INN 2.6.0

2015-09-12
Full changes and diff from previous release

Upgrading from 2.5 to 2.6

The following changes require your full attention because a manual intervention may be needed:

• The name and location of the pullnews configuration file have changed. It is now pullnews.marks, located in pathdb when pullnews is run as the news user, or otherwise in the running user's home directory. This file was previously stored in .pullnews in the running user's home directory (even for the news user). If you use pullnews, you need to manually move and rename the configuration file; otherwise, it will no longer work. Note that the -c flag passed to pullnews allows specifying another configuration file, if need be.

• The default location of the mailpost database directory has changed from pathtmp to pathdb. If you use mailpost without an explicitly specified database directory (using the -b flag), then you should manually move your current database files mailpost-msgid.dir and mailpost-msgid.pag from pathtmp to pathdb.

• If you have been using TLS/SSL with nnrpd before, be aware that the default value of a few inn.conf parameters have changed: the server now decides the preferred cipher (instead of the client), and only TLS protocols are allowed (using the flawed SSLv2 and SSLv3 protocols is now disabled). If you want to change these settings, the respective tlspreferserverciphers and tlsprotocols parameters can be tuned to your needs.

• The --with-kerberos configure flag used to add Kerberos v5 support has been renamed to --with-krb5.

• The --with-berkeleydb configure flag used to add Berkeley DB support has been renamed to --with-bdb.

• The --enable-ipv6 configure flag no longer exists. IPv6 is now unconditionally enabled, if available.

• $HOME is no longer exported as an environment variable by innshellvars, innshellvars.tcl and the Perl module INN::Config. It was previously overriding the default user home directory with pathnews. If you use these scripts in your own scripts, you will have to take care of that change.

• Owing to the implementation of RFC 4643 (AUTHINFO USER/PASS) in innd, if remote peers have to authenticate in order to feed articles, they now have to send a username (which was previously wrongly optional), before sending their password. The mandatory username, though currently unused by innd, can be whatever the remote peer wishes. In previous versions of INN, inncheck was already complaining when passwd.nntp contained an empty username associated with a password. A manual review of authenticated feeds should then be done so as to ensure that they are properly working.

• The Injection-Date and Injection-Info header fields are now generated by nnrpd at injection time instead of the NNTP-Posting-Date, NNTP-Posting-Host, X-Complaints-To and X-Trace header fields. Local scripts that were using (for authentication, privacy, etc.) these now deprecated header fields should be updated. Also note that the Path header field of locally posted articles can also contain the contents of the deprecated NNTP-Posting-Host header field.

• The two addnntppostingdate and addnntppostinghost parameters in inn.conf have been respectively renamed to addinjectiondate and addinjectionpostinghost. innupgrade takes care of the modification only for inn.conf; a manual change will therefore be needed for readers.conf, if these parameters are overridden in this file.

• The default values of a few inn.conf parameters have changed to make use of the vastly expanded storage and RAM commonly available today: datamovethreshold (from 8192 to 16384), msgidcachesize (from 16000 to 64000), overcachesize (from 64 to 128), and wireformat (now enabled by default). The generation of status reports and performance timings are now also enabled by default: logstatus and nnrpdoverstats parameters, with a frequency of 10 minutes (status and timer parameters).

• The default value of max-queue-size has changed from 5 to 20, and use-mmap now defaults to true for innfeed.conf.

If you are upgrading from a version prior to INN 2.5, see also upgrades instructions from 2.4 to 2.5.

Bug Fixes

• The NNTP protocol requires a username to be sent before a password when authentication is used. innd was wrongly allowing only a password to be sent by authenticated peers. See the note above for more details.

• The Lines header field is no longer generated by nnrpd at injection time.

• The presence of a Subject header field beginning with cmsg no longer causes an article to be interpreted as a control message by nnrpd at injection time.

• Fixed a leak of semaphores when using buffindexed. Thanks to Richard Kettlewell for having fixed the issue.

• Other minor bug fixes and documentation improvements.

• All of the applicable bug fixes from the INN 2.5 STABLE series are also included in INN 2.6.

New Features

• The Injection-Date header field is now generated by nnrpd at injection time instead of the deprecated NNTP-Posting-Date header field, when addinjectiondate is set to true. Note that addnntppostingdate has been renamed to addinjectiondate in inn.conf.

• The Injection-Info header field is now generated by nnrpd at injection time instead of the deprecated NNTP-Posting-Host (when addinjectionpostinghost is set to true), X-Complaints-To and X-Trace header fields. Note that addnntppostinghost has been renamed to addinjectionpostinghost in inn.conf. The Path header field of locally posted articles now also contains the contents of the NNTP-Posting-Host header field.

• A new addinjectionpostingaccount parameter has been added in inn.conf. When set to true, the Injection-Info header field contains an additional posting-account attribute that mentions the username assigned to the user at connection time or after authentication. The default value for this parameter is false.

• A few header fields are now considered as obsolete by nnrpd at injection time: NNTP-Posting-Date, NNTP-Posting-Host, X-Complaints-To, X-Trace, Also-Control, Article-Names, Article-Updates, and See-Also header fields.
  Besides, nnrpd will similarly reject obsolete sendsys, senduuname and version control messages.

• nnrpd no longer differentiates IHAVE from POST. Articles injected with IHAVE are now treated as though they were injected with POST. It means that if the previous behaviour of IHAVE was expected, innd should handle itself the connection instead of nnrpd.

• The name of the pullnews configuration file is now pullnews.marks located in pathdb when pullnews is run as the news user, or otherwise in the running user's home directory. It was previously stored in .pullnews in the running user's home directory (even for the news user).

• Building with Libtool is no longer optional. The --enable-libtool option to configure has been removed.

• DESTDIR and non-root installs are now properly supported and documented in INSTALL. The make install, make update and make cert steps properly obey DESTDIR. Besides, it is no longer a requirement that the installation step be done by the superuser, as long as the user executing the install has supplied a DESTDIR value that points to a writable directory, and the person or process performing the install corrects the file ownerships when INN is installed on the system on which it's going to run. Thanks to James Ralston for this support.

• When building INN with Berkeley DB, Cyrus SASL, Kerberos v5, OpenSSL, or zlib support, no longer add standard locations to compiler and linker include flags. Such default paths are now added only if explicitly given to one or more of the --with-bdb, --with-bdb-include, --with-bdb-lib, --with-sasl, --with-sasl-include, --with-sasl-lib, --with-krb5, --with-krb5-include, --with-krb5-lib, --with-openssl, --with-openssl-include, --with-openssl-lib, --with-zlib, --with-zlib-include, or --with-zlib-lib configure flags (the flags ending with -include and -lib are new in INN 2.6.0).

• If the Berkeley DB, Cyrus SASL, Kerberos v5, or OpenSSL SSL and crypto libraries are found at configure time, INN will now be built with support for them unless respectively the --without-bdb, --without-sasl, --without-krb5, or --without-openssl flags are explicitly passed to configure. Note that it was already the default behaviour for zlib support when Berkeley DB support was also enabled.

• The configure flag --enable-reduced-depends has been added to request that library probes assume shared libraries are in use and dependencies of libraries should not be probed. It therefore tries to minimize the shared library dependencies of the resulting binaries on platforms with proper shared library dependencies. This is not enabled by default, and is of interest primarily to people building packages for distributions.

• Building INN with Python support now requires the use of Python 2.2.0 or later as the distutils.sysconfig module used was introduced with Python 2.2.0.

• The INN test suite driver is now fully synchronized with the upstream version of the C TAP Harness package maintained by Russ Allbery. Keeping the INN test suite driver up-to-date will be possible thanks to a new getc-tap-harness script in the support directory that automatically fetches the latest upstream changes.
  Similarly, the new getrra-c-util script permits keeping most of the utility and portability functions synchronized with the upstream version of the rra-c-util package maintained by Russ Allbery.

INN 2.5.5

2015-05-23
Full changes and diff from previous release

Bug Fixes

• innwatch no longer creates a child process only for sleeping and then waits on that process. The forked-off process only died after it had done sleeping, which caused the INN service to drop into maintenance state when for instance running under SMF on illumos/Solaris (since not all processes die within timeout). Thanks to Lauri Tirkkonen for the patch.

• innd no longer crashes if a channel is supposed to sleep but does not define a waker callback function. Also, the highest file descriptor of sleeping channels is now properly updated. Thanks to Petr Novopashenniy for the bug report.

• Add new -i flag to both cnfsstat and innwatch to specify how many seconds they should sleep at startup. It will especially be useful in rc.news so that these scripts are actually started and then sleep by themselves, instead of being started a minute after innd and therefore not being properly stopped if rc.news stop is invoked during that minute.

• When the creation of a newsgroup needed expanding the tradindexed group index, an already-running nnrpd was not automatically noticing newly created newsgroups. Richard Kettlewell fixed that issue.

• Fixed flushing of CNFS buffers when using NFS storage.

• Fixed how innupgrade is executed during an update of an INN installation; on a few systems like AIX, it fails to run because its taint mode was improperly declared.

• innreport now properly takes into account the time nnrpd spends writing when using SASL.

• scanlogs now only shows the first 50 lines from error log files. Otherwise, all of them were present verbatim in the daily report, and the resulting e-mail could bounce owing to its length. Thanks to Jeffrey M. Vinocur for the bug report.

• Fixed the use of the legacy AUTHINFO GENERIC command, that has been broken since INN 2.4.0 (therefore proving readers probably no longer use that method to authenticate). Thanks to Richard Kettlewell for having noticed, though, and contributed to tighten the security of the replies of this command.

New Features

• New inn.conf parameters used by nnrpd to fine-tune the TLS/SSL configuration have been added: tlsciphers, tlscompression, tlseccurve, tlspreferserverciphers, and tlsprotocols. Many thanks to Christian Mock for his contribution that permits tightening the level of security provided by TLS/SSL.

• Add new -f flag to innwatch to specify the configuration file to use, in case it is not the default innwatch.ctl file.

• Add new -t flag to mailpost to change, if needed, the default directory to use to temporarily store error messages that are sent to the newsmaster. Two paths are now tried by default: pathtmp as set in inn.conf, and then /var/tmp if pathtmp is not writable.

• Several improvements have been contributed to pullnews by Geraint Edwards: the new -a flag adds the Diablo-compatible hashfeed ability, the new -B flag triggers header-only feeding, the -m flag now permits removing header fields matching (or not) a given regexp, and rnews reporting is improved.

• Add the nnrp.access2readers.conf contribution script written by Jeffrey M. Vinocur to convert old-style nnrp.access file to readers.conf.

INN 2.5.4

2014-05-17
Full changes and diff from previous release

Highlights

• A test has been improved in innwatch.ctl so that innwatch no longer throttles innd when no overview directory exists. You should manually update your innwatch.ctl file to get this improvement.

• An up-to-date control.ctl file is provided with this release. You should manually update your control.ctl file with the new information recorded about Usenet hierarchies.

Bug Fixes

• Fixed a long-standing limitation on how controlchan and pgpverify were checking the signer of control messages. They now properly handle the case of several UIDs being defined on a single PGP key, as well as the presence of spaces into UIDs. In previous versions of INN, a few valid control messages got ignored because of that limitation (fido.ger.* and grisbi.* were for instance impacted).

• INN now properly builds fine with Flex 2.5.36 (this version introduced a change of type for a variable used by INN).

• When using funnel feeds, innfeed log files were open forever, which resulted in empty log files, once rotated by scanlogs. innfeed now reopens its log files upon receiving a HUP signal; this signal is in particular sent by scanlogs during log rotation. Thanks to Florian Schlichting for the patch.

• Exploder and process channels are now reopened when ctlinnd flushlogs is used. Otherwise, they could hold open an already deleted errlog file. The issue affected in particular controlchan or ninpaths, running as such channels.

• Fixed a buffer overflow when using imapfeed with more than a million commands during the same IMAP session. Thanks to David Binderman for the bug report.

• Fixed a segfault occurring in innd on systems where time_t is a 64-bit integer. Thanks to S.P. Zeidler for the patch.

• Fixed a segfault occurring in nnrpd when a res block was used in readers.conf without the program key.

• Fixed an issue where users were denied posting because of an overlapping buffer copy in a check nnrpd was doing. Thanks to Florian Schlichting for the patch.

• Fixed a regression that occurred in INN 2.5.3 regarding the path used by default by pullnews for its configuration file. Instead of looking in the running user's home directory, it was looking in the pathnews directory set in inn.conf. Thanks to Tony Evans for the bug report.

• When neither wget nor ncftpget nor ncftp was found at configure time, the path to the simpleftp substitution program shipped with INN was not properly set in innshellvars, innshellvars.pl, and the INN::Config Perl module. Thanks to Christian Garbs for the bug report.

• ckpasswd no longer tries to use the ndbm compatibility layer provided by Berkeley DB if Berkeley DB has been built without ndbm support. Also add support for gdbm libraries in ckpasswd.

• Fixed a Perl warning in inncheck; using defined(@array) has been deprecated since Perl 5.16.

• Fixed the occurrence of an unexpected cant select error generated by innd. Thanks to Paul Tomblin for having caught that long-standing issue.

• When building INN with Berkeley DB support, no longer add -L/usr/lib to the linker include flags; unconditionally adding it may break the build on systems using lib32 and lib64 directories.

• On a fresh INN install, motd.innd and motd.nnrpd are no longer installed by default. Instead, samples for these files are provided in pathetc, named differently so that their default contents are not displayed to news clients before they get customized.

• Other minor bug fixes and documentation improvements (like the addition in the readers.conf man page of the log and program parameters in res blocks, and the include directive).

New Features

• As the name of the radius.conf configuration file shipped with INN for the nnrpd authenticator against a RADIUS server conflicts with the libradius package, this file is renamed to inn-radius.conf (innupgrade takes care of the rename during the update).

• The attributes hash is now accessible to nnrpd Perl posting filter. As a result, filter_nnrpd.pl can make use of it. Only authentication and access Perl hooks could previously use the attributes hash. Thanks to Steve Crook for this addition.

INN 2.5.3

2012-06-15
Full changes and diff from previous release

Highlights

• Please note that the HTML_STATUS compile-time option has been replaced with the htmlstatus parameter in inn.conf. If you used HTML_STATUS, you should set htmlstatus accordingly.

• A confusion in the name of a key in innfeed.conf existed in the source code. Make sure that the misspelled, undocumented backlog-limit-high key is not used in your innfeed.conf file; its real name is backlog-limit-highwater. You should rename the key in case it is present in your configuration file. Otherwise, it will not be taken into account. You can run inncheck to verify that the syntax of this file is correct.
  It is generally recommended to run inncheck after any changes done to configuration files, especially with the new improved version of this script shipped with INN 2.5.3, thanks to the hard work of Florian Schlichting who added support for the syntax of incoming.conf, innfeed.conf, readers.conf and storage.conf.

• An up-to-date control.ctl file is provided with this release. You should manually update your control.ctl file with the new information recorded about Usenet hierarchies.

Bug Fixes

• When HDR/XHDR/XPAT were used on a new article coming into a newsgroup, requesting a header field not present in the overview database, the first subsequent OVER/XOVER command did not show that article. A remap of the overview data file was missing in nnrpd. Thanks to Sam Varshavchik for the bug report.

• When a header field appeared more than once in an article, it was missing from the overview data. OVER/XOVER, as well as HDR/XHDR/XPAT using the overview, were therefore returning an empty field. The content of the first occurrence is now returned, in accordance with RFC 3977.
  Perl and Python filters for innd now also properly initialize their header field variables with the first occurrence of header fields. (It is still the last occurrence for the Perl filter for nnrpd.)

• Fixed a possible plaintext command injection during the negotiation of a TLS layer. The vulnerability detailed in CVE-2011-0411 (and CVE-2012-3523, specifically for INN) affects the STARTTLS and AUTHINFO SASL commands. nnrpd now resets its read buffer upon a successful negotiation of a TLS layer. It prevents malicious commands, sent unencrypted, from being executed in the new encrypted state of the session.

• Fixed a regression that occurred in INN 2.5.0 when leading whitespace characters have been made significant in header field bodies. It could lead INN to drop articles and throttle itself when running as a slave because Xref header fields generated by other news servers, or even INN 2.4.6, could contain (valid) leading whitespace. Thanks to Matija Nalis for having caught this bug.

• Fixed an invalid 431 response to CHECK commands when innd is paused: the Message-ID of the article to defer was missing. Also fixed another issue in the messages innd replied; when an error occurred during a write on a channel, a trailing extra junk byte was added to the reply. Thanks to River Tarnell for these bug reports.

• cnfsheadconf now properly recognizes continuation lines in cycbuff.conf, that is to say lines ending with a backslash (\). Thanks to John F. Morse for the bug report.

• The order of CNFS buffers in a metacycbuff is now properly read and written by cnfsheadconf. There previously was a confusion between hexadecimal and decimal values. Thanks again to John F. Morse.

• When the -l flag is given to cnfsstat, the cycbuff.conf and storage.conf files are now reloaded if they have been modified since the previous output of cnfsstat.

• Fixed an issue at configure time that made INN wrongly assume that OpenBSD (4.6) didn't support Unix-domain sockets. Thanks to Wim Lewis for the patch.

• Fixed an issue on systems which do not have a working flock(2) function (Solaris, for instance). mailpost and pullnews are reported not to be usable on such systems. Many thanks to Dennis Davis for the bug report.
  A wrapper around shlock is now called in Perl scripts. The INN::Utils::Shlock module has been added for that use.

• Fixed an issue in the Python access hook for nnrpd: it has not been working since Python 2.5 on 64-bit platforms, owing to a change to Python's C API, using a new Py_ssize_t type definition instead of int. Thanks to Raphael Barrois for the patch.

• Improve the stability of the Perl filters for innd and nnrpd: properly save and restore the stack pointer when needed.

• controlchan now imposes a date cutoff on processing control articles. The artcutoff parameter set in inn.conf is used. Otherwise, without that cutoff, old control articles could be maliciously reinjected into Usenet, and replayed. (An unsigned Injection-Date header field could be added to an article that only had a Date header field.) A new -c flag has been added to controlchan to disable the cutoff check, if needed (usually when manually invoking the program).

• nnrpd no longer adds or updates the Path header field when an article is forwarded to a moderator. It could otherwise lead to rejects at injection time when the article was approved by the moderator.

• The X-Trace header field was not properly generated when an article was locally posted. The field mentioning the IP address was skipped, resulting in a wrong syntax for this header field. The local 127.0.0.1 IP address is now used. Besides, localhost is now mentioned instead of an obscure stdin in injection header fields.

• Fixed a bug in the frequency innfeed logs its status: too many useless lines were written to news.notice. Thanks to Florian Schlichting for the fix.

• When unset in innfeed.conf, the dynamic-method parameter now properly defaults to 3 (instead of 0) and use-mmap to false (instead of true). These two values were already the recommended ones in the documentation and the sample file. Note that use-mmap is only used when innfeed is given file names to send instead of storage API tokens, which is a fairly rare use case.

• innfeed no longer generates an error message (logged in news.err) when a parameter is not defined in innfeed.conf. All the parameters have a default value, so there is no need to warn the user if they are not present in innfeed.conf. Thanks to Dieter Stussy for having reported this problem.

• Implement an upper limit to the number of file descriptors innd can handle. At most (FD_SETSIZE-1) file descriptors can be used. This upper limit now overrides any superior number set with rlimitnofile in inn.conf. Thanks to Steve Crook for the bug report.

• A default timeout on outgoing sockets (using NNTPconnect) has been added by Florian Schlichting. For a long time, there have been occasional problems with actsync (and probably other programs) that would hang until manually killed or restarted.

• inncheck now properly finds the boundaries of substituted variables in newsfeeds thanks to Alexander Bartolich.

• docheckgroups no longer uses AWK. On a few systems, the script was failing because of the presence of an old version of AWK that has a limit in the size of the input it can handle. Processing large newsgroups files was consequently impossible. docheckgroups now uses Perl instead of AWK, which solves the issue reported by John F. Morse.

• pullnews no longer stops processing newsgroups when an error occurs during its run (for instance when a newsgroup mentioned in the configuration file is removed from an upstream server). Besides, it can now use authentication when posting to the downstream server.
  A few other minor bugs have been fixed as for the way pullnews counts the articles.

• Fixed the way innreport handles leap years. It now properly generates HTML reports; dates were assumed to be relative to the current year, which may break their computation during for instance the whole 2012 leap year. Please note that no HTML reports have been lost, and that they will appear when INN is updated to this new version.

• Other minor bug fixes and documentation improvements. In particular, the debug-shrinking, fast-exit and initial-sleep keys in innfeed.conf are now documented. The function filter_end(), called when Perl filtering is turned off, is also documented for the innd and nnrpd Perl filters.

New Features

• It is now possible to properly generate daily statistics with sendinpaths thanks to the new -k and -r flags that permit controlling the interval of days for processing dump files. The new -c flag permits sending a copy of the generated e-mail to the newsmaster.
  Also fixed an issue with statistics that could be missing or duplicated for a couple of days when monthly sent.
  The documentation has been updated and mentions a preferred daily run of sendinpaths. This script is a complete rewrite in Perl, and is based on Mohan Kokal's initial work.

• A single header field line is limited to 998 bytes, per RFC 5536. innd was previously accepting, and also generating Xref header field lines, up to 1022 bytes. Now, nnrpd (acting as an injecting agent) rejects articles which contain header field lines whose length exceeds 998 bytes. And innd (acting as a relaying or serving agent) no longer checks that.

• nnrpd advertises the COUNTS, DISTRIBUTIONS, MODERATORS, MOTD and SUBSCRIPTIONS variants of the LIST command in response to CAPABILITIES. These commands already existed in nnrpd but RFC 6048 had not yet been published.

• Add support for LIST MOTD in innd. Consequently, the motd.news configuration file which was previously used only by *...

INN 2.5.2

2010-03-24
Full changes and diff from previous release

Highlights

• The way checkpoints are handled by innreport for innd and innfeed has totally changed to provide more accurate daily statistics. The first Usenet report after an upgrade to INN 2.5.2 will probably contain incorrect statistics for incoming and outgoing articles because the beginning of the log files that will be used was generated by a previous version of INN.

• A new version of innreport.conf is shipped with INN 2.5.2 but, in order to preserve any local changes, will not be automatically installed with make update. The changes are minor and not mandatory for the upgrade.

• Julien Elie has implemented in innd the new version of the NNTP protocol described in RFC 3977, RFC 4643 and RFC 4644, and innd now recognizes the CAPABILITIES command. Despite these standards, three commands (IHAVE, CHECK and TAKETHIS) will continue, for interoperability reasons, to return a reject code (respectively 435, 438, and 439) when the command contains a syntax error instead of 501. The mandatory username argument for authenticated peers is not enforced in INN 2.5.2 but will be enforced by INN 2.6.0 when it is released.

Bug Fixes

• The keyword generation code now generates a Keywords header field only if the original article does not already have one. The generated Keywords header field no longer begins with a comma. If keyword generation is set to true in inn.conf but the Keywords header field is not stored in the overview, the news administrator is warned and keyword generation deactivated, since it exists only to populate the overview data.

• Two segfaults in keyword generation were fixed. The first occurred when an article already had a Keywords header field longer than the keylimit parameter. The second was caused by a possible invalid pointer beyond the newly allocated Keywords header field.

• Fixed innd handling of empty lines. innd was not properly discarding an empty command and was closing the connection when it received only whitespace in a command.

• Fixed a bug in how innd responded to reader commands when readers were not allowed. A superfluous blank line was sent in its response.

• Fixed a bug in innd's response to TAKETHIS when authentication is required. Previously, 480 code was returned immediately without accepting the multi-line data block first, which broke synchronization in the NNTP protocol.

• Fixed a bug in recognizing the article terminator when empty articles were fed to innd via IHAVE or TAKETHIS, leading to treating subsequent NNTP commands as part of the article.

• When innd could not provide information for LIST ACTIVE.TIMES and LIST NEWSGROUPS, it was returning an invalid error message without a response code. The proper 503 answer code is now returned.

• When an unauthenticated user tried to post an article, nnrpd replied 440 (posting not allowed) instead of the correct 480 (authentication required) response if the user might be able to post after authentication. Thanks to Daniel Weber for the bug report.

• Fixed a bug in both innd and nnrpd answers to LIST commands where the output was not checked for valid dot stuffing.

• Fixed a bug leading to junked non-control articles being sent to control-only feeds, and also fixed handling of poisoned control groups. Thanks to Andrew Gierth for the patch.

• Fixed a bug in innreport leading to incorrect summing of innd stats when hostname was set to an IPv6 address instead of a fully qualified domain name. Thanks to Petr Novopashenniy for the bug report.

• Changed how innreport uses innd and innfeed checkpoint messages. Previously, connections held open for multiple days led to skewed and incorrect statistics on how many articles had been received or sent. The count is now more accurate and, for each connection of a feed, only depends on incominglogfrequency in inn.conf and stats-period in innfeed.conf.

• Fixed a bug in nnrpd Perl filter: a header field whose name begins with the name of a standardized header field was not properly handled.

• Fixed a bug in how innd was parsing Message-ID and Supersedes header field bodies which contained trailing whitespace. The article was corrupted by an unexpected \r in the middle of the header field body. nnrpd now checks the syntax of the Message-ID header field, if present.

• Fixed various bugs in how leading whitespace was treated in header fields. The HDR, XHDR and XPAT commands were not properly showing leading whitespace in header field bodies. Lone \n and \r characters are now changed into spaces and \r\n is just removed. archive, makehistory, and tdx-util now keep leading whitespace in header field bodies when generating overview data, and archive now changes \n (when not preceded by \r) into a space when generating overview data.

• Fixed a bug in the generation of overview data which may corrupt previously generated overview data when a pseudo Xref header field is injected in an extra overview field.

• Fixed a bug in the parsing of the ovgrouppat wildmat in inn.conf that prevented overview data from being generated when poisoned groups were specified but a latter sub-pattern matched the group. A uwildmat expression is now correctly handled, and a potential segfault has been fixed. Thanks to Dieter Stussy for the bug report.

• Fixed a bug when HDR, XHDR and XPAT were used when virtualhost was set to true in readers.conf. The Xref header field of articles posted to only one newsgroup appeared empty.

• HDR and OVER commands now return the correct 423 code (instead of 420) when the current article number is used but the article no longer exists.

• Fixed a bug in tdx-util in parsing empty overview fields when called with -A or -F.

• Fixed a bug in cvtbatch, which was returning only the size of the headers of an article when the b parameter was used with the -w flag. It now correctly returns the size of the whole article, which is what b was documented to do. cvtbatch also has a new t parameter, which can be used with the -w flag to retrieve the arrival time of an article.

• Fixed a bug in how mailpost handles cross-posting feature. It was not properly detaching from sendmail. Thanks to Harald Dunkel for the patch.

• Fixed a bug in the newsfeeds C flag: the count of followup groups was one less than the real number. When the value of the Followup-To header field is poster, it is no longer considered to be a followup. Thanks to Dieter Stussy for the patch.

• When using tradindexed, the overview data for a cancelled article is now immediately removed from the overview. Thanks to Lars Magne Ingebrigtsen for the patch.

• batcher has not supported the retrieval of an article with its file name for a long time. The -S flag has therefore been removed.

• inews no longer rejects articles that contain more than 50 header fields. Thanks to Torsten Jerzembeck for the bug report.

• news.daily no longer sends superfluous mails when the nomail keyword is given. Mail is only sent when there is real output. Previously, there would always be headings and empty lines left over from the structuring of the full report, which are now omitted. Also, the output of programs executed with postexec is now included in the regular mail. Thanks to Florian Schlichting for the patch.

• innconfval no longer maps NULL string or list values to an empty string or list and instead maps them to undefined values. This fixes an issue reported by Kamil Jonca: nnrpd was inserting an empty Organization header field when the organization parameter in inn.conf was unset.

• Other minor bug fixes and documentation improvements.

New Features

• innd now has a decent parser for NNTP commands. The parser is more correct (commands like IHAVE<mid>, without a space between the command and its argument, are no longer valid) and allows leading and trailing whitespaces in commands. innd also now checks the length of the NNTP command sent by the client. If the command contains more than 512 bytes (or 497 bytes for an argument), an error is returned and the command is discarded. After ten unrecognized commands, innd closes the connection with the appropriate code (400 instead of 500).

• The output of the HELP command specifies the arguments expected by NNTP commands, similar to nnrpd's HELP command.

• LIST ACTIVE, LIST ACTIVE.TIMES and LIST NEWSGROUPS now allow an optional wildmat argument to restrict the results of those commands to specific newsgroups.

• LIST SUBSCRIPTIONS now accepts an optional wildmat argument to restrict the results of this command to specific newsgroups.

• When using HEAD or STAT with an article number or a range, 412 (no group selected) is now returned instead of 501 (syntax error).

• Jeffrey M. Vinocur has implemented support in both innd and nnrpd for whitespace in usernames/passwords provided with AUTHINFO USER/PASS. They were previously treated as invalid arguments or incorrectly parsed. innd and nnrpd now treat everything after the first whitespace character following AUTHINFO USER/PASS, up to, but not including, the final CRLF, as the username/password, in conformity with RFC 4643.

• The syntax of Message-IDs is now based on RFC 5536 (USEFOR) instead of RFC 1036. The major change is that quoted-pairs have been removed from the syntax.

• The Perl and Python filters for innd now check the Message-ID of articles arriving through TAKETHIS. Only CHECK and IHAVE commands previously used them.

• Case-insensitive matches are now used for distribu...

INN 2.5.1

2009-10-12
Full changes and diff from previous release

Bug Fixes

• Fixed a segfault in imap_connection which could occur when SASL was used.

• Fixed a segfault in the keyword generation code which was assuming that an article was nul-terminated. Fixed another segfault in the keyword generation code when an article already contained a Keywords header field. Thanks to Nix for the bug reports.

• Fixed a memory allocation problem which caused nnrpd to die when retrieving via HDR/XHDR/XPAT the contents of an extra overview field absent from the headers of an article. The NEWNEWS command was also affected on very rare cases. Thanks to Tim Woodall for the bug report.

• HDR/XHDR/XPAT answers are now robust when the overview database is inconsistent. When the overview schema was modified without the overview database being rebuilt, wrong results could be returned for extra fields (especially a random portion of some other header field). The desired header field name is now explicitly searched for in the overview information.

• Fixed the source which is logged to the news log file for local postings when the local server is not listed in incoming.conf. A wrong name was used, taken amongst known peers. The source is now logged as localhost.

• Fixed a bug in the timecaf storage method: only the first 65535 articles could be retrievable in a CAF, though everything was properly stored. (A Crunched Article File contains all the articles that arrive to the news server during 256 seconds.)
  The storage token now uses 4 bytes to store the article sequence number for timecaf, instead of only 2 bytes. Thanks to Kamil Jonca for the bug report and also the patch.

• Fixed a bug in both timecaf and timehash which prevented them from working on systems where short ints were not 16-bit integers.

• The default value for /remember/ has changed from 10 to 11 because it should be one more than the artcutoff parameter in inn.conf, so that articles posted one day into the future are properly retained in history.

New Features

• Owing to the US-CERT vulnerability note VU#238019, Cyrus SASL library has slightly changed. imap_connection and nnrpd now handle that change. Otherwise, some answers are too long to be properly computed during SASL exchanges.

• When there is not enough space to write an entire CAF header, the timecaf storage manager now uses a larger blocksize. On 32-bit systems, the CAF header is about 300 bytes, leaving about 200 bytes for the free bitmap index (the remaining of a 512-byte blocksize). On 64-bit systems, the size of the CAF header could exceed 512 bytes, thus leaving no room for the free bitmap index. A 1 KB blocksize is then used, or a larger size if need be.

• A new CNFS version has been introduced by Miquel van Smoorenburg in the CNFS header. CNFSv4 uses 4 KB blocks instead of 512 bytes, which more particularly makes writes faster. CNFSv4 supports files/partitions up to 16 TB with a 4 KB blocksize.
  Existing CNFS buffers are kept unchanged; only new CNFS buffers are initialized with that new version.

• grephistory -l now returns the contents of the expires history field as well as the hash of the Message-ID. Besides, when the storage API token does not exist, grephistory -v now also returns the hash of the requested Message-ID.

• The check on cancel messages when verifycancels is set to true in inn.conf has been changed to verify that at least one newsgroup in the cancel message can be found in the article to be cancelled. This new feature is from Christopher Biedl.
  The previous behaviour was to check whether the cancel message is from the same person as the original post, which is extremely easy to spoof; besides, RFC 5537 (USEPRO) mentions that "cancel control messages are not required to contain From and Sender header fields matching the target message. This requirement only encouraged cancel issuers to conceal their identity and provided no security".

• The way the /remember/ line in expire.ctl works has changed. History retention for an article was done according to its original arrival time; it is now according to its original posting date. Otherwise, unnecessary data may be kept too long in the history file.
  To achieve that, the HISremember() function in history API now expects a fourth parameter: the article posting time.
  Note that article expiration has not changed and is still based on arrival time, unless the -p flag is passed to expire or expireover, in which case posting time is used.

• auth_krb5 has been rewritten by Russ Allbery to use modern Kerberos APIs. Note that using ckpasswd with PAM support and a Kerberos PAM module instead of this authenticator is still recommended.

• A new -L flag has been added by Jonathan Kamens to makehistory so as to specify a load average limit. If the system load average exceeds the specified limit, makehistory sleeps until it goes below the limit.

• As UTF-8 is the default character set in RFC 3977, ctlinnd pause, ctlinnd readers, ctlinnd reject, ctlinnd reserve, ctlinnd throttle and nnrpd -r commands now require the given reason to be encoded in UTF-8, so that it can be properly sent to news readers. The creator's name given to ctlinnd newgroup is also expected to be encoded in UTF-8.

• The output of consistency checks for article storage and the history file no longer appears by default when cnfsstat -a is used. A new -v flag has been added to cnfsstat so as to see it.

• The default path for TLS certificates has changed from pathnews/lib to pathetc. It only affects new INN installations or generations of certificates with make cert. Besides, a default value has been added to tlscapath because it is required by nnrpd when TLS is used.

• gzip(1) is now the default UUCP batcher in send-uucp instead of compress(1) because gzip is more widely available than compress, due to old patent issues. Note that there is no impact on decompression as it is handled by rnews.

• cnfsheadconf now uses the Perl core module Math::BigInt rather than the deprecated bigint.pl library. When used without specifying a CNFS buffer, it now properly displays the status of all CNFS buffers.

INN 2.5.0

2009-05-21
Full changes and diff from previous release

Upgrading from 2.4 to 2.5

The following changes require your full attention because a manual intervention may be needed:

• In order to process control messages, controlchan now needs the MIME::Parser module. Packages are available from most distributions, or you can install the module directly from CPAN (MIME-tools in modules/by-module/MIME/, for instance on ftp.perl.org).
  Perl 5.8.0 or later is recommended for INN. If you are using an earlier version, you will also need the Encode module for correct processing of control messages. (It is included with Perl itself in 5.8.0 and later.)

• Checkgroups control messages are now differently handled by controlchan: all matching lines in control.ctl will be used for a given checkgroups and a doit action will really be executed (adding, removing and changing the status of newsgroups). You should make sure that your local configuration does not rely on the previous behaviour of only mailing changes, without actually performing them.

• You should use the new control.ctl.local file shipped with INN in pathetc and, at the same time, update your control.ctl and moderators files. Also make sure that your active.times, distrib.pats and newsgroups files are properly encoded in UTF-8, as it is strongly recommended by RFC 3977.

• The overview.fmt file is no longer used by INN. Two new parameters have been added to inn.conf: extraoverviewadvertised and extraoverviewhidden. Although innupgrade takes care of the change during make update, you should make sure that your overview database is consistent with all the fields declared in overview.fmt because they will all be advertised, and Xref:full forced as the eighth overview field. See the inn.conf(5) man page for more information about these parameters.

• The innreport configuration file has slightly changed. The new innreport.conf file shipped with INN should be used and your possible changes backported to this new version.

• The $SPOOLBASE variable has been renamed to $SPOOLDIR in innshellvars in order to be more consistent. It impacts shell scripts only. If you import innshellvars and use that variable in your scripts, you will have to rename it.

• gpgverify is no longer included in INN, pgpverify now has better support for GnuPG and should be used instead.

• The auth_smb authenticator program to check passwords with an SMB authentication is no longer included in INN. It was a stripped-down version of pam_smbpass(5), wasn't maintained, and likely had security problems. To authenticate to an SMB server such as Samba, use PAM and ckpasswd's PAM support instead.

• The parameters used by nnrpd to provide TLS support are now tlscafile, tlscapath, tlscertfile and tlskeyfile in inn.conf. The sasl.conf file used for that in previous versions of INN is obsolete. innupgrade takes care of the change during make update.

• The nntpactsync parameter has been renamed to incominglogfrequency in inn.conf; innupgrade handles this renaming during the update.

• In newsfeeds, innfeed should be run directly rather than through startinnfeed. innupgrade will attempt to take care of this modification during make update.
  When starting innd by hand, innd can just be run directly rather than using inndstart. If you get error messages about resetting the file descriptor limits, you may need to increase the file descriptor limits. See the sample init script in contrib for an example of how to do this.

If you are upgrading from a version prior to INN 2.4, see also upgrades instructions from 2.3 to 2.4.

Bug Fixes

• If strippath is set in readers.conf, the whole user-supplied Path header field will now be stripped. Previously, the final component of the user-supplied Path header field body would still be retained.

• Fixed a bug in ctlinnd renumber which was resetting the low and high water marks of empty newsgroups in the active file. This command now makes the low water mark one more than the real high water mark. The answers to LIST ACTIVE, GROUP and LISTGROUP have also been fixed to do that.

• All of the applicable bug fixes from the INN 2.4 STABLE series are also included in INN 2.5.

New Features

• Ken Murchison has contributed SASL authentication support for nnrpd, implementing the AUTHINFO SASL section of RFC 4643. If the --with-sasl option is given to configure, nnrpd will be able to authenticate clients via secure SASL mechanisms.

• Julien Elie has implemented in nnrpd the new version of the NNTP protocol described in RFC 3977, RFC 4642 and RFC 4643. Consequently, nnrpd now recognizes the CAPABILITIES command, the HDR and LIST HEADERS commands, the second optional argument to specify a range of articles to LISTGROUP, the OVER command, as well as the :bytes and :lines metadata items.

• Heath Kehoe has added the ability to compress overview data before it is stored in ovdb. It significantly improves the performance of this storage method and reduces the time spent by expireover. See the new --with-zlib option to configure and the ovdb(5) man page.

• Alexander Bartolich has greatly improved innreport and especially its XHTML output (an XSL transformation is also provided, if needed, in innreport-filter.xslt, in the contrib directory).

• inndstart and startinnfeed are no longer part of INN and are no longer used. Instead, a separate setuid root helper program written by Russ Allbery is used to bind to the news ports (and does only that), and is run by innd and nnrpd when necessary. This means that INN may not be able to increase file descriptor limits for itself the way that it could before. If you get error messages about resetting the file descriptor limits, you may need to increase the file descriptor limits as root before running rc.news as the news user. See the sample init script in contrib for an example of how to do this. More information on file descriptor limits can be found in INSTALL.

• INN's IPv6 support was largely rewritten by Russ Allbery. IPv4 and IPv6 are now handled through the same code wherever possible, the new IPv6-aware APIs are used everywhere possible, and replacement functions are provided for systems that don't have them yet. The network code is now much more centralized, eliminating lots of duplicate code and adding better IPv6 support to some utilities.

• INN now uses Autoconf 2.61 or later for configuration. As a result, some configure options have changed slightly and more of the standard --*dir options should be supported in lieu of the old INN-specific options. See configure --help for the available options.

• Thanks to Kirill Berezin, the buffindexed overview method now supports buffers larger than 2 GB. It is not necessary to compile INN with large file support to use such large buffers with buffindexed. Buffindexed is now also more robust with mmaped files and uses more optimized data placement.

• tinyleaf, a miniature IHAVE-only leaf server written by Russ Allbery, is now included. See the tinyleaf(8) man page for more information.

• controlchan recognizes the new application/news-groupinfo entity described in USEPRO and can handle character set conversions of newsgroup descriptions. The MIME::Parser and Encode modules are used. Processing control messages has been greatly improved, especially checkgroups: the active and newsgroups files are now properly updated when they are processed, and all matching lines in control.ctl for a given checkgroups are honoured (which for instance allows using both drop and doit actions for the same checkgroups message).
  A new control.ctl.local file has also been added in pathetc. Rules set in that file override rules in control.ctl, allowing administrators to specify local rules for some control messages without modifying the control.ctl configuration file that comes with INN. It also specifies encodings to use for the newsgroups file. By default, UTF-8 will be used for newsgroup descriptions, as strongly recommended by RFC 3977.

• The Perl and Python filter_mode hooks are now called when innd is shutting down via either ctlinnd shutdown or ctlinnd xexec with a new mode value of shutdown. This will allow the Perl hooks to save filter data across innd restarts without requiring that the news administrator throttle the server first. (Python already had a separate close hook that is also called.)

• The legacy innshellvars.pl script has been replaced with a real INN Perl module INN::Config for Perl programs. The location of Perl modules can be set with the --with-libperl-dir option to configure. All Perl scripts shipped with INN have been converted to use that module. You may want to consider using INN::Config in your Perl scripts, though innshellvars.pl is still provided with INN.

• Support for embedded Tcl filters in innd has been removed. It hasn't worked for some time and causes innd crashes if compiled in (even if not used). If someone wants to step forward and maintain it, we recommend starting from scratch and emulating the Perl and Python filters.

• news2mail can now set the envelope-from address of the mails it sends. A third optional part in news2mail.cf entries has been added by D. Stussy to achieve that.

• The -g option to nnrpd is no longer supported. If you are verifying passwords against the system password database, see the ckpasswd(8) man page, and in particular the -s option. (A much better idea would be to just use PAM, which ckpasswd supports.)

• Support...

INN 2.4.6

2009-02-27
Full changes and diff from previous release

Highlights

• An updated moderators file with information about the aioe.*, perl.* and si.* hierarchies is provided.

• An updated control.ctl file is provided.

Bug Fixes

• Fixed the segfault of the radius authenticator when none of the radius servers respond. Thanks to Matija Nalis for this patch.

• Fixed a lost initialization in buffindexed, which resolves a potential segfault, thanks to a patch by Kirill Berezin.

• INN now properly supports Perl 5.10.0 (and also 5.8.9); Perl filters were causing innd to segfault on a few systems like FreeBSD.

• Fixed a long-standing bug which affected Perl hooks for innd: the variable containing the body of an article was not properly created, which caused regular expressions matching new lines to fail. It especially affected filters like Cleanfeed which sometimes failed to detect unwanted articles.
  To fix that issue, Julien Elie added the use of a shared string, available since Perl 5.7.2, with a fall back to a slower but reliable copy of such bodies in case the function is not available. Using a Perl version superior to 5.7.2 is therefore recommended.

• Fixed two bugs which could prevent nnrpd from being run as a daemon in FreeBSD. Thanks to Johan van Selst for having identified the problem and to Kai Gallasch for having provided a testing FreeBSD server. The listening address was not initialized to ::0 or 0.0.0.0 when the -b flag was not used and an incorrect size was given when IPv6 was enabled and the binding done using IPv4.

• Some annoying assertion failures occurring in innfeed have been fixed by Russ Allbery and Julien Elie.

• Fixed a bug in mod-active for aliased newsgroups. Only = was written to the active file. Thanks to D. Stussy for this patch.

• Fixed a bug which caused innd not to honour the Ad flag in newsfeeds.

• Fixed a bug in the IP address displayed for localhost in innd's status file. It was not correctly initialized.

• Fixed a permission issue: XHDR and XPAT were not checking the rights the user had to read articles when accessing them by their Message-ID.

• Fixed a bug in the replies of XHDR, XOVER and XPAT when the newsgroup is empty. Two initial replies were sent instead of one: the right 420 code followed by a wrong 224 code.

• When no newsgroup is selected, LISTGROUP now returns the right 412 code (instead of 481).

• Other minor bugs have also been fixed.

New Features

• inncheck now uses a range of permissions to see whether the file modes are correctly set. Therefore, different configurations depending on the security the user wants to enforce on his system are possible.

• A new improved version of docheckgroups is shipped with INN. The -u flag permits updating automatically the newsgroups file (with a proper number of tabulations and an alphabetical sort), removing obsolete descriptions and adding new ones. A second argument on command-line permits specifying which newsgroups should not be checked, so as not to treat them.

• An email= keyword has been added by James Ralston to news.daily in order to supply another mail address than the one set at configure time for Usenet daily reports.

• INN supports Berkeley DB 4.7, which is the recommended version to use owing to various bugs affecting previous versions of Berkeley DB.

INN 2.4.5

2008-06-29
Full changes and diff from previous release

Bug Fixes

• Fixed the "alarm signal" around SSL_read in nnrpd: it allows a proper disconnection of news clients which were previously hanging when posting an article through an SSL connection. Moreover, the clienttimeout parameter now works on SSL connections. Thanks to Matija Nalis for the patch.

• Fixed a segmentation fault when an article of a size greater than remaining in the stack is retrieved via SSL. Thanks to Chris Caputo for this patch.

• Fixed a few segfaults and bugs which affected both Python innd and nnrpd hooks. They no longer check the existence of methods not used by the hooked script. An issue with Python exception handling was also fixed, as well as a segfault fixed by Russ Allbery which happened whenever one closes and then reopens Python in the same process. Julien Elie also fixed a bug when reloading Python filters (they were not always correctly reloaded) and a segfault when generating access groups with embedded Python filters for nnrpd. Many thanks to David Hlacik for its bug reports.

• Fixed a bug in INN.py and add missing methods to it.

• Fixed a long-standing bug in innreport which prevented it from correctly reporting nnrpd and innfeed log messages.

• Fixed a hang in Perl hooks on (at least) HP/PA since Perl 5.10.

• Fixed a compilation problem on some platforms because of AF_INET6 which was not inside a HAVE_INET6 block in innfeed.

• Fixed a bug in innfeed which contained thrice the same IPs for each peer; it unnecessarily slowed the peer IP rotation for innfeed. Thanks, D. Stussy, for having seen that. Miquel van Smoorenburg provided the patch.

New Features

• SO_KEEPALIVE is now implemented for SSL TCP connections on systems which support it, allowing system detection and closing the dead TCP SSL connections automatically after system-specified time. Thanks to Matija Nalis for the patch.

• The nnrpd.py stub file in order to test Python nnrpd hooks, as mentioned in their documentation, is now installed; only INN.py was previously installed in pathfilter.

• A new heavily improved version of pullnews is shipped with this INN release. This new version is provided by Geraint Edwards. He added no more than 16 flags, fixed some bugs and integrated the backupfeed contrib script by Kai Henningsen, adding again 6 other flags. A long-standing but very minor bug in the -g option was especially fixed and items from the to-do list implemented. Many thanks again to Geraint Edwards.

• New header fields are accessible through Perl and Python innd filtering hooks. You will find the exact list in the INN Python Filtering and Authentication Hooks documentation (doc/hook-python) and in Python samples. Thanks to Matija Nalis for this addition of new useful header fields.

• New samples for Python nnrpd hooks are shipped with INN: nnrpd_access.py for access control and nnrpd_dynamic.py for dynamic access control. The nnrpd_auth.py script is now only used for authorization control. See the readers.conf man page for more information (especially the python_auth, python_access and python_dynamic parameters). The documentation about INN Python Filtering and Authentication Hooks has also been improved by Julien Elie.

INN 2.4.4

2008-05-05
Full changes and diff from previous release

Highlight

• The sample control.ctl file has been extensively updated.

Bug Fixes

• Fixed incomplete checking of packet sizes in the ctlinnd interface in the no-Unix-domain-sockets case. This is a potential buffer overflow in dead code since basically all systems INN builds on support Unix domain sockets these days. Also track the buffer size more correctly in the client side of this interface for the Unix domain socket case.

• Group blocks in incoming.conf are now correctly parsed and no longer cause segfaults when loading this file.

• Fixed a problem with innfeed continuously segfaulting on amd64 hardware (and possibly on lots of 64-bit platforms). Many thanks to Ollivier Robert for his patch and also to Kai Gallasch for having reported the problem and provided the FreeBSD server to debug it.

• scanlogs now rotates innfeed's log file, which prevents innfeed from silently dying when its log file reaches 2 GB.

• Some news clients hang when posting an article through an SSL connection: it seems that nnrpd's SSL routines make it wrongly wait for data completion. In order to fix the problem, the select() wait is now just bypassed. However, the idle timer stat is currently not collected for such connections. Thanks to Kachun Lee for this workaround.

• Fixed a bug in the display of the used compressor (cunbatch was used if arguments were passed to gzip or bzip2).

• Fixed a bug in mailpost and pullnews which prevented useful error messages to be seen. Also add the -x flag to pullnews in order to insert Xref header fields in articles which lack one.

• ovdb_init now properly closes stdin/out/err when it becomes a daemon. The issue was reported by Viktor Pilpenok and fixed by Marco d'Itri.

• perl-nocem will now check for a timeout and re-open the socket if required. Additionally, perl-nocem will switch to cancel_ctlinnd in case cancel_nntp fails after sending the Message-ID. Thanks to Christoph Biedl for the patch. A more detailed documentation has also been written for perl-nocem(8).

• Checkgroups when there is nothing to change no longer result in sending a blank mail to administrators. Besides, no mail is sent by controlchan for the creation of a newsgroup when the action is no change.

• Checkgroups are now properly propagated even though the news server does not carry the groups they are posted to.

• Fixed empty LISTGROUP replies which were not terminated. Thanks to David Canzi for the patch.

• Other minor bug fixes and documentation improvements.

New Features

• Perl 5.10 support has been added to INN thanks to Jakub Bogusz.

• If compiling with Berkeley DB, use its ndbm compatibility layer for ckpasswd in preference to searching for a traditional dbm library. INN also supports Berkeley DB 4.4, 4.5 and 4.6 thanks to Marco d'Itri.

• Added support for Diablo quickhash and hashfeed algorithms. It allows distributing the messages among several peers (new Q flag for newsfeeds). Thanks to Miquel van Smoorenburg for this implementation in INN.

• innd now listens on separate sockets for IPv4 and IPv6 connections if the IPV6_V6ONLY socket option is available. There might also be operating systems that still have separate IPv4 and IPv6 TCP implementations, and advanced features like TCP SACK might not be available on v6 sockets. Thanks to Miquel van Smoorenburg for this patch.

• The two configuration options bindaddress and bindaddress6 can now be set on a per-peer basis for innfeed. Setting bindaddress6 to none tells innfeed to never attempt an IPv6 connection to that host. Thanks to Miquel van Smoorenburg for this patch.

• Added an nnrpdflags parameter to inn.conf (modelled on the concept of innflags) to permit passing of command line arguments to instances of nnrpd spawned from innd.

• A new inn.conf parameter called pathcluster has been added: it allows appending a common name to the Path header field body on all incoming articles. pathhost and pathalias (if set) are still appended to the path as usual, but pathcluster is always appended as the last element (e.g. on the leftmost side of the Path header field body). Thanks to Miquel van Smoorenburg for this feature.

• simpleftp has been rewritten to use Net::FTP. Indeed, ftp.pl is no longer shipped with Perl 5 and the script did not work.

• The RADIUS configuration is now wrapped in a server {} block in radius.conf.

• controlchan and docheckgroups now handle wire format messages so that articles from the spool can be directly fed to them.

• Newgroup control messages for existing groups now change their description. If a mail is sent to administrators, it reminds them to update their newsgroups file. It also warns when there are missing or obsolete descriptions. Furthermore, the newsgroups file is now written prettier (from one to three tabulations between the name of the group and its short description) and to.* groups cannot be created.

• In response to a LIST [file] command, if the file does not exist, we assume it is not maintained and return 503 instead of 215 and an empty file. Moreover, capability to LIST ACTIVE.TIMES for a wildmat pattern as its third argument has been added in order to select wanted newsgroups.

• inews now tries to authenticate if it does not receive a 200 return code after MODE READER. Indeed, it might be able to post even with a 201 return code and also with another codes like 440 or 480.

• If creating a new history file, set the ownership and mode appropriately. inncheck also expects fewer things to be private to the news user. Most of the configuration files will never contain private information like passwords.