SASL: Also disallow suspended nicks to login using EXTERNAL mechanism. Improve the log message for failed logins.

include/modules/sasl.h

@@ -110,7 +110,14 @@ namespace SASL
 				delete s;
 			}
 
-			Log(Config->GetClient("NickServ")) << "A user failed to identify for account " << this->GetAccount() << " using SASL";
+			Anope::string accountstatus;
+			NickAlias *na = NickAlias::Find(GetAccount());
+			if (!na)
+				accountstatus = "nonexistent ";
+			else if (na->nc->HasExt("NS_SUSPENDED"))
+				accountstatus = "suspended ";
+
+			Log(Config->GetClient("NickServ")) << "A user failed to identify for " << accountstatus << "account " << this->GetAccount() << " using SASL";
 		}
 	};
 }

modules/m_sasl.cpp

@@ -93,7 +93,7 @@ class External : public Mechanism
 			}
 
 			NickCore *nc = certs->FindAccountFromCert(mysess->cert);
-			if (!nc)
+			if (!nc || nc->HasExt("NS_SUSPENDED"))
 			{
 				sasl->Fail(sess);
 				delete sess;