',name)
+       (put ',enable  'definition-name ',name)
+       (put ',disable 'definition-name ',name))))
+
+(defmacro erc-with-buffer (spec &rest body)
+  "Execute BODY in the buffer associated with SPEC.
+
+SPEC should have the form
+
+ (TARGET [PROCESS])
+
+If TARGET is a buffer, use it.  Otherwise, use the buffer
+matching TARGET in the process specified by PROCESS.
+
+If PROCESS is nil, use the current `erc-server-process'.
+See `erc-get-buffer' for details.
+
+See also `with-current-buffer'.
+
+\(fn (TARGET [PROCESS]) BODY...)"
+  (declare (indent 1) (debug ((form &optional form) body)))
+  (let ((buf (make-symbol "buf"))
+        (proc (make-symbol "proc"))
+        (target (make-symbol "target"))
+        (process (make-symbol "process")))
+    `(let* ((,target ,(car spec))
+            (,process ,(cadr spec))
+            (,buf (if (bufferp ,target)
+                      ,target
+                    (let ((,proc (or ,process
+                                     (and (processp erc-server-process)
+                                          erc-server-process))))
+                      (if (and ,target ,proc)
+                          (erc-get-buffer ,target ,proc))))))
+       (when (buffer-live-p ,buf)
+         (with-current-buffer ,buf
+           ,@body)))))
+
+(defmacro erc-with-server-buffer (&rest body)
+  "Execute BODY in the current ERC server buffer.
+If no server buffer exists, return nil."
+  (declare (indent 0) (debug (body)))
+  (let ((buffer (make-symbol "buffer")))
+    `(let ((,buffer (erc-server-buffer)))
+       (when (buffer-live-p ,buffer)
+         (with-current-buffer ,buffer
+           ,@body)))))
+
+(defmacro erc-with-all-buffers-of-server (process pred &rest forms)
+  "Execute FORMS in all buffers which have same process as this server.
+FORMS will be evaluated in all buffers having the process PROCESS and
+where PRED matches or in all buffers of the server process if PRED is
+nil."
+  (declare (indent 2) (debug (form form body)))
+  (macroexp-let2 nil pred pred
+    `(erc-buffer-filter (lambda ()
+                          (when (or (not ,pred) (funcall ,pred))
+                            ,@forms))
+                        ,process)))
+
+(defun erc-log-aux (string)
+  "Do the debug logging of STRING."
+  (let ((cb (current-buffer))
+        (point 1)
+        (was-eob nil)
+        (session-buffer (erc-server-buffer)))
+    (if session-buffer
+        (progn
+          (set-buffer session-buffer)
+          (if (not (and erc-dbuf (bufferp erc-dbuf) (buffer-live-p erc-dbuf)))
+              (progn
+                (setq erc-dbuf (get-buffer-create
+                                (concat "*ERC-DEBUG: "
+                                        erc-session-server "*")))))
+          (set-buffer erc-dbuf)
+          (setq point (point))
+          (setq was-eob (eobp))
+          (goto-char (point-max))
+          (insert (concat "** " string "\n"))
+          (if was-eob (goto-char (point-max))
+            (goto-char point))
+          (set-buffer cb))
+      (message "ERC: ** %s" string))))
+
+(define-inline erc-log (string)
+  "Logs STRING if logging is on (see `erc-log-p')."
+  (inline-quote
+   (when erc-log-p
+     (erc-log-aux ,string))))
+
+(defun erc-downcase (string)
+  "Return a downcased copy of STRING with properties.
+Use the CASEMAPPING ISUPPORT parameter to determine the style."
+  (let* ((mapping (erc--get-isupport-entry 'CASEMAPPING 'single))
+         (inhibit-read-only t))
+    (if (equal mapping "ascii")
+        (downcase string)
+      (with-temp-buffer
+        (insert string)
+        (translate-region (point-min) (point-max)
+                          (if (equal mapping "rfc1459-strict")
+                              erc--casemapping-rfc1459-strict
+                            erc--casemapping-rfc1459))
+        (buffer-string)))))
+
+(define-inline erc-get-channel-user (nick)
+  "Find NICK in the current buffer's `erc-channel-users' hash table."
+  (inline-quote (gethash (erc-downcase ,nick) erc-channel-users)))
+
+(define-inline erc-get-server-user (nick)
+  "Find NICK in the current server's `erc-server-users' hash table."
+  (inline-letevals (nick)
+    (inline-quote (erc-with-server-buffer
+                    (gethash (erc-downcase ,nick) erc-server-users)))))
+
+(provide 'erc-common)
+
+;;; erc-common.el ends here
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 8a00e711ac..03bd8f1352 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -156,6 +156,18 @@ erc-subseq
 		 (setq i (1+ i) start (1+ start)))
 	       res))))))
 
+
+;;;; Misc 29.1
+
+(defmacro erc-compat--with-memoization (table &rest forms)
+  (declare (indent defun))
+  (cond
+   ((fboundp 'with-memoization)
+    `(with-memoization ,table ,@forms)) ; 29.1
+   ((fboundp 'cl--generic-with-memoization)
+    `(cl--generic-with-memoization ,table ,@forms))
+   (t `(progn ,@forms))))
+
 (provide 'erc-compat)
 
 ;;; erc-compat.el ends here
diff --git a/lisp/erc/erc-goodies.el b/lisp/erc/erc-goodies.el
index 8fef23945d..59b5f01f23 100644
--- a/lisp/erc/erc-goodies.el
+++ b/lisp/erc/erc-goodies.el
@@ -29,10 +29,23 @@
 
 ;;; Code:
 
-(require 'erc)
-
 ;;; Imenu support
 
+(require 'erc-common)
+
+(defvar erc-controls-highlight-regexp)
+(defvar erc-controls-remove-regexp)
+(defvar erc-input-marker)
+(defvar erc-insert-marker)
+(defvar erc-server-process)
+(defvar erc-modules)
+(defvar erc-log-p)
+
+(declare-function erc-buffer-list "erc" (&optional predicate proc))
+(declare-function erc-error "erc" (&rest args))
+(declare-function erc-extract-command-from-line "erc" (line))
+(declare-function erc-beg-of-input-line "erc" nil)
+
 (defun erc-imenu-setup ()
   "Setup Imenu support in an ERC buffer."
   (setq-local imenu-create-index-function #'erc-create-imenu-index))
diff --git a/lisp/erc/erc-networks.el b/lisp/erc/erc-networks.el
index 2c8f8fb72b..667b0c3d76 100644
--- a/lisp/erc/erc-networks.el
+++ b/lisp/erc/erc-networks.el
@@ -39,8 +39,32 @@
 
 ;;; Code:
 
-(require 'erc)
 (eval-when-compile (require 'cl-lib))
+(require 'erc-common)
+
+(defvar erc--target)
+(defvar erc-insert-marker)
+(defvar erc-kill-buffer-hook)
+(defvar erc-kill-server-hook)
+(defvar erc-modules)
+(defvar erc-rename-buffers)
+(defvar erc-reuse-buffers)
+(defvar erc-server-announced-name)
+(defvar erc-server-connected)
+(defvar erc-server-parameters)
+(defvar erc-server-process)
+(defvar erc-session-server)
+
+(declare-function erc--default-target "erc" nil)
+(declare-function erc--get-isupport-entry "erc-backend" (key &optional single))
+(declare-function erc-buffer-filter "erc" (predicate &optional proc))
+(declare-function erc-current-nick "erc" nil)
+(declare-function erc-display-error-notice "erc" (parsed string))
+(declare-function erc-error "erc" (&rest args))
+(declare-function erc-get-buffer "erc" (target &optional proc))
+(declare-function erc-server-buffer "erc" nil)
+(declare-function erc-server-process-alive "erc-backend" (&optional buffer))
+(declare-function erc-set-active-buffer "erc" (buffer))
 
 ;; Variables
 
@@ -813,7 +837,7 @@ erc-networks--id-given
   (erc-networks--id-symbol nid))
 
 (cl-generic-define-context-rewriter erc-obsolete-var (var spec)
-  `((with-suppressed-warnings ((obsolete ,var)) ,var) ,spec))
+  `((with-suppressed-warnings ((obsolete ,var) (free-vars ,var)) ,var) ,spec))
 
 ;; As a catch-all, derive the symbol from the unquoted printed repr.
 (cl-defgeneric erc-networks--id-create (id)
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index db39e341b2..e0a4bd3001 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -60,6 +60,9 @@
 
 (load "erc-loaddefs" 'noerror 'nomessage)
 
+(require 'erc-networks)
+(require 'erc-goodies)
+(require 'erc-backend)
 (require 'cl-lib)
 (require 'format-spec)
 (require 'pp)
@@ -69,8 +72,6 @@
 (require 'iso8601)
 (eval-when-compile (require 'subr-x))
 
-(require 'erc-compat)
-
 (defconst erc-version "5.4.1"
   "This version of ERC.")
 
@@ -132,29 +133,12 @@ erc-scripts
   "Running scripts at startup and with /LOAD."
   :group 'erc)
 
-;; Defined in erc-backend
-(defvar erc--server-last-reconnect-count)
-(defvar erc--server-reconnecting)
-(defvar erc-channel-members-changed-hook)
-(defvar erc-network)
-(defvar erc-networks--id)
-(defvar erc-server-367-functions)
-(defvar erc-server-announced-name)
-(defvar erc-server-connect-function)
-(defvar erc-server-connected)
-(defvar erc-server-current-nick)
-(defvar erc-server-lag)
-(defvar erc-server-last-sent-time)
-(defvar erc-server-process)
-(defvar erc-server-quitting)
-(defvar erc-server-reconnect-count)
-(defvar erc-server-reconnecting)
-(defvar erc-session-client-certificate)
-(defvar erc-session-connector)
-(defvar erc-session-port)
-(defvar erc-session-server)
-(defvar erc-session-user-full-name)
-(defvar erc-session-username)
+;; Forward declarations
+(defvar erc-message-parsed)
+
+(defvar tabbar--local-hlf)
+(defvar motif-version-string)
+(defvar gtk-version-string)
 
 ;; tunable connection and authentication parameters
 
@@ -349,9 +333,6 @@ erc-channel-hide-list
   :group 'erc-ignore
   :type 'erc-message-type)
 
-(defvar-local erc-session-password nil
-  "The password used for the current session.")
-
 (defcustom erc-disconnected-hook nil
   "Run this hook with arguments (NICK IP REASON) when disconnected.
 This happens before automatic reconnection.  Note, that
@@ -436,69 +417,14 @@ erc--casemapping-rfc1459-strict
    '((?\[ . ?\{) (?\] . ?\}) (?\\ . ?\|))
    (mapcar (lambda (c) (cons c (+ c 32))) "ABCDEFGHIJKLMNOPQRSTUVWXYZ")))
 
-(defun erc-downcase (string)
-  "Return a downcased copy of STRING with properties.
-Use the CASEMAPPING ISUPPORT parameter to determine the style."
-  (let* ((mapping (erc--get-isupport-entry 'CASEMAPPING 'single))
-         (inhibit-read-only t))
-    (if (equal mapping "ascii")
-        (downcase string)
-      (with-temp-buffer
-        (insert string)
-        (translate-region (point-min) (point-max)
-                          (if (equal mapping "rfc1459-strict")
-                              erc--casemapping-rfc1459-strict
-                            erc--casemapping-rfc1459))
-        (buffer-string)))))
-
-(defmacro erc-with-server-buffer (&rest body)
-  "Execute BODY in the current ERC server buffer.
-If no server buffer exists, return nil."
-  (declare (indent 0) (debug (body)))
-  (let ((buffer (make-symbol "buffer")))
-    `(let ((,buffer (erc-server-buffer)))
-       (when (buffer-live-p ,buffer)
-         (with-current-buffer ,buffer
-           ,@body)))))
-
-(cl-defstruct (erc-server-user (:type vector) :named)
-  ;; User data
-  nickname host login full-name info
-  ;; Buffers
-  ;;
-  ;; This is an alist of the form (BUFFER . CHANNEL-DATA), where
-  ;; CHANNEL-DATA is either nil or an erc-channel-user struct.
-  (buffers nil)
-  )
-
-(cl-defstruct (erc-channel-user (:type vector) :named)
-  voice halfop op admin owner
-  ;; Last message time (in the form of the return value of
-  ;; (current-time)
-  ;;
-  ;; This is useful for ordered name completion.
-  (last-message-time nil))
-
-(define-inline erc-get-channel-user (nick)
-  "Find NICK in the current buffer's `erc-channel-users' hash table."
-  (inline-quote (gethash (erc-downcase ,nick) erc-channel-users)))
-
-(define-inline erc-get-server-user (nick)
-  "Find NICK in the current server's `erc-server-users' hash table."
-  (inline-letevals (nick)
-    (inline-quote (erc-with-server-buffer
-		    (gethash (erc-downcase ,nick) erc-server-users)))))
-
-(define-inline erc-add-server-user (nick user)
+(defun erc-add-server-user (nick user)
   "This function is for internal use only.
 
 Adds USER with nickname NICK to the `erc-server-users' hash table."
-  (inline-letevals (nick user)
-    (inline-quote
-     (erc-with-server-buffer
-       (puthash (erc-downcase ,nick) ,user erc-server-users)))))
+  (erc-with-server-buffer
+    (puthash (erc-downcase nick) user erc-server-users)))
 
-(define-inline erc-remove-server-user (nick)
+(defun erc-remove-server-user (nick)
   "This function is for internal use only.
 
 Removes the user with nickname NICK from the `erc-server-users'
@@ -506,10 +432,8 @@ erc-remove-server-user
 `erc-channel-users' lists of other buffers.
 
 See also: `erc-remove-user'."
-  (inline-letevals (nick)
-    (inline-quote
-     (erc-with-server-buffer
-       (remhash (erc-downcase ,nick) erc-server-users)))))
+  (erc-with-server-buffer
+    (remhash (erc-downcase nick) erc-server-users)))
 
 (defun erc-change-user-nickname (user new-nick)
   "This function is for internal use only.
@@ -580,55 +504,45 @@ erc-remove-channel-users
              erc-channel-users)
     (clrhash erc-channel-users)))
 
-(define-inline erc-channel-user-owner-p (nick)
+(defun erc-channel-user-owner-p (nick)
   "Return non-nil if NICK is an owner of the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
-	  (hash-table-p erc-channel-users)
-	  (let ((cdata (erc-get-channel-user ,nick)))
-	    (and cdata (cdr cdata)
-		 (erc-channel-user-owner (cdr cdata))))))))
-
-(define-inline erc-channel-user-admin-p (nick)
+  (and nick
+       (hash-table-p erc-channel-users)
+       (let ((cdata (erc-get-channel-user nick)))
+         (and cdata (cdr cdata)
+              (erc-channel-user-owner (cdr cdata))))))
+
+(defun erc-channel-user-admin-p (nick)
   "Return non-nil if NICK is an admin in the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
+  (and nick
        (hash-table-p erc-channel-users)
-       (let ((cdata (erc-get-channel-user ,nick)))
+       (let ((cdata (erc-get-channel-user nick)))
          (and cdata (cdr cdata)
-              (erc-channel-user-admin (cdr cdata))))))))
+              (erc-channel-user-admin (cdr cdata))))))
 
-(define-inline erc-channel-user-op-p (nick)
+(defun erc-channel-user-op-p (nick)
   "Return non-nil if NICK is an operator in the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
+  (and nick
        (hash-table-p erc-channel-users)
-       (let ((cdata (erc-get-channel-user ,nick)))
+       (let ((cdata (erc-get-channel-user nick)))
          (and cdata (cdr cdata)
-              (erc-channel-user-op (cdr cdata))))))))
+              (erc-channel-user-op (cdr cdata))))))
 
-(define-inline erc-channel-user-halfop-p (nick)
+(defun erc-channel-user-halfop-p (nick)
   "Return non-nil if NICK is a half-operator in the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
+  (and nick
        (hash-table-p erc-channel-users)
-       (let ((cdata (erc-get-channel-user ,nick)))
+       (let ((cdata (erc-get-channel-user nick)))
          (and cdata (cdr cdata)
-              (erc-channel-user-halfop (cdr cdata))))))))
+              (erc-channel-user-halfop (cdr cdata))))))
 
-(define-inline erc-channel-user-voice-p (nick)
+(defun erc-channel-user-voice-p (nick)
   "Return non-nil if NICK has voice in the current channel."
-  (inline-letevals (nick)
-    (inline-quote
-     (and ,nick
+  (and nick
        (hash-table-p erc-channel-users)
-       (let ((cdata (erc-get-channel-user ,nick)))
+       (let ((cdata (erc-get-channel-user nick)))
          (and cdata (cdr cdata)
-              (erc-channel-user-voice (cdr cdata))))))))
+              (erc-channel-user-voice (cdr cdata))))))
 
 (defun erc-get-channel-user-list ()
   "Return a list of users in the current channel.
@@ -1377,96 +1291,6 @@ erc-debug-log-file
 
 (defvar-local erc-dbuf nil)
 
-(defmacro define-erc-module (name alias doc enable-body disable-body
-                                  &optional local-p)
-  "Define a new minor mode using ERC conventions.
-Symbol NAME is the name of the module.
-Symbol ALIAS is the alias to use, or nil.
-DOC is the documentation string to use for the minor mode.
-ENABLE-BODY is a list of expressions used to enable the mode.
-DISABLE-BODY is a list of expressions used to disable the mode.
-If LOCAL-P is non-nil, the mode will be created as a buffer-local
-mode, rather than a global one.
-
-This will define a minor mode called erc-NAME-mode, possibly
-an alias erc-ALIAS-mode, as well as the helper functions
-erc-NAME-enable, and erc-NAME-disable.
-
-Example:
-
-  ;;;###autoload(autoload \\='erc-replace-mode \"erc-replace\")
-  (define-erc-module replace nil
-    \"This mode replaces incoming text according to `erc-replace-alist'.\"
-    ((add-hook \\='erc-insert-modify-hook
-               #\\='erc-replace-insert))
-    ((remove-hook \\='erc-insert-modify-hook
-                  #\\='erc-replace-insert)))"
-  (declare (doc-string 3) (indent defun))
-  (let* ((sn (symbol-name name))
-         (mode (intern (format "erc-%s-mode" (downcase sn))))
-         (group (intern (format "erc-%s" (downcase sn))))
-         (enable (intern (format "erc-%s-enable" (downcase sn))))
-         (disable (intern (format "erc-%s-disable" (downcase sn)))))
-    `(progn
-       (define-minor-mode
-        ,mode
-        ,(format "Toggle ERC %S mode.
-With a prefix argument ARG, enable %s if ARG is positive,
-and disable it otherwise.  If called from Lisp, enable the mode
-if ARG is omitted or nil.
-%s" name name doc)
-        ;; FIXME: We don't know if this group exists, so this `:group' may
-        ;; actually just silence a valid warning about the fact that the var
-        ;; is not associated with any group.
-        :global ,(not local-p) :group (quote ,group)
-        (if ,mode
-            (,enable)
-          (,disable)))
-       (defun ,enable ()
-         ,(format "Enable ERC %S mode."
-                  name)
-         (interactive)
-         (add-to-list 'erc-modules (quote ,name))
-         (setq ,mode t)
-         ,@enable-body)
-       (defun ,disable ()
-         ,(format "Disable ERC %S mode."
-                  name)
-         (interactive)
-         (setq erc-modules (delq (quote ,name) erc-modules))
-         (setq ,mode nil)
-         ,@disable-body)
-       ,(when (and alias (not (eq name alias)))
-          `(defalias
-             ',(intern
-                (format "erc-%s-mode"
-                        (downcase (symbol-name alias))))
-             #',mode))
-       ;; For find-function and find-variable.
-       (put ',mode    'definition-name ',name)
-       (put ',enable  'definition-name ',name)
-       (put ',disable 'definition-name ',name))))
-
-;; The rationale for favoring inheritance here (nicer dispatch) is
-;; kinda flimsy since there aren't yet any actual methods.
-
-(cl-defstruct erc--target
-  (string "" :type string :documentation "Received name of target.")
-  (symbol nil :type symbol :documentation "Case-mapped name as symbol."))
-
-;; These should probably take on a `joined' field to track joinedness,
-;; which should be toggled by `erc-server-JOIN', `erc-server-PART',
-;; etc.  Functions like `erc--current-buffer-joined-p' (bug#48598) may
-;; find it useful.
-
-(cl-defstruct (erc--target-channel (:include erc--target)))
-
-(cl-defstruct (erc--target-channel-local (:include erc--target-channel)))
-
-;; At some point, it may make sense to add a query type with an
-;; account field, which may help support reassociation across
-;; reconnects and nick changes (likely requires v3 extensions).
-
 (defun erc--target-from-string (string)
   "Construct an `erc--target' variant from STRING."
   (funcall (if (erc-channel-p string)
@@ -1516,12 +1340,6 @@ erc-once-with-server-event
     (add-hook hook fun nil t)
     fun))
 
-(define-inline erc-log (string)
-  "Logs STRING if logging is on (see `erc-log-p')."
-  (inline-quote
-   (when erc-log-p
-     (erc-log-aux ,string))))
-
 (defun erc-server-buffer ()
   "Return the server buffer for the current buffer's process.
 The buffer-local variable `erc-server-process' is used to find
@@ -1577,29 +1395,7 @@ erc-ison-p
                    (if erc-online-p "" "not "))
         erc-online-p))))
 
-(defun erc-log-aux (string)
-  "Do the debug logging of STRING."
-  (let ((cb (current-buffer))
-        (point 1)
-        (was-eob nil)
-        (session-buffer (erc-server-buffer)))
-    (if session-buffer
-        (progn
-          (set-buffer session-buffer)
-          (if (not (and erc-dbuf (bufferp erc-dbuf) (buffer-live-p erc-dbuf)))
-              (progn
-                (setq erc-dbuf (get-buffer-create
-                                (concat "*ERC-DEBUG: "
-                                        erc-session-server "*")))))
-          (set-buffer erc-dbuf)
-          (setq point (point))
-          (setq was-eob (eobp))
-          (goto-char (point-max))
-          (insert (concat "** " string "\n"))
-          (if was-eob (goto-char (point-max))
-            (goto-char point))
-          (set-buffer cb))
-      (message "ERC: ** %s" string))))
+
 
 ;; Last active buffer, to print server messages in the right place
 
@@ -1841,40 +1637,6 @@ erc-member-ignore-case
           (throw 'result list)
         (setq list (cdr list))))))
 
-(defmacro erc-with-buffer (spec &rest body)
-  "Execute BODY in the buffer associated with SPEC.
-
-SPEC should have the form
-
- (TARGET [PROCESS])
-
-If TARGET is a buffer, use it.  Otherwise, use the buffer
-matching TARGET in the process specified by PROCESS.
-
-If PROCESS is nil, use the current `erc-server-process'.
-See `erc-get-buffer' for details.
-
-See also `with-current-buffer'.
-
-\(fn (TARGET [PROCESS]) BODY...)"
-  (declare (indent 1) (debug ((form &optional form) body)))
-  (let ((buf (make-symbol "buf"))
-        (proc (make-symbol "proc"))
-        (target (make-symbol "target"))
-        (process (make-symbol "process")))
-    `(let* ((,target ,(car spec))
-            (,process ,(cadr spec))
-            (,buf (if (bufferp ,target)
-                      ,target
-                    (let ((,proc (or ,process
-                                     (and (processp erc-server-process)
-                                          erc-server-process))))
-                      (if (and ,target ,proc)
-                          (erc-get-buffer ,target ,proc))))))
-       (when (buffer-live-p ,buf)
-         (with-current-buffer ,buf
-           ,@body)))))
-
 (defun erc-get-buffer (target &optional proc)
   "Return the buffer matching TARGET in the process PROC.
 If PROC is not supplied, all processes are searched."
@@ -1921,18 +1683,6 @@ erc-buffer-list
     (setq predicate (lambda () t)))
   (erc-buffer-filter predicate proc))
 
-(defmacro erc-with-all-buffers-of-server (process pred &rest forms)
-  "Execute FORMS in all buffers which have same process as this server.
-FORMS will be evaluated in all buffers having the process PROCESS and
-where PRED matches or in all buffers of the server process if PRED is
-nil."
-  (declare (indent 1) (debug (form form body)))
-  (macroexp-let2 nil pred pred
-    `(erc-buffer-filter (lambda ()
-                          (when (or (not ,pred) (funcall ,pred))
-                            ,@forms))
-                        ,process)))
-
 (define-obsolete-function-alias 'erc-iswitchb #'erc-switch-to-buffer "25.1")
 (defun erc--switch-to-buffer (&optional arg)
   (read-buffer "Switch to ERC buffer: "
@@ -2877,8 +2627,6 @@ erc-lurker-cleanup-interval
 consumption of lurker state during long Emacs sessions and/or ERC
 sessions with large numbers of incoming PRIVMSGs.")
 
-(defvar erc-message-parsed)
-
 (defun erc-lurker-update-status (_message)
   "Update `erc-lurker-state' if necessary.
 
@@ -4090,9 +3838,6 @@ erc-cmd-SERVER
   t)
 (put 'erc-cmd-SERVER 'process-not-needed t)
 
-(defvar motif-version-string)
-(defvar gtk-version-string)
-
 (defun erc-cmd-SV ()
   "Say the current ERC and Emacs version into channel."
   (erc-send-message (format "I'm using ERC %s with GNU Emacs %s (%s%s)%s."
@@ -5349,6 +5094,12 @@ erc-parse-prefix
           (setq i (1+ i)))
         alist))))
 
+(defcustom erc-channel-members-changed-hook nil
+  "This hook is called every time the variable `channel-members' changes.
+The buffer where the change happened is current while this hook is called."
+  :group 'erc-hooks
+  :type 'hook)
+
 (defun erc-channel-receive-names (names-string)
   "This function is for internal use only.
 
@@ -5392,13 +5143,6 @@ erc-channel-receive-names
              name name t voice halfop op admin owner)))))
     (run-hooks 'erc-channel-members-changed-hook)))
 
-
-(defcustom erc-channel-members-changed-hook nil
-  "This hook is called every time the variable `channel-members' changes.
-The buffer where the change happened is current while this hook is called."
-  :group 'erc-hooks
-  :type 'hook)
-
 (defun erc-update-user-nick (nick &optional new-nick
                                   host login full-name info)
   "Update the stored user information for the user with nickname NICK.
@@ -6008,12 +5752,6 @@ erc-user-input
 (defvar erc-command-regexp "^/\\([A-Za-z']+\\)\\(\\s-+.*\\|\\s-*\\)$"
   "Regular expression used for matching commands in ERC.")
 
-(cl-defstruct erc-input
-  string insertp sendp)
-
-(cl-defstruct (erc--input-split (:include erc-input))
-  lines cmdp)
-
 (defun erc--discard-trailing-multiline-nulls (state)
   "Ensure last line of STATE's string is non-null.
 But only when `erc-send-whitespace-lines' is non-nil.  STATE is
@@ -6957,9 +6695,6 @@ erc-format-lag-time
           (t ""))))
 
 ;; erc-goodies is required at end of this file.
-(declare-function erc-controls-strip "erc-goodies" (str))
-
-(defvar tabbar--local-hlf)
 
 ;; FIXME when 29.1 is cut and `format-spec' is added to ELPA Compat,
 ;; remove the function invocations from the spec form below.
@@ -7448,12 +7183,4 @@ erc-handle-irc-url
 
 (provide 'erc)
 
-(require 'erc-backend)
-
-;; Deprecated. We might eventually stop requiring the goodies automatically.
-;; IMPORTANT: This require must appear _after_ the above (provide 'erc) to
-;; avoid a recursive require error when byte-compiling the entire package.
-(require 'erc-goodies)
-(require 'erc-networks)
-
 ;;; erc.el ends here
diff --git a/test/lisp/erc/erc-networks-tests.el b/test/lisp/erc/erc-networks-tests.el
index 66a334b709..32bdfa11ff 100644
--- a/test/lisp/erc/erc-networks-tests.el
+++ b/test/lisp/erc/erc-networks-tests.el
@@ -20,7 +20,7 @@
 ;;; Code:
 
 (require 'ert-x) ; cl-lib
-(require 'erc-networks)
+(require 'erc)
 
 (defun erc-networks-tests--create-dead-proc (&optional buf)
   (let ((p (start-process "true" (or buf (current-buffer)) "true")))
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index b2ed29e80e..c88dd9888d 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -24,7 +24,6 @@
 (require 'ert-x)
 (require 'erc)
 (require 'erc-ring)
-(require 'erc-networks)
 
 (ert-deftest erc--read-time-period ()
   (cl-letf (((symbol-function 'read-string) (lambda (&rest _) "")))
@@ -48,27 +47,6 @@ erc--read-time-period
   (cl-letf (((symbol-function 'read-string) (lambda (&rest _) "1d")))
     (should (equal (erc--read-time-period "foo: ") 86400))))
 
-(ert-deftest erc--meta--backend-dependencies ()
-  (with-temp-buffer
-    (insert-file-contents-literally
-     (concat (file-name-sans-extension (symbol-file 'erc)) ".el"))
-    (let ((beg (search-forward ";; Defined in erc-backend"))
-          (end (search-forward "\n\n"))
-          vars)
-      (save-excursion
-        (save-restriction
-          (narrow-to-region beg end)
-          (goto-char (point-min))
-          (with-syntax-table lisp-data-mode-syntax-table
-            (condition-case _
-                (while (push (cadr (read (current-buffer))) vars))
-              (end-of-file)))))
-      (should (= (point) end))
-      (dolist (var vars)
-        (setq var (concat "\\_<" (symbol-name var) "\\_>"))
-        (ert-info (var)
-          (should (save-excursion (search-forward-regexp var nil t))))))))
-
 (ert-deftest erc-with-all-buffers-of-server ()
   (let (proc-exnet
         proc-onet
-- 
2.37.3


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #4: 0002-Add-GS2-authorization-to-sasl-scram-rfc.patch --]
[-- Type: text/x-patch, Size: 3025 bytes --]

From 05e5bdd488a309b70ca140fc620ad48023befa24 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 19 Sep 2022 21:28:52 -0700
Subject: [PATCH 2/5] Add GS2 authorization to sasl-scram-rfc

* lisp/net/sasl-scram-rfc.el (sasl-scram-gs2-header-function,
sasl-scram-construct-gs2-header): Add new variable and default
function for determining a SCRAM GSS-API message header.  `defcustom'
not used because library doesn't define any others.
(sasl-scram-client-first-message): Use gs2-header function.
(sasl-scram--client-final-message): Use dedicated gs2-header function.
Also remove whitespace when base64-encoding, as per RFC 5802.
Bug#57956.
---
 lisp/net/sasl-scram-rfc.el | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/lisp/net/sasl-scram-rfc.el b/lisp/net/sasl-scram-rfc.el
index ee52ed6e07..f7a2e42541 100644
--- a/lisp/net/sasl-scram-rfc.el
+++ b/lisp/net/sasl-scram-rfc.el
@@ -45,14 +45,21 @@
 
 ;;; Generic for SCRAM-*
 
+(defvar sasl-scram-gs2-header-function 'sasl-scram-construct-gs2-header
+  "Function to create GS2 header.
+See https://www.rfc-editor.org/rfc/rfc5801#section-4.")
+
+(defun sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
 (defun sasl-scram-client-first-message (client _step)
   (let ((c-nonce (sasl-unique-id)))
     (sasl-client-set-property client 'c-nonce c-nonce))
   (concat
-   ;; n = client doesn't support channel binding
-   "n,"
-   ;; TODO: where would we get authorization id from?
-   ","
+   (funcall sasl-scram-gs2-header-function client)
    (sasl-scram--client-first-message-bare client)))
 
 (defun sasl-scram--client-first-message-bare (client)
@@ -77,11 +84,11 @@ sasl-scram--client-final-message
 
 	 (c-nonce (sasl-client-property client 'c-nonce))
 	 ;; no channel binding, no authorization id
-	 (cbind-input "n,,"))
+         (cbind-input (funcall sasl-scram-gs2-header-function client)))
     (unless (string-prefix-p c-nonce nonce)
       (sasl-error "Invalid nonce from server"))
     (let* ((client-final-message-without-proof
-	    (concat "c=" (base64-encode-string cbind-input) ","
+            (concat "c=" (base64-encode-string cbind-input t) ","
 		    "r=" nonce))
 	   (password
 	    ;; TODO: either apply saslprep or disallow non-ASCII characters
@@ -113,7 +120,7 @@ sasl-scram--client-final-message
 	   (client-proof (funcall string-xor client-key client-signature))
 	   (client-final-message
 	    (concat client-final-message-without-proof ","
-		    "p=" (base64-encode-string client-proof))))
+                    "p=" (base64-encode-string client-proof t))))
       (sasl-client-set-property client 'auth-message auth-message)
       (sasl-client-set-property client 'salted-password salted-password)
       client-final-message)))
-- 
2.37.3


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #5: 0003-Support-local-ERC-modules-in-erc-mode-buffers.patch --]
[-- Type: text/x-patch, Size: 11897 bytes --]

From 03812d6e956e83538db5223af473eec621b2f2dd Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 12 Jul 2021 03:44:28 -0700
Subject: [PATCH 3/5] Support local ERC modules in erc-mode buffers

* lisp/erc/erc.el (erc-migrate-modules): add some missing mappings.
(erc--module-name-migrations, erc--features-to-modules,
erc--modules-to-features): add alists to support simplified
module-name migrations.
(erc-update-modules): Change return value to a list of minor-mode
commands for local modules that need deferred activation, if any.  Use
`custom-variable-p' to detect flavor.  Currently, all modules are
global, meaning so are their accompanying minor modes.
(erc-open): Defer enabling of local modules via `erc-update-modules'
until after buffer is initialized with other local vars.  Also defer
major mode hooks so they can detect things like whether the buffer is
a server or target buffer.

* lisp/erc/erc-common.el (define-erc-modules): Don't enable local
modules (minor modes) unless `erc-mode' is the major mode. And don't
disable them unless the minor mode is actually active.  Also, don't
mutate `erc-modules' when dealing with a local module.  It's believed
that the original authors wanted this functionality.
(erc--normalize-module-symbol): Add helper for `erc-migrate-modules'.

* lisp/erc/erc-goodies.el: Require cl-lib. Bug#57955.
---
 lisp/erc/erc-common.el     | 26 ++++++++----
 lisp/erc/erc-goodies.el    |  1 +
 lisp/erc/erc.el            | 83 +++++++++++++++++++++++++-------------
 test/lisp/erc/erc-tests.el | 47 +++++++++++++++++++++
 4 files changed, 121 insertions(+), 36 deletions(-)

diff --git a/lisp/erc/erc-common.el b/lisp/erc/erc-common.el
index d8aac36eab..90ea56108d 100644
--- a/lisp/erc/erc-common.el
+++ b/lisp/erc/erc-common.el
@@ -28,6 +28,7 @@
 
 (defvar erc--casemapping-rfc1459)
 (defvar erc--casemapping-rfc1459-strict)
+(defvar erc--module-name-migrations)
 (defvar erc-channel-users)
 (defvar erc-dbuf)
 (defvar erc-log-p)
@@ -85,6 +86,10 @@ erc--target
   (contents "" :type string)
   (tags '() :type list))
 
+(defun erc--normalize-module-symbol (module)
+  "Canonicalize symbol MODULE for `erc-modules'."
+  (or (cdr (assq module erc--module-name-migrations)) module))
+
 (defmacro define-erc-module (name alias doc enable-body disable-body
                                   &optional local-p)
   "Define a new minor mode using ERC conventions.
@@ -98,7 +103,9 @@ define-erc-module
 
 This will define a minor mode called erc-NAME-mode, possibly
 an alias erc-ALIAS-mode, as well as the helper functions
-erc-NAME-enable, and erc-NAME-disable.
+erc-NAME-enable, and erc-NAME-disable.  Beware that for global
+modules, these helpers, as well as the minor-mode toggle, all mutate
+the user option `erc-modules'.
 
 Example:
 
@@ -134,16 +141,21 @@ define-erc-module
          ,(format "Enable ERC %S mode."
                   name)
          (interactive)
-         (add-to-list 'erc-modules (quote ,name))
-         (setq ,mode t)
-         ,@enable-body)
+         (unless ,local-p
+           (cl-pushnew (erc--normalize-module-symbol ',name) erc-modules))
+         (when (or ,(not local-p) (eq major-mode 'erc-mode))
+           (setq ,mode t)
+           ,@enable-body))
        (defun ,disable ()
          ,(format "Disable ERC %S mode."
                   name)
          (interactive)
-         (setq erc-modules (delq (quote ,name) erc-modules))
-         (setq ,mode nil)
-         ,@disable-body)
+         (unless ,local-p
+           (setq erc-modules (delq (erc--normalize-module-symbol ',name)
+                                   erc-modules)))
+         (when (or ,(not local-p) ,mode)
+           (setq ,mode nil)
+           ,@disable-body))
        ,(when (and alias (not (eq name alias)))
           `(defalias
              ',(intern
diff --git a/lisp/erc/erc-goodies.el b/lisp/erc/erc-goodies.el
index 59b5f01f23..1af83b58ba 100644
--- a/lisp/erc/erc-goodies.el
+++ b/lisp/erc/erc-goodies.el
@@ -31,6 +31,7 @@
 
 ;;; Imenu support
 
+(eval-when-compile (require 'cl-lib))
 (require 'erc-common)
 
 (defvar erc-controls-highlight-regexp)
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index e0a4bd3001..23649a5620 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1780,14 +1780,36 @@ erc-default-nicks
 (defvar-local erc-nick-change-attempt-count 0
   "Used to keep track of how many times an attempt at changing nick is made.")
 
+(defconst erc--features-to-modules
+  '((erc-pcomplete completion pcomplete)
+    (erc-capab capab-identify)
+    (erc-join autojoin)
+    (erc-page page ctcp-page)
+    (erc-sound sound ctcp-sound)
+    (erc-stamp stamp timestamp)
+    (erc-services services nickserv))
+  "Migration alist mapping a library feature to module names.
+Keys need not be unique: a library may define more than one
+module.")
+
+(defconst erc--modules-to-features
+  (cl-loop for (feature . names) in erc--features-to-modules
+           append (mapcar (lambda (name) (cons name feature)) names))
+  "Migration alist mapping a module's name to library feature.")
+
+(defconst erc--module-name-migrations
+  (let (pairs)
+    (pcase-dolist (`(,_ ,canonical . ,rest) erc--features-to-modules)
+      (dolist (obsolete rest)
+        (push (cons obsolete canonical) pairs)))
+    pairs)
+  "Association list of obsolete module names to canonical names.")
+
 (defun erc-migrate-modules (mods)
   "Migrate old names of ERC modules to new ones."
   ;; modify `transforms' to specify what needs to be changed
   ;; each item is in the format '(old . new)
-  (let ((transforms '((pcomplete . completion))))
-    (delete-dups
-     (mapcar (lambda (m) (or (cdr (assoc m transforms)) m))
-             mods))))
+  (delete-dups (mapcar #'erc--normalize-module-symbol mods)))
 
 (defcustom erc-modules '(netsplit fill button match track completion readonly
                                   networks ring autojoin noncommands irccontrols
@@ -1866,27 +1888,22 @@ erc-modules
   :group 'erc)
 
 (defun erc-update-modules ()
-  "Run this to enable erc-foo-mode for all modules in `erc-modules'."
-  (let (req)
+  "Enable global minor mode for all global modules in `erc-modules'.
+Return minor-mode commands for all local modules, possibly for
+deferred invocation, as done by `erc-open' whenever a new ERC
+buffer is created.  Local modules were introduced in ERC 5.6."
+  (let (local-modules)
     (dolist (mod erc-modules)
-      (setq req (concat "erc-" (symbol-name mod)))
-      (cond
-       ;; yuck. perhaps we should bring the filenames into sync?
-       ((string= req "erc-capab-identify")
-        (setq req "erc-capab"))
-       ((string= req "erc-completion")
-        (setq req "erc-pcomplete"))
-       ((string= req "erc-pcomplete")
-        (setq mod 'completion))
-       ((string= req "erc-autojoin")
-        (setq req "erc-join")))
-      (condition-case nil
-          (require (intern req))
-        (error nil))
+      (require (or (alist-get mod erc--modules-to-features)
+                   (intern (concat "erc-" (symbol-name mod))))
+               nil 'noerror) ; some modules don't have a corresponding feature
       (let ((sym (intern-soft (concat "erc-" (symbol-name mod) "-mode"))))
-        (if (fboundp sym)
+        (unless (and sym (fboundp sym))
+          (error "`%s' is not a known ERC module" mod))
+        (if (custom-variable-p sym)
             (funcall sym 1)
-          (error "`%s' is not a known ERC module" mod))))))
+          (push sym local-modules))))
+    local-modules))
 
 (defun erc-setup-buffer (buffer)
   "Consults `erc-join-buffer' to find out how to display `BUFFER'."
@@ -1942,18 +1959,22 @@ erc-open
   (let* ((target (and channel (erc--target-from-string channel)))
          (buffer (erc-get-buffer-create server port nil target id))
          (old-buffer (current-buffer))
-         old-point
+         (old-recon-count erc-server-reconnect-count)
+         (old-point nil)
+         (delayed-modules nil)
          (continued-session (and erc--server-reconnecting
                                  (with-suppressed-warnings
                                      ((obsolete erc-reuse-buffers))
                                    erc-reuse-buffers))))
     (when connect (run-hook-with-args 'erc-before-connect server port nick))
-    (erc-update-modules)
     (set-buffer buffer)
     (setq old-point (point))
-    (let ((old-recon-count erc-server-reconnect-count))
-      (erc-mode)
-      (setq erc-server-reconnect-count old-recon-count))
+    (setq delayed-modules (erc-update-modules))
+
+    (delay-mode-hooks (erc-mode))
+
+    (setq erc-server-reconnect-count old-recon-count)
+
     (when (setq erc-server-connected (not connect))
       (setq erc-server-announced-name
             (buffer-local-value 'erc-server-announced-name old-buffer)))
@@ -2016,6 +2037,12 @@ erc-open
     (setq erc-dbuf
           (when erc-log-p
             (get-buffer-create (concat "*ERC-DEBUG: " server "*"))))
+
+    (erc-determine-parameters server port nick full-name user passwd)
+
+    (save-excursion (run-mode-hooks))
+    (dolist (mod delayed-modules) (funcall mod +1))
+
     ;; set up prompt
     (unless continued-session
       (goto-char (point-max))
@@ -2027,8 +2054,6 @@ erc-open
       (erc-display-prompt)
       (goto-char (point-max)))
 
-    (erc-determine-parameters server port nick full-name user passwd)
-
     ;; Saving log file on exit
     (run-hook-with-args 'erc-connect-pre-hook buffer)
 
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index c88dd9888d..4646c35e25 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -953,4 +953,51 @@ erc-message
     (kill-buffer "ExampleNet")
     (kill-buffer "#chan")))
 
+(ert-deftest erc-migrate-modules ()
+  (should (equal (erc-migrate-modules '(autojoin timestamp button))
+                 '(autojoin stamp button)))
+  ;; Default unchanged
+  (should (equal (erc-migrate-modules erc-modules) erc-modules)))
+
+(ert-deftest erc-update-modules ()
+  (let* (calls
+         (erc-modules '(fake-foo fake-bar)))
+    (cl-letf (((symbol-function 'require)
+               (lambda (s &rest _) (push s calls)))
+              ((symbol-function 'erc-fake-foo-mode)
+               (lambda (n) (push (cons 'fake-foo n) calls)))
+              ;; Here, foo is a global module (minor mode)
+              ((get 'erc-fake-foo-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-fake-bar-mode)
+               (lambda (n) (push (cons 'fake-bar n) calls)))
+              ((symbol-function 'erc-autojoin-mode)
+               (lambda (n) (push (cons 'autojoin n) calls)))
+              ((get 'erc-autojoin-mode 'standard-value) #'ignore)
+              ((symbol-function 'erc-networks-mode)
+               (lambda (n) (push (cons 'networks n) calls)))
+              ((symbol-function 'erc-completion-mode)
+               (lambda (n) (push (cons 'completion n) calls)))
+              ((get 'erc-completion-mode 'standard-value) #'ignore))
+
+      (ert-info ("Locals")
+        (should (equal (erc-update-modules)
+                       '(erc-fake-bar-mode)))
+        ;; Bar still required
+        (should (equal (nreverse calls) '(erc-fake-foo
+                                          (fake-foo . 1)
+                                          erc-fake-bar)))
+        (setq calls nil))
+
+      (ert-info ("Module name overrides")
+        (setq erc-modules '(completion autojoin networks))
+        (should-not (erc-update-modules)) ; no locals
+        (should (equal (nreverse calls)
+                       '(erc-pcomplete
+                         (completion . 1)
+                         erc-join
+                         (autojoin . 1)
+                         erc-networks
+                         (networks . 1))))
+        (setq calls nil)))))
+
 ;;; erc-tests.el ends here
-- 
2.37.3


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #6: 0004-Call-erc-login-indirectly-via-new-generic-wrapper.patch --]
[-- Type: text/x-patch, Size: 1981 bytes --]

From cbc776566ee5ed177ee1a923300143695c6d71fc Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:49:23 -0700
Subject: [PATCH 4/5] Call erc-login indirectly via new generic wrapper

* lisp/erc/erc-backend (erc--register-connection): Add new generic
function that defers to `erc-login' by default.
(erc-process-sentinel, erc-server-connect): Call
`erc--register-connection' instead of `erc-login'.
---
 lisp/erc/erc-backend.el | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index 026b34849a..fee29e7d05 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -625,6 +625,10 @@ erc-open-network-stream
   (let ((p (plist-put parameters :nowait t)))
     (apply #'open-network-stream name buffer host service p)))
 
+(cl-defmethod erc--register-connection ()
+  "Perform opening IRC protocol exchange with server."
+  (erc-login))
+
 (defun erc-server-connect (server port buffer &optional client-certificate)
   "Perform the connection and login using the specified SERVER and PORT.
 We will store server variables in the buffer given by BUFFER.
@@ -673,7 +677,7 @@ erc-server-connect
         ;; waiting for a non-blocking connect - keep the user informed
         (erc-display-message nil nil buffer "Opening connection..\n")
       (message "%s...done" msg)
-      (erc-login)) ))
+      (erc--register-connection))))
 
 (defun erc-server-reconnect ()
   "Reestablish the current IRC connection.
@@ -851,7 +855,7 @@ erc-process-sentinel
                   cproc (process-status cproc) event erc-server-quitting))
         (if (string-match "^open" event)
             ;; newly opened connection (no wait)
-            (erc-login)
+            (erc--register-connection)
           ;; assume event is 'failed
           (erc-with-all-buffers-of-server cproc nil
                                           (setq erc-server-connected nil))
-- 
2.37.3


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #7: 0005-Add-non-IRCv3-SASL-module-to-ERC.patch --]
[-- Type: text/x-patch, Size: 66477 bytes --]

From 27242c8becae2962972c2a6cfdf4de44d276184b Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:37:13 -0700
Subject: [PATCH 5/5] Add non-IRCv3 SASL module to ERC

* lisp/erc/erc-compat.el (erc-compat--sasl-scram-construct-gs2-header,
erc-compat--sasl-scram-client-first-message,
erc-compat--sasl-scram--client-final-message): Add minimal
authorization support via own variant of
`sasl-scram--client-final-message' and supporting sasl-scram-rfc
functions introduced in Emacs 29.
* lisp/erc/erc.el (erc-modules): Add `sasl'.

* lisp/erc/erc-sasl.el: New file.
* test/lisp/erc/erc-sasl-tests.el: New file.
* test/lisp/erc/erc-scenarios-sasl.el: New file.
* test/lisp/erc/resources/sasl/plain-failed.eld: New file.
* test/lisp/erc/resources/sasl/plain.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-1.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-256.eld: New file.
* test/lisp/erc/resources/sasl/external.eld: New file.
---
 doc/misc/erc.texi                             | 138 +++++-
 lisp/erc/erc-compat.el                        | 104 +++++
 lisp/erc/erc-sasl.el                          | 396 ++++++++++++++++++
 lisp/erc/erc.el                               |   1 +
 test/lisp/erc/erc-sasl-tests.el               | 302 +++++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 161 +++++++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  35 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 +++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 +++
 11 files changed, 1279 insertions(+), 1 deletion(-)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

diff --git a/doc/misc/erc.texi b/doc/misc/erc.texi
index 3db83197f9..80b4171cdb 100644
--- a/doc/misc/erc.texi
+++ b/doc/misc/erc.texi
@@ -78,6 +78,7 @@ Top
 Advanced Usage
 
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL.
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 
@@ -478,6 +479,10 @@ Modules
 @item ring
 Enable an input history
 
+@cindex modules, sasl
+@item sasl
+Enable SASL authentication
+
 @cindex modules, scrolltobottom
 @item scrolltobottom
 Scroll to the bottom of the buffer
@@ -525,6 +530,7 @@ Advanced Usage
 
 @menu
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 @end menu
@@ -842,6 +848,7 @@ Connecting
 @noindent
 For details, @pxref{Top,,auth-source, auth, Emacs auth-source Library}.
 
+@anchor{ERC auth-source functions}
 @defopt erc-auth-source-server-function
 @end defopt
 @defopt erc-auth-source-services-function
@@ -854,7 +861,8 @@ Connecting
 @code{:user} is the ``desired'' nickname rather than the current one.
 Generalized names, like @code{:user} and @code{:host}, are always used
 over back-end specific ones, like @code{:login} or @code{:machine}.
-ERC expects a string to use as the secret or nil, if the search fails.
+ERC expects a string to use as the secret or @code{nil}, if the search
+fails.
 
 @findex erc-auth-source-search
 The default value for all three options is the function
@@ -915,6 +923,134 @@ Connecting
 make the most sense, but any reasonably printable object is
 acceptable.
 
+@node SASL
+@section Authenticating via SASL
+@cindex SASL
+
+@strong{Warning:} ERC's SASL offering is currently limited by a lack
+of support for proper IRCv3 capability negotiation.  In most cases,
+this shouldn't affect your ability to authenticate.  If you run into
+trouble, please contact us (@pxref{Getting Help and Reporting Bugs}).
+
+Regardless of the mechanism or the network, you'll likely have to be
+registered before first use.  Please refer to the network's own
+instructions for details.  If you're new to IRC and using a bouncer,
+know that you almost certainly won't be needing SASL for the
+@samp{client -> bouncer} connection.
+
+Note that @code{sasl} is a ``local'' ERC module.  This means invoking
+@code{erc-sasl-mode} manually or calling @code{erc-update-modules}
+won't do any good.  Instead, simply add @code{sasl} to
+@code{erc-modules} (or @code{let}-bind it while calling
+@code{erc-tls}), and SASL will be enabled for the current connection.
+But before that, please explore all custom options pertaining to your
+chosen mechanism.
+
+@defopt erc-sasl-mechanism
+The name of an SASL subprotocol type as a @emph{lowercase} symbol.
+
+@var{plain} and @var{scram} (``password-based''):
+
+@indentedblock
+Here, ``password'' refers to your account password, which is usually
+your @samp{NickServ} password.  This often differs from any connection
+(server) password given to @code{erc-tls} via its @code{:password}
+parameter.  To make this work, customize both @code{erc-sasl-user} and
+@code{erc-sasl-password} or bind them when invoking @code{erc-tls}.
+@end indentedblock
+
+@var{external} (via Client TLS Certificate):
+
+@indentedblock
+You'll want to specify the @code{:client-certificate} param when
+opening a new connection, which is typically done by calling
+@code{emacs-tls}.  But before that, ensure you've registered your
+fingerprint with the network.  The fingerprint is usually a SHA1 or
+SHA256 digest in either "normalized" or "openssl" forms.  The first is
+lowercase without delims (@samp{deadbeef}) and the second uppercase
+with colon seps (@samp{DE:AD:BE:EF}).
+
+Additional considerations:
+@enumerate
+@item
+There's no reason to send your password after registering.
+@item
+Most IRCds will allow you to authenticate with a client cert but
+without the hassle of SASL (meaning you may not need this module).
+@item
+Technically, @var{EXTERNAL} merely indicates that an out-of-band mode
+of authentication is in effect (being deferred to), so depending on
+the specific application or service, there's an off chance client
+certs aren't involved.
+@end enumerate
+@end indentedblock
+
+@var{ecdsa-nist256p-challenge}:
+
+@indentedblock
+This mechanism is quite complicated and currently requires the
+external @samp{openssl} executable, so please use something else if at
+all possible.  Ignoring that, specify your key file (e.g.,
+@samp{~/pki/mykey.pem}) as the value of @code{erc-sasl-password}, and
+then configure your network settings.  On servers running Atheme
+services, you can add your public key with @samp{NickServ} like so:
+
+@example
+ERC> /msg NickServ set property \
+     pubkey AgGZmlYTUjJlea/BVz7yrjJ6gysiAPaQxzeUzTH4hd5j
+
+@end example
+(You may be able to omit the @samp{property} subcommand.)
+@end indentedblock
+
+@end defopt
+
+@defopt erc-sasl-user
+This should be your network account name, typically the same one
+registered with nickname services.  Specify this when your
+@samp{NickServ} account name differs from the nick you're connecting
+with.
+@end defopt
+
+@defopt erc-sasl-password
+For ``password-based'' mechanisms, ERC sends any nonempty string as
+the authentication password.
+
+If you instead give a non-@code{nil} symbol, like @samp{Libera.Chat},
+ERC will use it for the @code{:host} field in an auth-source query.
+Actually, the same goes for when this option is @code{nil} but an
+explicit session ID is already on file (@pxref{Network Identifier}).
+For all such queries, ERC specifies the value of @code{erc-sasl-user}
+for the @code{:user} (@code{:login}) param.  Keep in mind that none of
+this matters unless @code{erc-sasl-auth-source-function} holds a
+function (it's @code{nil} by default).
+
+Otherwise, if you set this option to @code{nil} (or the empty string)
+or if an auth-source lookup has failed, ERC will try a non-@code{nil}
+``server password'', likely whatever you gave as the @var{password}
+argument to @code{erc-tls}.  This fallback behavior may change,
+however, so please don't rely on it.  As a last resort, ERC will
+prompt you for input.
+
+Also, if your mechanism is @code{ecdsa-nist256p-challenge}, this
+option should instead hold the file name of your key.
+@end defopt
+
+@defopt erc-sasl-auth-source-function
+This is nearly identical to the other ERC @samp{auth-source} function
+options (@pxref{ERC auth-source functions}) except that the default
+value here is @code{nil}, meaning you have to set it to something like
+@code{erc-auth-source-search} for queries to be performed.
+@end defopt
+
+@defopt erc-sasl-authzid
+In the rarest of circumstances, a network may want you to specify a
+specific role or assume an alternate identity.  In most cases, this
+happens because the server is buggy or misconfigured.  If you suspect
+such a thing, please contact your network operator.  Otherwise, just
+leave this set to @code{nil}.
+@end defopt
+
 
 @node Sample Configuration
 @section Sample Configuration
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 03bd8f1352..bc3e1dcfc6 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -157,6 +157,110 @@ erc-subseq
 	       res))))))
 
 
+;;;; SASL
+
+(declare-function sasl-step-data "sasl" (step))
+(declare-function sasl-error "sasl" (datum))
+(declare-function sasl-client-property "sasl" (client property))
+(declare-function sasl-client-set-property "sasl" (client property value))
+(declare-function sasl-mechanism-name "sasl" (mechanism))
+(declare-function sasl-client-name "sasl" (client))
+(declare-function sasl-client-mechanism "sasl" (client))
+(declare-function sasl-read-passphrase "sasl" (prompt))
+(declare-function sasl-unique-id "sasl" nil)
+(declare-function decode-hex-string "hex-util" (string))
+(declare-function rfc2104-hash "rfc2104" (hash block-length hash-length
+                                               key text))
+(declare-function sasl-scram--client-first-message-bare "sasl-scram-rfc"
+                  (client))
+(declare-function cl-mapcar "cl-lib" (cl-func cl-x &rest cl-rest))
+
+(defun erc-compat--sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
+(defun erc-compat--sasl-scram-client-first-message (client _step)
+  (let ((c-nonce (sasl-unique-id)))
+    (sasl-client-set-property client 'c-nonce c-nonce))
+  (concat (erc-compat--sasl-scram-construct-gs2-header client)
+          (sasl-scram--client-first-message-bare client)))
+
+;; This is `sasl-scram--client-final-message' from sasl-scram-rfc,
+;; with the NO-LINE-BREAK argument of `base64-encode-string' set to t
+;; because https://www.rfc-editor.org/rfc/rfc5802#section-2.1 says:
+;;
+;;  > The use of base64 in SCRAM is restricted to the canonical form
+;;  > with no whitespace.
+;;
+;; Unfortunately, advising `base64-encode-string' won't work
+;; because the byte compiler precomputes the result when all inputs
+;; are constants, as they are in the unpatched version.
+;;
+;; The only other substantial change is the addition of authz support.
+;; This can be dropped if adopted by Emacs 29 and `compat'.  Changes
+;; proposed for 29 are marked with a "; *n", comment below.  See older
+;; versions of lisp/erc/erc-v3-sasl.el (bug#49860) if needing a true
+;; side-by-side diff.  This also inlines the internal function
+;; `sasl-scram--client-first-message-bare' and takes various liberties
+;; with formatting.
+
+(defun erc-compat--sasl-scram--client-final-message
+    (hash-fun block-length hash-length client step)
+  (unless (string-match
+           "^r=\\([^,]+\\),s=\\([^,]+\\),i=\\([0-9]+\\)\\(?:$\\|,\\)"
+           (sasl-step-data step))
+    (sasl-error "Unexpected server response"))
+  (let* ((hmac-fun
+          (lambda (text key)
+            (decode-hex-string
+             (rfc2104-hash hash-fun block-length hash-length key text))))
+         (step-data (sasl-step-data step))
+         (nonce (match-string 1 step-data))
+         (salt-base64 (match-string 2 step-data))
+         (iteration-count (string-to-number (match-string 3 step-data)))
+         (c-nonce (sasl-client-property client 'c-nonce))
+         (cbind-input
+          (if (string-prefix-p c-nonce nonce)
+              (erc-compat--sasl-scram-construct-gs2-header client) ; *1
+            (sasl-error "Invalid nonce from server")))
+         (client-final-message-without-proof
+          (concat "c=" (base64-encode-string cbind-input t) "," ; *2
+                  "r=" nonce))
+         (password
+          (sasl-read-passphrase
+           (format "%s passphrase for %s: "
+                   (sasl-mechanism-name (sasl-client-mechanism client))
+                   (sasl-client-name client))))
+         (salt (base64-decode-string salt-base64))
+         (string-xor (lambda (a b)
+                       (apply #'unibyte-string (cl-mapcar #'logxor a b))))
+         (salted-password (let ((digest (concat salt (string 0 0 0 1)))
+                                (xored nil))
+                            (dotimes (_i iteration-count xored)
+                              (setq digest (funcall hmac-fun digest password))
+                              (setq xored (if (null xored)
+                                              digest
+                                            (funcall string-xor xored
+                                                     digest))))))
+         (client-key (funcall hmac-fun "Client Key" salted-password))
+         (stored-key (decode-hex-string (funcall hash-fun client-key)))
+         (auth-message (concat "n=" (sasl-client-name client)
+                               ",r=" c-nonce "," step-data
+                               "," client-final-message-without-proof))
+         (client-signature (funcall hmac-fun
+                                    (encode-coding-string auth-message 'utf-8)
+                                    stored-key))
+         (client-proof (funcall string-xor client-key client-signature))
+         (client-final-message
+          (concat client-final-message-without-proof ","
+                  "p=" (base64-encode-string client-proof t)))) ; *3
+    (sasl-client-set-property client 'auth-message auth-message)
+    (sasl-client-set-property client 'salted-password salted-password)
+    client-final-message))
+
+
 ;;;; Misc 29.1
 
 (defmacro erc-compat--with-memoization (table &rest forms)
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
new file mode 100644
index 0000000000..f36a305247
--- /dev/null
+++ b/lisp/erc/erc-sasl.el
@@ -0,0 +1,396 @@
+;;; erc-sasl.el --- SASL for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published
+;; by the Free Software Foundation, either version 3 of the License,
+;; or (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;; This "non-IRCv3" implementation resembles many others that have
+;; surfaced over the years, the first possibly being:
+;;
+;; https://lists.gnu.org/archive/html/erc-discuss/2012-02/msg00001.html
+;;
+;; See options and Info manual for usage.
+;;
+;; TODO:
+;;
+;; - Find a way to obfuscate the password in memory (via something
+;;   like `auth-source--obfuscate'); it's currently visible in
+;;   backtraces.
+;;
+;; - Implement a proxy mechanism that chooses the strongest available
+;;   mechanism for you.  Requires CAP 3.2 (see bug#49860).
+
+;;; Code:
+(require 'erc)
+(require 'rx)
+(require 'sasl)
+(require 'sasl-scram-rfc)
+(require 'sasl-scram-sha256 nil t)
+
+(defgroup erc-sasl nil
+  "SASL for ERC."
+  :group 'erc
+  :package-version '(ERC . "5.4")) ; FIXME increment on next release
+
+(defcustom erc-sasl-mechanism nil
+  "SASL mechanism to connect with.
+Note that any value other than nil or `external' likely requires
+`erc-sasl-user' and `erc-sasl-password'."
+  :type '(choice (const nil)
+                 (const plain)
+                 (const external)
+                 (const scram-sha-1)
+                 (const scram-sha-256)
+                 (const scram-sha-512)
+                 (const ecdsa-nist256p-challenge)))
+
+(defcustom erc-sasl-user nil
+  "Optional account username to send when authenticating.
+This is also referred to as the authentication identity, or
+\"authcid\".  When nil, applicable mechanisms will use the
+session's current nick."
+  :type '(choice string (const nil)))
+
+(defcustom erc-sasl-password nil
+  "Optional account password to send when authenticating.
+When the value is a string, ERC uses it unconditionally for most
+mechanisms (see below).  As a special case, when the value is a
+non-nil symbol, ERC uses it as the value of the `:host' field in
+an auth-source query, provided `erc-sasl-auth-source-function' is
+set to a function.  When nil, ERC will try a non-nil \"session
+password\", likely one given as the `:password' argument to
+`erc-tls'.  As a last resort, ERC will prompt the user for input.
+
+Note that when `erc-sasl-mechanism' is set to
+`ecdsa-nist256p-challenge', this option should hold the file name
+of the key, which is typically in PEM format."
+  :type '(choice (const nil) string symbol))
+
+(defcustom erc-sasl-auth-source-function nil
+  "Function to query auth-source for an SASL password.
+Called with keyword params known to `auth-source-search', which
+may include a non-nil `erc-sasl-user' for the `:user' field
+and a non-nil `erc-sasl-password' for the `:host' field, when
+the latter option is a symbol instead of a string.  In return,
+ERC expects a string to send as the SASL password, or nil, to
+move on to the next approach, as described in the doc string for
+the option `erc-sasl-password'.  See info node `(erc)
+Connecting' for details on ERC's auth-source integration."
+  :type '(choice (const erc-auth-source-search)
+                 (const nil)
+                 function))
+
+(defcustom erc-sasl-authzid nil
+  "SASL authorization identity, likely unneeded for everyday use."
+  :type '(choice (const nil) string))
+
+
+;; Analogous to what erc-backend does to persist opening params.
+(defvar-local erc-sasl--options nil)
+
+;; Session-local (server buffer) SASL subproto state
+(defvar-local erc-sasl--state nil)
+
+(cl-defstruct erc-sasl--state
+  "Holder for client object and subproto state."
+  (client nil :type vector)
+  (step nil :type vector)
+  (pending nil :type string))
+
+(defun erc-sasl--read-password (prompt)
+  "Return configured option or server password.
+PROMPT is passed to `read-passwd' if necessary."
+  (let* ((pass (alist-get 'password erc-sasl--options))
+         (found
+          (or (and (stringp pass) (not (string-empty-p pass)) pass)
+              (and erc-sasl-auth-source-function
+                   (let ((user (alist-get 'user erc-sasl--options))
+                         (host (or pass
+                                   (erc-networks--id-given erc-networks--id))))
+                     (apply erc-sasl-auth-source-function
+                            `(,@(and user (list :user user))
+                              ,@(and host (list :host (symbol-name host)))))))
+              erc-session-password)))
+    (if found
+        (copy-sequence found)
+      (read-passwd prompt))))
+
+(defun erc-sasl--plain-response (client steps)
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (sasl-plain-response client steps)))
+
+(declare-function erc-compat--sasl-scram--client-final-message "erc-compat"
+                  (hash-fun block-length hash-length client step))
+
+(defun erc-sasl--scram-sha-hack-client-final-message (&rest args)
+  ;; In the future (29+), we'll hopefully be able to call
+  ;; `sasl-scram--client-final-message' directly
+  (require 'erc-compat)
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (apply #'erc-compat--sasl-scram--client-final-message args)))
+
+(defun erc-sasl--scram-sha-1-client-final-message (client step)
+  (erc-sasl--scram-sha-hack-client-final-message 'sha1 64 20 client step))
+
+(defun erc-sasl--scram-sha-256-client-final-message (client step)
+  (erc-sasl--scram-sha-hack-client-final-message 'sasl-scram-sha256 64 32
+                                                 client step))
+
+(defun erc-sasl--scram-sha512 (object &optional start end binary)
+  (secure-hash 'sha512 object start end binary))
+
+(defun erc-sasl--scram-sha-512-client-final-message (client step)
+  (erc-sasl--scram-sha-hack-client-final-message #'erc-sasl--scram-sha512
+                                                 128 64 client step))
+
+(defun erc-sasl--scram-sha-512-authenticate-server (client step)
+  (sasl-scram--authenticate-server #'erc-sasl--scram-sha512
+                                   128 64 client step))
+
+(defun erc-sasl--ecdsa-first (client _step)
+  "Return CLIENT name."
+  (sasl-client-name client))
+
+;; FIXME do this with gnutls somehow
+(defun erc-sasl--ecdsa-sign (client step)
+  "Return signed challenge for CLIENT and current STEP."
+  (let ((challenge (sasl-step-data step)))
+    (with-temp-buffer
+      (set-buffer-multibyte nil)
+      (insert challenge)
+      (call-process-region (point-min) (point-max)
+                           "openssl" 'delete t nil "pkeyutl" "-inkey"
+                           (sasl-client-property client 'ecdsa-keyfile)
+                           "-sign")
+      (buffer-string))))
+
+(pcase-dolist
+    (`(,name . ,steps)
+     '(("PLAIN"
+        erc-sasl--plain-response)
+       ("EXTERNAL"
+        ignore)
+       ("SCRAM-SHA-1"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-1-client-final-message
+        sasl-scram-sha-1-authenticate-server)
+       ("SCRAM-SHA-256"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-256-client-final-message
+        sasl-scram-sha-256-authenticate-server)
+       ("SCRAM-SHA-512"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-512-client-final-message
+        erc-sasl--scram-sha-512-authenticate-server)
+       ("ECDSA-NIST256P-CHALLENGE"
+        erc-sasl--ecdsa-first
+        erc-sasl--ecdsa-sign)))
+  (let ((feature (intern (concat "erc-sasl-" (downcase name)))))
+    (put feature 'sasl-mechanism (sasl-make-mechanism name steps))
+    (provide feature)))
+
+(cl-defgeneric erc-sasl--create-client (mechanism)
+  "Create and return a new SASL client object for MECHANISM."
+  (let ((sasl-mechanism-alist (copy-sequence sasl-mechanism-alist))
+        (sasl-mechanisms sasl-mechanisms)
+        (name (upcase (symbol-name mechanism)))
+        (feature (intern (concat "erc-sasl-" (symbol-name mechanism))))
+        client)
+    (setf (alist-get name sasl-mechanism-alist nil nil #'equal) `(,feature))
+    (cl-pushnew name sasl-mechanisms :test #'equal)
+    (setq client (sasl-make-client (sasl-find-mechanism `(,name))
+                                   (or (alist-get 'user erc-sasl--options)
+                                       (erc-downcase (erc-current-nick)))
+                                   "N/A" "N/A"))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+(cl-defmethod erc-sasl--create-client ((_m (eql plain)))
+  "Create and return a new PLAIN client object."
+  ;; https://tools.ietf.org/html/rfc4616#section-2.
+  (let* ((sans (remq (assoc "PLAIN" sasl-mechanism-alist)
+                     sasl-mechanism-alist))
+         (sasl-mechanism-alist (cons '("PLAIN" erc-sasl-plain) sans))
+         (authc (or (alist-get 'user erc-sasl--options)
+                    (erc-downcase (erc-current-nick))))
+         (port (if (numberp erc-session-port)
+                   (number-to-string erc-session-port)
+                 "0"))
+         ;; In most cases, `erc-server-announced-name' won't be known.
+         (host (or erc-server-announced-name erc-session-server))
+         (mech (sasl-find-mechanism '("PLAIN")))
+         (client (sasl-make-client mech authc port host)))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-256)))
+  "Create and return a new SCRAM-SHA-256 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-512)))
+  "Create and return a new SCRAM-SHA-512 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((_ (eql ecdsa-nist256p-challenge)))
+  "Create and return a new ECDSA-NIST256P-CHALLENGE client."
+  (unless (executable-find "openssl")
+    (user-error "Could not find openssl command-line utility"))
+  (let ((keyfile (cdr (assq 'password erc-sasl--options))))
+    (unless (and keyfile (file-exists-p keyfile))
+      (user-error "`erc-sasl-password' does not point to ECDSA keyfile"))
+    (let ((client (cl-call-next-method)))
+      (sasl-client-set-property client 'ecdsa-keyfile keyfile)
+      client)))
+
+;; This stands alone because it's also used by bug#49860
+(defun erc-sasl--init ()
+  (setq erc-sasl--state (make-erc-sasl--state)
+        erc-sasl--options `((user . ,erc-sasl-user)
+                            (password . ,erc-sasl-password)
+                            (mechanism . ,erc-sasl-mechanism)
+                            (authzid . ,erc-sasl-authzid))))
+
+(defun erc-sasl--mechanism-offered-p (offered)
+  "Return non-nil when OFFERED appears among a list of mechanisms."
+  (string-match-p (rx-to-string
+                   `(: (| bot ",")
+                       ,(symbol-name
+                         (alist-get 'mechanism erc-sasl--options))
+                       (| eot ",")))
+                  (downcase offered)))
+
+(defun erc-sasl--authenticate-handler (_proc parsed)
+  "Handle PARSED `erc-response' from server.
+Maybe transition to next state."
+  (if-let* ((response (car (erc-response.command-args parsed)))
+            ((= 400 (length response))))
+      (cl-callf (lambda (s) (concat s response))
+          (erc-sasl--state-pending erc-sasl--state))
+    (cl-assert response t)
+    (when (string= "+" response)
+      (setq response ""))
+    (setf response (base64-decode-string
+                    (concat (erc-sasl--state-pending erc-sasl--state) response))
+          (erc-sasl--state-pending erc-sasl--state) nil)
+    ;; The server is done sending, so our turn
+    (let ((client (erc-sasl--state-client erc-sasl--state))
+          (step (erc-sasl--state-step erc-sasl--state))
+          data)
+      (when step
+        (sasl-step-set-data step response))
+      (setq step (setf (erc-sasl--state-step erc-sasl--state)
+                       (sasl-next-step client step))
+            data (sasl-step-data step))
+      (when (string= data "")
+        (setq data nil))
+      (when data
+        (setq data (base64-encode-string data t)))
+      ;; No need for : because no spaces (right?)
+      (erc-server-send (concat "AUTHENTICATE " (or data "+"))))))
+
+(erc-define-catalog
+ 'english
+ '((s902 . "ERR_NICKLOCKED nick %n unavailable: %s")
+   (s904 . "ERR_SASLFAIL (authentication failed) %s")
+   (s905 . "ERR SASLTOOLONG (credentials too long) %s")
+   (s906 . "ERR_SASLABORTED (authentication aborted) %s")
+   (s907 . "ERR_SASLALREADY (already authenticated) %s")
+   (s908 . "RPL_SASLMECHS (unsupported mechanism %m) %s")))
+
+(define-erc-module sasl nil
+  "Non-IRCv3 SASL support for ERC.
+This doesn't solicit or validate a suite of supported mechanisms."
+  ;; See bug#49860 for a full, CAP 3.2-aware implementation, currently
+  ;; a WIP as of ERC 5.5.
+  ((unless erc--target
+     (add-hook 'erc-server-AUTHENTICATE-functions
+               #'erc-sasl--authenticate-handler 0 t)
+     (erc-sasl--init)
+     (let* ((mech (alist-get 'mechanism erc-sasl--options))
+            (client (erc-sasl--create-client mech)))
+       (unless client
+         (erc-display-error-notice nil (format "Unknown mechanism: %s" mech))
+         (erc-error "Unknown mechanism: %s" mech))
+       (setf (erc-sasl--state-client erc-sasl--state) client))))
+  ((remove-hook 'erc-server-AUTHENTICATE-functions
+                #'erc-sasl--authenticate-handler t)
+   (kill-local-variable 'erc-sasl--options))
+  'local)
+
+;; FIXME use generic mechanism instead of hooks after bug#49860.
+(define-erc-response-handler (AUTHENTICATE)
+  "Maybe authenticate to server." nil)
+
+(defun erc-sasl--destroy (proc)
+  (run-hook-with-args 'erc-quit-hook proc)
+  (delete-process proc)
+  (erc-error "Disconnected from %s; please review SASL settings" proc))
+
+(define-erc-response-handler (902)
+  "Handle a ERR_NICKLOCKED response." nil
+  (erc-display-message parsed '(notice error) 'active 's902
+                       ?n (car (erc-response.command-args parsed))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(define-erc-response-handler (903)
+  "Handle a RPL_SASLSUCCESS response." nil
+  (when erc-sasl-mode
+    (unless erc-server-connected
+      (erc-server-send "CAP END")))
+  (erc-handle-unknown-server-response proc parsed))
+
+(define-erc-response-handler (907)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's907
+                       ?s (erc-response.contents parsed)))
+
+(define-erc-response-handler (904 905 906)
+  "Handle various SASL-related error responses." nil
+  (erc-display-message parsed '(notice error) 'active
+                       (intern (format "s%s" (erc-response.command parsed)))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(define-erc-response-handler (908)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's908
+                       '?m (alist-get 'mechanism erc-sasl--options)
+                       '?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(cl-defmethod erc--register-connection (&context (erc-sasl-mode (eql t)))
+  "Send speculative/pipelined CAP and AUTHENTICATE and hope for the best."
+  (erc-server-send "CAP REQ :sasl")
+  (erc-login)
+  (let* ((c (erc-sasl--state-client erc-sasl--state))
+         (m (sasl-mechanism-name (sasl-client-mechanism c))))
+    (erc-server-send (format "AUTHENTICATE %s" m))))
+
+(provide 'erc-sasl)
+;;; erc-sasl.el ends here
+;;
+;; Local Variables:
+;; generated-autoload-file: "erc-loaddefs.el"
+;; End:
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 23649a5620..994504d72e 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1871,6 +1871,7 @@ erc-modules
     (const :tag "readonly: Make displayed lines read-only" readonly)
     (const :tag "replace: Replace text in messages" replace)
     (const :tag "ring: Enable an input history" ring)
+    (const :tag "sasl: Enable SASL authentication" sasl)
     (const :tag "scrolltobottom: Scroll to the bottom of the buffer"
            scrolltobottom)
     (const :tag "services: Identify to Nickserv (IRC Services) automatically"
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
new file mode 100644
index 0000000000..112303baf5
--- /dev/null
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -0,0 +1,302 @@
+;;; erc-sasl-tests.el --- Tests for erc-sasl.  -*- lexical-binding:t -*-
+
+;; Copyright (C) 2020-2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation, either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;;; Code:
+
+(require 'ert-x)
+(require 'erc-sasl)
+
+(ert-deftest erc-sasl--mechanism-offered-p ()
+  (let ((erc-sasl--options '((mechanism . external))))
+    (should (erc-sasl--mechanism-offered-p "foo,external"))
+    (should (erc-sasl--mechanism-offered-p "external,bar"))
+    (should (erc-sasl--mechanism-offered-p "foo,external,bar"))
+    (should-not (erc-sasl--mechanism-offered-p "fooexternal"))
+    (should-not (erc-sasl--mechanism-offered-p "externalbar"))))
+
+(ert-deftest erc-sasl--read-password ()
+  (ert-info ("Explicit erc-sasl-password")
+    (let ((erc-sasl--options '((password . "foo"))))
+      (should (string= (erc-sasl--read-password nil) "foo"))))
+
+  (ert-info ("Fallback to erc-session-password")
+    (let ((erc-session-password "bar")
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar")))
+    (let ((erc-session-password "bar")
+          (erc-sasl--options '((user . "tester") (password)))
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar"))))
+
+  (let* ((entries (list
+                   "machine FSF.chat port 6697 user bob password sesame"
+                   ;; This must come *after* ^, else *1 (below) always passes
+                   "machine GNU/chat port 6697 user bob password spam"
+                   "machine MyHost port irc password 123"))
+         (netrc-file (make-temp-file "auth-source-test" nil nil
+                                     (mapconcat 'identity entries "\n")))
+         (auth-sources (list netrc-file))
+         (erc-session-server "irc.gnu.org")
+         (erc-session-port 6697)
+         (erc-networks--id (erc-networks--id-create nil))
+         ;;
+         (erc-sasl-auth-source-function #'erc--auth-source-search)
+         erc-server-announced-name ; too early
+         auth-source-do-cache)
+
+    (unwind-protect
+        (ert-info ("Auth source")
+
+          (ert-info ("Symbol as password specifies machine")
+            (let ((erc-sasl--options '((user . "bob")
+                                       (password . FSF.chat)))
+                  (erc-networks--id (make-erc-networks--id)))
+              (should (string= (erc-sasl--read-password nil) "sesame"))))
+
+          (ert-info ("Use session ID when password empty") ; *1
+            (let ((erc-sasl--options '((user . "bob") (password)))
+                  (erc-networks--id (erc-networks--id-create 'GNU/chat)))
+              (should (string= (erc-sasl--read-password nil) "spam")))))
+
+      (delete-file netrc-file))
+
+    (ert-info ("Prompt when search fails and server password null")
+      (let ((erc-sasl-auth-source-function #'ignore))
+        (should (string= (ert-simulate-keys "baz\r"
+                           (erc-sasl--read-password "pwd:"))
+                         "baz"))))))
+
+(ert-deftest erc-sasl-create-client--plain ()
+  (let* ((erc-session-password "password123")
+         (erc-server-current-nick "tester")
+         (erc-session-port 1667)
+         (erc-session-server "localhost")
+         (client (erc-sasl--create-client 'plain))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [erc-sasl--plain-response
+                                 "\0tester\0password123"])
+                   (format "%S" result)))
+    (should (string= (sasl-step-data result) "\0tester\0password123"))
+    (should-not (sasl-next-step client result)))
+  (should (equal (assoc-default "PLAIN" sasl-mechanism-alist) '(sasl-plain))))
+
+(ert-deftest erc-sasl-create-client--external ()
+  (let* ((erc-server-current-nick "tester")
+         (client (erc-sasl--create-client 'external))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [ignore nil]) (format "%S" result)))
+    (should-not (sasl-step-data result))
+    (should-not (sasl-next-step client result)))
+  (should-not (member "EXTERNAL" sasl-mechanisms))
+  (should-not (assoc-default "EXTERNAL" sasl-mechanism-alist)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-1 ()
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-1))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                          "s=5mJO6d4rjCnsBU1X,"
+                          "i=4096"))
+            (req (concat "c=bixhPWppbGxlcyw=,"
+                         "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                         "p=OVUhgPu8wEm2cDoVLfaHzVUYPWU=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-1-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=ZWR23c9MJir0ZgfGf5jEtLOn6Ng="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256 ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                   "s=MTk2M2VkMzM5ZmU0NDRiYmI0MzIyOGVhN2YwNzYwNmI=,"
+                   "i=4096"))
+            (req (concat
+                  "c=bixhPWppbGxlcyw=,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                  "p=1vDesVBzJmv0lX0Ae1kHFtdVHkC6j4gISKVqaR45HFg=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=gUePTYSZN9xgcE06KSyKO9fUmSwH26qifoapXyEs75s="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                   "s=ZTg1MmE1YmFhZGI1NDcyMjk3NzYwZmRjZDM3Y2I1OTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                  "p=LP4sjJrjJKp5qTsARyZCppXpKLu4FMM284hNESPvGhI=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=847WXfnmReGyE1qlq1And6R4bPBNROTZ7EMS/QrJtUM="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-512--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha512"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-512))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                   "s=YzMzOWZiY2U0YzcwNDA0M2I4ZGE2M2ZjOTBjODExZTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                  "p=vMBb9tKxFAfBtel087/GLbo4objAIYr1wM+mFv/jYLKXE"
+                  "NUF0vynm81qQbywQE5ScqFFdAfwYMZq/lj4s0V1OA==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format
+                        "%S" `[erc-sasl--scram-sha-512-client-final-message
+                               ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp (concat "v=Va7NIvt8wCdhvxnv+bZriSxGoto6On5EVnRHO/ece8zs0"
+                          "qpQassdqir1Zlwh3e3EmBq+kcSy+ClNCsbzBpXe/w==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(defconst erc-sasl-tests-ecdsa-key-file "
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIIJueQ3W2IrGbe9wKdOI75yGS7PYZSj6W4tg854hlsvmoAoGCCqGSM49
+AwEHoUQDQgAEAZmaVhNSMmV5r8FXPvKuMnqDKyIA9pDHN5TNMfiF3mMeikGgK10W
+IRX9cyi2wdYg9mUUYyh9GKdBCYHGUJAiCA==
+-----END EC PRIVATE KEY-----
+")
+
+(ert-deftest erc-sasl-create-client-ecdsa ()
+  (unless (executable-find "openssl")
+    (ert-skip "System lacks openssl"))
+  (ert-with-temp-file keyfile
+    :prefix "ecdsa_key"
+    :suffix ".pem"
+    :text erc-sasl-tests-ecdsa-key-file
+    (let* ((erc-server-current-nick "jilles")
+           (erc-sasl--options `((password . ,keyfile)))
+           (client (erc-sasl--create-client 'ecdsa-nist256p-challenge))
+           (step (sasl-next-step client nil)))
+      (ert-info ("Client's initial request")
+        (should (equal (format "%S" [erc-sasl--ecdsa-first "jilles"])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) "jilles")))
+      (ert-info ("Server's initial response")
+        (let ((resp (concat "\0\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20"
+                            "\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37")))
+          (sasl-step-set-data step resp)
+          (setq step (sasl-next-step client step))
+          ;; FIXME this is dumb
+          (should (<= 68 (length (sasl-step-data step)) 72))))
+      (should-not (sasl-next-step client step)))))
+
+;;; erc-sasl-tests.el ends here
diff --git a/test/lisp/erc/erc-scenarios-sasl.el b/test/lisp/erc/erc-scenarios-sasl.el
new file mode 100644
index 0000000000..3ff7cc805d
--- /dev/null
+++ b/test/lisp/erc/erc-scenarios-sasl.el
@@ -0,0 +1,161 @@
+;;; erc-scenarios-sasl.el --- SASL tests for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; This program is free software: you can redistribute it and/or
+;; modify it under the terms of the GNU General Public License as
+;; published by the Free Software Foundation, either version 3 of the
+;; License, or (at your option) any later version.
+;;
+;; This program is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program.  If not, see
+;; <https://www.gnu.org/licenses/>.
+
+;;; Code:
+
+(require 'ert-x)
+(eval-and-compile
+  (let ((load-path (cons (ert-resource-directory) load-path)))
+    (require 'erc-scenarios-common)))
+
+(declare-function sasl-client-name "sasl" (client))
+
+(require 'erc-scenarios-common)
+(require 'erc-sasl)
+
+(ert-deftest erc-scenarios-sasl--plain ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'plain)
+       (erc-sasl-password "password123")
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "This server is in debug mode")
+        ;; Regression "\0\0\0\0 ..." caused by (fillarray passphrase 0)
+        (should (string= erc-sasl-password "password123"))))))
+
+(ert-deftest erc-scenarios-sasl--external ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'external))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'external)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "903 * Authentication successful")
+        (funcall expect 10 "This server is in debug mode")))))
+
+(ert-deftest erc-scenarios-sasl--plain-fail ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain-failed))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "wrong")
+       (erc-sasl-mechanism 'plain)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter))
+       (buf nil))
+
+    (ert-info ("Connect")
+      (setq buf (erc :server "127.0.0.1"
+                     :port port
+                     :nick "tester"
+                     :user "tester"
+                     :full-name "tester"))
+      (let ((err (should-error
+                  (with-current-buffer buf
+                    (funcall expect 20 "Connection failed!")))))
+        (should (string-search "please review" (cadr err)))
+        (with-current-buffer buf
+          (funcall expect 10 "Opening connection")
+          (funcall expect 20 "SASL authentication failed")
+          (should-not (erc-server-process-alive)))))))
+
+(defun erc-scenarios--common--sasl (mech)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t mech))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "sesame")
+       (erc-sasl-mechanism mech)
+       (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+       (sasl-unique-id-function (lambda () (pop mock-rvs)))
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "jilles"
+                                :full-name "jilles")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "jaguar"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "jaguar"
+        (funcall expect 10 "Found your hostname")
+        (funcall expect 20 "marked as being away")))))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-1 ()
+  :tags '(:expensive-test)
+  (let ((erc-sasl-authzid "jilles"))
+    (erc-scenarios--common--sasl 'scram-sha-1)))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-256 ()
+  :tags '(:expensive-test)
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (erc-scenarios--common--sasl 'scram-sha-256))
+
+;;; erc-scenarios-sasl.el ends here
diff --git a/test/lisp/erc/resources/sasl/external.eld b/test/lisp/erc/resources/sasl/external.eld
new file mode 100644
index 0000000000..2cd237ec4d
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/external.eld
@@ -0,0 +1,33 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester"))
+
+((auth-req 3.2 "AUTHENTICATE EXTERNAL")
+ (0.0 ":irc.example.org CAP * ACK :sasl")
+ (0.0 "AUTHENTICATE +"))
+
+((auth-noop 3.2 "AUTHENTICATE +")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/plain-failed.eld b/test/lisp/erc/resources/sasl/plain-failed.eld
new file mode 100644
index 0000000000..336700290c
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain-failed.eld
@@ -0,0 +1,16 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.foonet.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.foonet.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.foonet.org CAP * ACK :cap-notify sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.foonet.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgB3cm9uZw==")
+ (0.0 ":irc.foonet.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.foonet.org 904 * :SASL authentication failed: Invalid account credentials"))
+
+((cap-end 3.2 "CAP END"))
diff --git a/test/lisp/erc/resources/sasl/plain.eld b/test/lisp/erc/resources/sasl/plain.eld
new file mode 100644
index 0000000000..9c6ce3feeb
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain.eld
@@ -0,0 +1,35 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.example.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.example.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.example.org CAP * ACK :sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.example.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgBwYXNzd29yZDEyMw==")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-1.eld b/test/lisp/erc/resources/sasl/scram-sha-1.eld
new file mode 100644
index 0000000000..49980e9e12
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-1.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-1")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE bixhPWppbGxlcyxuPWppbGxlcyxyPWM1UnFMQ1p5MEw0ZkdrS0FaMGh1akZCcw==")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNYUW9LY2l2cUN3OWlEWlBTcGIscz01bUpPNmQ0cmpDbnNCVTFYLGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXhoUFdwcGJHeGxjeXc9LHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzWFFvS2NpdnFDdzlpRFpQU3BiLHA9T1ZVaGdQdTh3RW0yY0RvVkxmYUh6VlVZUFdVPQ==")
+ (0 "AUTHENTICATE dj1aV1IyM2M5TUppcjBaZ2ZHZjVqRXRMT242Tmc9"))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-256.eld b/test/lisp/erc/resources/sasl/scram-sha-256.eld
new file mode 100644
index 0000000000..74de9a23ec
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-256.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-256")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE biwsbj1qaWxsZXMscj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnM=")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNkNDA2N2YwYWZkYjU0YzNkYmQ0ZmU2NDViODRjYWUzNyxzPVpUZzFNbUUxWW1GaFpHSTFORGN5TWprM056WXdabVJqWkRNM1kySTFPVE09LGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXdzLHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzZDQwNjdmMGFmZGI1NGMzZGJkNGZlNjQ1Yjg0Y2FlMzcscD1MUDRzakpyakpLcDVxVHNBUnlaQ3BwWHBLTHU0Rk1NMjg0aE5FU1B2R2hJPQ==")
+ (0 "AUTHENTICATE dj04NDdXWGZubVJlR3lFMXFscTFBbmQ2UjRiUEJOUk9UWjdFTVMvUXJKdFVNPQ=="))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
-- 
2.37.3


^ permalink raw reply related	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]         ` <87k04m4th8.fsf@neverwas.me>
@ 2022-11-08 14:10           ` J.P.
       [not found]           ` <87o7thlepf.fsf@neverwas.me>
  1 sibling, 0 replies; 54+ messages in thread
From: J.P. @ 2022-11-08 14:10 UTC (permalink / raw)
  To: 29108; +Cc: emacs-erc, bandali

"J.P." <jp@neverwas.me> writes:

> I'd really like this thing to see some daylight, so if anyone can find
> the time to take a quick look, please do (Cc. bandali). I think most
> folks would agree that an ERC without SASL in Emacs 29 would be less
> than ideal.

In the interest of keeping things from stagnating further, I'd like to
move development on this to HEAD so people can try it and provide
feedback prior to Emacs 29 being cut. If there are any objections to
that, please raise them before Saturday the 12th of November, 2022.
Thanks.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]           ` <87o7thlepf.fsf@neverwas.me>
@ 2022-11-09  4:08             ` Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors
  2022-11-09 13:49               ` J.P.
       [not found]               ` <874jv81bn2.fsf@neverwas.me>
  2022-11-13 15:36             ` J.P.
       [not found]             ` <87o7taoohd.fsf@neverwas.me>
  2 siblings, 2 replies; 54+ messages in thread
From: Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors @ 2022-11-09  4:08 UTC (permalink / raw)
  To: J.P.; +Cc: bandali, 29108, emacs-erc

[-- Attachment #1: Type: text/plain, Size: 605 bytes --]

"J.P." <jp@neverwas.me> writes:

> "J.P." <jp@neverwas.me> writes:
>
> In the interest of keeping things from stagnating further, I'd like to
> move development on this to HEAD so people can try it and provide
> feedback prior to Emacs 29 being cut. If there are any objections to
> that, please raise them before Saturday the 12th of November, 2022.
> Thanks.

What's special about November 12th?

-- 
Akib Azmain Turja, GPG key: 70018CE5819F17A3BBA666AFE74F0EFA922AE7F5
Fediverse: akib@hostux.social
Codeberg: akib
emailselfdefense.fsf.org | "Nothing can be secure without encryption."

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2022-11-09  4:08             ` Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors
@ 2022-11-09 13:49               ` J.P.
       [not found]               ` <874jv81bn2.fsf@neverwas.me>
  1 sibling, 0 replies; 54+ messages in thread
From: J.P. @ 2022-11-09 13:49 UTC (permalink / raw)
  To: Akib Azmain Turja; +Cc: bandali, 29108, emacs-erc

Hi Akib,

Akib Azmain Turja <akib@disroot.org> writes:

> What's special about November 12th?

It's just some arbitrary date.

But ...

you can make it somewhat special by volunteering to review some patches
ASAP, which I'll then try to improve upon by said date (or thereabouts).

Also, I've been trying to get a hold of you regarding another bug:

  https://debbugs.gnu.org/cgi/bugreport.cgi?bug=58985

Based on your email to the devel mailing list, it seems you have some
experience (or at least opinions and interest) in that area. Please take
a look if you haven't already, and then volunteer to help get some
improvements in tree before Emacs 29 is cut.

Also, I've noticed someone on Libera with the nick akib pop into #erc on
occasion. Please don't hesitate to say hi if that was in fact you.

Thanks,
J.P.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]               ` <874jv81bn2.fsf@neverwas.me>
@ 2022-11-09 17:50                 ` Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors
       [not found]                 ` <87iljoqaor.fsf@disroot.org>
  1 sibling, 0 replies; 54+ messages in thread
From: Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors @ 2022-11-09 17:50 UTC (permalink / raw)
  To: J.P.; +Cc: Adam Porter, 29108, bandali, emacs-erc

[-- Attachment #1: Type: text/plain, Size: 2524 bytes --]

"J.P." <jp@neverwas.me> writes:

> Hi Akib,
>
> Akib Azmain Turja <akib@disroot.org> writes:
>
>> What's special about November 12th?
>
> It's just some arbitrary date.
>
> But ...
>
> you can make it somewhat special by volunteering to review some patches
> ASAP, which I'll then try to improve upon by said date (or thereabouts).
>
> Also, I've been trying to get a hold of you regarding another bug:

Just out of curiosity, why me?  Is it because I use pass?

>
>   https://debbugs.gnu.org/cgi/bugreport.cgi?bug=58985

Hmm, looks like I was CC'ed, but I didn't notice.  :(
I will try to review the patches.

Yeah, auth-source-pass is indeed just a hack, a terrible one.  I needed
to apply a few advices on that auth-source-pass make it work at least
reasonably well for me uses.

Fix auth-source-pass will require the existing API of it (which the
Emacs package "pass" uses) and may even need complete rewrite.

But Adam Porter (CC'ing), the maintainer of ement.el (available on GNU
ELPA), a Matrix client, claims that auth-source is from the dark side[1]
and refused to support it claiming it's not suitable for general use[2].

>
> Based on your email to the devel mailing list, it seems you have some
> experience (or at least opinions and interest) in that area. Please take
> a look if you haven't already, and then volunteer to help get some
> improvements in tree before Emacs 29 is cut.

Thanks for the reminder, otherwise I would have just missed that
discussion.

Anyway, when the Emacs 29 branch is going to cut?  I have some changes
(semantic highlighting of code) waiting to merge to Eglot (now in core)
for about six months.  I have got the paperwork to sign about ten days
ago, but due to some (personal) problems it's taking some time to sign
it.  I really want to make it into Emacs 29, instead of 30.

>
> Also, I've noticed someone on Libera with the nick akib pop into #erc on
> occasion. Please don't hesitate to say hi if that was in fact you.

Yeah, that's indeed me.

>
> Thanks,
> J.P.
>
>
>


Footnotes:
[1]  https://libreddit.de/r/emacs/comments/8lvda6/is_authsource_from_the_dark_side/
     https://old.reddit.com/r/emacs/comments/8lvda6/is_authsource_from_the_dark_side/

[2]  https://github.com/alphapapa/ement.el/issues/109

-- 
Akib Azmain Turja, GPG key: 70018CE5819F17A3BBA666AFE74F0EFA922AE7F5
Fediverse: akib@hostux.social
Codeberg: akib
emailselfdefense.fsf.org | "Nothing can be secure without encryption."

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]                 ` <87iljoqaor.fsf@disroot.org>
@ 2022-11-10  5:28                   ` J.P.
       [not found]                   ` <87sfirml89.fsf@neverwas.me>
  1 sibling, 0 replies; 54+ messages in thread
From: J.P. @ 2022-11-10  5:28 UTC (permalink / raw)
  To: Akib Azmain Turja; +Cc: Adam Porter, 29108, bandali, emacs-erc

Akib Azmain Turja <akib@disroot.org> writes:

> "J.P." <jp@neverwas.me> writes:
>
> [...]
>> Also, I've been trying to get a hold of you regarding another bug:
>
> Just out of curiosity, why me?  Is it because I use pass?

Because you took to emacs-devel to air your frustrations and share some
code, which made me hopeful that you might be willing to direct that
energy toward solving these problems in a productive and practical way.

>>   https://debbugs.gnu.org/cgi/bugreport.cgi?bug=58985
>
> Hmm, looks like I was CC'ed, but I didn't notice.  :(
> I will try to review the patches.

I also replied directly to your initial email on emacs-devel:

  https://lists.gnu.org/archive/html/emacs-devel/2022-11/msg00334.html

> Yeah, auth-source-pass is indeed just a hack, a terrible one.  I needed
> to apply a few advices on that auth-source-pass make it work at least
> reasonably well for me uses.
>
> Fix auth-source-pass will require the existing API of it (which the
> Emacs package "pass" uses) and may even need complete rewrite.

I didn't realize that the Melpa package pass required password-store
(and thereby auth-source-pass). TIL.

> But Adam Porter (CC'ing), the maintainer of ement.el (available on GNU
> ELPA), a Matrix client, claims that auth-source is from the dark side[1]
> and refused to support it claiming it's not suitable for general use[2].

If you don't mind, I'd rather not discuss any gripes you may have with
auth-source generally on this bug thread. And please direct any further
discussion regarding both auth-source-pass and (to whatever extent it's
relevant) auth-source, to bug#58985. Thanks.

>> Based on your email to the devel mailing list, it seems you have some
>> experience (or at least opinions and interest) in that area. Please take
>> a look if you haven't already, and then volunteer to help get some
>> improvements in tree before Emacs 29 is cut.
>
> Thanks for the reminder, otherwise I would have just missed that
> discussion.
>
> Anyway, when the Emacs 29 branch is going to cut?  I have some changes
> (semantic highlighting of code) waiting to merge to Eglot (now in core)
> for about six months.  I have got the paperwork to sign about ten days
> ago, but due to some (personal) problems it's taking some time to sign
> it.  I really want to make it into Emacs 29, instead of 30.

All I've heard is that Emacs 29 will be cut "later this month."
Regarding your paperwork situation, I feel your pain but sadly have
nothing useful say on the matter (not that this bug thread is the right
place for that).

>> Also, I've noticed someone on Libera with the nick akib pop into #erc on
>> occasion. Please don't hesitate to say hi if that was in fact you.
>
> Yeah, that's indeed me.

Cool.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]                   ` <87sfirml89.fsf@neverwas.me>
@ 2022-11-10 18:04                     ` Adam Porter
  2022-11-10 21:50                       ` J.P.
                                         ` (2 more replies)
  0 siblings, 3 replies; 54+ messages in thread
From: Adam Porter @ 2022-11-10 18:04 UTC (permalink / raw)
  To: J.P., Akib Azmain Turja; +Cc: 29108, bandali, emacs-erc

On 11/9/22 23:28, J.P. wrote:

 > Akib Azmain Turja <akib@disroot.org> writes:

>> But Adam Porter (CC'ing), the maintainer of ement.el (available on GNU
>> ELPA), a Matrix client, claims that auth-source is from the dark side[1]
>> and refused to support it claiming it's not suitable for general use[2].

Please note: I did not expect to be mentioned in this way here.  It's 
not my intention to speak poorly of others' software, especially in 
public.  In the Reddit post I made, I tried to be objective and show the 
problems clearly with code examples.

And that is merely my opinion, of course, based on the shortcomings I 
noted (e.g. the lack of API to update a secret, the undocumented 
error-handling signals, etc).  I expect that, were I to use it in my 
software, I would end up working around these problems and answering 
users' support questions about them; and since I don't use it myself, 
either, it doesn't seem like a good idea to do so.

Nevertheless, it's clearly used by a number of people and third-party 
packages that integrate with it, so take my opinion of it with a grain 
of salt.  If it seems useful to you, by all means, use it.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2022-11-10 18:04                     ` Adam Porter
@ 2022-11-10 21:50                       ` J.P.
       [not found]                       ` <87sfiq7a3j.fsf@neverwas.me>
  2022-11-11  5:51                       ` Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors
  2 siblings, 0 replies; 54+ messages in thread
From: J.P. @ 2022-11-10 21:50 UTC (permalink / raw)
  To: Adam Porter; +Cc: 29108, bandali, Akib Azmain Turja, emacs-erc

Adam Porter <adam@alphapapa.net> writes:

> On 11/9/22 23:28, J.P. wrote:
>
>> Akib Azmain Turja <akib@disroot.org> writes:
>
>>> But Adam Porter (CC'ing), the maintainer of ement.el (available on GNU
>>> ELPA), a Matrix client, claims that auth-source is from the dark side[1]
>>> and refused to support it claiming it's not suitable for general use[2].
>
> Please note: I did not expect to be mentioned in this way here.  It's not my
> intention to speak poorly of others' software, especially in public.  In the
> Reddit post I made, I tried to be objective and show the problems clearly with
> code examples.

That's certainly the impression I got, and I regret not having said as
much sooner. Sorry you had to burn cycles on a dignified defense. At the
same time, I'm hopeful folks will find the restraint to chalk this up to
a teachable moment and attribute Akib's bit of ambush editorializing
(something I myself have been guilty of over the years) to the angst of
youth or a moment of weakness, both potential engines of productivity
when channeled in a more positive direction.

> And that is merely my opinion, of course, based on the shortcomings I noted
> (e.g. the lack of API to update a secret, the undocumented error-handling
> signals, etc).  I expect that, were I to use it in my software, I would end up
> working around these problems and answering users' support questions about
> them; and since I don't use it myself, either, it doesn't seem like a good
> idea to do so.
>
> Nevertheless, it's clearly used by a number of people and third-party packages
> that integrate with it, so take my opinion of it with a grain of salt.  If it
> seems useful to you, by all means, use it.

Thanks for your work on Emacs.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]                       ` <87sfiq7a3j.fsf@neverwas.me>
@ 2022-11-11  1:25                         ` Adam Porter
  2022-11-11  5:56                         ` Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors
       [not found]                         ` <878rkighkn.fsf@disroot.org>
  2 siblings, 0 replies; 54+ messages in thread
From: Adam Porter @ 2022-11-11  1:25 UTC (permalink / raw)
  To: J.P.; +Cc: 29108, bandali, Akib Azmain Turja, emacs-erc

On 11/10/22 15:50, J.P. wrote:
> Adam Porter <adam@alphapapa.net> writes:
> 
>> On 11/9/22 23:28, J.P. wrote:
>>
>>> Akib Azmain Turja <akib@disroot.org> writes:
>>
>>>> But Adam Porter (CC'ing), the maintainer of ement.el (available on GNU
>>>> ELPA), a Matrix client, claims that auth-source is from the dark side[1]
>>>> and refused to support it claiming it's not suitable for general use[2].
>>
>> Please note: I did not expect to be mentioned in this way here.  It's not my
>> intention to speak poorly of others' software, especially in public.  In the
>> Reddit post I made, I tried to be objective and show the problems clearly with
>> code examples.
> 
> That's certainly the impression I got, and I regret not having said as
> much sooner. Sorry you had to burn cycles on a dignified defense. At the
> same time, I'm hopeful folks will find the restraint to chalk this up to
> a teachable moment and attribute Akib's bit of ambush editorializing
> (something I myself have been guilty of over the years) to the angst of
> youth or a moment of weakness, both potential engines of productivity
> when channeled in a more positive direction.

Agreed, thanks.

>> And that is merely my opinion, of course, based on the shortcomings I noted
>> (e.g. the lack of API to update a secret, the undocumented error-handling
>> signals, etc).  I expect that, were I to use it in my software, I would end up
>> working around these problems and answering users' support questions about
>> them; and since I don't use it myself, either, it doesn't seem like a good
>> idea to do so.
>>
>> Nevertheless, it's clearly used by a number of people and third-party packages
>> that integrate with it, so take my opinion of it with a grain of salt.  If it
>> seems useful to you, by all means, use it.
> 
> Thanks for your work on Emacs.

Thanks for the kind words.





^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
  2022-11-10 18:04                     ` Adam Porter
  2022-11-10 21:50                       ` J.P.
       [not found]                       ` <87sfiq7a3j.fsf@neverwas.me>
@ 2022-11-11  5:51                       ` Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors
  2022-11-14 22:28                         ` Adam Porter
  2 siblings, 1 reply; 54+ messages in thread
From: Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors @ 2022-11-11  5:51 UTC (permalink / raw)
  To: Adam Porter; +Cc: emacs-erc, 29108, bandali, J.P.

[-- Attachment #1: Type: text/plain, Size: 1546 bytes --]

Adam Porter <adam@alphapapa.net> writes:

> On 11/9/22 23:28, J.P. wrote:
>
>> Akib Azmain Turja <akib@disroot.org> writes:
>
>>> But Adam Porter (CC'ing), the maintainer of ement.el (available on GNU
>>> ELPA), a Matrix client, claims that auth-source is from the dark side[1]
>>> and refused to support it claiming it's not suitable for general use[2].
>
> Please note: I did not expect to be mentioned in this way here.  It's
> not my intention to speak poorly of others' software, especially in
> public.  In the Reddit post I made, I tried to be objective and show
> the problems clearly with code examples.

Sorry, I didn't want to hurt you, please forgive me.

>
> And that is merely my opinion, of course, based on the shortcomings I
> noted (e.g. the lack of API to update a secret, the undocumented
> error-handling signals, etc).  I expect that, were I to use it in my
> software, I would end up working around these problems and answering
> users' support questions about them; and since I don't use it myself,
> either, it doesn't seem like a good idea to do so.

Thanks for the clarification.

>
> Nevertheless, it's clearly used by a number of people and third-party
> packages that integrate with it, so take my opinion of it with a grain
> of salt.  If it seems useful to you, by all means, use it.
>

-- 
Akib Azmain Turja, GPG key: 70018CE5819F17A3BBA666AFE74F0EFA922AE7F5
Fediverse: akib@hostux.social
Codeberg: akib
emailselfdefense.fsf.org | "Nothing can be secure without encryption."

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]                       ` <87sfiq7a3j.fsf@neverwas.me>
  2022-11-11  1:25                         ` Adam Porter
@ 2022-11-11  5:56                         ` Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors
       [not found]                         ` <878rkighkn.fsf@disroot.org>
  2 siblings, 0 replies; 54+ messages in thread
From: Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors @ 2022-11-11  5:56 UTC (permalink / raw)
  To: J.P.; +Cc: Adam Porter, 29108, bandali, emacs-erc

[-- Attachment #1: Type: text/plain, Size: 2198 bytes --]

"J.P." <jp@neverwas.me> writes:

> Adam Porter <adam@alphapapa.net> writes:
>
>> On 11/9/22 23:28, J.P. wrote:
>>
>>> Akib Azmain Turja <akib@disroot.org> writes:
>>
>>>> But Adam Porter (CC'ing), the maintainer of ement.el (available on GNU
>>>> ELPA), a Matrix client, claims that auth-source is from the dark side[1]
>>>> and refused to support it claiming it's not suitable for general use[2].
>>
>> Please note: I did not expect to be mentioned in this way here.  It's not my
>> intention to speak poorly of others' software, especially in public.  In the
>> Reddit post I made, I tried to be objective and show the problems clearly with
>> code examples.
>
> That's certainly the impression I got, and I regret not having said as
> much sooner. Sorry you had to burn cycles on a dignified defense. At the
> same time, I'm hopeful folks will find the restraint to chalk this up to
> a teachable moment and attribute Akib's bit of ambush editorializing
> (something I myself have been guilty of over the years) to the angst of
> youth or a moment of weakness, both potential engines of productivity
> when channeled in a more positive direction.

I'm extremely sorry, I didn't actually wanted to give that impression.
Please forgive me.

>
>> And that is merely my opinion, of course, based on the shortcomings I noted
>> (e.g. the lack of API to update a secret, the undocumented error-handling
>> signals, etc).  I expect that, were I to use it in my software, I would end up
>> working around these problems and answering users' support questions about
>> them; and since I don't use it myself, either, it doesn't seem like a good
>> idea to do so.
>>
>> Nevertheless, it's clearly used by a number of people and third-party packages
>> that integrate with it, so take my opinion of it with a grain of salt.  If it
>> seems useful to you, by all means, use it.

Your works are awesome, thank you much for the work.

>
> Thanks for your work on Emacs.

-- 
Akib Azmain Turja, GPG key: 70018CE5819F17A3BBA666AFE74F0EFA922AE7F5
Fediverse: akib@hostux.social
Codeberg: akib
emailselfdefense.fsf.org | "Nothing can be secure without encryption."

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

^ permalink raw reply	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]           ` <87o7thlepf.fsf@neverwas.me>
  2022-11-09  4:08             ` Akib Azmain Turja via Bug reports for GNU Emacs, the Swiss army knife of text editors
@ 2022-11-13 15:36             ` J.P.
       [not found]             ` <87o7taoohd.fsf@neverwas.me>
  2 siblings, 0 replies; 54+ messages in thread
From: J.P. @ 2022-11-13 15:36 UTC (permalink / raw)
  To: 29108; +Cc: emacs-erc, bandali

[-- Attachment #1: Type: text/plain, Size: 470 bytes --]

"J.P." <jp@neverwas.me> writes:

> In the interest of keeping things from stagnating further, I'd like to
> move development on this to HEAD so people can try it and provide
> feedback prior to Emacs 29 being cut. If there are any objections to
> that, please raise them before Saturday the 12th of November, 2022.
> Thanks.

v6. Added some sweeping changes that are still pretty raw, which
probably means a delay of a couple days, at least. Apologies for the
hold up.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0000-v5-v6.diff --]
[-- Type: text/x-patch, Size: 35458 bytes --]

From 21f3196c0b55d8e7c27c4918f741cbbecfaf2136 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 13 Nov 2022 07:14:27 -0800
Subject: [PATCH 0/5] *** NOT A PATCH ***

*** BLURB HERE ***

F. Jason Park (5):
  Add GS2 authorization to sasl-scram-rfc
  Don't set erc-networks--id until network is known
  Support local ERC modules in erc-mode buffers
  Call erc-login indirectly via new generic wrapper
  Add non-IRCv3 SASL module to ERC

 doc/misc/erc.texi                             | 137 +++++-
 lisp/erc/erc-backend.el                       |  15 +-
 lisp/erc/erc-common.el                        |  56 ++-
 lisp/erc/erc-compat.el                        | 116 +++++
 lisp/erc/erc-goodies.el                       |   1 +
 lisp/erc/erc-networks.el                      |  39 +-
 lisp/erc/erc-sasl.el                          | 424 ++++++++++++++++++
 lisp/erc/erc.el                               |  85 ++--
 lisp/net/sasl-scram-rfc.el                    |  21 +-
 test/lisp/erc/erc-sasl-tests.el               | 319 +++++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 208 +++++++++
 test/lisp/erc/erc-tests.el                    |  63 +++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  39 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 ++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 ++
 17 files changed, 1586 insertions(+), 80 deletions(-)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

Interdiff:
diff --git a/doc/misc/erc.texi b/doc/misc/erc.texi
index 80b4171cdb..79f8c92719 100644
--- a/doc/misc/erc.texi
+++ b/doc/misc/erc.texi
@@ -938,13 +938,12 @@ SASL
 know that you almost certainly won't be needing SASL for the
 @samp{client -> bouncer} connection.
 
-Note that @code{sasl} is a ``local'' ERC module.  This means invoking
-@code{erc-sasl-mode} manually or calling @code{erc-update-modules}
-won't do any good.  Instead, simply add @code{sasl} to
-@code{erc-modules} (or @code{let}-bind it while calling
-@code{erc-tls}), and SASL will be enabled for the current connection.
-But before that, please explore all custom options pertaining to your
-chosen mechanism.
+Note that @code{sasl} is a ``local'' ERC module, which various library
+functions, like @code{erc-update-modules}, may treat differently than
+global modules in user code.  However, this should not affect everyday
+client use.  To get started, just add @code{sasl} to
+@code{erc-modules} like any other module.  But before that, please
+explore all custom options pertaining to your chosen mechanism.
 
 @defopt erc-sasl-mechanism
 The name of an SASL subprotocol type as a @emph{lowercase} symbol.
diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index fee29e7d05..37a3da8b66 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -1529,7 +1529,7 @@ define-erc-response-handler
         (cl-pushnew (erc-server-buffer) bufs)
         (erc-set-current-nick nn)
         ;; Rename session, possibly rename server buf and all targets
-        (when (erc-network)
+        (when erc-server-connected
           (erc-networks--id-reload erc-networks--id proc parsed))
         (erc-update-mode-line)
         (setq erc-nick-change-attempt-count 0)
@@ -1539,6 +1539,9 @@ define-erc-response-handler
          'NICK-you ?n nick ?N nn)
         (run-hook-with-args 'erc-nick-changed-functions nn nick))
        (t
+        (unless (or erc-server-connected
+                    (erc-networks--id-given erc-networks--id))
+          (setq erc-networks--id nil))
         (erc-handle-user-status-change 'nick (list nick login host) (list nn))
         (erc-display-message parsed 'notice bufs 'NICK ?n nick
                              ?u login ?h host ?N nn))))))
@@ -2165,6 +2168,8 @@ erc-server-322-message
 
 (define-erc-response-handler (433)
   "Login-time \"nick in use\"." nil
+  (unless (or erc-server-connected (erc-networks--id-given erc-networks--id))
+    (setq erc-networks--id nil))
   (erc-nickname-in-use (cadr (erc-response.command-args parsed))
                        "already in use"))
 
diff --git a/lisp/erc/erc-common.el b/lisp/erc/erc-common.el
index 90ea56108d..a300cfc4fa 100644
--- a/lisp/erc/erc-common.el
+++ b/lisp/erc/erc-common.el
@@ -28,7 +28,6 @@
 
 (defvar erc--casemapping-rfc1459)
 (defvar erc--casemapping-rfc1459-strict)
-(defvar erc--module-name-migrations)
 (defvar erc-channel-users)
 (defvar erc-dbuf)
 (defvar erc-log-p)
@@ -86,9 +85,40 @@ erc--target
   (contents "" :type string)
   (tags '() :type list))
 
-(defun erc--normalize-module-symbol (module)
-  "Canonicalize symbol MODULE for `erc-modules'."
-  (or (cdr (assq module erc--module-name-migrations)) module))
+;; TODO move goodies modules here after 29 is released.
+(defconst erc--features-to-modules
+  '((erc-pcomplete completion pcomplete)
+    (erc-capab capab-identify)
+    (erc-join autojoin)
+    (erc-page page ctcp-page)
+    (erc-sound sound ctcp-sound)
+    (erc-stamp stamp timestamp)
+    (erc-services services nickserv))
+  "Migration alist mapping a library feature to module names.
+Keys need not be unique: a library may define more than one
+module.  Sometimes a module's downcased alias will be its
+canonical name.")
+
+(defconst erc--modules-to-features
+  (let (pairs)
+    (pcase-dolist (`(,feature . ,names) erc--features-to-modules)
+      (dolist (name names)
+        (push (cons name feature) pairs)))
+    (nreverse pairs))
+  "Migration alist mapping a module's name to its home library feature.")
+
+(defconst erc--module-name-migrations
+  (let (pairs)
+    (pcase-dolist (`(,_ ,canonical . ,rest) erc--features-to-modules)
+      (dolist (obsolete rest)
+        (push (cons obsolete canonical) pairs)))
+    pairs)
+  "Association list of obsolete module names to canonical names.")
+
+(defun erc--normalize-module-symbol (symbol)
+  "Return preferred SYMBOL for `erc-modules'."
+  (setq symbol (intern (downcase (symbol-name symbol))))
+  (or (cdr (assq symbol erc--module-name-migrations)) symbol))
 
 (defmacro define-erc-module (name alias doc enable-body disable-body
                                   &optional local-p)
@@ -118,6 +148,7 @@ define-erc-module
                   #\\='erc-replace-insert)))"
   (declare (doc-string 3) (indent defun))
   (let* ((sn (symbol-name name))
+         (mod (erc--normalize-module-symbol name))
          (mode (intern (format "erc-%s-mode" (downcase sn))))
          (group (intern (format "erc-%s" (downcase sn))))
          (enable (intern (format "erc-%s-enable" (downcase sn))))
@@ -141,21 +172,20 @@ define-erc-module
          ,(format "Enable ERC %S mode."
                   name)
          (interactive)
-         (unless ,local-p
-           (cl-pushnew (erc--normalize-module-symbol ',name) erc-modules))
-         (when (or ,(not local-p) (eq major-mode 'erc-mode))
-           (setq ,mode t)
-           ,@enable-body))
+         ,@(unless local-p `((cl-pushnew ',mod erc-modules)))
+         ,@(macroexp-unprogn
+            `(,@(if local-p '(when (eq major-mode 'erc-mode)) '(progn))
+              (setq ,mode t)
+              ,@enable-body)))
        (defun ,disable ()
          ,(format "Disable ERC %S mode."
                   name)
          (interactive)
-         (unless ,local-p
-           (setq erc-modules (delq (erc--normalize-module-symbol ',name)
-                                   erc-modules)))
-         (when (or ,(not local-p) ,mode)
-           (setq ,mode nil)
-           ,@disable-body))
+         ,@(unless local-p `((setq erc-modules (delq ',mod erc-modules))))
+         ,@(macroexp-unprogn
+            `(,@(if local-p `(when ,mode) '(progn))
+              (setq ,mode nil)
+              ,@disable-body)))
        ,(when (and alias (not (eq name alias)))
           `(defalias
              ',(intern
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index bc3e1dcfc6..6d4ef21383 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -194,9 +194,9 @@ erc-compat--sasl-scram-client-first-message
 ;;  > The use of base64 in SCRAM is restricted to the canonical form
 ;;  > with no whitespace.
 ;;
-;; Unfortunately, advising `base64-encode-string' won't work
-;; because the byte compiler precomputes the result when all inputs
-;; are constants, as they are in the unpatched version.
+;; Unfortunately, simply advising `base64-encode-string' won't work
+;; since the byte compiler precomputes the result when all inputs are
+;; constants, as they are in the original version.
 ;;
 ;; The only other substantial change is the addition of authz support.
 ;; This can be dropped if adopted by Emacs 29 and `compat'.  Changes
@@ -272,6 +272,18 @@ erc-compat--with-memoization
     `(cl--generic-with-memoization ,table ,@forms))
    (t `(progn ,@forms))))
 
+(defun erc-compat--local-minor-modes ()
+  (delq nil
+        (if (boundp 'local-minor-modes)
+            (mapcar (lambda (m)
+                      (and (string-prefix-p "erc-" (symbol-name m)) m))
+                    local-minor-modes)
+          (mapcar (pcase-lambda (`(,k . _))
+                    (and (string-prefix-p "erc-" (symbol-name k))
+                         (string-suffix-p "-mode" (symbol-name k))
+                         k))
+                  (buffer-local-variables)))))
+
 (provide 'erc-compat)
 
 ;;; erc-compat.el ends here
diff --git a/lisp/erc/erc-networks.el b/lisp/erc/erc-networks.el
index dba6ead073..aa90bb8479 100644
--- a/lisp/erc/erc-networks.el
+++ b/lisp/erc/erc-networks.el
@@ -826,12 +826,11 @@ erc-networks--id
 
 ;; For now, please use this instead of `erc-networks--id-fixed-p'.
 (cl-defgeneric erc-networks--id-given (net-id)
-  "Return the preassigned identifier for a network presence, if any.
-This may have originated from an `:id' arg to entry-point commands
-`erc-tls' or `erc'.")
+  "Return the preassigned identifier for a network context, if any.
+When non-nil, assume NET-ID originated from an `:id' argument to
+entry-point commands `erc-tls' or `erc'.")
 
-(cl-defmethod erc-networks--id-given ((_ erc-networks--id))
-  nil)
+(cl-defmethod erc-networks--id-given (_) nil) ; _ may be nil
 
 (cl-defmethod erc-networks--id-given ((nid erc-networks--id-fixed))
   (erc-networks--id-symbol nid))
@@ -866,22 +865,15 @@ erc-networks--id-create
   ((_ symbol) &context (erc-obsolete-var erc-reuse-buffers null))
   (erc-networks--id-fixed-create (intern (buffer-name))))
 
-(cl-defgeneric erc-networks--id-on-connect (net-id)
-  "Update NET-ID `erc-networks--id' after connection params known.
-This is typically during or just after MOTD.")
-
-(cl-defmethod erc-networks--id-on-connect ((_ erc-networks--id))
-  nil)
-
-(cl-defmethod erc-networks--id-on-connect ((id erc-networks--id-qualifying))
-  (erc-networks--id-qualifying-update id (erc-networks--id-qualifying-create)))
-
 (cl-defgeneric erc-networks--id-equal-p (self other)
-  "Return non-nil when two network identities exhibit underlying equality.
-SELF and OTHER are `erc-networks--id' struct instances.  This
-should normally be used only for ID recovery or merging, after
-which no two identities should be `equal' (timestamps aside) that
-aren't also `eq'.")
+  "Return non-nil when two network IDs exhibit underlying equality.
+Expect SELF and OTHER to be `erc-networks--id' struct instances
+and that this will only be called for ID recovery or merging,
+after which no two identities should be `equal' (timestamps
+aside) that aren't also `eq'.")
+
+(cl-defmethod erc-networks--id-equal-p ((_ null) (_ erc-networks--id)) nil)
+(cl-defmethod erc-networks--id-equal-p ((_ erc-networks--id) (_ null)) nil)
 
 (cl-defmethod erc-networks--id-equal-p ((self erc-networks--id)
                                         (other erc-networks--id))
@@ -1381,7 +1373,8 @@ erc-networks--update-server-identity
   (let* ((identity erc-networks--id)
          (buffer (current-buffer))
          (f (lambda ()
-              (unless (or (eq (current-buffer) buffer)
+              (unless (or (not erc-networks--id)
+                          (eq (current-buffer) buffer)
                           (eq erc-networks--id identity))
                 (if (erc-networks--id-equal-p identity erc-networks--id)
                     (throw 'buffer erc-networks--id)
@@ -1400,8 +1393,8 @@ erc-networks--init-identity
   "Update identity with real network name."
   ;; Initialize identity for real now that we know the network
   (cl-assert erc-network)
-  (unless (erc-networks--id-symbol erc-networks--id) ; unless just reconnected
-    (erc-networks--id-on-connect erc-networks--id))
+  (unless erc-networks--id
+    (setq erc-networks--id (erc-networks--id-create nil)))
   ;; Find duplicate identities or other conflicting ones and act
   ;; accordingly.
   (erc-networks--update-server-identity)
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
index f36a305247..ac2646051c 100644
--- a/lisp/erc/erc-sasl.el
+++ b/lisp/erc/erc-sasl.el
@@ -19,8 +19,8 @@
 
 ;;; Commentary:
 
-;; This "non-IRCv3" implementation resembles many others that have
-;; surfaced over the years, the first possibly being:
+;; This "non-IRCv3" implementation resembles others that have surfaced
+;; over the years, the first possibly being from Joseph Gay:
 ;;
 ;; https://lists.gnu.org/archive/html/erc-discuss/2012-02/msg00001.html
 ;;
@@ -30,29 +30,35 @@
 ;;
 ;; - Find a way to obfuscate the password in memory (via something
 ;;   like `auth-source--obfuscate'); it's currently visible in
-;;   backtraces.
+;;   backtraces and bug reports.
 ;;
 ;; - Implement a proxy mechanism that chooses the strongest available
 ;;   mechanism for you.  Requires CAP 3.2 (see bug#49860).
+;;
+;; - Integrate with whatever solution ERC eventually settles on to
+;;   handle user options for different network contexts.  At the
+;;   moment, this does its own thing for stashing and restoring
+;;   session options, but ERC should make abstractions available for
+;;   all local modules to use, possibly based on connection-local
+;;   variables.
 
 ;;; Code:
 (require 'erc)
 (require 'rx)
 (require 'sasl)
 (require 'sasl-scram-rfc)
-(require 'sasl-scram-sha256 nil t)
+(require 'sasl-scram-sha256 nil t) ; not present in Emacs 27
 
 (defgroup erc-sasl nil
   "SASL for ERC."
   :group 'erc
-  :package-version '(ERC . "5.4")) ; FIXME increment on next release
+  :package-version '(ERC . "5.4.1")) ; FIXME increment on next release
 
-(defcustom erc-sasl-mechanism nil
+(defcustom erc-sasl-mechanism 'plain
   "SASL mechanism to connect with.
 Note that any value other than nil or `external' likely requires
 `erc-sasl-user' and `erc-sasl-password'."
-  :type '(choice (const nil)
-                 (const plain)
+  :type '(choice (const plain)
                  (const external)
                  (const scram-sha-1)
                  (const scram-sha-256)
@@ -68,17 +74,18 @@ erc-sasl-user
 
 (defcustom erc-sasl-password nil
   "Optional account password to send when authenticating.
-When the value is a string, ERC uses it unconditionally for most
-mechanisms (see below).  As a special case, when the value is a
-non-nil symbol, ERC uses it as the value of the `:host' field in
-an auth-source query, provided `erc-sasl-auth-source-function' is
-set to a function.  When nil, ERC will try a non-nil \"session
-password\", likely one given as the `:password' argument to
-`erc-tls'.  As a last resort, ERC will prompt the user for input.
+When the value is a string, ERC will use it unconditionally for
+most mechanisms.  Otherwise, when `erc-sasl-auth-source-function'
+is a function, ERC will attempt an auth-source query, possibly
+using a non-nil symbol for the suggested `:host' parameter if set
+as this option's value or passed as an `:id' to `erc-tls'.
+Failing that, ERC will try a non-nil \"session password\" if one
+is on file, typically from a `:password' argument supplied to
+`erc-tls'.  As a last resort, ERC will prompt for input.
 
 Note that when `erc-sasl-mechanism' is set to
 `ecdsa-nist256p-challenge', this option should hold the file name
-of the key, which is typically in PEM format."
+of the key."
   :type '(choice (const nil) string symbol))
 
 (defcustom erc-sasl-auth-source-function nil
@@ -91,7 +98,7 @@ erc-sasl-auth-source-function
 move on to the next approach, as described in the doc string for
 the option `erc-sasl-password'.  See info node `(erc)
 Connecting' for details on ERC's auth-source integration."
-  :type '(choice (const erc-auth-source-search)
+  :type '(choice (function-item erc-auth-source-search)
                  (const nil)
                  function))
 
@@ -103,6 +110,13 @@ erc-sasl-authzid
 ;; Analogous to what erc-backend does to persist opening params.
 (defvar-local erc-sasl--options nil)
 
+;; In the future, ERC will hopefully use connection-local variables to
+;; handle such bookkeeping transparently.
+(defvar erc-sasl--session-options nil
+  "An alist associating network-IDs to `erc-sasl--options'.
+This is for persisting user options captured at entry-point
+invocation throughout an Emacs session.")
+
 ;; Session-local (server buffer) SASL subproto state
 (defvar-local erc-sasl--state nil)
 
@@ -263,13 +277,26 @@ erc-sasl--create-client
       (sasl-client-set-property client 'ecdsa-keyfile keyfile)
       client)))
 
-;; This stands alone because it's also used by bug#49860
+;; This stands alone because it's also used by bug#49860.
 (defun erc-sasl--init ()
-  (setq erc-sasl--state (make-erc-sasl--state)
-        erc-sasl--options `((user . ,erc-sasl-user)
-                            (password . ,erc-sasl-password)
-                            (mechanism . ,erc-sasl-mechanism)
-                            (authzid . ,erc-sasl-authzid))))
+  ;; When reconnecting, try to recover stashed parameters.
+  (let ((existing (assoc erc-networks--id erc-sasl--session-options
+                         #'erc-networks--id-equal-p)))
+    ;; This likely only runs when `erc' was called with an :id keyword.
+    (when (and existing (not erc--server-reconnecting))
+      (setq erc-sasl--session-options (delq existing erc-sasl--session-options)
+            existing nil))
+    (setq erc-sasl--state (make-erc-sasl--state)
+          erc-sasl--options (or (cdr existing)
+                                `((user . ,erc-sasl-user)
+                                  (password . ,erc-sasl-password)
+                                  (mechanism . ,erc-sasl-mechanism)
+                                  (authzid . ,erc-sasl-authzid))))))
+
+(defun erc-sasl--on-connection-established (&rest _)
+  (setf (alist-get erc-networks--id erc-sasl--session-options nil nil
+                   #'erc-networks--id-equal-p)
+        erc-sasl--options))
 
 (defun erc-sasl--mechanism-offered-p (offered)
   "Return non-nil when OFFERED appears among a list of mechanisms."
@@ -359,6 +386,7 @@ erc-sasl--destroy
   (when erc-sasl-mode
     (unless erc-server-connected
       (erc-server-send "CAP END")))
+  (add-hook 'erc-after-connect #'erc-sasl--on-connection-established 0 t)
   (erc-handle-unknown-server-response proc parsed))
 
 (define-erc-response-handler (907)
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 2869383960..a703f903ec 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1780,31 +1780,6 @@ erc-default-nicks
 (defvar-local erc-nick-change-attempt-count 0
   "Used to keep track of how many times an attempt at changing nick is made.")
 
-(defconst erc--features-to-modules
-  '((erc-pcomplete completion pcomplete)
-    (erc-capab capab-identify)
-    (erc-join autojoin)
-    (erc-page page ctcp-page)
-    (erc-sound sound ctcp-sound)
-    (erc-stamp stamp timestamp)
-    (erc-services services nickserv))
-  "Migration alist mapping a library feature to module names.
-Keys need not be unique: a library may define more than one
-module.")
-
-(defconst erc--modules-to-features
-  (cl-loop for (feature . names) in erc--features-to-modules
-           append (mapcar (lambda (name) (cons name feature)) names))
-  "Migration alist mapping a module's name to library feature.")
-
-(defconst erc--module-name-migrations
-  (let (pairs)
-    (pcase-dolist (`(,_ ,canonical . ,rest) erc--features-to-modules)
-      (dolist (obsolete rest)
-        (push (cons obsolete canonical) pairs)))
-    pairs)
-  "Association list of obsolete module names to canonical names.")
-
 (defun erc-migrate-modules (mods)
   "Migrate old names of ERC modules to new ones."
   ;; modify `transforms' to specify what needs to be changed
@@ -1888,23 +1863,25 @@ erc-modules
     (repeat :tag "Others" :inline t symbol))
   :group 'erc)
 
-(defun erc-update-modules ()
+(defun erc-update-modules (&optional defer-locals)
   "Enable global minor mode for all global modules in `erc-modules'.
-Return minor-mode commands for all local modules, possibly for
-deferred invocation, as done by `erc-open' whenever a new ERC
-buffer is created.  Local modules were introduced in ERC 5.6."
-  (let (local-modules)
-    (dolist (mod erc-modules)
-      (require (or (alist-get mod erc--modules-to-features)
-                   (intern (concat "erc-" (symbol-name mod))))
+With DEFER-LOCALS, return minor-mode commands for all local
+modules, possibly for deferred invocation, as done by `erc-open'
+whenever a new ERC buffer is created.  Local modules were
+introduced in ERC 5.5."
+  (let ((local-modes
+         (when (and defer-locals (derived-mode-p 'erc-mode))
+           (erc-compat--local-minor-modes))))
+    (dolist (module erc-modules (and defer-locals local-modes))
+      (require (or (alist-get module erc--modules-to-features)
+                   (intern (concat "erc-" (symbol-name module))))
                nil 'noerror) ; some modules don't have a corresponding feature
-      (let ((sym (intern-soft (concat "erc-" (symbol-name mod) "-mode"))))
-        (unless (and sym (fboundp sym))
-          (error "`%s' is not a known ERC module" mod))
-        (if (custom-variable-p sym)
-            (funcall sym 1)
-          (push sym local-modules))))
-    local-modules))
+      (let ((mode (intern-soft (concat "erc-" (symbol-name module) "-mode"))))
+        (unless (and mode (fboundp mode))
+          (error "`%s' is not a known ERC module" module))
+        (if (and defer-locals (not (custom-variable-p mode)))
+            (cl-pushnew mode local-modes)
+          (funcall mode 1))))))
 
 (defun erc-setup-buffer (buffer)
   "Consults `erc-join-buffer' to find out how to display `BUFFER'."
@@ -1966,15 +1943,17 @@ erc-open
          (continued-session (and erc--server-reconnecting
                                  (with-suppressed-warnings
                                      ((obsolete erc-reuse-buffers))
-                                   erc-reuse-buffers))))
+                                   erc-reuse-buffers)
+                                 erc-networks--id)))
     (when connect (run-hook-with-args 'erc-before-connect server port nick))
     (set-buffer buffer)
     (setq old-point (point))
-    (setq delayed-modules (erc-update-modules))
+    (setq delayed-modules (erc-update-modules 'defer-locals))
 
     (delay-mode-hooks (erc-mode))
 
-    (setq erc-server-reconnect-count old-recon-count)
+    (setq erc-server-reconnect-count old-recon-count
+          erc--server-reconnecting continued-session)
 
     (when (setq erc-server-connected (not connect))
       (setq erc-server-announced-name
@@ -2030,10 +2009,11 @@ erc-open
     (setq erc-default-nicks (if (consp erc-nick) erc-nick (list erc-nick)))
     ;; client certificate (only useful if connecting over TLS)
     (setq erc-session-client-certificate client-certificate)
-    (setq erc-networks--id (if connect
-                               (erc-networks--id-create id)
-                             (buffer-local-value 'erc-networks--id
-                                                 old-buffer)))
+    (setq erc-networks--id
+          (if connect
+              (or erc--server-reconnecting
+                  (and id (erc-networks--id-create id)))
+            (buffer-local-value 'erc-networks--id old-buffer)))
     ;; debug output buffer
     (setq erc-dbuf
           (when erc-log-p
@@ -3197,7 +3177,8 @@ erc-auth-source-join-function
                  function))
 
 (defun erc--auth-source-determine-params-defaults ()
-  (let* ((net (and-let* ((esid (erc-networks--id-symbol erc-networks--id))
+  (let* ((net (and-let* ((erc-networks--id)
+                         (esid (erc-networks--id-symbol erc-networks--id))
                          ((symbol-name esid)))))
          (localp (and erc--target (erc--target-channel-local-p erc--target)))
          (hosts (if localp
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
index 112303baf5..81db9ad948 100644
--- a/test/lisp/erc/erc-sasl-tests.el
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -1,6 +1,6 @@
 ;;; erc-sasl-tests.el --- Tests for erc-sasl.  -*- lexical-binding:t -*-
 
-;; Copyright (C) 2020-2022 Free Software Foundation, Inc.
+;; Copyright (C) 2022 Free Software Foundation, Inc.
 ;;
 ;; This file is part of GNU Emacs.
 ;;
@@ -276,6 +276,10 @@ erc-sasl-tests-ecdsa-key-file
 ")
 
 (ert-deftest erc-sasl-create-client-ecdsa ()
+  :tags '(:unstable)
+  ;; This is currently useless because it just roundtrips shelling out
+  ;; to pkeyutl.
+  (ert-skip "Placeholder")
   (unless (executable-find "openssl")
     (ert-skip "System lacks openssl"))
   (ert-with-temp-file keyfile
@@ -295,8 +299,21 @@ erc-sasl-create-client-ecdsa
                             "\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37")))
           (sasl-step-set-data step resp)
           (setq step (sasl-next-step client step))
-          ;; FIXME this is dumb
-          (should (<= 68 (length (sasl-step-data step)) 72))))
+          (ert-with-temp-file sigfile
+            :prefix "ecdsa_sig"
+            :suffix ".sig"
+            :text (sasl-step-data step)
+            (with-temp-buffer
+              (set-buffer-multibyte nil)
+              (insert resp)
+              (let ((ec (call-process-region
+                         (point-min) (point-max)
+                         "openssl" 'delete t nil "pkeyutl"
+                         "-inkey" keyfile "-sigfile" sigfile
+                         "-verify")))
+                (unless (zerop ec)
+                  (message "%s" (buffer-string)))
+                (should (zerop ec)))))))
       (should-not (sasl-next-step client step)))))
 
 ;;; erc-sasl-tests.el ends here
diff --git a/test/lisp/erc/erc-scenarios-sasl.el b/test/lisp/erc/erc-scenarios-sasl.el
index 3ff7cc805d..7970e65ec2 100644
--- a/test/lisp/erc/erc-scenarios-sasl.el
+++ b/test/lisp/erc/erc-scenarios-sasl.el
@@ -41,6 +41,7 @@ erc-scenarios-sasl--plain
        (erc-modules (cons 'sasl erc-modules))
        (erc-sasl-mechanism 'plain)
        (erc-sasl-password "password123")
+       (erc-sasl--session-options nil)
        (inhibit-message noninteractive)
        (expect (erc-d-t-make-expecter)))
 
@@ -60,6 +61,49 @@ erc-scenarios-sasl--plain
         ;; Regression "\0\0\0\0 ..." caused by (fillarray passphrase 0)
         (should (string= erc-sasl-password "password123"))))))
 
+;; This is meant to assert `erc-update-modules' and local-module
+;; behavior generally.  It only exists here for convenience because as
+;; of ERC 5.5, `sasl' is the only local module.
+(ert-deftest erc-scenarios-sasl--local-modules-reconnect ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain 'plain))
+       (port (process-contact dumb-server :service))
+       (erc-sasl--session-options nil)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect with options let-bound")
+      (with-current-buffer
+          ;; This won't work unless the library is already loaded
+          (let ((erc-modules (cons 'sasl erc-modules))
+                (erc-sasl-mechanism 'plain)
+                (erc-sasl-password "password123"))
+            (erc :server "127.0.0.1"
+                 :port port
+                 :nick "tester"
+                 :user "tester"
+                 :full-name "tester"))
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (with-current-buffer (erc-d-t-wait-for 10 (get-buffer "ExampleOrg"))
+      (ert-info ("First connection succeeds")
+        (funcall expect 10 "This server is in debug mode")
+        (erc-cmd-QUIT "")
+        (funcall expect 10 "finished"))
+
+      (should-not erc-sasl-password) ; obviously
+      (should-not (memq 'sasl erc-modules))
+
+      (erc-d-t-wait-for 10 (not (erc-server-process-alive)))
+      (erc-cmd-RECONNECT)
+      (ert-info ("Second connection succeeds")
+        (funcall expect 10 "This server is in debug mode")
+        (erc-cmd-QUIT "")
+        (funcall expect 10 "finished")))))
+
 (ert-deftest erc-scenarios-sasl--external ()
   :tags '(:expensive-test)
   (erc-scenarios-common-with-cleanup
@@ -70,6 +114,7 @@ erc-scenarios-sasl--external
        (port (process-contact dumb-server :service))
        (erc-modules (cons 'sasl erc-modules))
        (erc-sasl-mechanism 'external)
+       (erc-sasl--session-options nil)
        (inhibit-message noninteractive)
        (expect (erc-d-t-make-expecter)))
 
@@ -99,6 +144,7 @@ erc-scenarios-sasl--plain-fail
        (erc-modules (cons 'sasl erc-modules))
        (erc-sasl-password "wrong")
        (erc-sasl-mechanism 'plain)
+       (erc-sasl--session-options nil)
        (inhibit-message noninteractive)
        (expect (erc-d-t-make-expecter))
        (buf nil))
@@ -128,6 +174,7 @@ erc-scenarios--common--sasl
        (erc-modules (cons 'sasl erc-modules))
        (erc-sasl-password "sesame")
        (erc-sasl-mechanism mech)
+       (erc-sasl--session-options nil)
        (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
        (sasl-unique-id-function (lambda () (pop mock-rvs)))
        (inhibit-message noninteractive)
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index 4646c35e25..91815b8fae 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -960,44 +960,60 @@ erc-migrate-modules
   (should (equal (erc-migrate-modules erc-modules) erc-modules)))
 
 (ert-deftest erc-update-modules ()
-  (let* (calls
-         (erc-modules '(fake-foo fake-bar)))
+  (let (calls
+        erc-modules
+        erc-kill-channel-hook erc-kill-server-hook erc-kill-buffer-hook)
     (cl-letf (((symbol-function 'require)
                (lambda (s &rest _) (push s calls)))
-              ((symbol-function 'erc-fake-foo-mode)
-               (lambda (n) (push (cons 'fake-foo n) calls)))
-              ;; Here, foo is a global module (minor mode)
-              ((get 'erc-fake-foo-mode 'standard-value) #'ignore)
+
+              ;; Local modules
               ((symbol-function 'erc-fake-bar-mode)
                (lambda (n) (push (cons 'fake-bar n) calls)))
+
+              ;; Global modules
+              ((symbol-function 'erc-fake-foo-mode)
+               (lambda (n) (push (cons 'fake-foo n) calls)))
+              ((get 'erc-fake-foo-mode 'standard-value) 'ignore)
               ((symbol-function 'erc-autojoin-mode)
                (lambda (n) (push (cons 'autojoin n) calls)))
-              ((get 'erc-autojoin-mode 'standard-value) #'ignore)
+              ((get 'erc-autojoin-mode 'standard-value) 'ignore)
               ((symbol-function 'erc-networks-mode)
                (lambda (n) (push (cons 'networks n) calls)))
+              ((get 'erc-networks-mode 'standard-value) 'ignore)
               ((symbol-function 'erc-completion-mode)
                (lambda (n) (push (cons 'completion n) calls)))
-              ((get 'erc-completion-mode 'standard-value) #'ignore))
-
-      (ert-info ("Locals")
-        (should (equal (erc-update-modules)
-                       '(erc-fake-bar-mode)))
-        ;; Bar still required
-        (should (equal (nreverse calls) '(erc-fake-foo
-                                          (fake-foo . 1)
-                                          erc-fake-bar)))
+              ((get 'erc-completion-mode 'standard-value) 'ignore))
+
+      (ert-info ("Local modules")
+        (setq erc-modules '(fake-foo fake-bar))
+        (should (equal (erc-update-modules t) '(erc-fake-bar-mode)))
+        ;; Bar the feature is still required but the mode is not activated
+        (should (equal (nreverse calls)
+                       '(erc-fake-foo (fake-foo . 1) erc-fake-bar)))
         (setq calls nil))
 
       (ert-info ("Module name overrides")
         (setq erc-modules '(completion autojoin networks))
-        (should-not (erc-update-modules)) ; no locals
-        (should (equal (nreverse calls)
-                       '(erc-pcomplete
-                         (completion . 1)
-                         erc-join
-                         (autojoin . 1)
-                         erc-networks
-                         (networks . 1))))
-        (setq calls nil)))))
+        (should-not (erc-update-modules t)) ; no locals
+        (should (equal (nreverse calls) '( erc-pcomplete (completion . 1)
+                                           erc-join (autojoin . 1)
+                                           erc-networks (networks . 1))))
+        (setq calls nil))
+
+      (ert-info ("Reenabling of local minor modes by `erc-open'")
+        (with-temp-buffer
+          (erc-mode)
+          (setq erc-modules '(completion autojoin networks))
+          (if (< 27 emacs-major-version)
+              (let ((local-minor-modes '(font-lock-mode erc-fake-bar-mode)))
+                (should (equal (erc-update-modules t) '(erc-fake-bar-mode))))
+            (cl-letf (((symbol-function 'buffer-local-variables)
+                       (lambda (&rest _) '((font-lock-mode)
+                                           (erc-fake-bar-mode)))))
+              (should (equal (erc-update-modules t) '(erc-fake-bar-mode)))))
+          (should (equal (nreverse calls)
+                         '( erc-pcomplete (completion . 1)
+                            erc-join (autojoin . 1)
+                            erc-networks (networks . 1)))))))))
 
 ;;; erc-tests.el ends here
diff --git a/test/lisp/erc/resources/sasl/plain.eld b/test/lisp/erc/resources/sasl/plain.eld
index 9c6ce3feeb..1341cd78e5 100644
--- a/test/lisp/erc/resources/sasl/plain.eld
+++ b/test/lisp/erc/resources/sasl/plain.eld
@@ -33,3 +33,7 @@
 ((mode-user 1.2 "MODE tester +i")
  (0.0 ":irc.example.org 221 tester +Zi")
  (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
+
+((quit 5 "QUIT :\2ERC\2")
+ (0 ":tester!~u@yuvqisyu7m7qs.irc QUIT :Quit"))
+((drop 1 DROP))
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: 0001-Add-GS2-authorization-to-sasl-scram-rfc.patch --]
[-- Type: text/x-patch, Size: 3030 bytes --]

From a7177b08ef8a0fe055d1e09045aaa95a8ba66ceb Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 19 Sep 2022 21:28:52 -0700
Subject: [PATCH 1/5] Add GS2 authorization to sasl-scram-rfc

* lisp/net/sasl-scram-rfc.el (sasl-scram-gs2-header-function,
sasl-scram-construct-gs2-header): Add new variable and default
function for determining a SCRAM GSS-API message header.  This is
mainly intended for other libraries rather than end users.
(sasl-scram-client-first-message): Use gs2-header function.
(sasl-scram--client-final-message): Use dedicated gs2-header function.
Also remove whitespace when base64-encoding, as per RFC 5802.
(Bug#57956.)
---
 lisp/net/sasl-scram-rfc.el | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/lisp/net/sasl-scram-rfc.el b/lisp/net/sasl-scram-rfc.el
index ee52ed6e07..f7a2e42541 100644
--- a/lisp/net/sasl-scram-rfc.el
+++ b/lisp/net/sasl-scram-rfc.el
@@ -45,14 +45,21 @@
 
 ;;; Generic for SCRAM-*
 
+(defvar sasl-scram-gs2-header-function 'sasl-scram-construct-gs2-header
+  "Function to create GS2 header.
+See https://www.rfc-editor.org/rfc/rfc5801#section-4.")
+
+(defun sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
 (defun sasl-scram-client-first-message (client _step)
   (let ((c-nonce (sasl-unique-id)))
     (sasl-client-set-property client 'c-nonce c-nonce))
   (concat
-   ;; n = client doesn't support channel binding
-   "n,"
-   ;; TODO: where would we get authorization id from?
-   ","
+   (funcall sasl-scram-gs2-header-function client)
    (sasl-scram--client-first-message-bare client)))
 
 (defun sasl-scram--client-first-message-bare (client)
@@ -77,11 +84,11 @@ sasl-scram--client-final-message
 
 	 (c-nonce (sasl-client-property client 'c-nonce))
 	 ;; no channel binding, no authorization id
-	 (cbind-input "n,,"))
+         (cbind-input (funcall sasl-scram-gs2-header-function client)))
     (unless (string-prefix-p c-nonce nonce)
       (sasl-error "Invalid nonce from server"))
     (let* ((client-final-message-without-proof
-	    (concat "c=" (base64-encode-string cbind-input) ","
+            (concat "c=" (base64-encode-string cbind-input t) ","
 		    "r=" nonce))
 	   (password
 	    ;; TODO: either apply saslprep or disallow non-ASCII characters
@@ -113,7 +120,7 @@ sasl-scram--client-final-message
 	   (client-proof (funcall string-xor client-key client-signature))
 	   (client-final-message
 	    (concat client-final-message-without-proof ","
-		    "p=" (base64-encode-string client-proof))))
+                    "p=" (base64-encode-string client-proof t))))
       (sasl-client-set-property client 'auth-message auth-message)
       (sasl-client-set-property client 'salted-password salted-password)
       client-final-message)))
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #4: 0002-Don-t-set-erc-networks-id-until-network-is-known.patch --]
[-- Type: text/x-patch, Size: 7501 bytes --]

From 665eb8627e3b2ba1befeb64cbff0caf217a28089 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 13 Nov 2022 01:52:48 -0800
Subject: [PATCH 2/5] Don't set erc-networks--id until network is known

* lisp/erc/erc-networks.el (erc-networks--id-given): Accept a null
argument.
(erc-networks--id-on-connect): Remove unused function.
(erc-networks--id-equal-p): Add method for comparing initialized and
unset IDs.
(erc-networks--update-server-identity): Ensure `erc-networks--id' is
set before continuing search.
(erc-networks--init-identity): Don't assume `erc-networks--id' is
non-nil.

* lisp/erc/erc.el (erc-open): For continued sessions, try copying over
the last network ID.
(erc--auth-source-determine-params-default): Don't expect a network ID
to have been initialized.

* lisp/erc/erc-backend.el (erc-server-NICK, erc-server-433): Unless
already connected, clear network ID when server rejects or mandates a
nick change.
---
 lisp/erc/erc-backend.el  |  7 ++++++-
 lisp/erc/erc-networks.el | 39 ++++++++++++++++-----------------------
 lisp/erc/erc.el          | 13 ++++++++-----
 3 files changed, 30 insertions(+), 29 deletions(-)

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index 026b34849a..2c8c4dcb28 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -1525,7 +1525,7 @@ define-erc-response-handler
         (cl-pushnew (erc-server-buffer) bufs)
         (erc-set-current-nick nn)
         ;; Rename session, possibly rename server buf and all targets
-        (when (erc-network)
+        (when erc-server-connected
           (erc-networks--id-reload erc-networks--id proc parsed))
         (erc-update-mode-line)
         (setq erc-nick-change-attempt-count 0)
@@ -1535,6 +1535,9 @@ define-erc-response-handler
          'NICK-you ?n nick ?N nn)
         (run-hook-with-args 'erc-nick-changed-functions nn nick))
        (t
+        (unless (or erc-server-connected
+                    (erc-networks--id-given erc-networks--id))
+          (setq erc-networks--id nil))
         (erc-handle-user-status-change 'nick (list nick login host) (list nn))
         (erc-display-message parsed 'notice bufs 'NICK ?n nick
                              ?u login ?h host ?N nn))))))
@@ -2161,6 +2164,8 @@ erc-server-322-message
 
 (define-erc-response-handler (433)
   "Login-time \"nick in use\"." nil
+  (unless (or erc-server-connected (erc-networks--id-given erc-networks--id))
+    (setq erc-networks--id nil))
   (erc-nickname-in-use (cadr (erc-response.command-args parsed))
                        "already in use"))
 
diff --git a/lisp/erc/erc-networks.el b/lisp/erc/erc-networks.el
index dba6ead073..aa90bb8479 100644
--- a/lisp/erc/erc-networks.el
+++ b/lisp/erc/erc-networks.el
@@ -826,12 +826,11 @@ erc-networks--id
 
 ;; For now, please use this instead of `erc-networks--id-fixed-p'.
 (cl-defgeneric erc-networks--id-given (net-id)
-  "Return the preassigned identifier for a network presence, if any.
-This may have originated from an `:id' arg to entry-point commands
-`erc-tls' or `erc'.")
+  "Return the preassigned identifier for a network context, if any.
+When non-nil, assume NET-ID originated from an `:id' argument to
+entry-point commands `erc-tls' or `erc'.")
 
-(cl-defmethod erc-networks--id-given ((_ erc-networks--id))
-  nil)
+(cl-defmethod erc-networks--id-given (_) nil) ; _ may be nil
 
 (cl-defmethod erc-networks--id-given ((nid erc-networks--id-fixed))
   (erc-networks--id-symbol nid))
@@ -866,22 +865,15 @@ erc-networks--id-create
   ((_ symbol) &context (erc-obsolete-var erc-reuse-buffers null))
   (erc-networks--id-fixed-create (intern (buffer-name))))
 
-(cl-defgeneric erc-networks--id-on-connect (net-id)
-  "Update NET-ID `erc-networks--id' after connection params known.
-This is typically during or just after MOTD.")
-
-(cl-defmethod erc-networks--id-on-connect ((_ erc-networks--id))
-  nil)
-
-(cl-defmethod erc-networks--id-on-connect ((id erc-networks--id-qualifying))
-  (erc-networks--id-qualifying-update id (erc-networks--id-qualifying-create)))
-
 (cl-defgeneric erc-networks--id-equal-p (self other)
-  "Return non-nil when two network identities exhibit underlying equality.
-SELF and OTHER are `erc-networks--id' struct instances.  This
-should normally be used only for ID recovery or merging, after
-which no two identities should be `equal' (timestamps aside) that
-aren't also `eq'.")
+  "Return non-nil when two network IDs exhibit underlying equality.
+Expect SELF and OTHER to be `erc-networks--id' struct instances
+and that this will only be called for ID recovery or merging,
+after which no two identities should be `equal' (timestamps
+aside) that aren't also `eq'.")
+
+(cl-defmethod erc-networks--id-equal-p ((_ null) (_ erc-networks--id)) nil)
+(cl-defmethod erc-networks--id-equal-p ((_ erc-networks--id) (_ null)) nil)
 
 (cl-defmethod erc-networks--id-equal-p ((self erc-networks--id)
                                         (other erc-networks--id))
@@ -1381,7 +1373,8 @@ erc-networks--update-server-identity
   (let* ((identity erc-networks--id)
          (buffer (current-buffer))
          (f (lambda ()
-              (unless (or (eq (current-buffer) buffer)
+              (unless (or (not erc-networks--id)
+                          (eq (current-buffer) buffer)
                           (eq erc-networks--id identity))
                 (if (erc-networks--id-equal-p identity erc-networks--id)
                     (throw 'buffer erc-networks--id)
@@ -1400,8 +1393,8 @@ erc-networks--init-identity
   "Update identity with real network name."
   ;; Initialize identity for real now that we know the network
   (cl-assert erc-network)
-  (unless (erc-networks--id-symbol erc-networks--id) ; unless just reconnected
-    (erc-networks--id-on-connect erc-networks--id))
+  (unless erc-networks--id
+    (setq erc-networks--id (erc-networks--id-create nil)))
   ;; Find duplicate identities or other conflicting ones and act
   ;; accordingly.
   (erc-networks--update-server-identity)
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 6b14cf87e2..63379af141 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -2008,10 +2008,12 @@ erc-open
     (setq erc-default-nicks (if (consp erc-nick) erc-nick (list erc-nick)))
     ;; client certificate (only useful if connecting over TLS)
     (setq erc-session-client-certificate client-certificate)
-    (setq erc-networks--id (if connect
-                               (erc-networks--id-create id)
-                             (buffer-local-value 'erc-networks--id
-                                                 old-buffer)))
+    (setq erc-networks--id
+          (if connect
+              (or (and continued-session
+                       (buffer-local-value 'erc-networks--id old-buffer))
+                  (and id (erc-networks--id-create id)))
+            (buffer-local-value 'erc-networks--id old-buffer)))
     ;; debug output buffer
     (setq erc-dbuf
           (when erc-log-p
@@ -3171,7 +3173,8 @@ erc-auth-source-join-function
                  function))
 
 (defun erc--auth-source-determine-params-defaults ()
-  (let* ((net (and-let* ((esid (erc-networks--id-symbol erc-networks--id))
+  (let* ((net (and-let* ((erc-networks--id)
+                         (esid (erc-networks--id-symbol erc-networks--id))
                          ((symbol-name esid)))))
          (localp (and erc--target (erc--target-channel-local-p erc--target)))
          (hosts (if localp
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #5: 0003-Support-local-ERC-modules-in-erc-mode-buffers.patch --]
[-- Type: text/x-patch, Size: 14134 bytes --]

From 6210a98556063dd22b0ddc36ec75cebab5cb9cd6 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 12 Jul 2021 03:44:28 -0700
Subject: [PATCH 3/5] Support local ERC modules in erc-mode buffers

* lisp/erc/erc.el (erc-migrate-modules): Add some missing mappings.
(erc-update-modules): Change return value from nil to a list of
minor-mode commands for local modules.  Use `custom-variable-p' to
detect flavor.  Currently, all modules are global and so are their
accompanying minor modes.
(erc-open): Defer enabling of local modules via `erc-update-modules'
until after buffer is initialized with other local vars.  Also defer
major mode hooks so they can detect things like whether the buffer is
a server or target buffer.  Also ensure local module setup code can
detect when `erc-open' was called with a non-nil
`erc--server-reconnecting'.  It's reset to nil by
`erc-server-connect'.
* lisp/erc/erc-common.el (erc--module-name-migrations,
erc--features-to-modules, erc--modules-to-features): Add alists of
old-to-new module names to support module-name migrations.
(define-erc-modules): Don't enable local modules (minor modes) unless
`erc-mode' is the major mode.  And don't disable them unless the minor
mode is actually active.  Also, don't mutate `erc-modules' when
dealing with a local module.
(erc--normalize-module-symbol): Add helper for `erc-migrate-modules'.
* lisp/erc/erc-goodies.el: Require cl-lib.
* test/lisp/erc/erc-tests.el (erc-migrate-modules,
erc-update-modules): Add rudimentary unit tests.  (Bug#57955.)
---
 lisp/erc/erc-common.el     | 56 +++++++++++++++++++++++----
 lisp/erc/erc-goodies.el    |  1 +
 lisp/erc/erc.el            | 78 ++++++++++++++++++++------------------
 test/lisp/erc/erc-tests.el | 58 ++++++++++++++++++++++++++++
 4 files changed, 150 insertions(+), 43 deletions(-)

diff --git a/lisp/erc/erc-common.el b/lisp/erc/erc-common.el
index d8aac36eab..a300cfc4fa 100644
--- a/lisp/erc/erc-common.el
+++ b/lisp/erc/erc-common.el
@@ -85,6 +85,41 @@ erc--target
   (contents "" :type string)
   (tags '() :type list))
 
+;; TODO move goodies modules here after 29 is released.
+(defconst erc--features-to-modules
+  '((erc-pcomplete completion pcomplete)
+    (erc-capab capab-identify)
+    (erc-join autojoin)
+    (erc-page page ctcp-page)
+    (erc-sound sound ctcp-sound)
+    (erc-stamp stamp timestamp)
+    (erc-services services nickserv))
+  "Migration alist mapping a library feature to module names.
+Keys need not be unique: a library may define more than one
+module.  Sometimes a module's downcased alias will be its
+canonical name.")
+
+(defconst erc--modules-to-features
+  (let (pairs)
+    (pcase-dolist (`(,feature . ,names) erc--features-to-modules)
+      (dolist (name names)
+        (push (cons name feature) pairs)))
+    (nreverse pairs))
+  "Migration alist mapping a module's name to its home library feature.")
+
+(defconst erc--module-name-migrations
+  (let (pairs)
+    (pcase-dolist (`(,_ ,canonical . ,rest) erc--features-to-modules)
+      (dolist (obsolete rest)
+        (push (cons obsolete canonical) pairs)))
+    pairs)
+  "Association list of obsolete module names to canonical names.")
+
+(defun erc--normalize-module-symbol (symbol)
+  "Return preferred SYMBOL for `erc-modules'."
+  (setq symbol (intern (downcase (symbol-name symbol))))
+  (or (cdr (assq symbol erc--module-name-migrations)) symbol))
+
 (defmacro define-erc-module (name alias doc enable-body disable-body
                                   &optional local-p)
   "Define a new minor mode using ERC conventions.
@@ -98,7 +133,9 @@ define-erc-module
 
 This will define a minor mode called erc-NAME-mode, possibly
 an alias erc-ALIAS-mode, as well as the helper functions
-erc-NAME-enable, and erc-NAME-disable.
+erc-NAME-enable, and erc-NAME-disable.  Beware that for global
+modules, these helpers, as well as the minor-mode toggle, all mutate
+the user option `erc-modules'.
 
 Example:
 
@@ -111,6 +148,7 @@ define-erc-module
                   #\\='erc-replace-insert)))"
   (declare (doc-string 3) (indent defun))
   (let* ((sn (symbol-name name))
+         (mod (erc--normalize-module-symbol name))
          (mode (intern (format "erc-%s-mode" (downcase sn))))
          (group (intern (format "erc-%s" (downcase sn))))
          (enable (intern (format "erc-%s-enable" (downcase sn))))
@@ -134,16 +172,20 @@ define-erc-module
          ,(format "Enable ERC %S mode."
                   name)
          (interactive)
-         (add-to-list 'erc-modules (quote ,name))
-         (setq ,mode t)
-         ,@enable-body)
+         ,@(unless local-p `((cl-pushnew ',mod erc-modules)))
+         ,@(macroexp-unprogn
+            `(,@(if local-p '(when (eq major-mode 'erc-mode)) '(progn))
+              (setq ,mode t)
+              ,@enable-body)))
        (defun ,disable ()
          ,(format "Disable ERC %S mode."
                   name)
          (interactive)
-         (setq erc-modules (delq (quote ,name) erc-modules))
-         (setq ,mode nil)
-         ,@disable-body)
+         ,@(unless local-p `((setq erc-modules (delq ',mod erc-modules))))
+         ,@(macroexp-unprogn
+            `(,@(if local-p `(when ,mode) '(progn))
+              (setq ,mode nil)
+              ,@disable-body)))
        ,(when (and alias (not (eq name alias)))
           `(defalias
              ',(intern
diff --git a/lisp/erc/erc-goodies.el b/lisp/erc/erc-goodies.el
index 59b5f01f23..1af83b58ba 100644
--- a/lisp/erc/erc-goodies.el
+++ b/lisp/erc/erc-goodies.el
@@ -31,6 +31,7 @@
 
 ;;; Imenu support
 
+(eval-when-compile (require 'cl-lib))
 (require 'erc-common)
 
 (defvar erc-controls-highlight-regexp)
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 63379af141..6c9d4de2ba 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1784,10 +1784,7 @@ erc-migrate-modules
   "Migrate old names of ERC modules to new ones."
   ;; modify `transforms' to specify what needs to be changed
   ;; each item is in the format '(old . new)
-  (let ((transforms '((pcomplete . completion))))
-    (delete-dups
-     (mapcar (lambda (m) (or (cdr (assoc m transforms)) m))
-             mods))))
+  (delete-dups (mapcar #'erc--normalize-module-symbol mods)))
 
 (defcustom erc-modules '(netsplit fill button match track completion readonly
                                   networks ring autojoin noncommands irccontrols
@@ -1865,28 +1862,28 @@ erc-modules
     (repeat :tag "Others" :inline t symbol))
   :group 'erc)
 
-(defun erc-update-modules ()
-  "Run this to enable erc-foo-mode for all modules in `erc-modules'."
-  (let (req)
-    (dolist (mod erc-modules)
-      (setq req (concat "erc-" (symbol-name mod)))
-      (cond
-       ;; yuck. perhaps we should bring the filenames into sync?
-       ((string= req "erc-capab-identify")
-        (setq req "erc-capab"))
-       ((string= req "erc-completion")
-        (setq req "erc-pcomplete"))
-       ((string= req "erc-pcomplete")
-        (setq mod 'completion))
-       ((string= req "erc-autojoin")
-        (setq req "erc-join")))
-      (condition-case nil
-          (require (intern req))
-        (error nil))
-      (let ((sym (intern-soft (concat "erc-" (symbol-name mod) "-mode"))))
-        (if (fboundp sym)
-            (funcall sym 1)
-          (error "`%s' is not a known ERC module" mod))))))
+(defun erc-update-modules (&optional defer-locals)
+  "Enable global minor mode for all global modules in `erc-modules'.
+With DEFER-LOCALS, return minor-mode commands for all local
+modules, possibly for deferred invocation, as done by `erc-open'
+whenever a new ERC buffer is created.  Local modules were
+introduced in ERC 5.5."
+  (let ((local-modes
+         (when (and defer-locals (derived-mode-p 'erc-mode))
+           (delq nil (mapcar
+                      (lambda (m)
+                        (and (string-prefix-p "erc-" (symbol-name m)) m))
+                      local-minor-modes)))))
+    (dolist (module erc-modules (and defer-locals local-modes))
+      (require (or (alist-get module erc--modules-to-features)
+                   (intern (concat "erc-" (symbol-name module))))
+               nil 'noerror) ; some modules don't have a corresponding feature
+      (let ((mode (intern-soft (concat "erc-" (symbol-name module) "-mode"))))
+        (unless (and mode (fboundp mode))
+          (error "`%s' is not a known ERC module" module))
+        (if (and defer-locals (not (custom-variable-p mode)))
+            (cl-pushnew mode local-modes)
+          (funcall mode 1))))))
 
 (defun erc-setup-buffer (buffer)
   "Consults `erc-join-buffer' to find out how to display `BUFFER'."
@@ -1942,18 +1939,24 @@ erc-open
   (let* ((target (and channel (erc--target-from-string channel)))
          (buffer (erc-get-buffer-create server port nil target id))
          (old-buffer (current-buffer))
-         old-point
+         (old-recon-count erc-server-reconnect-count)
+         (old-point nil)
+         (delayed-modules nil)
          (continued-session (and erc--server-reconnecting
                                  (with-suppressed-warnings
                                      ((obsolete erc-reuse-buffers))
-                                   erc-reuse-buffers))))
+                                   erc-reuse-buffers)
+                                 erc-networks--id)))
     (when connect (run-hook-with-args 'erc-before-connect server port nick))
-    (erc-update-modules)
     (set-buffer buffer)
     (setq old-point (point))
-    (let ((old-recon-count erc-server-reconnect-count))
-      (erc-mode)
-      (setq erc-server-reconnect-count old-recon-count))
+    (setq delayed-modules (erc-update-modules 'defer-locals))
+
+    (delay-mode-hooks (erc-mode))
+
+    (setq erc-server-reconnect-count old-recon-count
+          erc--server-reconnecting continued-session)
+
     (when (setq erc-server-connected (not connect))
       (setq erc-server-announced-name
             (buffer-local-value 'erc-server-announced-name old-buffer)))
@@ -2010,14 +2013,19 @@ erc-open
     (setq erc-session-client-certificate client-certificate)
     (setq erc-networks--id
           (if connect
-              (or (and continued-session
-                       (buffer-local-value 'erc-networks--id old-buffer))
+              (or erc--server-reconnecting
                   (and id (erc-networks--id-create id)))
             (buffer-local-value 'erc-networks--id old-buffer)))
     ;; debug output buffer
     (setq erc-dbuf
           (when erc-log-p
             (get-buffer-create (concat "*ERC-DEBUG: " server "*"))))
+
+    (erc-determine-parameters server port nick full-name user passwd)
+
+    (save-excursion (run-mode-hooks))
+    (dolist (mod delayed-modules) (funcall mod +1))
+
     ;; set up prompt
     (unless continued-session
       (goto-char (point-max))
@@ -2029,8 +2037,6 @@ erc-open
       (erc-display-prompt)
       (goto-char (point-max)))
 
-    (erc-determine-parameters server port nick full-name user passwd)
-
     ;; Saving log file on exit
     (run-hook-with-args 'erc-connect-pre-hook buffer)
 
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index c88dd9888d..d074b36c8b 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -953,4 +953,62 @@ erc-message
     (kill-buffer "ExampleNet")
     (kill-buffer "#chan")))
 
+(ert-deftest erc-migrate-modules ()
+  (should (equal (erc-migrate-modules '(autojoin timestamp button))
+                 '(autojoin stamp button)))
+  ;; Default unchanged
+  (should (equal (erc-migrate-modules erc-modules) erc-modules)))
+
+(ert-deftest erc-update-modules ()
+  (let (calls
+        erc-modules
+        erc-kill-channel-hook erc-kill-server-hook erc-kill-buffer-hook)
+    (cl-letf (((symbol-function 'require)
+               (lambda (s &rest _) (push s calls)))
+
+              ;; Local modules
+              ((symbol-function 'erc-fake-bar-mode)
+               (lambda (n) (push (cons 'fake-bar n) calls)))
+
+              ;; Global modules
+              ((symbol-function 'erc-fake-foo-mode)
+               (lambda (n) (push (cons 'fake-foo n) calls)))
+              ((get 'erc-fake-foo-mode 'standard-value) 'ignore)
+              ((symbol-function 'erc-autojoin-mode)
+               (lambda (n) (push (cons 'autojoin n) calls)))
+              ((get 'erc-autojoin-mode 'standard-value) 'ignore)
+              ((symbol-function 'erc-networks-mode)
+               (lambda (n) (push (cons 'networks n) calls)))
+              ((get 'erc-networks-mode 'standard-value) 'ignore)
+              ((symbol-function 'erc-completion-mode)
+               (lambda (n) (push (cons 'completion n) calls)))
+              ((get 'erc-completion-mode 'standard-value) 'ignore))
+
+      (ert-info ("Local modules")
+        (setq erc-modules '(fake-foo fake-bar))
+        (should (equal (erc-update-modules t) '(erc-fake-bar-mode)))
+        ;; Bar the feature is still required but the mode is not activated
+        (should (equal (nreverse calls)
+                       '(erc-fake-foo (fake-foo . 1) erc-fake-bar)))
+        (setq calls nil))
+
+      (ert-info ("Module name overrides")
+        (setq erc-modules '(completion autojoin networks))
+        (should-not (erc-update-modules t)) ; no locals
+        (should (equal (nreverse calls) '( erc-pcomplete (completion . 1)
+                                           erc-join (autojoin . 1)
+                                           erc-networks (networks . 1))))
+        (setq calls nil))
+
+      (ert-info ("Reenabling of local minor modes by `erc-open'")
+        (with-temp-buffer
+          (erc-mode)
+          (setq erc-modules '(completion autojoin networks))
+          (let ((local-minor-modes '(font-lock-mode erc-fake-bar-mode)))
+            (should (equal (erc-update-modules t) '(erc-fake-bar-mode))))
+          (should (equal (nreverse calls)
+                         '( erc-pcomplete (completion . 1)
+                            erc-join (autojoin . 1)
+                            erc-networks (networks . 1)))))))))
+
 ;;; erc-tests.el ends here
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #6: 0004-Call-erc-login-indirectly-via-new-generic-wrapper.patch --]
[-- Type: text/x-patch, Size: 1981 bytes --]

From e47b40618b6481e1fa2b751dd79a5a4e2f3da2a7 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:49:23 -0700
Subject: [PATCH 4/5] Call erc-login indirectly via new generic wrapper

* lisp/erc/erc-backend (erc--register-connection): Add new generic
function that defers to `erc-login' by default.
(erc-process-sentinel, erc-server-connect): Call
`erc--register-connection' instead of `erc-login'.
---
 lisp/erc/erc-backend.el | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index 2c8c4dcb28..37a3da8b66 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -625,6 +625,10 @@ erc-open-network-stream
   (let ((p (plist-put parameters :nowait t)))
     (apply #'open-network-stream name buffer host service p)))
 
+(cl-defmethod erc--register-connection ()
+  "Perform opening IRC protocol exchange with server."
+  (erc-login))
+
 (defun erc-server-connect (server port buffer &optional client-certificate)
   "Perform the connection and login using the specified SERVER and PORT.
 We will store server variables in the buffer given by BUFFER.
@@ -673,7 +677,7 @@ erc-server-connect
         ;; waiting for a non-blocking connect - keep the user informed
         (erc-display-message nil nil buffer "Opening connection..\n")
       (message "%s...done" msg)
-      (erc-login)) ))
+      (erc--register-connection))))
 
 (defun erc-server-reconnect ()
   "Reestablish the current IRC connection.
@@ -851,7 +855,7 @@ erc-process-sentinel
                   cproc (process-status cproc) event erc-server-quitting))
         (if (string-match "^open" event)
             ;; newly opened connection (no wait)
-            (erc-login)
+            (erc--register-connection)
           ;; assume event is 'failed
           (erc-with-all-buffers-of-server cproc nil
                                           (setq erc-server-connected nil))
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #7: 0005-Add-non-IRCv3-SASL-module-to-ERC.patch --]
[-- Type: text/x-patch, Size: 73241 bytes --]

From 21f3196c0b55d8e7c27c4918f741cbbecfaf2136 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 12 Jul 2021 03:44:28 -0700
Subject: [PATCH 5/5] Add non-IRCv3 SASL module to ERC

* lisp/erc/erc-compat.el (erc-compat--sasl-scram-construct-gs2-header,
erc-compat--sasl-scram-client-first-message,
erc-compat--sasl-scram--client-final-message): Add minimal
authorization support via own variant of
`sasl-scram--client-final-message' and supporting sasl-scram-rfc
functions introduced in Emacs 29.
(erc-compat--local-minor-modes): Add helper for finding local modules
active in an ERC buffer.
* lisp/erc/erc.el (erc-modules): Add `sasl'.
* lisp/erc/erc-sasl.el: New file (bug#29108).
* test/lisp/erc/erc-sasl-tests.el: New file.
* test/lisp/erc/erc-scenarios-sasl.el: New file.
* test/lisp/erc/resources/sasl/plain-failed.eld: New file.
* test/lisp/erc/resources/sasl/plain.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-1.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-256.eld: New file.
* test/lisp/erc/resources/sasl/external.eld: New file.
---
 doc/misc/erc.texi                             | 137 +++++-
 lisp/erc/erc-compat.el                        | 116 +++++
 lisp/erc/erc-sasl.el                          | 424 ++++++++++++++++++
 lisp/erc/erc.el                               |   6 +-
 test/lisp/erc/erc-sasl-tests.el               | 319 +++++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 208 +++++++++
 test/lisp/erc/erc-tests.el                    |   9 +-
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  39 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 ++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 ++
 12 files changed, 1394 insertions(+), 7 deletions(-)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

diff --git a/doc/misc/erc.texi b/doc/misc/erc.texi
index 3db83197f9..79f8c92719 100644
--- a/doc/misc/erc.texi
+++ b/doc/misc/erc.texi
@@ -78,6 +78,7 @@ Top
 Advanced Usage
 
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL.
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 
@@ -478,6 +479,10 @@ Modules
 @item ring
 Enable an input history
 
+@cindex modules, sasl
+@item sasl
+Enable SASL authentication
+
 @cindex modules, scrolltobottom
 @item scrolltobottom
 Scroll to the bottom of the buffer
@@ -525,6 +530,7 @@ Advanced Usage
 
 @menu
 * Connecting::                  Ways of connecting to an IRC server.
+* SASL::                        Authenticating via SASL
 * Sample Configuration::        An example configuration file.
 * Options::                     Options that are available for ERC.
 @end menu
@@ -842,6 +848,7 @@ Connecting
 @noindent
 For details, @pxref{Top,,auth-source, auth, Emacs auth-source Library}.
 
+@anchor{ERC auth-source functions}
 @defopt erc-auth-source-server-function
 @end defopt
 @defopt erc-auth-source-services-function
@@ -854,7 +861,8 @@ Connecting
 @code{:user} is the ``desired'' nickname rather than the current one.
 Generalized names, like @code{:user} and @code{:host}, are always used
 over back-end specific ones, like @code{:login} or @code{:machine}.
-ERC expects a string to use as the secret or nil, if the search fails.
+ERC expects a string to use as the secret or @code{nil}, if the search
+fails.
 
 @findex erc-auth-source-search
 The default value for all three options is the function
@@ -915,6 +923,133 @@ Connecting
 make the most sense, but any reasonably printable object is
 acceptable.
 
+@node SASL
+@section Authenticating via SASL
+@cindex SASL
+
+@strong{Warning:} ERC's SASL offering is currently limited by a lack
+of support for proper IRCv3 capability negotiation.  In most cases,
+this shouldn't affect your ability to authenticate.  If you run into
+trouble, please contact us (@pxref{Getting Help and Reporting Bugs}).
+
+Regardless of the mechanism or the network, you'll likely have to be
+registered before first use.  Please refer to the network's own
+instructions for details.  If you're new to IRC and using a bouncer,
+know that you almost certainly won't be needing SASL for the
+@samp{client -> bouncer} connection.
+
+Note that @code{sasl} is a ``local'' ERC module, which various library
+functions, like @code{erc-update-modules}, may treat differently than
+global modules in user code.  However, this should not affect everyday
+client use.  To get started, just add @code{sasl} to
+@code{erc-modules} like any other module.  But before that, please
+explore all custom options pertaining to your chosen mechanism.
+
+@defopt erc-sasl-mechanism
+The name of an SASL subprotocol type as a @emph{lowercase} symbol.
+
+@var{plain} and @var{scram} (``password-based''):
+
+@indentedblock
+Here, ``password'' refers to your account password, which is usually
+your @samp{NickServ} password.  This often differs from any connection
+(server) password given to @code{erc-tls} via its @code{:password}
+parameter.  To make this work, customize both @code{erc-sasl-user} and
+@code{erc-sasl-password} or bind them when invoking @code{erc-tls}.
+@end indentedblock
+
+@var{external} (via Client TLS Certificate):
+
+@indentedblock
+You'll want to specify the @code{:client-certificate} param when
+opening a new connection, which is typically done by calling
+@code{emacs-tls}.  But before that, ensure you've registered your
+fingerprint with the network.  The fingerprint is usually a SHA1 or
+SHA256 digest in either "normalized" or "openssl" forms.  The first is
+lowercase without delims (@samp{deadbeef}) and the second uppercase
+with colon seps (@samp{DE:AD:BE:EF}).
+
+Additional considerations:
+@enumerate
+@item
+There's no reason to send your password after registering.
+@item
+Most IRCds will allow you to authenticate with a client cert but
+without the hassle of SASL (meaning you may not need this module).
+@item
+Technically, @var{EXTERNAL} merely indicates that an out-of-band mode
+of authentication is in effect (being deferred to), so depending on
+the specific application or service, there's an off chance client
+certs aren't involved.
+@end enumerate
+@end indentedblock
+
+@var{ecdsa-nist256p-challenge}:
+
+@indentedblock
+This mechanism is quite complicated and currently requires the
+external @samp{openssl} executable, so please use something else if at
+all possible.  Ignoring that, specify your key file (e.g.,
+@samp{~/pki/mykey.pem}) as the value of @code{erc-sasl-password}, and
+then configure your network settings.  On servers running Atheme
+services, you can add your public key with @samp{NickServ} like so:
+
+@example
+ERC> /msg NickServ set property \
+     pubkey AgGZmlYTUjJlea/BVz7yrjJ6gysiAPaQxzeUzTH4hd5j
+
+@end example
+(You may be able to omit the @samp{property} subcommand.)
+@end indentedblock
+
+@end defopt
+
+@defopt erc-sasl-user
+This should be your network account name, typically the same one
+registered with nickname services.  Specify this when your
+@samp{NickServ} account name differs from the nick you're connecting
+with.
+@end defopt
+
+@defopt erc-sasl-password
+For ``password-based'' mechanisms, ERC sends any nonempty string as
+the authentication password.
+
+If you instead give a non-@code{nil} symbol, like @samp{Libera.Chat},
+ERC will use it for the @code{:host} field in an auth-source query.
+Actually, the same goes for when this option is @code{nil} but an
+explicit session ID is already on file (@pxref{Network Identifier}).
+For all such queries, ERC specifies the value of @code{erc-sasl-user}
+for the @code{:user} (@code{:login}) param.  Keep in mind that none of
+this matters unless @code{erc-sasl-auth-source-function} holds a
+function (it's @code{nil} by default).
+
+Otherwise, if you set this option to @code{nil} (or the empty string)
+or if an auth-source lookup has failed, ERC will try a non-@code{nil}
+``server password'', likely whatever you gave as the @var{password}
+argument to @code{erc-tls}.  This fallback behavior may change,
+however, so please don't rely on it.  As a last resort, ERC will
+prompt you for input.
+
+Also, if your mechanism is @code{ecdsa-nist256p-challenge}, this
+option should instead hold the file name of your key.
+@end defopt
+
+@defopt erc-sasl-auth-source-function
+This is nearly identical to the other ERC @samp{auth-source} function
+options (@pxref{ERC auth-source functions}) except that the default
+value here is @code{nil}, meaning you have to set it to something like
+@code{erc-auth-source-search} for queries to be performed.
+@end defopt
+
+@defopt erc-sasl-authzid
+In the rarest of circumstances, a network may want you to specify a
+specific role or assume an alternate identity.  In most cases, this
+happens because the server is buggy or misconfigured.  If you suspect
+such a thing, please contact your network operator.  Otherwise, just
+leave this set to @code{nil}.
+@end defopt
+
 
 @node Sample Configuration
 @section Sample Configuration
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 03bd8f1352..6d4ef21383 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -157,6 +157,110 @@ erc-subseq
 	       res))))))
 
 
+;;;; SASL
+
+(declare-function sasl-step-data "sasl" (step))
+(declare-function sasl-error "sasl" (datum))
+(declare-function sasl-client-property "sasl" (client property))
+(declare-function sasl-client-set-property "sasl" (client property value))
+(declare-function sasl-mechanism-name "sasl" (mechanism))
+(declare-function sasl-client-name "sasl" (client))
+(declare-function sasl-client-mechanism "sasl" (client))
+(declare-function sasl-read-passphrase "sasl" (prompt))
+(declare-function sasl-unique-id "sasl" nil)
+(declare-function decode-hex-string "hex-util" (string))
+(declare-function rfc2104-hash "rfc2104" (hash block-length hash-length
+                                               key text))
+(declare-function sasl-scram--client-first-message-bare "sasl-scram-rfc"
+                  (client))
+(declare-function cl-mapcar "cl-lib" (cl-func cl-x &rest cl-rest))
+
+(defun erc-compat--sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
+(defun erc-compat--sasl-scram-client-first-message (client _step)
+  (let ((c-nonce (sasl-unique-id)))
+    (sasl-client-set-property client 'c-nonce c-nonce))
+  (concat (erc-compat--sasl-scram-construct-gs2-header client)
+          (sasl-scram--client-first-message-bare client)))
+
+;; This is `sasl-scram--client-final-message' from sasl-scram-rfc,
+;; with the NO-LINE-BREAK argument of `base64-encode-string' set to t
+;; because https://www.rfc-editor.org/rfc/rfc5802#section-2.1 says:
+;;
+;;  > The use of base64 in SCRAM is restricted to the canonical form
+;;  > with no whitespace.
+;;
+;; Unfortunately, simply advising `base64-encode-string' won't work
+;; since the byte compiler precomputes the result when all inputs are
+;; constants, as they are in the original version.
+;;
+;; The only other substantial change is the addition of authz support.
+;; This can be dropped if adopted by Emacs 29 and `compat'.  Changes
+;; proposed for 29 are marked with a "; *n", comment below.  See older
+;; versions of lisp/erc/erc-v3-sasl.el (bug#49860) if needing a true
+;; side-by-side diff.  This also inlines the internal function
+;; `sasl-scram--client-first-message-bare' and takes various liberties
+;; with formatting.
+
+(defun erc-compat--sasl-scram--client-final-message
+    (hash-fun block-length hash-length client step)
+  (unless (string-match
+           "^r=\\([^,]+\\),s=\\([^,]+\\),i=\\([0-9]+\\)\\(?:$\\|,\\)"
+           (sasl-step-data step))
+    (sasl-error "Unexpected server response"))
+  (let* ((hmac-fun
+          (lambda (text key)
+            (decode-hex-string
+             (rfc2104-hash hash-fun block-length hash-length key text))))
+         (step-data (sasl-step-data step))
+         (nonce (match-string 1 step-data))
+         (salt-base64 (match-string 2 step-data))
+         (iteration-count (string-to-number (match-string 3 step-data)))
+         (c-nonce (sasl-client-property client 'c-nonce))
+         (cbind-input
+          (if (string-prefix-p c-nonce nonce)
+              (erc-compat--sasl-scram-construct-gs2-header client) ; *1
+            (sasl-error "Invalid nonce from server")))
+         (client-final-message-without-proof
+          (concat "c=" (base64-encode-string cbind-input t) "," ; *2
+                  "r=" nonce))
+         (password
+          (sasl-read-passphrase
+           (format "%s passphrase for %s: "
+                   (sasl-mechanism-name (sasl-client-mechanism client))
+                   (sasl-client-name client))))
+         (salt (base64-decode-string salt-base64))
+         (string-xor (lambda (a b)
+                       (apply #'unibyte-string (cl-mapcar #'logxor a b))))
+         (salted-password (let ((digest (concat salt (string 0 0 0 1)))
+                                (xored nil))
+                            (dotimes (_i iteration-count xored)
+                              (setq digest (funcall hmac-fun digest password))
+                              (setq xored (if (null xored)
+                                              digest
+                                            (funcall string-xor xored
+                                                     digest))))))
+         (client-key (funcall hmac-fun "Client Key" salted-password))
+         (stored-key (decode-hex-string (funcall hash-fun client-key)))
+         (auth-message (concat "n=" (sasl-client-name client)
+                               ",r=" c-nonce "," step-data
+                               "," client-final-message-without-proof))
+         (client-signature (funcall hmac-fun
+                                    (encode-coding-string auth-message 'utf-8)
+                                    stored-key))
+         (client-proof (funcall string-xor client-key client-signature))
+         (client-final-message
+          (concat client-final-message-without-proof ","
+                  "p=" (base64-encode-string client-proof t)))) ; *3
+    (sasl-client-set-property client 'auth-message auth-message)
+    (sasl-client-set-property client 'salted-password salted-password)
+    client-final-message))
+
+
 ;;;; Misc 29.1
 
 (defmacro erc-compat--with-memoization (table &rest forms)
@@ -168,6 +272,18 @@ erc-compat--with-memoization
     `(cl--generic-with-memoization ,table ,@forms))
    (t `(progn ,@forms))))
 
+(defun erc-compat--local-minor-modes ()
+  (delq nil
+        (if (boundp 'local-minor-modes)
+            (mapcar (lambda (m)
+                      (and (string-prefix-p "erc-" (symbol-name m)) m))
+                    local-minor-modes)
+          (mapcar (pcase-lambda (`(,k . _))
+                    (and (string-prefix-p "erc-" (symbol-name k))
+                         (string-suffix-p "-mode" (symbol-name k))
+                         k))
+                  (buffer-local-variables)))))
+
 (provide 'erc-compat)
 
 ;;; erc-compat.el ends here
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
new file mode 100644
index 0000000000..ac2646051c
--- /dev/null
+++ b/lisp/erc/erc-sasl.el
@@ -0,0 +1,424 @@
+;;; erc-sasl.el --- SASL for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published
+;; by the Free Software Foundation, either version 3 of the License,
+;; or (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;; This "non-IRCv3" implementation resembles others that have surfaced
+;; over the years, the first possibly being from Joseph Gay:
+;;
+;; https://lists.gnu.org/archive/html/erc-discuss/2012-02/msg00001.html
+;;
+;; See options and Info manual for usage.
+;;
+;; TODO:
+;;
+;; - Find a way to obfuscate the password in memory (via something
+;;   like `auth-source--obfuscate'); it's currently visible in
+;;   backtraces and bug reports.
+;;
+;; - Implement a proxy mechanism that chooses the strongest available
+;;   mechanism for you.  Requires CAP 3.2 (see bug#49860).
+;;
+;; - Integrate with whatever solution ERC eventually settles on to
+;;   handle user options for different network contexts.  At the
+;;   moment, this does its own thing for stashing and restoring
+;;   session options, but ERC should make abstractions available for
+;;   all local modules to use, possibly based on connection-local
+;;   variables.
+
+;;; Code:
+(require 'erc)
+(require 'rx)
+(require 'sasl)
+(require 'sasl-scram-rfc)
+(require 'sasl-scram-sha256 nil t) ; not present in Emacs 27
+
+(defgroup erc-sasl nil
+  "SASL for ERC."
+  :group 'erc
+  :package-version '(ERC . "5.4.1")) ; FIXME increment on next release
+
+(defcustom erc-sasl-mechanism 'plain
+  "SASL mechanism to connect with.
+Note that any value other than nil or `external' likely requires
+`erc-sasl-user' and `erc-sasl-password'."
+  :type '(choice (const plain)
+                 (const external)
+                 (const scram-sha-1)
+                 (const scram-sha-256)
+                 (const scram-sha-512)
+                 (const ecdsa-nist256p-challenge)))
+
+(defcustom erc-sasl-user nil
+  "Optional account username to send when authenticating.
+This is also referred to as the authentication identity, or
+\"authcid\".  When nil, applicable mechanisms will use the
+session's current nick."
+  :type '(choice string (const nil)))
+
+(defcustom erc-sasl-password nil
+  "Optional account password to send when authenticating.
+When the value is a string, ERC will use it unconditionally for
+most mechanisms.  Otherwise, when `erc-sasl-auth-source-function'
+is a function, ERC will attempt an auth-source query, possibly
+using a non-nil symbol for the suggested `:host' parameter if set
+as this option's value or passed as an `:id' to `erc-tls'.
+Failing that, ERC will try a non-nil \"session password\" if one
+is on file, typically from a `:password' argument supplied to
+`erc-tls'.  As a last resort, ERC will prompt for input.
+
+Note that when `erc-sasl-mechanism' is set to
+`ecdsa-nist256p-challenge', this option should hold the file name
+of the key."
+  :type '(choice (const nil) string symbol))
+
+(defcustom erc-sasl-auth-source-function nil
+  "Function to query auth-source for an SASL password.
+Called with keyword params known to `auth-source-search', which
+may include a non-nil `erc-sasl-user' for the `:user' field
+and a non-nil `erc-sasl-password' for the `:host' field, when
+the latter option is a symbol instead of a string.  In return,
+ERC expects a string to send as the SASL password, or nil, to
+move on to the next approach, as described in the doc string for
+the option `erc-sasl-password'.  See info node `(erc)
+Connecting' for details on ERC's auth-source integration."
+  :type '(choice (function-item erc-auth-source-search)
+                 (const nil)
+                 function))
+
+(defcustom erc-sasl-authzid nil
+  "SASL authorization identity, likely unneeded for everyday use."
+  :type '(choice (const nil) string))
+
+
+;; Analogous to what erc-backend does to persist opening params.
+(defvar-local erc-sasl--options nil)
+
+;; In the future, ERC will hopefully use connection-local variables to
+;; handle such bookkeeping transparently.
+(defvar erc-sasl--session-options nil
+  "An alist associating network-IDs to `erc-sasl--options'.
+This is for persisting user options captured at entry-point
+invocation throughout an Emacs session.")
+
+;; Session-local (server buffer) SASL subproto state
+(defvar-local erc-sasl--state nil)
+
+(cl-defstruct erc-sasl--state
+  "Holder for client object and subproto state."
+  (client nil :type vector)
+  (step nil :type vector)
+  (pending nil :type string))
+
+(defun erc-sasl--read-password (prompt)
+  "Return configured option or server password.
+PROMPT is passed to `read-passwd' if necessary."
+  (let* ((pass (alist-get 'password erc-sasl--options))
+         (found
+          (or (and (stringp pass) (not (string-empty-p pass)) pass)
+              (and erc-sasl-auth-source-function
+                   (let ((user (alist-get 'user erc-sasl--options))
+                         (host (or pass
+                                   (erc-networks--id-given erc-networks--id))))
+                     (apply erc-sasl-auth-source-function
+                            `(,@(and user (list :user user))
+                              ,@(and host (list :host (symbol-name host)))))))
+              erc-session-password)))
+    (if found
+        (copy-sequence found)
+      (read-passwd prompt))))
+
+(defun erc-sasl--plain-response (client steps)
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (sasl-plain-response client steps)))
+
+(declare-function erc-compat--sasl-scram--client-final-message "erc-compat"
+                  (hash-fun block-length hash-length client step))
+
+(defun erc-sasl--scram-sha-hack-client-final-message (&rest args)
+  ;; In the future (29+), we'll hopefully be able to call
+  ;; `sasl-scram--client-final-message' directly
+  (require 'erc-compat)
+  (let ((sasl-read-passphrase #'erc-sasl--read-password))
+    (apply #'erc-compat--sasl-scram--client-final-message args)))
+
+(defun erc-sasl--scram-sha-1-client-final-message (client step)
+  (erc-sasl--scram-sha-hack-client-final-message 'sha1 64 20 client step))
+
+(defun erc-sasl--scram-sha-256-client-final-message (client step)
+  (erc-sasl--scram-sha-hack-client-final-message 'sasl-scram-sha256 64 32
+                                                 client step))
+
+(defun erc-sasl--scram-sha512 (object &optional start end binary)
+  (secure-hash 'sha512 object start end binary))
+
+(defun erc-sasl--scram-sha-512-client-final-message (client step)
+  (erc-sasl--scram-sha-hack-client-final-message #'erc-sasl--scram-sha512
+                                                 128 64 client step))
+
+(defun erc-sasl--scram-sha-512-authenticate-server (client step)
+  (sasl-scram--authenticate-server #'erc-sasl--scram-sha512
+                                   128 64 client step))
+
+(defun erc-sasl--ecdsa-first (client _step)
+  "Return CLIENT name."
+  (sasl-client-name client))
+
+;; FIXME do this with gnutls somehow
+(defun erc-sasl--ecdsa-sign (client step)
+  "Return signed challenge for CLIENT and current STEP."
+  (let ((challenge (sasl-step-data step)))
+    (with-temp-buffer
+      (set-buffer-multibyte nil)
+      (insert challenge)
+      (call-process-region (point-min) (point-max)
+                           "openssl" 'delete t nil "pkeyutl" "-inkey"
+                           (sasl-client-property client 'ecdsa-keyfile)
+                           "-sign")
+      (buffer-string))))
+
+(pcase-dolist
+    (`(,name . ,steps)
+     '(("PLAIN"
+        erc-sasl--plain-response)
+       ("EXTERNAL"
+        ignore)
+       ("SCRAM-SHA-1"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-1-client-final-message
+        sasl-scram-sha-1-authenticate-server)
+       ("SCRAM-SHA-256"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-256-client-final-message
+        sasl-scram-sha-256-authenticate-server)
+       ("SCRAM-SHA-512"
+        erc-compat--sasl-scram-client-first-message
+        erc-sasl--scram-sha-512-client-final-message
+        erc-sasl--scram-sha-512-authenticate-server)
+       ("ECDSA-NIST256P-CHALLENGE"
+        erc-sasl--ecdsa-first
+        erc-sasl--ecdsa-sign)))
+  (let ((feature (intern (concat "erc-sasl-" (downcase name)))))
+    (put feature 'sasl-mechanism (sasl-make-mechanism name steps))
+    (provide feature)))
+
+(cl-defgeneric erc-sasl--create-client (mechanism)
+  "Create and return a new SASL client object for MECHANISM."
+  (let ((sasl-mechanism-alist (copy-sequence sasl-mechanism-alist))
+        (sasl-mechanisms sasl-mechanisms)
+        (name (upcase (symbol-name mechanism)))
+        (feature (intern (concat "erc-sasl-" (symbol-name mechanism))))
+        client)
+    (setf (alist-get name sasl-mechanism-alist nil nil #'equal) `(,feature))
+    (cl-pushnew name sasl-mechanisms :test #'equal)
+    (setq client (sasl-make-client (sasl-find-mechanism `(,name))
+                                   (or (alist-get 'user erc-sasl--options)
+                                       (erc-downcase (erc-current-nick)))
+                                   "N/A" "N/A"))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+(cl-defmethod erc-sasl--create-client ((_m (eql plain)))
+  "Create and return a new PLAIN client object."
+  ;; https://tools.ietf.org/html/rfc4616#section-2.
+  (let* ((sans (remq (assoc "PLAIN" sasl-mechanism-alist)
+                     sasl-mechanism-alist))
+         (sasl-mechanism-alist (cons '("PLAIN" erc-sasl-plain) sans))
+         (authc (or (alist-get 'user erc-sasl--options)
+                    (erc-downcase (erc-current-nick))))
+         (port (if (numberp erc-session-port)
+                   (number-to-string erc-session-port)
+                 "0"))
+         ;; In most cases, `erc-server-announced-name' won't be known.
+         (host (or erc-server-announced-name erc-session-server))
+         (mech (sasl-find-mechanism '("PLAIN")))
+         (client (sasl-make-client mech authc port host)))
+    (sasl-client-set-property client 'authenticator-name
+                              (alist-get 'authzid erc-sasl--options))
+    client))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-256)))
+  "Create and return a new SCRAM-SHA-256 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((m (eql scram-sha-512)))
+  "Create and return a new SCRAM-SHA-512 client."
+  (unless (featurep 'sasl-scram-sha256)
+    (user-error "SASL mechanism %s unsupported" m))
+  (cl-call-next-method))
+
+(cl-defmethod erc-sasl--create-client ((_ (eql ecdsa-nist256p-challenge)))
+  "Create and return a new ECDSA-NIST256P-CHALLENGE client."
+  (unless (executable-find "openssl")
+    (user-error "Could not find openssl command-line utility"))
+  (let ((keyfile (cdr (assq 'password erc-sasl--options))))
+    (unless (and keyfile (file-exists-p keyfile))
+      (user-error "`erc-sasl-password' does not point to ECDSA keyfile"))
+    (let ((client (cl-call-next-method)))
+      (sasl-client-set-property client 'ecdsa-keyfile keyfile)
+      client)))
+
+;; This stands alone because it's also used by bug#49860.
+(defun erc-sasl--init ()
+  ;; When reconnecting, try to recover stashed parameters.
+  (let ((existing (assoc erc-networks--id erc-sasl--session-options
+                         #'erc-networks--id-equal-p)))
+    ;; This likely only runs when `erc' was called with an :id keyword.
+    (when (and existing (not erc--server-reconnecting))
+      (setq erc-sasl--session-options (delq existing erc-sasl--session-options)
+            existing nil))
+    (setq erc-sasl--state (make-erc-sasl--state)
+          erc-sasl--options (or (cdr existing)
+                                `((user . ,erc-sasl-user)
+                                  (password . ,erc-sasl-password)
+                                  (mechanism . ,erc-sasl-mechanism)
+                                  (authzid . ,erc-sasl-authzid))))))
+
+(defun erc-sasl--on-connection-established (&rest _)
+  (setf (alist-get erc-networks--id erc-sasl--session-options nil nil
+                   #'erc-networks--id-equal-p)
+        erc-sasl--options))
+
+(defun erc-sasl--mechanism-offered-p (offered)
+  "Return non-nil when OFFERED appears among a list of mechanisms."
+  (string-match-p (rx-to-string
+                   `(: (| bot ",")
+                       ,(symbol-name
+                         (alist-get 'mechanism erc-sasl--options))
+                       (| eot ",")))
+                  (downcase offered)))
+
+(defun erc-sasl--authenticate-handler (_proc parsed)
+  "Handle PARSED `erc-response' from server.
+Maybe transition to next state."
+  (if-let* ((response (car (erc-response.command-args parsed)))
+            ((= 400 (length response))))
+      (cl-callf (lambda (s) (concat s response))
+          (erc-sasl--state-pending erc-sasl--state))
+    (cl-assert response t)
+    (when (string= "+" response)
+      (setq response ""))
+    (setf response (base64-decode-string
+                    (concat (erc-sasl--state-pending erc-sasl--state) response))
+          (erc-sasl--state-pending erc-sasl--state) nil)
+    ;; The server is done sending, so our turn
+    (let ((client (erc-sasl--state-client erc-sasl--state))
+          (step (erc-sasl--state-step erc-sasl--state))
+          data)
+      (when step
+        (sasl-step-set-data step response))
+      (setq step (setf (erc-sasl--state-step erc-sasl--state)
+                       (sasl-next-step client step))
+            data (sasl-step-data step))
+      (when (string= data "")
+        (setq data nil))
+      (when data
+        (setq data (base64-encode-string data t)))
+      ;; No need for : because no spaces (right?)
+      (erc-server-send (concat "AUTHENTICATE " (or data "+"))))))
+
+(erc-define-catalog
+ 'english
+ '((s902 . "ERR_NICKLOCKED nick %n unavailable: %s")
+   (s904 . "ERR_SASLFAIL (authentication failed) %s")
+   (s905 . "ERR SASLTOOLONG (credentials too long) %s")
+   (s906 . "ERR_SASLABORTED (authentication aborted) %s")
+   (s907 . "ERR_SASLALREADY (already authenticated) %s")
+   (s908 . "RPL_SASLMECHS (unsupported mechanism %m) %s")))
+
+(define-erc-module sasl nil
+  "Non-IRCv3 SASL support for ERC.
+This doesn't solicit or validate a suite of supported mechanisms."
+  ;; See bug#49860 for a full, CAP 3.2-aware implementation, currently
+  ;; a WIP as of ERC 5.5.
+  ((unless erc--target
+     (add-hook 'erc-server-AUTHENTICATE-functions
+               #'erc-sasl--authenticate-handler 0 t)
+     (erc-sasl--init)
+     (let* ((mech (alist-get 'mechanism erc-sasl--options))
+            (client (erc-sasl--create-client mech)))
+       (unless client
+         (erc-display-error-notice nil (format "Unknown mechanism: %s" mech))
+         (erc-error "Unknown mechanism: %s" mech))
+       (setf (erc-sasl--state-client erc-sasl--state) client))))
+  ((remove-hook 'erc-server-AUTHENTICATE-functions
+                #'erc-sasl--authenticate-handler t)
+   (kill-local-variable 'erc-sasl--options))
+  'local)
+
+;; FIXME use generic mechanism instead of hooks after bug#49860.
+(define-erc-response-handler (AUTHENTICATE)
+  "Maybe authenticate to server." nil)
+
+(defun erc-sasl--destroy (proc)
+  (run-hook-with-args 'erc-quit-hook proc)
+  (delete-process proc)
+  (erc-error "Disconnected from %s; please review SASL settings" proc))
+
+(define-erc-response-handler (902)
+  "Handle a ERR_NICKLOCKED response." nil
+  (erc-display-message parsed '(notice error) 'active 's902
+                       ?n (car (erc-response.command-args parsed))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(define-erc-response-handler (903)
+  "Handle a RPL_SASLSUCCESS response." nil
+  (when erc-sasl-mode
+    (unless erc-server-connected
+      (erc-server-send "CAP END")))
+  (add-hook 'erc-after-connect #'erc-sasl--on-connection-established 0 t)
+  (erc-handle-unknown-server-response proc parsed))
+
+(define-erc-response-handler (907)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's907
+                       ?s (erc-response.contents parsed)))
+
+(define-erc-response-handler (904 905 906)
+  "Handle various SASL-related error responses." nil
+  (erc-display-message parsed '(notice error) 'active
+                       (intern (format "s%s" (erc-response.command parsed)))
+                       ?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(define-erc-response-handler (908)
+  "Handle a RPL_SASLALREADY response." nil
+  (erc-display-message parsed '(notice error) 'active 's908
+                       '?m (alist-get 'mechanism erc-sasl--options)
+                       '?s (erc-response.contents parsed))
+  (erc-sasl--destroy proc))
+
+(cl-defmethod erc--register-connection (&context (erc-sasl-mode (eql t)))
+  "Send speculative/pipelined CAP and AUTHENTICATE and hope for the best."
+  (erc-server-send "CAP REQ :sasl")
+  (erc-login)
+  (let* ((c (erc-sasl--state-client erc-sasl--state))
+         (m (sasl-mechanism-name (sasl-client-mechanism c))))
+    (erc-server-send (format "AUTHENTICATE %s" m))))
+
+(provide 'erc-sasl)
+;;; erc-sasl.el ends here
+;;
+;; Local Variables:
+;; generated-autoload-file: "erc-loaddefs.el"
+;; End:
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 6c9d4de2ba..a703f903ec 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1846,6 +1846,7 @@ erc-modules
     (const :tag "readonly: Make displayed lines read-only" readonly)
     (const :tag "replace: Replace text in messages" replace)
     (const :tag "ring: Enable an input history" ring)
+    (const :tag "sasl: Enable SASL authentication" sasl)
     (const :tag "scrolltobottom: Scroll to the bottom of the buffer"
            scrolltobottom)
     (const :tag "services: Identify to Nickserv (IRC Services) automatically"
@@ -1870,10 +1871,7 @@ erc-update-modules
 introduced in ERC 5.5."
   (let ((local-modes
          (when (and defer-locals (derived-mode-p 'erc-mode))
-           (delq nil (mapcar
-                      (lambda (m)
-                        (and (string-prefix-p "erc-" (symbol-name m)) m))
-                      local-minor-modes)))))
+           (erc-compat--local-minor-modes))))
     (dolist (module erc-modules (and defer-locals local-modes))
       (require (or (alist-get module erc--modules-to-features)
                    (intern (concat "erc-" (symbol-name module))))
diff --git a/test/lisp/erc/erc-sasl-tests.el b/test/lisp/erc/erc-sasl-tests.el
new file mode 100644
index 0000000000..81db9ad948
--- /dev/null
+++ b/test/lisp/erc/erc-sasl-tests.el
@@ -0,0 +1,319 @@
+;;; erc-sasl-tests.el --- Tests for erc-sasl.  -*- lexical-binding:t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; GNU Emacs is free software: you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation, either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GNU Emacs is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with GNU Emacs.  If not, see <https://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;;; Code:
+
+(require 'ert-x)
+(require 'erc-sasl)
+
+(ert-deftest erc-sasl--mechanism-offered-p ()
+  (let ((erc-sasl--options '((mechanism . external))))
+    (should (erc-sasl--mechanism-offered-p "foo,external"))
+    (should (erc-sasl--mechanism-offered-p "external,bar"))
+    (should (erc-sasl--mechanism-offered-p "foo,external,bar"))
+    (should-not (erc-sasl--mechanism-offered-p "fooexternal"))
+    (should-not (erc-sasl--mechanism-offered-p "externalbar"))))
+
+(ert-deftest erc-sasl--read-password ()
+  (ert-info ("Explicit erc-sasl-password")
+    (let ((erc-sasl--options '((password . "foo"))))
+      (should (string= (erc-sasl--read-password nil) "foo"))))
+
+  (ert-info ("Fallback to erc-session-password")
+    (let ((erc-session-password "bar")
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar")))
+    (let ((erc-session-password "bar")
+          (erc-sasl--options '((user . "tester") (password)))
+          (erc-networks--id (erc-networks--id-create nil)))
+      (should (string= (erc-sasl--read-password nil) "bar"))))
+
+  (let* ((entries (list
+                   "machine FSF.chat port 6697 user bob password sesame"
+                   ;; This must come *after* ^, else *1 (below) always passes
+                   "machine GNU/chat port 6697 user bob password spam"
+                   "machine MyHost port irc password 123"))
+         (netrc-file (make-temp-file "auth-source-test" nil nil
+                                     (mapconcat 'identity entries "\n")))
+         (auth-sources (list netrc-file))
+         (erc-session-server "irc.gnu.org")
+         (erc-session-port 6697)
+         (erc-networks--id (erc-networks--id-create nil))
+         ;;
+         (erc-sasl-auth-source-function #'erc--auth-source-search)
+         erc-server-announced-name ; too early
+         auth-source-do-cache)
+
+    (unwind-protect
+        (ert-info ("Auth source")
+
+          (ert-info ("Symbol as password specifies machine")
+            (let ((erc-sasl--options '((user . "bob")
+                                       (password . FSF.chat)))
+                  (erc-networks--id (make-erc-networks--id)))
+              (should (string= (erc-sasl--read-password nil) "sesame"))))
+
+          (ert-info ("Use session ID when password empty") ; *1
+            (let ((erc-sasl--options '((user . "bob") (password)))
+                  (erc-networks--id (erc-networks--id-create 'GNU/chat)))
+              (should (string= (erc-sasl--read-password nil) "spam")))))
+
+      (delete-file netrc-file))
+
+    (ert-info ("Prompt when search fails and server password null")
+      (let ((erc-sasl-auth-source-function #'ignore))
+        (should (string= (ert-simulate-keys "baz\r"
+                           (erc-sasl--read-password "pwd:"))
+                         "baz"))))))
+
+(ert-deftest erc-sasl-create-client--plain ()
+  (let* ((erc-session-password "password123")
+         (erc-server-current-nick "tester")
+         (erc-session-port 1667)
+         (erc-session-server "localhost")
+         (client (erc-sasl--create-client 'plain))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [erc-sasl--plain-response
+                                 "\0tester\0password123"])
+                   (format "%S" result)))
+    (should (string= (sasl-step-data result) "\0tester\0password123"))
+    (should-not (sasl-next-step client result)))
+  (should (equal (assoc-default "PLAIN" sasl-mechanism-alist) '(sasl-plain))))
+
+(ert-deftest erc-sasl-create-client--external ()
+  (let* ((erc-server-current-nick "tester")
+         (client (erc-sasl--create-client 'external))
+         (result (sasl-next-step client nil)))
+    (should (equal (format "%S" [ignore nil]) (format "%S" result)))
+    (should-not (sasl-step-data result))
+    (should-not (sasl-next-step client result)))
+  (should-not (member "EXTERNAL" sasl-mechanisms))
+  (should-not (assoc-default "EXTERNAL" sasl-mechanism-alist)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-1 ()
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-1))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                          "s=5mJO6d4rjCnsBU1X,"
+                          "i=4096"))
+            (req (concat "c=bixhPWppbGxlcyw=,"
+                         "r=c5RqLCZy0L4fGkKAZ0hujFBsXQoKcivqCw9iDZPSpb,"
+                         "p=OVUhgPu8wEm2cDoVLfaHzVUYPWU=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-1-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=ZWR23c9MJir0ZgfGf5jEtLOn6Ng="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256 ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (erc-sasl--options '((authzid . "jilles")))
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,a=jilles,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                   "s=MTk2M2VkMzM5ZmU0NDRiYmI0MzIyOGVhN2YwNzYwNmI=,"
+                   "i=4096"))
+            (req (concat
+                  "c=bixhPWppbGxlcyw=,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBse697140729d8445fb95ec94ceacb14b3,"
+                  "p=1vDesVBzJmv0lX0Ae1kHFtdVHkC6j4gISKVqaR45HFg=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=gUePTYSZN9xgcE06KSyKO9fUmSwH26qifoapXyEs75s="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-256--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-256))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                   "s=ZTg1MmE1YmFhZGI1NDcyMjk3NzYwZmRjZDM3Y2I1OTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBsd4067f0afdb54c3dbd4fe645b84cae37,"
+                  "p=LP4sjJrjJKp5qTsARyZCppXpKLu4FMM284hNESPvGhI=")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format "%S"
+                               `[erc-sasl--scram-sha-256-client-final-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp "v=847WXfnmReGyE1qlq1And6R4bPBNROTZ7EMS/QrJtUM="))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(ert-deftest erc-sasl-create-client--scram-sha-512--no-authzid ()
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha512"))
+  (let* ((erc-server-current-nick "jilles")
+         (erc-session-password "sesame")
+         (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+         (sasl-unique-id-function (lambda () (pop mock-rvs)))
+         (client (erc-sasl--create-client 'scram-sha-512))
+         (step (sasl-next-step client nil)))
+    (ert-info ("Client's initial request")
+      (let ((req "n,,n=jilles,r=c5RqLCZy0L4fGkKAZ0hujFBs"))
+        (should (equal (format "%S"
+                               `[erc-compat--sasl-scram-client-first-message
+                                 ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's initial response")
+      (let ((resp (concat
+                   "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                   "s=YzMzOWZiY2U0YzcwNDA0M2I4ZGE2M2ZjOTBjODExZTM=,"
+                   "i=4096"))
+            (req (concat
+                  "c=biws,"
+                  "r=c5RqLCZy0L4fGkKAZ0hujFBs54c592745ce14e559fcc3f27b15464f6,"
+                  "p=vMBb9tKxFAfBtel087/GLbo4objAIYr1wM+mFv/jYLKXE"
+                  "NUF0vynm81qQbywQE5ScqFFdAfwYMZq/lj4s0V1OA==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should (equal (format
+                        "%S" `[erc-sasl--scram-sha-512-client-final-message
+                               ,req])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) req))))
+    (ert-info ("Server's final message")
+      (let ((resp (concat "v=Va7NIvt8wCdhvxnv+bZriSxGoto6On5EVnRHO/ece8zs0"
+                          "qpQassdqir1Zlwh3e3EmBq+kcSy+ClNCsbzBpXe/w==")))
+        (sasl-step-set-data step resp)
+        (setq step (sasl-next-step client step))
+        (should-not (sasl-step-data step)))))
+  (should (eq sasl-unique-id-function #'sasl-unique-id-function)))
+
+(defconst erc-sasl-tests-ecdsa-key-file "
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIIJueQ3W2IrGbe9wKdOI75yGS7PYZSj6W4tg854hlsvmoAoGCCqGSM49
+AwEHoUQDQgAEAZmaVhNSMmV5r8FXPvKuMnqDKyIA9pDHN5TNMfiF3mMeikGgK10W
+IRX9cyi2wdYg9mUUYyh9GKdBCYHGUJAiCA==
+-----END EC PRIVATE KEY-----
+")
+
+(ert-deftest erc-sasl-create-client-ecdsa ()
+  :tags '(:unstable)
+  ;; This is currently useless because it just roundtrips shelling out
+  ;; to pkeyutl.
+  (ert-skip "Placeholder")
+  (unless (executable-find "openssl")
+    (ert-skip "System lacks openssl"))
+  (ert-with-temp-file keyfile
+    :prefix "ecdsa_key"
+    :suffix ".pem"
+    :text erc-sasl-tests-ecdsa-key-file
+    (let* ((erc-server-current-nick "jilles")
+           (erc-sasl--options `((password . ,keyfile)))
+           (client (erc-sasl--create-client 'ecdsa-nist256p-challenge))
+           (step (sasl-next-step client nil)))
+      (ert-info ("Client's initial request")
+        (should (equal (format "%S" [erc-sasl--ecdsa-first "jilles"])
+                       (format "%S" step)))
+        (should (string= (sasl-step-data step) "jilles")))
+      (ert-info ("Server's initial response")
+        (let ((resp (concat "\0\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20"
+                            "\21\22\23\24\25\26\27\30\31\32\33\34\35\36\37")))
+          (sasl-step-set-data step resp)
+          (setq step (sasl-next-step client step))
+          (ert-with-temp-file sigfile
+            :prefix "ecdsa_sig"
+            :suffix ".sig"
+            :text (sasl-step-data step)
+            (with-temp-buffer
+              (set-buffer-multibyte nil)
+              (insert resp)
+              (let ((ec (call-process-region
+                         (point-min) (point-max)
+                         "openssl" 'delete t nil "pkeyutl"
+                         "-inkey" keyfile "-sigfile" sigfile
+                         "-verify")))
+                (unless (zerop ec)
+                  (message "%s" (buffer-string)))
+                (should (zerop ec)))))))
+      (should-not (sasl-next-step client step)))))
+
+;;; erc-sasl-tests.el ends here
diff --git a/test/lisp/erc/erc-scenarios-sasl.el b/test/lisp/erc/erc-scenarios-sasl.el
new file mode 100644
index 0000000000..7970e65ec2
--- /dev/null
+++ b/test/lisp/erc/erc-scenarios-sasl.el
@@ -0,0 +1,208 @@
+;;; erc-scenarios-sasl.el --- SASL tests for ERC -*- lexical-binding: t -*-
+
+;; Copyright (C) 2022 Free Software Foundation, Inc.
+;;
+;; This file is part of GNU Emacs.
+;;
+;; This program is free software: you can redistribute it and/or
+;; modify it under the terms of the GNU General Public License as
+;; published by the Free Software Foundation, either version 3 of the
+;; License, or (at your option) any later version.
+;;
+;; This program is distributed in the hope that it will be useful, but
+;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;; General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program.  If not, see
+;; <https://www.gnu.org/licenses/>.
+
+;;; Code:
+
+(require 'ert-x)
+(eval-and-compile
+  (let ((load-path (cons (ert-resource-directory) load-path)))
+    (require 'erc-scenarios-common)))
+
+(declare-function sasl-client-name "sasl" (client))
+
+(require 'erc-scenarios-common)
+(require 'erc-sasl)
+
+(ert-deftest erc-scenarios-sasl--plain ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'plain)
+       (erc-sasl-password "password123")
+       (erc-sasl--session-options nil)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "This server is in debug mode")
+        ;; Regression "\0\0\0\0 ..." caused by (fillarray passphrase 0)
+        (should (string= erc-sasl-password "password123"))))))
+
+;; This is meant to assert `erc-update-modules' and local-module
+;; behavior generally.  It only exists here for convenience because as
+;; of ERC 5.5, `sasl' is the only local module.
+(ert-deftest erc-scenarios-sasl--local-modules-reconnect ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain 'plain))
+       (port (process-contact dumb-server :service))
+       (erc-sasl--session-options nil)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect with options let-bound")
+      (with-current-buffer
+          ;; This won't work unless the library is already loaded
+          (let ((erc-modules (cons 'sasl erc-modules))
+                (erc-sasl-mechanism 'plain)
+                (erc-sasl-password "password123"))
+            (erc :server "127.0.0.1"
+                 :port port
+                 :nick "tester"
+                 :user "tester"
+                 :full-name "tester"))
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (with-current-buffer (erc-d-t-wait-for 10 (get-buffer "ExampleOrg"))
+      (ert-info ("First connection succeeds")
+        (funcall expect 10 "This server is in debug mode")
+        (erc-cmd-QUIT "")
+        (funcall expect 10 "finished"))
+
+      (should-not erc-sasl-password) ; obviously
+      (should-not (memq 'sasl erc-modules))
+
+      (erc-d-t-wait-for 10 (not (erc-server-process-alive)))
+      (erc-cmd-RECONNECT)
+      (ert-info ("Second connection succeeds")
+        (funcall expect 10 "This server is in debug mode")
+        (erc-cmd-QUIT "")
+        (funcall expect 10 "finished")))))
+
+(ert-deftest erc-scenarios-sasl--external ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'external))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-mechanism 'external)
+       (erc-sasl--session-options nil)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "tester"
+                                :user "tester"
+                                :full-name "tester")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "ExampleOrg"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "ExampleOrg"
+        (funcall expect 10 "903 * Authentication successful")
+        (funcall expect 10 "This server is in debug mode")))))
+
+(ert-deftest erc-scenarios-sasl--plain-fail ()
+  :tags '(:expensive-test)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t 'plain-failed))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "wrong")
+       (erc-sasl-mechanism 'plain)
+       (erc-sasl--session-options nil)
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter))
+       (buf nil))
+
+    (ert-info ("Connect")
+      (setq buf (erc :server "127.0.0.1"
+                     :port port
+                     :nick "tester"
+                     :user "tester"
+                     :full-name "tester"))
+      (let ((err (should-error
+                  (with-current-buffer buf
+                    (funcall expect 20 "Connection failed!")))))
+        (should (string-search "please review" (cadr err)))
+        (with-current-buffer buf
+          (funcall expect 10 "Opening connection")
+          (funcall expect 20 "SASL authentication failed")
+          (should-not (erc-server-process-alive)))))))
+
+(defun erc-scenarios--common--sasl (mech)
+  (erc-scenarios-common-with-cleanup
+      ((erc-scenarios-common-dialog "sasl")
+       (erc-d-linger-secs 0.5)
+       (erc-server-flood-penalty 0.1)
+       (dumb-server (erc-d-run "localhost" t mech))
+       (port (process-contact dumb-server :service))
+       (erc-modules (cons 'sasl erc-modules))
+       (erc-sasl-password "sesame")
+       (erc-sasl-mechanism mech)
+       (erc-sasl--session-options nil)
+       (mock-rvs (list "c5RqLCZy0L4fGkKAZ0hujFBs" ""))
+       (sasl-unique-id-function (lambda () (pop mock-rvs)))
+       (inhibit-message noninteractive)
+       (expect (erc-d-t-make-expecter)))
+
+    (ert-info ("Connect")
+      (with-current-buffer (erc :server "127.0.0.1"
+                                :port port
+                                :nick "jilles"
+                                :full-name "jilles")
+        (should (string= (buffer-name) (format "127.0.0.1:%d" port)))))
+
+    (erc-d-t-wait-for 10 "server buffer ready" (get-buffer "jaguar"))
+
+    (ert-info ("Notices received")
+      (with-current-buffer "jaguar"
+        (funcall expect 10 "Found your hostname")
+        (funcall expect 20 "marked as being away")))))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-1 ()
+  :tags '(:expensive-test)
+  (let ((erc-sasl-authzid "jilles"))
+    (erc-scenarios--common--sasl 'scram-sha-1)))
+
+(ert-deftest erc-scenarios-sasl--scram-sha-256 ()
+  :tags '(:expensive-test)
+  (unless (featurep 'sasl-scram-sha256)
+    (ert-skip "Emacs lacks sasl-scram-sha256"))
+  (erc-scenarios--common--sasl 'scram-sha-256))
+
+;;; erc-scenarios-sasl.el ends here
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index d074b36c8b..91815b8fae 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -1004,8 +1004,13 @@ erc-update-modules
         (with-temp-buffer
           (erc-mode)
           (setq erc-modules '(completion autojoin networks))
-          (let ((local-minor-modes '(font-lock-mode erc-fake-bar-mode)))
-            (should (equal (erc-update-modules t) '(erc-fake-bar-mode))))
+          (if (< 27 emacs-major-version)
+              (let ((local-minor-modes '(font-lock-mode erc-fake-bar-mode)))
+                (should (equal (erc-update-modules t) '(erc-fake-bar-mode))))
+            (cl-letf (((symbol-function 'buffer-local-variables)
+                       (lambda (&rest _) '((font-lock-mode)
+                                           (erc-fake-bar-mode)))))
+              (should (equal (erc-update-modules t) '(erc-fake-bar-mode)))))
           (should (equal (nreverse calls)
                          '( erc-pcomplete (completion . 1)
                             erc-join (autojoin . 1)
diff --git a/test/lisp/erc/resources/sasl/external.eld b/test/lisp/erc/resources/sasl/external.eld
new file mode 100644
index 0000000000..2cd237ec4d
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/external.eld
@@ -0,0 +1,33 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester"))
+
+((auth-req 3.2 "AUTHENTICATE EXTERNAL")
+ (0.0 ":irc.example.org CAP * ACK :sasl")
+ (0.0 "AUTHENTICATE +"))
+
+((auth-noop 3.2 "AUTHENTICATE +")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
diff --git a/test/lisp/erc/resources/sasl/plain-failed.eld b/test/lisp/erc/resources/sasl/plain-failed.eld
new file mode 100644
index 0000000000..336700290c
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain-failed.eld
@@ -0,0 +1,16 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.foonet.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.foonet.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.foonet.org CAP * ACK :cap-notify sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.foonet.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgB3cm9uZw==")
+ (0.0 ":irc.foonet.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.foonet.org 904 * :SASL authentication failed: Invalid account credentials"))
+
+((cap-end 3.2 "CAP END"))
diff --git a/test/lisp/erc/resources/sasl/plain.eld b/test/lisp/erc/resources/sasl/plain.eld
new file mode 100644
index 0000000000..1341cd78e5
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/plain.eld
@@ -0,0 +1,39 @@
+;; -*- mode: lisp-data; -*-
+((cap-req 10 "CAP REQ :sasl"))
+((nick 1 "NICK tester"))
+((user 1 "USER tester 0 * :tester")
+ (0.0 ":irc.example.org NOTICE * :*** Looking up your hostname...")
+ (0.0 ":irc.example.org NOTICE * :*** Found your hostname")
+ (0.0 ":irc.example.org CAP * ACK :sasl"))
+
+((authenticate-plain 3.2 "AUTHENTICATE PLAIN")
+ (0.0 ":irc.example.org AUTHENTICATE +"))
+
+((authenticate-gimme 3.2 "AUTHENTICATE AHRlc3RlcgBwYXNzd29yZDEyMw==")
+ (0.0 ":irc.example.org 900 * * tester :You are now logged in as tester")
+ (0.0 ":irc.example.org 903 * :Authentication successful"))
+
+((cap-end 3.2 "CAP END")
+ (0.0 ":irc.example.org 001 tester :Welcome to the ExampleOrg IRC Network tester")
+ (0.01 ":irc.example.org 002 tester :Your host is irc.example.org, running version oragono-2.6.1")
+ (0.01 ":irc.example.org 003 tester :This server was created Sat, 17 Jul 2021 09:06:42 UTC")
+ (0.01 ":irc.example.org 004 tester irc.example.org oragono-2.6.1 BERTZios CEIMRUabefhiklmnoqstuv Iabefhkloqv")
+ (0.0 ":irc.example.org 005 tester AWAYLEN=200 BOT=B CASEMAPPING=ascii CHANLIMIT=#:100 CHANMODES=Ibe,k,fl,CEMRUimnstu CHANNELLEN=64 CHANTYPES=# ELIST=U EXCEPTS EXTBAN=,m FORWARD=f INVEX KICKLEN=390 :are supported by this server")
+ (0.01 ":irc.example.org 005 tester MAXLIST=beI:60 MAXTARGETS=4 MODES MONITOR=100 NETWORK=ExampleOrg NICKLEN=32 PREFIX=(qaohv)~&@%+ STATUSMSG=~&@%+ TARGMAX=NAMES:1,LIST:1,KICK:1,WHOIS:1,USERHOST:10,PRIVMSG:4,TAGMSG:4,NOTICE:4,MONITOR:100 TOPICLEN=390 UTF8MAPPING=rfc8265 UTF8ONLY :are supported by this server")
+ (0.01 ":irc.example.org 005 tester draft/CHATHISTORY=100 :are supported by this server")
+ (0.0 ":irc.example.org 251 tester :There are 1 users and 0 invisible on 1 server(s)")
+ (0.0 ":irc.example.org 252 tester 0 :IRC Operators online")
+ (0.0 ":irc.example.org 253 tester 0 :unregistered connections")
+ (0.0 ":irc.example.org 254 tester 0 :channels formed")
+ (0.0 ":irc.example.org 255 tester :I have 1 clients and 0 servers")
+ (0.0 ":irc.example.org 265 tester 1 1 :Current local users 1, max 1")
+ (0.21 ":irc.example.org 266 tester 1 1 :Current global users 1, max 1")
+ (0.0 ":irc.example.org 422 tester :MOTD File is missing"))
+
+((mode-user 1.2 "MODE tester +i")
+ (0.0 ":irc.example.org 221 tester +Zi")
+ (0.0 ":irc.example.org NOTICE tester :This server is in debug mode and is logging all user I/O. If you do not wish for everything you send to be readable by the server owner(s), please disconnect."))
+
+((quit 5 "QUIT :\2ERC\2")
+ (0 ":tester!~u@yuvqisyu7m7qs.irc QUIT :Quit"))
+((drop 1 DROP))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-1.eld b/test/lisp/erc/resources/sasl/scram-sha-1.eld
new file mode 100644
index 0000000000..49980e9e12
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-1.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-1")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE bixhPWppbGxlcyxuPWppbGxlcyxyPWM1UnFMQ1p5MEw0ZkdrS0FaMGh1akZCcw==")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNYUW9LY2l2cUN3OWlEWlBTcGIscz01bUpPNmQ0cmpDbnNCVTFYLGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXhoUFdwcGJHeGxjeXc9LHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzWFFvS2NpdnFDdzlpRFpQU3BiLHA9T1ZVaGdQdTh3RW0yY0RvVkxmYUh6VlVZUFdVPQ==")
+ (0 "AUTHENTICATE dj1aV1IyM2M5TUppcjBaZ2ZHZjVqRXRMT242Tmc9"))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
diff --git a/test/lisp/erc/resources/sasl/scram-sha-256.eld b/test/lisp/erc/resources/sasl/scram-sha-256.eld
new file mode 100644
index 0000000000..74de9a23ec
--- /dev/null
+++ b/test/lisp/erc/resources/sasl/scram-sha-256.eld
@@ -0,0 +1,47 @@
+;;; -*- mode: lisp-data -*-
+((cap-req 5.2 "CAP REQ :sasl"))
+((nick 10 "NICK jilles"))
+((user 10 "USER user 0 * :jilles")
+ (0 "NOTICE AUTH :*** Processing connection to jaguar.test")
+ (0 "NOTICE AUTH :*** Looking up your hostname...")
+ (0 "NOTICE AUTH :*** Checking Ident")
+ (0 "NOTICE AUTH :*** No Ident response")
+ (0 "NOTICE AUTH :*** Found your hostname")
+ (0 ":jaguar.test CAP jilles ACK :sasl"))
+
+((auth-init 10 "AUTHENTICATE SCRAM-SHA-256")
+ (0 "AUTHENTICATE +"))
+
+((auth-challenge 10 "AUTHENTICATE biwsbj1qaWxsZXMscj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnM=")
+ (0 "AUTHENTICATE cj1jNVJxTENaeTBMNGZHa0tBWjBodWpGQnNkNDA2N2YwYWZkYjU0YzNkYmQ0ZmU2NDViODRjYWUzNyxzPVpUZzFNbUUxWW1GaFpHSTFORGN5TWprM056WXdabVJqWkRNM1kySTFPVE09LGk9NDA5Ng=="))
+
+((auth-final 10 "AUTHENTICATE Yz1iaXdzLHI9YzVScUxDWnkwTDRmR2tLQVowaHVqRkJzZDQwNjdmMGFmZGI1NGMzZGJkNGZlNjQ1Yjg0Y2FlMzcscD1MUDRzakpyakpLcDVxVHNBUnlaQ3BwWHBLTHU0Rk1NMjg0aE5FU1B2R2hJPQ==")
+ (0 "AUTHENTICATE dj04NDdXWGZubVJlR3lFMXFscTFBbmQ2UjRiUEJOUk9UWjdFTVMvUXJKdFVNPQ=="))
+
+((auth-done 10 "AUTHENTICATE +")
+ (0 ":jaguar.test 900 jilles jilles!jilles@localhost.stack.nl jilles :You are now logged in as jilles")
+ (0 ":jaguar.test 903 jilles :SASL authentication successful"))
+
+((cap-end 10.2 "CAP END")
+ (0 ":jaguar.test 001 jilles :Welcome to the jaguar IRC Network jilles!~jilles@127.0.0.1")
+ (0 ":jaguar.test 002 jilles :Your host is jaguar.test, running version InspIRCd-3")
+ (0 ":jaguar.test 003 jilles :This server was created 09:44:05 Dec 24 2020")
+ (0 ":jaguar.test 004 jilles jaguar.test InspIRCd-3 BILRSWcghiorswz ABEFHIJLMNOQRSTXYabcefghijklmnopqrstuvz :BEFHIJLXYabefghjkloqv")
+ (0 ":jaguar.test 005 jilles ACCEPT=30 AWAYLEN=200 BOT=B CALLERID=g CASEMAPPING=rfc1459 CHANLIMIT=#:120 CHANMODES=IXbeg,k,BEFHJLfjl,AMNOQRSTcimnprstuz CHANNELLEN=64 CHANTYPES=# ELIST=CMNTU ESILENCE=CcdiNnPpTtx EXCEPTS=e :are supported by this server")
+ (0 ":jaguar.test 005 jilles EXTBAN=,ANOQRSTUacmnprz HOSTLEN=64 INVEX=I KEYLEN=32 KICKLEN=255 LINELEN=512 MAXLIST=I:100,X:100,b:100,e:100,g:100 MAXTARGETS=20 MODES=20 MONITOR=30 NAMELEN=128 NAMESX NETWORK=jaguar :are supported by this server")
+ (0 ":jaguar.test 005 jilles NICKLEN=31 PREFIX=(Yqaohv)!~&@%+ REMOVE SAFELIST SECURELIST=60 SILENCE=32 STATUSMSG=!~&@%+ TOPICLEN=307 UHNAMES USERIP USERLEN=11 USERMODES=,,s,BILRSWcghiorwz WATCH=30 :are supported by this server")
+ (0 ":jaguar.test 005 jilles :are supported by this server")
+ (0 ":jaguar.test 251 jilles :There are 740 users and 108 invisible on 11 servers")
+ (0 ":jaguar.test 252 jilles 10 :operator(s) online")
+ (0 ":jaguar.test 254 jilles 373 :channels formed")
+ (0 ":jaguar.test 255 jilles :I have 28 clients and 1 servers")
+ (0 ":jaguar.test 265 jilles :Current local users: 28  Max: 29")
+ (0 ":jaguar.test 266 jilles :Current global users: 848  Max: 879")
+ (0 ":jaguar.test 375 jilles :jaguar.test message of the day")
+ (0 ":jaguar.test 372 jilles :   ~~ some message of the day ~~")
+ (0 ":jaguar.test 372 jilles :   ~~ or rkpryyrag gb rnpu bgure ~~")
+ (0 ":jaguar.test 376 jilles :End of message of the day."))
+
+((mode-user 1.2 "MODE jilles +i")
+ (0 ":jilles!~jilles@127.0.0.1 MODE jilles :+ri")
+ (0 ":jaguar.test 306 jilles :You have been marked as being away"))
-- 
2.38.1


^ permalink raw reply related	[flat|nested] 54+ messages in thread

* bug#29108: 25.3; ERC SASL support
       [not found]             ` <87o7taoohd.fsf@neverwas.me>
@ 2022-11-14  6:45               ` J.P.
  2022-11-14 15:20                 ` J.P.
       [not found]                 ` <87y1sdk1fg.fsf@neverwas.me>
  0 siblings, 2 replies; 54+ messages in thread
From: J.P. @ 2022-11-14  6:45 UTC (permalink / raw)
  To: 29108; +Cc: emacs-erc, bandali

[-- Attachment #1: Type: text/plain, Size: 287 bytes --]

"J.P." <jp@neverwas.me> writes:

> v6. Added some sweeping changes that are still pretty raw, which
> probably means a delay of a couple days, at least. Apologies for the
> hold up.

v7. Fixed some sloppiness involving mode activation. Restored misplaced
compat hunk to rightful patch.


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0000-v6-v7.diff --]
[-- Type: text/x-patch, Size: 11828 bytes --]

From ba6fae5c2851e2926e20e21c8dc962977c94987a Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 13 Nov 2022 22:38:13 -0800
Subject: [PATCH 0/5] *** NOT A PATCH ***

*** BLURB HERE ***

F. Jason Park (5):
  Add GS2 authorization to sasl-scram-rfc
  Don't set erc-networks--id until network is known
  Support local ERC modules in erc-mode buffers
  Call erc-login indirectly via new generic wrapper
  Add non-IRCv3 SASL module to ERC

 doc/misc/erc.texi                             | 148 +++++-
 etc/ERC-NEWS                                  |  21 +-
 lisp/erc/erc-backend.el                       |  15 +-
 lisp/erc/erc-common.el                        |  56 ++-
 lisp/erc/erc-compat.el                        | 116 +++++
 lisp/erc/erc-goodies.el                       |   1 +
 lisp/erc/erc-networks.el                      |  39 +-
 lisp/erc/erc-sasl.el                          | 433 ++++++++++++++++++
 lisp/erc/erc.el                               |  85 ++--
 lisp/net/sasl-scram-rfc.el                    |  21 +-
 test/lisp/erc/erc-sasl-tests.el               | 319 +++++++++++++
 test/lisp/erc/erc-scenarios-sasl.el           | 208 +++++++++
 test/lisp/erc/erc-tests.el                    |  63 +++
 test/lisp/erc/resources/sasl/external.eld     |  33 ++
 test/lisp/erc/resources/sasl/plain-failed.eld |  16 +
 test/lisp/erc/resources/sasl/plain.eld        |  39 ++
 test/lisp/erc/resources/sasl/scram-sha-1.eld  |  47 ++
 .../lisp/erc/resources/sasl/scram-sha-256.eld |  47 ++
 18 files changed, 1621 insertions(+), 86 deletions(-)
 create mode 100644 lisp/erc/erc-sasl.el
 create mode 100644 test/lisp/erc/erc-sasl-tests.el
 create mode 100644 test/lisp/erc/erc-scenarios-sasl.el
 create mode 100644 test/lisp/erc/resources/sasl/external.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain-failed.eld
 create mode 100644 test/lisp/erc/resources/sasl/plain.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-1.eld
 create mode 100644 test/lisp/erc/resources/sasl/scram-sha-256.eld

Interdiff:
diff --git a/doc/misc/erc.texi b/doc/misc/erc.texi
index 79f8c92719..8eb33c8e80 100644
--- a/doc/misc/erc.texi
+++ b/doc/misc/erc.texi
@@ -390,8 +390,15 @@ Modules
 
 There is a spiffy customize interface, which may be reached by typing
 @kbd{M-x customize-option @key{RET} erc-modules @key{RET}}.
-Alternatively, set @code{erc-modules} manually and then call
-@code{erc-update-modules}.
+Alternatively, set @code{erc-modules} manually, and ERC will load them
+and run their setup code during buffer initialization.  Third-party
+code may need to call the function @code{erc-update-modules}
+explicitly, although this is typically unnecessary.
+
+All modules operate as minor modes under the hood, and some newer ones
+are defined as buffer-local.  For everyday use, the only practical
+difference is that local modules can only be enabled in ERC buffers,
+and their toggle commands never mutate @code{erc-modules}.
 
 The following is a list of available modules.
 
@@ -1026,7 +1033,7 @@ SASL
 
 Otherwise, if you set this option to @code{nil} (or the empty string)
 or if an auth-source lookup has failed, ERC will try a non-@code{nil}
-``server password'', likely whatever you gave as the @var{password}
+``server password,'' likely whatever you gave as the @var{password}
 argument to @code{erc-tls}.  This fallback behavior may change,
 however, so please don't rely on it.  As a last resort, ERC will
 prompt you for input.
diff --git a/etc/ERC-NEWS b/etc/ERC-NEWS
index 5cabb9b015..f5b14376ad 100644
--- a/etc/ERC-NEWS
+++ b/etc/ERC-NEWS
@@ -48,10 +48,9 @@ hell.  For some, auth-source may provide a workaround in the form of
 nonstandard server passwords.  See the "Connection" node in the manual
 under the subheading "Password".
 
-If you require SASL immediately, please participate in ERC development
-by volunteering to try (and give feedback on) edge features, one of
-which is SASL.  All known external offerings, past and present, are
-valiant efforts whose use is nevertheless discouraged.
+** Rudimentary SASL support has arrived.
+A new module, 'erc-sasl', now ships with ERC 5.5.  See the SASL
+section in the manual for details.
 
 ** Username argument for entry-point commands.
 Commands 'erc' and 'erc-tls' now accept a ':user' keyword argument,
@@ -97,6 +96,20 @@ messages during periods of heavy traffic no longer disappear.
 Although rare, server passwords containing white space are now handled
 correctly.
 
+** Local modules and ERC-mode hooks are more useful.
+The 'local-p' parameter of 'define-erc-module' now affects more than
+the scope of a module's minor-mode.  This currently has little direct
+impact on the user experience, but third-party packages may wish to
+take note.
+
+More importantly, the function 'erc-update-modules' now supports an
+optional argument to defer the enabling of local modules and instead
+return their mode-activation commands.  'erc-open' leverages this new
+functionality to delay their activation, as well as that of all
+'erc-mode-hook' members, until most of ERC's mode-related variables
+have been initialized.  This does not include connection-specific
+variables defined in erc-backend, however.
+
 ** Miscellaneous behavioral changes in the library API.
 A number of core macros and other definitions have been moved to a new
 file called erc-common.el.  This was done to further lessen the
diff --git a/lisp/erc/erc-common.el b/lisp/erc/erc-common.el
index a300cfc4fa..e5fabdc67f 100644
--- a/lisp/erc/erc-common.el
+++ b/lisp/erc/erc-common.el
@@ -173,17 +173,17 @@ define-erc-module
                   name)
          (interactive)
          ,@(unless local-p `((cl-pushnew ',mod erc-modules)))
-         ,@(macroexp-unprogn
-            `(,@(if local-p '(when (eq major-mode 'erc-mode)) '(progn))
-              (setq ,mode t)
-              ,@enable-body)))
+         ,@(if local-p
+               `((when (setq ,mode (and (derived-mode-p 'erc-mode) t))
+                   ,@enable-body))
+             `((setq ,mode t) ,@enable-body)))
        (defun ,disable ()
          ,(format "Disable ERC %S mode."
                   name)
          (interactive)
          ,@(unless local-p `((setq erc-modules (delq ',mod erc-modules))))
          ,@(macroexp-unprogn
-            `(,@(if local-p `(when ,mode) '(progn))
+            `(,@(if local-p '(when (derived-mode-p 'erc-mode)) '(progn))
               (setq ,mode nil)
               ,@disable-body)))
        ,(when (and alias (not (eq name alias)))
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 6d4ef21383..d4a2e312be 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -272,7 +272,7 @@ erc-compat--with-memoization
     `(cl--generic-with-memoization ,table ,@forms))
    (t `(progn ,@forms))))
 
-(defun erc-compat--local-minor-modes ()
+(defun erc-compat--local-module-modes ()
   (delq nil
         (if (boundp 'local-minor-modes)
             (mapcar (lambda (m)
diff --git a/lisp/erc/erc-sasl.el b/lisp/erc/erc-sasl.el
index ac2646051c..a9d7ed235d 100644
--- a/lisp/erc/erc-sasl.el
+++ b/lisp/erc/erc-sasl.el
@@ -223,17 +223,18 @@ erc-sasl--create-client
   (let ((sasl-mechanism-alist (copy-sequence sasl-mechanism-alist))
         (sasl-mechanisms sasl-mechanisms)
         (name (upcase (symbol-name mechanism)))
-        (feature (intern (concat "erc-sasl-" (symbol-name mechanism))))
+        (feature (intern-soft (concat "erc-sasl-" (symbol-name mechanism))))
         client)
-    (setf (alist-get name sasl-mechanism-alist nil nil #'equal) `(,feature))
-    (cl-pushnew name sasl-mechanisms :test #'equal)
-    (setq client (sasl-make-client (sasl-find-mechanism `(,name))
-                                   (or (alist-get 'user erc-sasl--options)
-                                       (erc-downcase (erc-current-nick)))
-                                   "N/A" "N/A"))
-    (sasl-client-set-property client 'authenticator-name
-                              (alist-get 'authzid erc-sasl--options))
-    client))
+    (when feature
+      (setf (alist-get name sasl-mechanism-alist nil nil #'equal) `(,feature))
+      (cl-pushnew name sasl-mechanisms :test #'equal)
+      (setq client (sasl-make-client (sasl-find-mechanism `(,name))
+                                     (or (alist-get 'user erc-sasl--options)
+                                         (erc-downcase (erc-current-nick)))
+                                     "N/A" "N/A"))
+      (sasl-client-set-property client 'authenticator-name
+                                (alist-get 'authzid erc-sasl--options))
+      client)))
 
 (cl-defmethod erc-sasl--create-client ((_m (eql plain)))
   "Create and return a new PLAIN client object."
@@ -296,7 +297,9 @@ erc-sasl--init
 (defun erc-sasl--on-connection-established (&rest _)
   (setf (alist-get erc-networks--id erc-sasl--session-options nil nil
                    #'erc-networks--id-equal-p)
-        erc-sasl--options))
+        erc-sasl--options
+        ;;
+        erc-sasl--options nil))
 
 (defun erc-sasl--mechanism-offered-p (offered)
   "Return non-nil when OFFERED appears among a list of mechanisms."
@@ -318,7 +321,8 @@ erc-sasl--authenticate-handler
     (when (string= "+" response)
       (setq response ""))
     (setf response (base64-decode-string
-                    (concat (erc-sasl--state-pending erc-sasl--state) response))
+                    (concat (erc-sasl--state-pending erc-sasl--state)
+                            response))
           (erc-sasl--state-pending erc-sasl--state) nil)
     ;; The server is done sending, so our turn
     (let ((client (erc-sasl--state-client erc-sasl--state))
@@ -357,11 +361,14 @@ sasl
      (let* ((mech (alist-get 'mechanism erc-sasl--options))
             (client (erc-sasl--create-client mech)))
        (unless client
-         (erc-display-error-notice nil (format "Unknown mechanism: %s" mech))
-         (erc-error "Unknown mechanism: %s" mech))
+         (erc-display-error-notice
+          nil (format "Unknown SASL mechanism: %s" mech))
+         (erc-error "Unknown SASL mechanism: %s" mech))
        (setf (erc-sasl--state-client erc-sasl--state) client))))
   ((remove-hook 'erc-server-AUTHENTICATE-functions
                 #'erc-sasl--authenticate-handler t)
+   (setf (alist-get erc-networks--id erc-sasl--session-options nil t) nil)
+   (kill-local-variable 'erc-sasl--state)
    (kill-local-variable 'erc-sasl--options))
   'local)
 
@@ -410,11 +417,13 @@ erc-sasl--destroy
 
 (cl-defmethod erc--register-connection (&context (erc-sasl-mode (eql t)))
   "Send speculative/pipelined CAP and AUTHENTICATE and hope for the best."
-  (erc-server-send "CAP REQ :sasl")
-  (erc-login)
-  (let* ((c (erc-sasl--state-client erc-sasl--state))
-         (m (sasl-mechanism-name (sasl-client-mechanism c))))
-    (erc-server-send (format "AUTHENTICATE %s" m))))
+  (if-let* ((c (erc-sasl--state-client erc-sasl--state))
+            (m (sasl-mechanism-name (sasl-client-mechanism c))))
+      (progn
+        (erc-server-send "CAP REQ :sasl")
+        (erc-login)
+        (erc-server-send (format "AUTHENTICATE %s" m)))
+    (erc-sasl--destroy erc-server-process)))
 
 (provide 'erc-sasl)
 ;;; erc-sasl.el ends here
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index a703f903ec..c5989dbc7e 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1871,7 +1871,7 @@ erc-update-modules
 introduced in ERC 5.5."
   (let ((local-modes
          (when (and defer-locals (derived-mode-p 'erc-mode))
-           (erc-compat--local-minor-modes))))
+           (erc-compat--local-module-modes))))
     (dolist (module erc-modules (and defer-locals local-modes))
       (require (or (alist-get module erc--modules-to-features)
                    (intern (concat "erc-" (symbol-name module))))
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: 0001-Add-GS2-authorization-to-sasl-scram-rfc.patch --]
[-- Type: text/x-patch, Size: 3030 bytes --]

From a7177b08ef8a0fe055d1e09045aaa95a8ba66ceb Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 19 Sep 2022 21:28:52 -0700
Subject: [PATCH 1/5] Add GS2 authorization to sasl-scram-rfc

* lisp/net/sasl-scram-rfc.el (sasl-scram-gs2-header-function,
sasl-scram-construct-gs2-header): Add new variable and default
function for determining a SCRAM GSS-API message header.  This is
mainly intended for other libraries rather than end users.
(sasl-scram-client-first-message): Use gs2-header function.
(sasl-scram--client-final-message): Use dedicated gs2-header function.
Also remove whitespace when base64-encoding, as per RFC 5802.
(Bug#57956.)
---
 lisp/net/sasl-scram-rfc.el | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/lisp/net/sasl-scram-rfc.el b/lisp/net/sasl-scram-rfc.el
index ee52ed6e07..f7a2e42541 100644
--- a/lisp/net/sasl-scram-rfc.el
+++ b/lisp/net/sasl-scram-rfc.el
@@ -45,14 +45,21 @@
 
 ;;; Generic for SCRAM-*
 
+(defvar sasl-scram-gs2-header-function 'sasl-scram-construct-gs2-header
+  "Function to create GS2 header.
+See https://www.rfc-editor.org/rfc/rfc5801#section-4.")
+
+(defun sasl-scram-construct-gs2-header (client)
+  ;; The "n," means the client doesn't support channel binding, and
+  ;; the trailing comma is included as per RFC 5801.
+  (let ((authzid (sasl-client-property client 'authenticator-name)))
+    (concat "n," (and authzid "a=") authzid ",")))
+
 (defun sasl-scram-client-first-message (client _step)
   (let ((c-nonce (sasl-unique-id)))
     (sasl-client-set-property client 'c-nonce c-nonce))
   (concat
-   ;; n = client doesn't support channel binding
-   "n,"
-   ;; TODO: where would we get authorization id from?
-   ","
+   (funcall sasl-scram-gs2-header-function client)
    (sasl-scram--client-first-message-bare client)))
 
 (defun sasl-scram--client-first-message-bare (client)
@@ -77,11 +84,11 @@ sasl-scram--client-final-message
 
 	 (c-nonce (sasl-client-property client 'c-nonce))
 	 ;; no channel binding, no authorization id
-	 (cbind-input "n,,"))
+         (cbind-input (funcall sasl-scram-gs2-header-function client)))
     (unless (string-prefix-p c-nonce nonce)
       (sasl-error "Invalid nonce from server"))
     (let* ((client-final-message-without-proof
-	    (concat "c=" (base64-encode-string cbind-input) ","
+            (concat "c=" (base64-encode-string cbind-input t) ","
 		    "r=" nonce))
 	   (password
 	    ;; TODO: either apply saslprep or disallow non-ASCII characters
@@ -113,7 +120,7 @@ sasl-scram--client-final-message
 	   (client-proof (funcall string-xor client-key client-signature))
 	   (client-final-message
 	    (concat client-final-message-without-proof ","
-		    "p=" (base64-encode-string client-proof))))
+                    "p=" (base64-encode-string client-proof t))))
       (sasl-client-set-property client 'auth-message auth-message)
       (sasl-client-set-property client 'salted-password salted-password)
       client-final-message)))
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #4: 0002-Don-t-set-erc-networks-id-until-network-is-known.patch --]
[-- Type: text/x-patch, Size: 7501 bytes --]

From 665eb8627e3b2ba1befeb64cbff0caf217a28089 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 13 Nov 2022 01:52:48 -0800
Subject: [PATCH 2/5] Don't set erc-networks--id until network is known

* lisp/erc/erc-networks.el (erc-networks--id-given): Accept a null
argument.
(erc-networks--id-on-connect): Remove unused function.
(erc-networks--id-equal-p): Add method for comparing initialized and
unset IDs.
(erc-networks--update-server-identity): Ensure `erc-networks--id' is
set before continuing search.
(erc-networks--init-identity): Don't assume `erc-networks--id' is
non-nil.

* lisp/erc/erc.el (erc-open): For continued sessions, try copying over
the last network ID.
(erc--auth-source-determine-params-default): Don't expect a network ID
to have been initialized.

* lisp/erc/erc-backend.el (erc-server-NICK, erc-server-433): Unless
already connected, clear network ID when server rejects or mandates a
nick change.
---
 lisp/erc/erc-backend.el  |  7 ++++++-
 lisp/erc/erc-networks.el | 39 ++++++++++++++++-----------------------
 lisp/erc/erc.el          | 13 ++++++++-----
 3 files changed, 30 insertions(+), 29 deletions(-)

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index 026b34849a..2c8c4dcb28 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -1525,7 +1525,7 @@ define-erc-response-handler
         (cl-pushnew (erc-server-buffer) bufs)
         (erc-set-current-nick nn)
         ;; Rename session, possibly rename server buf and all targets
-        (when (erc-network)
+        (when erc-server-connected
           (erc-networks--id-reload erc-networks--id proc parsed))
         (erc-update-mode-line)
         (setq erc-nick-change-attempt-count 0)
@@ -1535,6 +1535,9 @@ define-erc-response-handler
          'NICK-you ?n nick ?N nn)
         (run-hook-with-args 'erc-nick-changed-functions nn nick))
        (t
+        (unless (or erc-server-connected
+                    (erc-networks--id-given erc-networks--id))
+          (setq erc-networks--id nil))
         (erc-handle-user-status-change 'nick (list nick login host) (list nn))
         (erc-display-message parsed 'notice bufs 'NICK ?n nick
                              ?u login ?h host ?N nn))))))
@@ -2161,6 +2164,8 @@ erc-server-322-message
 
 (define-erc-response-handler (433)
   "Login-time \"nick in use\"." nil
+  (unless (or erc-server-connected (erc-networks--id-given erc-networks--id))
+    (setq erc-networks--id nil))
   (erc-nickname-in-use (cadr (erc-response.command-args parsed))
                        "already in use"))
 
diff --git a/lisp/erc/erc-networks.el b/lisp/erc/erc-networks.el
index dba6ead073..aa90bb8479 100644
--- a/lisp/erc/erc-networks.el
+++ b/lisp/erc/erc-networks.el
@@ -826,12 +826,11 @@ erc-networks--id
 
 ;; For now, please use this instead of `erc-networks--id-fixed-p'.
 (cl-defgeneric erc-networks--id-given (net-id)
-  "Return the preassigned identifier for a network presence, if any.
-This may have originated from an `:id' arg to entry-point commands
-`erc-tls' or `erc'.")
+  "Return the preassigned identifier for a network context, if any.
+When non-nil, assume NET-ID originated from an `:id' argument to
+entry-point commands `erc-tls' or `erc'.")
 
-(cl-defmethod erc-networks--id-given ((_ erc-networks--id))
-  nil)
+(cl-defmethod erc-networks--id-given (_) nil) ; _ may be nil
 
 (cl-defmethod erc-networks--id-given ((nid erc-networks--id-fixed))
   (erc-networks--id-symbol nid))
@@ -866,22 +865,15 @@ erc-networks--id-create
   ((_ symbol) &context (erc-obsolete-var erc-reuse-buffers null))
   (erc-networks--id-fixed-create (intern (buffer-name))))
 
-(cl-defgeneric erc-networks--id-on-connect (net-id)
-  "Update NET-ID `erc-networks--id' after connection params known.
-This is typically during or just after MOTD.")
-
-(cl-defmethod erc-networks--id-on-connect ((_ erc-networks--id))
-  nil)
-
-(cl-defmethod erc-networks--id-on-connect ((id erc-networks--id-qualifying))
-  (erc-networks--id-qualifying-update id (erc-networks--id-qualifying-create)))
-
 (cl-defgeneric erc-networks--id-equal-p (self other)
-  "Return non-nil when two network identities exhibit underlying equality.
-SELF and OTHER are `erc-networks--id' struct instances.  This
-should normally be used only for ID recovery or merging, after
-which no two identities should be `equal' (timestamps aside) that
-aren't also `eq'.")
+  "Return non-nil when two network IDs exhibit underlying equality.
+Expect SELF and OTHER to be `erc-networks--id' struct instances
+and that this will only be called for ID recovery or merging,
+after which no two identities should be `equal' (timestamps
+aside) that aren't also `eq'.")
+
+(cl-defmethod erc-networks--id-equal-p ((_ null) (_ erc-networks--id)) nil)
+(cl-defmethod erc-networks--id-equal-p ((_ erc-networks--id) (_ null)) nil)
 
 (cl-defmethod erc-networks--id-equal-p ((self erc-networks--id)
                                         (other erc-networks--id))
@@ -1381,7 +1373,8 @@ erc-networks--update-server-identity
   (let* ((identity erc-networks--id)
          (buffer (current-buffer))
          (f (lambda ()
-              (unless (or (eq (current-buffer) buffer)
+              (unless (or (not erc-networks--id)
+                          (eq (current-buffer) buffer)
                           (eq erc-networks--id identity))
                 (if (erc-networks--id-equal-p identity erc-networks--id)
                     (throw 'buffer erc-networks--id)
@@ -1400,8 +1393,8 @@ erc-networks--init-identity
   "Update identity with real network name."
   ;; Initialize identity for real now that we know the network
   (cl-assert erc-network)
-  (unless (erc-networks--id-symbol erc-networks--id) ; unless just reconnected
-    (erc-networks--id-on-connect erc-networks--id))
+  (unless erc-networks--id
+    (setq erc-networks--id (erc-networks--id-create nil)))
   ;; Find duplicate identities or other conflicting ones and act
   ;; accordingly.
   (erc-networks--update-server-identity)
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 6b14cf87e2..63379af141 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -2008,10 +2008,12 @@ erc-open
     (setq erc-default-nicks (if (consp erc-nick) erc-nick (list erc-nick)))
     ;; client certificate (only useful if connecting over TLS)
     (setq erc-session-client-certificate client-certificate)
-    (setq erc-networks--id (if connect
-                               (erc-networks--id-create id)
-                             (buffer-local-value 'erc-networks--id
-                                                 old-buffer)))
+    (setq erc-networks--id
+          (if connect
+              (or (and continued-session
+                       (buffer-local-value 'erc-networks--id old-buffer))
+                  (and id (erc-networks--id-create id)))
+            (buffer-local-value 'erc-networks--id old-buffer)))
     ;; debug output buffer
     (setq erc-dbuf
           (when erc-log-p
@@ -3171,7 +3173,8 @@ erc-auth-source-join-function
                  function))
 
 (defun erc--auth-source-determine-params-defaults ()
-  (let* ((net (and-let* ((esid (erc-networks--id-symbol erc-networks--id))
+  (let* ((net (and-let* ((erc-networks--id)
+                         (esid (erc-networks--id-symbol erc-networks--id))
                          ((symbol-name esid)))))
          (localp (and erc--target (erc--target-channel-local-p erc--target)))
          (hosts (if localp
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #5: 0003-Support-local-ERC-modules-in-erc-mode-buffers.patch --]
[-- Type: text/x-patch, Size: 17364 bytes --]

From 21145f307c90c0231b8564e7f6517d2782a8cf17 Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 12 Jul 2021 03:44:28 -0700
Subject: [PATCH 3/5] Support local ERC modules in erc-mode buffers

* doc/misc/erc.texi: Mention local modules in Modules Chapter.

* lisp/erc/erc-compat.el (erc-compat--local-module-modes): Add helper
for finding local modules active in an ERC buffer.

* lisp/erc/erc.el (erc-migrate-modules): Add some missing mappings.
(erc-update-modules): Change return value from nil to a list of
minor-mode commands for local modules.  Use `custom-variable-p' to
detect flavor.  Currently, all modules are global and so are their
accompanying minor modes.
(erc-open): Defer enabling of local modules via `erc-update-modules'
until after buffer is initialized with other local vars.  Also defer
major mode hooks so they can detect things like whether the buffer is
a server or target buffer.  Also ensure local module setup code can
detect when `erc-open' was called with a non-nil
`erc--server-reconnecting'.  It's reset to nil by
`erc-server-connect'.

* lisp/erc/erc-common.el (erc--module-name-migrations,
erc--features-to-modules, erc--modules-to-features): Add alists of
old-to-new module names to support module-name migrations.
(define-erc-modules): Don't enable local modules (minor modes) unless
`erc-mode' is the major mode.  And don't disable them unless the minor
mode is actually active.  Also, don't mutate `erc-modules' when
dealing with a local module.
(erc--normalize-module-symbol): Add helper for `erc-migrate-modules'.

* lisp/erc/erc-goodies.el: Require cl-lib.
* test/lisp/erc/erc-tests.el (erc-migrate-modules,
erc-update-modules): Add rudimentary unit tests.  (Bug#57955.)
---
 doc/misc/erc.texi          | 11 +++++-
 etc/ERC-NEWS               | 14 +++++++
 lisp/erc/erc-common.el     | 56 ++++++++++++++++++++++++----
 lisp/erc/erc-compat.el     | 12 ++++++
 lisp/erc/erc-goodies.el    |  1 +
 lisp/erc/erc.el            | 75 ++++++++++++++++++++------------------
 test/lisp/erc/erc-tests.el | 58 +++++++++++++++++++++++++++++
 7 files changed, 182 insertions(+), 45 deletions(-)

diff --git a/doc/misc/erc.texi b/doc/misc/erc.texi
index 3db83197f9..5049710b32 100644
--- a/doc/misc/erc.texi
+++ b/doc/misc/erc.texi
@@ -389,8 +389,15 @@ Modules
 
 There is a spiffy customize interface, which may be reached by typing
 @kbd{M-x customize-option @key{RET} erc-modules @key{RET}}.
-Alternatively, set @code{erc-modules} manually and then call
-@code{erc-update-modules}.
+Alternatively, set @code{erc-modules} manually, and ERC will load them
+and run their setup code during buffer initialization.  Third-party
+code may need to call the function @code{erc-update-modules}
+explicitly, although this is typically unnecessary.
+
+All modules operate as minor modes under the hood, and some newer ones
+are defined as buffer-local.  For everyday use, the only practical
+difference is that local modules can only be enabled in ERC buffers,
+and their toggle commands never mutate @code{erc-modules}.
 
 The following is a list of available modules.
 
diff --git a/etc/ERC-NEWS b/etc/ERC-NEWS
index 5cabb9b015..e14cd3492a 100644
--- a/etc/ERC-NEWS
+++ b/etc/ERC-NEWS
@@ -97,6 +97,20 @@ messages during periods of heavy traffic no longer disappear.
 Although rare, server passwords containing white space are now handled
 correctly.
 
+** Local modules and ERC-mode hooks are more useful.
+The 'local-p' parameter of 'define-erc-module' now affects more than
+the scope of a module's minor-mode.  This currently has little direct
+impact on the user experience, but third-party packages may wish to
+take note.
+
+More importantly, the function 'erc-update-modules' now supports an
+optional argument to defer the enabling of local modules and instead
+return their mode-activation commands.  'erc-open' leverages this new
+functionality to delay their activation, as well as that of all
+'erc-mode-hook' members, until most of ERC's mode-related variables
+have been initialized.  This does not include connection-specific
+variables defined in erc-backend, however.
+
 ** Miscellaneous behavioral changes in the library API.
 A number of core macros and other definitions have been moved to a new
 file called erc-common.el.  This was done to further lessen the
diff --git a/lisp/erc/erc-common.el b/lisp/erc/erc-common.el
index d8aac36eab..e5fabdc67f 100644
--- a/lisp/erc/erc-common.el
+++ b/lisp/erc/erc-common.el
@@ -85,6 +85,41 @@ erc--target
   (contents "" :type string)
   (tags '() :type list))
 
+;; TODO move goodies modules here after 29 is released.
+(defconst erc--features-to-modules
+  '((erc-pcomplete completion pcomplete)
+    (erc-capab capab-identify)
+    (erc-join autojoin)
+    (erc-page page ctcp-page)
+    (erc-sound sound ctcp-sound)
+    (erc-stamp stamp timestamp)
+    (erc-services services nickserv))
+  "Migration alist mapping a library feature to module names.
+Keys need not be unique: a library may define more than one
+module.  Sometimes a module's downcased alias will be its
+canonical name.")
+
+(defconst erc--modules-to-features
+  (let (pairs)
+    (pcase-dolist (`(,feature . ,names) erc--features-to-modules)
+      (dolist (name names)
+        (push (cons name feature) pairs)))
+    (nreverse pairs))
+  "Migration alist mapping a module's name to its home library feature.")
+
+(defconst erc--module-name-migrations
+  (let (pairs)
+    (pcase-dolist (`(,_ ,canonical . ,rest) erc--features-to-modules)
+      (dolist (obsolete rest)
+        (push (cons obsolete canonical) pairs)))
+    pairs)
+  "Association list of obsolete module names to canonical names.")
+
+(defun erc--normalize-module-symbol (symbol)
+  "Return preferred SYMBOL for `erc-modules'."
+  (setq symbol (intern (downcase (symbol-name symbol))))
+  (or (cdr (assq symbol erc--module-name-migrations)) symbol))
+
 (defmacro define-erc-module (name alias doc enable-body disable-body
                                   &optional local-p)
   "Define a new minor mode using ERC conventions.
@@ -98,7 +133,9 @@ define-erc-module
 
 This will define a minor mode called erc-NAME-mode, possibly
 an alias erc-ALIAS-mode, as well as the helper functions
-erc-NAME-enable, and erc-NAME-disable.
+erc-NAME-enable, and erc-NAME-disable.  Beware that for global
+modules, these helpers, as well as the minor-mode toggle, all mutate
+the user option `erc-modules'.
 
 Example:
 
@@ -111,6 +148,7 @@ define-erc-module
                   #\\='erc-replace-insert)))"
   (declare (doc-string 3) (indent defun))
   (let* ((sn (symbol-name name))
+         (mod (erc--normalize-module-symbol name))
          (mode (intern (format "erc-%s-mode" (downcase sn))))
          (group (intern (format "erc-%s" (downcase sn))))
          (enable (intern (format "erc-%s-enable" (downcase sn))))
@@ -134,16 +172,20 @@ define-erc-module
          ,(format "Enable ERC %S mode."
                   name)
          (interactive)
-         (add-to-list 'erc-modules (quote ,name))
-         (setq ,mode t)
-         ,@enable-body)
+         ,@(unless local-p `((cl-pushnew ',mod erc-modules)))
+         ,@(if local-p
+               `((when (setq ,mode (and (derived-mode-p 'erc-mode) t))
+                   ,@enable-body))
+             `((setq ,mode t) ,@enable-body)))
        (defun ,disable ()
          ,(format "Disable ERC %S mode."
                   name)
          (interactive)
-         (setq erc-modules (delq (quote ,name) erc-modules))
-         (setq ,mode nil)
-         ,@disable-body)
+         ,@(unless local-p `((setq erc-modules (delq ',mod erc-modules))))
+         ,@(macroexp-unprogn
+            `(,@(if local-p '(when (derived-mode-p 'erc-mode)) '(progn))
+              (setq ,mode nil)
+              ,@disable-body)))
        ,(when (and alias (not (eq name alias)))
           `(defalias
              ',(intern
diff --git a/lisp/erc/erc-compat.el b/lisp/erc/erc-compat.el
index 03bd8f1352..96b862c8c5 100644
--- a/lisp/erc/erc-compat.el
+++ b/lisp/erc/erc-compat.el
@@ -168,6 +168,18 @@ erc-compat--with-memoization
     `(cl--generic-with-memoization ,table ,@forms))
    (t `(progn ,@forms))))
 
+(defun erc-compat--local-module-modes ()
+  (delq nil
+        (if (boundp 'local-minor-modes)
+            (mapcar (lambda (m)
+                      (and (string-prefix-p "erc-" (symbol-name m)) m))
+                    local-minor-modes)
+          (mapcar (pcase-lambda (`(,k . _))
+                    (and (string-prefix-p "erc-" (symbol-name k))
+                         (string-suffix-p "-mode" (symbol-name k))
+                         k))
+                  (buffer-local-variables)))))
+
 (provide 'erc-compat)
 
 ;;; erc-compat.el ends here
diff --git a/lisp/erc/erc-goodies.el b/lisp/erc/erc-goodies.el
index 59b5f01f23..1af83b58ba 100644
--- a/lisp/erc/erc-goodies.el
+++ b/lisp/erc/erc-goodies.el
@@ -31,6 +31,7 @@
 
 ;;; Imenu support
 
+(eval-when-compile (require 'cl-lib))
 (require 'erc-common)
 
 (defvar erc-controls-highlight-regexp)
diff --git a/lisp/erc/erc.el b/lisp/erc/erc.el
index 63379af141..3d8afe8df6 100644
--- a/lisp/erc/erc.el
+++ b/lisp/erc/erc.el
@@ -1784,10 +1784,7 @@ erc-migrate-modules
   "Migrate old names of ERC modules to new ones."
   ;; modify `transforms' to specify what needs to be changed
   ;; each item is in the format '(old . new)
-  (let ((transforms '((pcomplete . completion))))
-    (delete-dups
-     (mapcar (lambda (m) (or (cdr (assoc m transforms)) m))
-             mods))))
+  (delete-dups (mapcar #'erc--normalize-module-symbol mods)))
 
 (defcustom erc-modules '(netsplit fill button match track completion readonly
                                   networks ring autojoin noncommands irccontrols
@@ -1865,28 +1862,25 @@ erc-modules
     (repeat :tag "Others" :inline t symbol))
   :group 'erc)
 
-(defun erc-update-modules ()
-  "Run this to enable erc-foo-mode for all modules in `erc-modules'."
-  (let (req)
-    (dolist (mod erc-modules)
-      (setq req (concat "erc-" (symbol-name mod)))
-      (cond
-       ;; yuck. perhaps we should bring the filenames into sync?
-       ((string= req "erc-capab-identify")
-        (setq req "erc-capab"))
-       ((string= req "erc-completion")
-        (setq req "erc-pcomplete"))
-       ((string= req "erc-pcomplete")
-        (setq mod 'completion))
-       ((string= req "erc-autojoin")
-        (setq req "erc-join")))
-      (condition-case nil
-          (require (intern req))
-        (error nil))
-      (let ((sym (intern-soft (concat "erc-" (symbol-name mod) "-mode"))))
-        (if (fboundp sym)
-            (funcall sym 1)
-          (error "`%s' is not a known ERC module" mod))))))
+(defun erc-update-modules (&optional defer-locals)
+  "Enable global minor mode for all global modules in `erc-modules'.
+With DEFER-LOCALS, return minor-mode commands for all local
+modules, possibly for deferred invocation, as done by `erc-open'
+whenever a new ERC buffer is created.  Local modules were
+introduced in ERC 5.5."
+  (let ((local-modes
+         (when (and defer-locals (derived-mode-p 'erc-mode))
+           (erc-compat--local-module-modes))))
+    (dolist (module erc-modules (and defer-locals local-modes))
+      (require (or (alist-get module erc--modules-to-features)
+                   (intern (concat "erc-" (symbol-name module))))
+               nil 'noerror) ; some modules don't have a corresponding feature
+      (let ((mode (intern-soft (concat "erc-" (symbol-name module) "-mode"))))
+        (unless (and mode (fboundp mode))
+          (error "`%s' is not a known ERC module" module))
+        (if (and defer-locals (not (custom-variable-p mode)))
+            (cl-pushnew mode local-modes)
+          (funcall mode 1))))))
 
 (defun erc-setup-buffer (buffer)
   "Consults `erc-join-buffer' to find out how to display `BUFFER'."
@@ -1942,18 +1936,24 @@ erc-open
   (let* ((target (and channel (erc--target-from-string channel)))
          (buffer (erc-get-buffer-create server port nil target id))
          (old-buffer (current-buffer))
-         old-point
+         (old-recon-count erc-server-reconnect-count)
+         (old-point nil)
+         (delayed-modules nil)
          (continued-session (and erc--server-reconnecting
                                  (with-suppressed-warnings
                                      ((obsolete erc-reuse-buffers))
-                                   erc-reuse-buffers))))
+                                   erc-reuse-buffers)
+                                 erc-networks--id)))
     (when connect (run-hook-with-args 'erc-before-connect server port nick))
-    (erc-update-modules)
     (set-buffer buffer)
     (setq old-point (point))
-    (let ((old-recon-count erc-server-reconnect-count))
-      (erc-mode)
-      (setq erc-server-reconnect-count old-recon-count))
+    (setq delayed-modules (erc-update-modules 'defer-locals))
+
+    (delay-mode-hooks (erc-mode))
+
+    (setq erc-server-reconnect-count old-recon-count
+          erc--server-reconnecting continued-session)
+
     (when (setq erc-server-connected (not connect))
       (setq erc-server-announced-name
             (buffer-local-value 'erc-server-announced-name old-buffer)))
@@ -2010,14 +2010,19 @@ erc-open
     (setq erc-session-client-certificate client-certificate)
     (setq erc-networks--id
           (if connect
-              (or (and continued-session
-                       (buffer-local-value 'erc-networks--id old-buffer))
+              (or erc--server-reconnecting
                   (and id (erc-networks--id-create id)))
             (buffer-local-value 'erc-networks--id old-buffer)))
     ;; debug output buffer
     (setq erc-dbuf
           (when erc-log-p
             (get-buffer-create (concat "*ERC-DEBUG: " server "*"))))
+
+    (erc-determine-parameters server port nick full-name user passwd)
+
+    (save-excursion (run-mode-hooks))
+    (dolist (mod delayed-modules) (funcall mod +1))
+
     ;; set up prompt
     (unless continued-session
       (goto-char (point-max))
@@ -2029,8 +2034,6 @@ erc-open
       (erc-display-prompt)
       (goto-char (point-max)))
 
-    (erc-determine-parameters server port nick full-name user passwd)
-
     ;; Saving log file on exit
     (run-hook-with-args 'erc-connect-pre-hook buffer)
 
diff --git a/test/lisp/erc/erc-tests.el b/test/lisp/erc/erc-tests.el
index c88dd9888d..d074b36c8b 100644
--- a/test/lisp/erc/erc-tests.el
+++ b/test/lisp/erc/erc-tests.el
@@ -953,4 +953,62 @@ erc-message
     (kill-buffer "ExampleNet")
     (kill-buffer "#chan")))
 
+(ert-deftest erc-migrate-modules ()
+  (should (equal (erc-migrate-modules '(autojoin timestamp button))
+                 '(autojoin stamp button)))
+  ;; Default unchanged
+  (should (equal (erc-migrate-modules erc-modules) erc-modules)))
+
+(ert-deftest erc-update-modules ()
+  (let (calls
+        erc-modules
+        erc-kill-channel-hook erc-kill-server-hook erc-kill-buffer-hook)
+    (cl-letf (((symbol-function 'require)
+               (lambda (s &rest _) (push s calls)))
+
+              ;; Local modules
+              ((symbol-function 'erc-fake-bar-mode)
+               (lambda (n) (push (cons 'fake-bar n) calls)))
+
+              ;; Global modules
+              ((symbol-function 'erc-fake-foo-mode)
+               (lambda (n) (push (cons 'fake-foo n) calls)))
+              ((get 'erc-fake-foo-mode 'standard-value) 'ignore)
+              ((symbol-function 'erc-autojoin-mode)
+               (lambda (n) (push (cons 'autojoin n) calls)))
+              ((get 'erc-autojoin-mode 'standard-value) 'ignore)
+              ((symbol-function 'erc-networks-mode)
+               (lambda (n) (push (cons 'networks n) calls)))
+              ((get 'erc-networks-mode 'standard-value) 'ignore)
+              ((symbol-function 'erc-completion-mode)
+               (lambda (n) (push (cons 'completion n) calls)))
+              ((get 'erc-completion-mode 'standard-value) 'ignore))
+
+      (ert-info ("Local modules")
+        (setq erc-modules '(fake-foo fake-bar))
+        (should (equal (erc-update-modules t) '(erc-fake-bar-mode)))
+        ;; Bar the feature is still required but the mode is not activated
+        (should (equal (nreverse calls)
+                       '(erc-fake-foo (fake-foo . 1) erc-fake-bar)))
+        (setq calls nil))
+
+      (ert-info ("Module name overrides")
+        (setq erc-modules '(completion autojoin networks))
+        (should-not (erc-update-modules t)) ; no locals
+        (should (equal (nreverse calls) '( erc-pcomplete (completion . 1)
+                                           erc-join (autojoin . 1)
+                                           erc-networks (networks . 1))))
+        (setq calls nil))
+
+      (ert-info ("Reenabling of local minor modes by `erc-open'")
+        (with-temp-buffer
+          (erc-mode)
+          (setq erc-modules '(completion autojoin networks))
+          (let ((local-minor-modes '(font-lock-mode erc-fake-bar-mode)))
+            (should (equal (erc-update-modules t) '(erc-fake-bar-mode))))
+          (should (equal (nreverse calls)
+                         '( erc-pcomplete (completion . 1)
+                            erc-join (autojoin . 1)
+                            erc-networks (networks . 1)))))))))
+
 ;;; erc-tests.el ends here
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #6: 0004-Call-erc-login-indirectly-via-new-generic-wrapper.patch --]
[-- Type: text/x-patch, Size: 1981 bytes --]

From d7a7309214089aee49ce547816ba39c1ae0672ce Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Sun, 18 Sep 2022 01:49:23 -0700
Subject: [PATCH 4/5] Call erc-login indirectly via new generic wrapper

* lisp/erc/erc-backend (erc--register-connection): Add new generic
function that defers to `erc-login' by default.
(erc-process-sentinel, erc-server-connect): Call
`erc--register-connection' instead of `erc-login'.
---
 lisp/erc/erc-backend.el | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lisp/erc/erc-backend.el b/lisp/erc/erc-backend.el
index 2c8c4dcb28..37a3da8b66 100644
--- a/lisp/erc/erc-backend.el
+++ b/lisp/erc/erc-backend.el
@@ -625,6 +625,10 @@ erc-open-network-stream
   (let ((p (plist-put parameters :nowait t)))
     (apply #'open-network-stream name buffer host service p)))
 
+(cl-defmethod erc--register-connection ()
+  "Perform opening IRC protocol exchange with server."
+  (erc-login))
+
 (defun erc-server-connect (server port buffer &optional client-certificate)
   "Perform the connection and login using the specified SERVER and PORT.
 We will store server variables in the buffer given by BUFFER.
@@ -673,7 +677,7 @@ erc-server-connect
         ;; waiting for a non-blocking connect - keep the user informed
         (erc-display-message nil nil buffer "Opening connection..\n")
       (message "%s...done" msg)
-      (erc-login)) ))
+      (erc--register-connection))))
 
 (defun erc-server-reconnect ()
   "Reestablish the current IRC connection.
@@ -851,7 +855,7 @@ erc-process-sentinel
                   cproc (process-status cproc) event erc-server-quitting))
         (if (string-match "^open" event)
             ;; newly opened connection (no wait)
-            (erc-login)
+            (erc--register-connection)
           ;; assume event is 'failed
           (erc-with-all-buffers-of-server cproc nil
                                           (setq erc-server-connected nil))
-- 
2.38.1


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #7: 0005-Add-non-IRCv3-SASL-module-to-ERC.patch --]
[-- Type: text/x-patch, Size: 73110 bytes --]

From ba6fae5c2851e2926e20e21c8dc962977c94987a Mon Sep 17 00:00:00 2001
From: "F. Jason Park" <jp@neverwas.me>
Date: Mon, 12 Jul 2021 03:44:28 -0700
Subject: [PATCH 5/5] Add non-IRCv3 SASL module to ERC

* lisp/erc/erc-compat.el (erc-compat--sasl-scram-construct-gs2-header,
erc-compat--sasl-scram-client-first-message,
erc-compat--sasl-scram--client-final-message): Add minimal
authorization support via own variant of
`sasl-scram--client-final-message' and supporting sasl-scram-rfc
functions introduced in Emacs 29.

* lisp/erc/erc.el (erc-modules): Add `sasl'.
* lisp/erc/erc-sasl.el: New file (bug#29108).
* test/lisp/erc/erc-sasl-tests.el: New file.
* test/lisp/erc/erc-scenarios-sasl.el: New file.
* test/lisp/erc/resources/sasl/plain-failed.eld: New file.
* test/lisp/erc/resources/sasl/plain.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-1.eld: New file.
* test/lisp/erc/resources/sasl/scram-sha-256.eld: New file.
* test/lisp/erc/resources/sasl/external.eld: New file.
---
 doc/misc/erc.texi                             | 137 +++++-
 etc/ERC-NEWS</