Hi Julien,

Le Lundi 08 février 2021 à 21:44 UTC, Julien ÉLIE écrivait sur news.software.nntp :

https://code.th-h.de/?p=usenet/INN.git;a=tree;f=filter

I think I've succeffuly rewrited those hooks to be RFC 8315 compliant.

If that works and looks good, tell me how to (and where) submit these.

As Thomas reads this newsgroup, just provide a link to your patch.

I've put the files on a webpage here:
https://home.gegeweb.org/rfc8315.html

Patch files:
https://home.gegeweb.org/files/filter_nnrpd.pl.patch https://home.gegeweb.org/files/cleanfeed.local.patch

And also (article in French) on my Gemini capsule: gemini://home.gegeweb.org/rfc8315-inn.gmi

I use these patch on my two servers.
Works fine, and tested a posting with slrn an libcanclock (sha-1) from
another server and the cancel from mine. Cancel wath accepted for the
sha-1 lock/key added on client side. Not tested with a MD5 key/lock,
but should works too.
If key/lock doesn't match cancel is refused, posted localy or from feed.

Thanks for it!

You're welcome!

--
On ne le dira jamais assez, l'anarchisme, c'est l'ordre sans le
gouvernement ; c'est la paix sans la violence. C'est le contraire
précisément de tout ce qu'on lui reproche, soit par ignorance, soit
par mauvaise foi. -+- Hem Day -+-

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Gérald Niel wrote:

Julien ÉLIE wrote:

When this feature will be natively integrated into INN, it will be even easier.

Theres is the libcanlock that could be used.
Not avaialable yet on FreeBSD ports, but available on Linux Debian
based  : https://micha.freeshell.org/libcanlock/

There is a NetBSD (pkgsrc) package available too: <https://ftp.netbsd.org/pub/pkgsrc/current/pkgsrc/news/libcanlock/README.html>

Unfortunatly the v3 doesn't works yet with slrn (on client side).

libcanlock V3 can be configured to emulate the V2 API (with the option "--enable-legacy-api", which is used by default). This is sufficient
for slrn, but the V2 API has no support for SHA2.

There are patches for slrn to use the V3 API: <https://micha.freeshell.org/libcanlock/#patches>
The hash algorithm can then be configured via "canlock_algo".
Quoted from the patched manual:
|
| 6.7.1. canlock_algo
|
| Type: string
| Default: "SHA256"
|
| If slrn is configured to put cancel-locks into the articles you post,
| then this variable is used to select the hash algorithm for <scheme>
| and HMAC (used as recommended in Section 4 of RFC 8315).
|
| The default value is the mandatory hash algorithm defined by RFC 8315.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Le Lundi 08 février 2021 à 10:33 UTC, Michael Bäuerle écrivait sur news.software.nntp :

libcanlock V3 can be configured to emulate the V2 API (with the option "--enable-legacy-api", which is used by default). This is sufficient
for slrn, but the V2 API has no support for SHA2.

There are patches for slrn to use the V3 API: <https://micha.freeshell.org/libcanlock/#patches>
The hash algorithm can then be configured via "canlock_algo".

Thanks for the information.
I would test on MacOS (Big Sur) but I can't compile slrn.
HEAD from git or latest stable, with or without libcanlock.
I've succefully compiled libcanclock (not yet in Homebrew).
Don't know how to fix that! :(
And I'm not sure if it is an issue from slrn code.

(Darwin Kernel Version 20.3.0: Thu Jan 21 00:07:06 PST 2021; root:xnu-7195.81.3~1/RELEASE_X86_64 x86_64)

slrn/src/misc.c:376:4: error: implicit declaration of function 'VA_COPY'
is invalid in C99 [-Werror,-Wimplicit-function-declaration]
VA_COPY(ap1, ap);
^
1 error generated.

I'll try on Linux.

--
On ne le dira jamais assez, l'anarchisme, c'est l'ordre sans le
gouvernement ; c'est la paix sans la violence. C'est le contraire
précisément de tout ce qu'on lui reproche, soit par ignorance, soit
par mauvaise foi. -+- Hem Day -+-

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Gérald Niel wrote:

I've put the files on a webpage here:
https://home.gegeweb.org/rfc8315.html

Patch files:
https://home.gegeweb.org/files/filter_nnrpd.pl.patch https://home.gegeweb.org/files/cleanfeed.local.patch

And also (article in French) on my Gemini capsule: gemini://home.gegeweb.org/rfc8315-inn.gmi

I use these patch on my two servers.
Works fine, and tested a posting with slrn an libcanclock (sha-1) from another server and the cancel from mine. Cancel wath accepted for the
sha-1 lock/key added on client side. Not tested with a MD5 key/lock,

Likely MD5 is not worth to implement it.

The Cancel-Lock RFC draft written by Simon Lyall in the last century
defined only SHA1: <https://tools.ietf.org/html/draft-ietf-usefor-cancel-lock-01#section-2.1>

There was support for MD5 in libcanlock version 0 and 1, but in 2003 the
MD5 support was removed from libcanlock version 2. Quoted from changelog:
|
| VERSION 2:
|
| 10 Aug 2003
|
| [...]
| - The md5_key(), md5_lock() and md5_verify() functions have been
| removed. As far as I can tell they weren't being used.

AFAIK the Perl based server implementations do not create MD5 based
locks/keys too.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Gérald Niel wrote:

Michael Bäuerle écrivait sur news.software.nntp:

libcanlock V3 can be configured to emulate the V2 API (with the option "--enable-legacy-api", which is used by default). This is sufficient
for slrn, but the V2 API has no support for SHA2.

There are patches for slrn to use the V3 API: <https://micha.freeshell.org/libcanlock/#patches>
The hash algorithm can then be configured via "canlock_algo".

Thanks for the information.
I would test on MacOS (Big Sur) but I can't compile slrn.
HEAD from git or latest stable, with or without libcanlock.
I've succefully compiled libcanclock (not yet in Homebrew).
Don't know how to fix that! :(
And I'm not sure if it is an issue from slrn code.

(Darwin Kernel Version 20.3.0: Thu Jan 21 00:07:06 PST 2021; root:xnu-7195.81.3~1/RELEASE_X86_64 x86_64)

slrn/src/misc.c:376:4: error: implicit declaration of function 'VA_COPY'
is invalid in C99 [-Werror,-Wimplicit-function-declaration]
VA_COPY(ap1, ap);
^
1 error generated.

VA_COPY seems to be a macro that is defined by the configuration process (intended for systems that don't have va_copy() as defined by C99).

What does the "configure" script prints for this check on your machine?
|
| checking for an implementation of va_copy()... yes

On my machine the configure script writes this into "src/sysconf.h":
|
| /* define if you have va_copy() in stdarg.h */
| #define VA_COPY va_copy

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Le Mercredi 10 février 2021 à 15:02 UTC, Michael Bäuerle écrivait sur news.software.nntp :

AFAIK the Perl based server implementations do not create MD5 based locks/keys too.

Yes right, I've adapted the code to use sha256 instead of sha1 for the Cancel-Lock/Key as the RFC8315 specification.

But in cleanfeed.local it take care about sha256, sha1 or md5 for the verification.
I've only added the sha256, sha1 and md5 verifications was already in
the original code.

I use libcanlock with slrn on linux (Debian buster) and it use sha1.

(hope my english is good)
--
On ne le dira jamais assez, l'anarchisme, c'est l'ordre sans le
gouvernement ; c'est la paix sans la violence. C'est le contraire
précisément de tout ce qu'on lui reproche, soit par ignorance, soit
par mauvaise foi. -+- Hem Day -+-

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Le Mardi 09 février 2021 à 21:42 UTC, Michael Bäuerle écrivait sur news.software.nntp :

What does the "configure" script prints for this check on your machine?
|
| checking for an implementation of va_copy()... yes

$ ./configure | grep va_copy
checking for an implementation of va_copy()... no
checking for an implementation of __va_copy()... no

On my machine the configure script writes this into "src/sysconf.h":
|
| /* define if you have va_copy() in stdarg.h */
| #define VA_COPY va_copy

I have this:

/* define if you have va_copy() in stdarg.h */
/* #undef VA_COPY */

/* define if va_lists can't be copied by value */
#define VA_COPY_AS_ARRAY 1

And yet man stdarg(3) does mention va_copy().

It's beyond my skills! ;)

--
On ne le dira jamais assez, l'anarchisme, c'est l'ordre sans le
gouvernement ; c'est la paix sans la violence. C'est le contraire
précisément de tout ce qu'on lui reproche, soit par ignorance, soit
par mauvaise foi. -+- Hem Day -+-

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Gérald Niel wrote:

Michael Bäuerle écrivait sur news.software.nntp :

AFAIK the Perl based server implementations do not create MD5 based locks/keys too.

Yes right, I've adapted the code to use sha256 instead of sha1 for the Cancel-Lock/Key as the RFC8315 specification.

But in cleanfeed.local it take care about sha256, sha1 or md5 for the verification.
I've only added the sha256, sha1 and md5 verifications was already in
the original code.

Capability to verify SHA512 would be nice to have too.
It is registered with "COMMON" for "Intended Usage": <https://www.iana.org/assignments/netnews-parameters/netnews-parameters.xhtml#cancel-lock-hash-algorithms>

I use libcanlock with slrn on linux (Debian buster) and it use sha1.

This is the expected behaviour without patches (via the V2 API emulation
of libcanlock).

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Le Jeudi 11 février 2021 à 21:29 UTC, Michael Bäuerle écrivait sur news.software.nntp :

Capability to verify SHA512 would be nice to have too.
It is registered with "COMMON" for "Intended Usage": <https://www.iana.org/assignments/netnews-parameters/netnews-parameters.xhtml#cancel-lock-hash-algorithms>

I've updated cleanfeed.local and the patch.

This is the expected behaviour without patches (via the V2 API emulation
of libcanlock).

Yes.

--
On ne le dira jamais assez, l'anarchisme, c'est l'ordre sans le
gouvernement ; c'est la paix sans la violence. C'est le contraire
précisément de tout ce qu'on lui reproche, soit par ignorance, soit
par mauvaise foi. -+- Hem Day -+-

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)