diff -Nrup inn-2.4.4/ChangeLog inn-2.4.5/ChangeLog
--- inn-2.4.4/ChangeLog	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/ChangeLog	2008-06-29 10:56:57.000000000 -0700
@@ -1,500 +1,238 @@
-2008-05-05  iulius
+2008-06-29  iulius
 
-	* NEWS, doc/pod/news.pod: Update the ChangeLog for Perl 5.10
-	  support.
+	* lib/perl.c: Use snprintf instead of asprintf.
 
-	* innd/perl.c, lib/perl.c, nnrpd/perl.c: Perl 5.10 support for INN.
-	  Thanks, Jakub Bogusz, for the patch.
+	* doc/hook-python, doc/pod/hook-python.pod: Use initial capital
+	  letters for head titles.
 
-2008-04-30  iulius
-
-	* NEWS, doc/pod/news.pod: Update the ChangeLog for Berkeley DB 4.5
-	  (which works).
-
-	* configure, configure.in: Fix a problem at build time: auth_krb5.c
-	  should normally be compiled only if "--with-kerberos" is given to
-	  configure.
-
-2008-04-26  iulius
-
-	* innfeed/host.c: Fix a bug in hostDeleteIpv4Addr(): after innfeed
-	  has called that function, host->nextIpAddr can point outside the
-	  host->ipAddrs[] array.
-
-	* NEWS, doc/man/innfeed.1, doc/man/mailpost.8, doc/man/pullnews.1:
-	  Update generated documentation.
-
-	* doc/pod/news.pod: New changelog for INN 2.4.4 (the last one?).
-
-	* doc/pod/pullnews.pod, frontends/pullnews.in: Fix bugs in pullnews
-	  because of a lack of parenthesis. Update its documentation for -x
-	  (and also add this feature).
-
-	* doc/pod/mailpost.pod, frontends/mailpost.in: * Fix a bug when
-	  mailpost either couldn't find the pathtmp directory or couldn't
-	  write to it; * Add documentation for -h, -n and -o; * Add a list
-	  of known headers; * Clarify the use of -b; * Fix
-	  <pathdb>/mailpost-msgid.db which is <pathtmp>/mailpost-msgid.dir
-	  and <pathtmp>/mailpost-msgid.pag; * Fix the usage of [newsgroups]
-	  which is not optional; * It is $Database and not $lockfile in
-	  dbmopen/close; * Better formatting of error mails; * Typos.
-
-	* LICENSE: Clarify RSA's license for lib/md5.c.
-
-	* NEWS, doc/pod/news.pod, innfeed/connection.c: Revert commit 7753
-	  because innfeed uses too much CPU with it.
-
-2008-04-17  iulius
-
-	* NEWS, doc/pod/news.pod: Update the ChangeLog for INN 2.4.4 (new
-	  features for bindaddress and bindaddress6, instead of
-	  force-ipv4).
-
-	* doc/man/innfeed.conf.5, innfeed/connection.c, innfeed/host.c,
-	  innfeed/host.h: bindaddress/bindaddress6 keys can now be set on a
-	  per-peer basis in infeed.conf.
-	  
-	  Setting "bindaddress6: none" is equivalent to "force-ipv4: true".
-	  
-	  Both bindaddress and bindaddress6 work simultaneously, using
-	  bindaddress for IPv4 peer addresses and bindaddress6 for IPv6
-	  peer addresses. If a peer has IPv6 addresses, and at least one of
-	  them works, it never falls back to IPv4. If none of the IPv6
-	  addresses work, it falls back to IPv4.
-	  
-	  Since the server cannot connect to an IPv4 address if it binds to
-	  an IPv6 address and the other way around, hostIpAddr() has been
-	  changed to take an extra "family" argument, so that IPv4
-	  addresses are skipped for IPv6 sockets and vice versa.
-	  
-	  Thanks to Miquel van Smoorenburg for this patch.
-
-2008-04-13  iulius
-
-	* NEWS, doc/pod/news.pod: Changelog for INN 2.4.4.
-
-	* scripts/scanlogs.in: scanlogs now rotates innfeed's log file (a
-	  regexp is used to find its name in innfeed.conf). When this log
-	  file reached 2 GB, innfeed began to silently die whenever it is
-	  started.
-	  
-	  Also fix the rotation of send-nntp.log and send-uucp.log.
-	  
-	  Thanks to Shalon Wood for the bug report.
-
-	* frontends/inews.c: inews now tries to authenticate if it does not
-	  receive a 200 return code after MODE READER. Indeed, it might be
-	  able to post even with a 201 return code (and also with another
-	  codes like 440 or 480 but such codes are not RFC compliant in
-	  reply to MODE READER).
-	  
-	  Thanks to Alan Schwartz for the bug report.
-
-	* doc/man/innfeed.conf.5: Fix escape characters in the innfeed.conf
-	  man page.
-
-2008-04-12  iulius
-
-	* configure, configure.in, storage/ovdb/ovdb.c: INN now supports
-	  Berkeley DB 4.6. Thanks to Marco d'Itri for the patch.
-
-2008-04-10  iulius
-
-	* nnrpd/line.c: It seems that the SSL_read cannot be mixed with
-	  select() as in the current code. SSL communicates in its own data
-	  blocks and hand shaking. The do_readline using SSL_read could
-	  return, but still with a partial line in the SSL_read buffer.
-	  Then the server SSL routine would sit there waiting for
-	  completion of that data block while nnrpd sat at the select()
-	  routine waiting for more data from the server.
-	  
-	  (Without this patch, clients like Thunderbird, SeaMonkey or slrn
-	  sometimes hang when posting using a SSL connection.)
-	  
-	  Here, we decide to just bypass the select() wait. Unlike innd
-	  with multiple threads, the select on nnrpd is just waiting on a
-	  single file descriptor, so it is not really essential with
-	  blocked read like SSL_read. Using an alarm signal around SSL_read
-	  for non active timeout, SSL works without dead locks. However,
-	  without the select() wait, the IDLE timer stat won't be
-	  collected...
-	  
-	  Patch from Kachun Lee.
-
-2008-04-09  iulius
-
-	* innfeed/connection.c: In all of the response handlers that idle
-	  the connection if there's nothing left in the queue, don't idle
-	  if there are writes pending. The cases where this could possibly
-	  trigger are obscure and involve the remote peer doing evil
-	  things, but the rest of the code handles it correctly and we were
-	  still seeing assertion failures, indicating that evil may be
-	  happening.
-	  
-	  In issueStreamingCommands, make certain that there are no pending
-	  writes before idling the connection.
-	  
-	  Add the code to ihaveBodyDone that was already in
-	  commandWriteDone to idle the connection if the queue is empty in
-	  case we'd had to defer the idle in the response handler due to an
-	  unfinished write.
-	  
-	  Whenever doSomeWrites is called with writes still pending, add a
-	  work callback to do the write at the next opportunity. This
-	  should eliminate a temporary connection deadlock state on
-	  flushing, where the response to the IHAVE body arrived before we
-	  finished writing it. Before, doSomeWrites would have failed to
-	  call issueQUIT because writes were still pending, and then after
-	  the writes complete, there's no code to go back and issue it
-	  until the read timeout expires.
-	  
-	  Thanks to Russ Allbery for the patch.
-
-2008-04-06  iulius
-
-	* doc/man/inn.conf.5, doc/man/innd.8, doc/man/nnrpd.8,
-	  doc/pod/inn.conf.pod, doc/pod/nnrpd.pod, include/inn/innconf.h,
-	  innd/rc.c, lib/innconf.c, samples/inn.conf.in: Add a "nnrpdflags"
-	  parameter to inn.conf (modeled on the concept of "innflags") to
-	  permit passing of commandline arguments to instances of nnrpd
-	  spawned from innd.
-
-	* scripts/innreport_inn.pm: Do not report an unknown line when a
-	  cancel feed is closed. Innreport does not (currently) count such
-	  cancels.
-
-	* innd/inndstart.c: This patch makes innd listen on separate
-	  sockets for IPv4 and IPv6 connections if the IPV6_V6ONLY socket
-	  option is available.
-	  
-	  There might also be operating systems that still have separate
-	  IPv4 and IPv6 TCP implementations, and advanced features like TCP
-	  SACK might not be available on v6 sockets.
-	  
-	  Thanks to Miquel van Smoorenburg for this patch.
-
-	* doc/pod/inn.conf.pod, doc/pod/innd.pod, include/inn/innconf.h,
-	  innd/art.c, innd/cc.c, innd/innd.c, innd/innd.h, innd/site.c,
-	  lib/innconf.c, samples/inn.conf.in, scripts/inncheck.in,
-	  tests/lib/innconf-t.c: This patch adds a new inn.conf parameter
-	  called "pathcluster" which allows to append a common name to the
-	  Path: header on all incoming articles. "pathhost" and "pathalias"
-	  (if set) are still appended to the path as usual, but
-	  "pathcluster" is always appended as the last element (e.g. on the
-	  leftmost side of the Path: header).
-	  
-	  If the last pathname of the incoming article is the same as
-	  "pathcluster", it is stripped from the path.
-	  
-	  Thanks to Miquel van Smoorenburg for this patch.
-
-	* innd/Makefile: Update dependencies.
-
-	* authprogs/radius.c: Switch xmalloc to xcalloc. Bug reported by
-	  Erik Klavon.
-
-	* innd/rc.c: Group blocks in incoming.conf are now correctly parsed
-	  and no longer cause segfaults.
-
-	* control/docheckgroups.in, control/modules/checkgroups.pl,
-	  control/modules/newgroup.pl, control/modules/rmgroup.pl:
-	  docheckgroups now handles wireformat articles (for using it
-	  manually from the spool) and warns when there are missing or
-	  obsolete descriptions.
-	  
-	  Newgroup control messages for existing groups now change their
-	  description. If a mail is sent to administrators, it reminds them
-	  to update their newsgroups file. Now pretty print the newsgroups
-	  file (from one to three tabulations between the name of the group
-	  and its short description). Refuse the creation of to. groups.
-	  
-	  Checkgroups when there is nothing to change no longer result in
-	  sending a blank mail to administrators.
-
-	* scripts/innreport_inn.pm: Better innreport processing of log
-	  files (especially for Python filtering and Cleanfeed rejects).
-	  Add a NoCeM entry for perl-nocem. Only ncmspool was previously
-	  parsed.
-
-	* doc/man/innd.8, doc/man/newsfeeds.5, doc/pod/innd.pod,
-	  doc/pod/newsfeeds.pod, frontends/sys2nf.c, innd/art.c,
-	  samples/newsfeeds.in: * Checkgroups are now properly propagated
-	  even though the news server does not carry the groups they are
-	  posted to. * Improve documentation as for the use of
-	  "!control,!control.*" regarding the propagation of control
-	  articles. * Expand "control*" to "control,control.*" in
-	  documentation and samples for more accuracy. * control.cancel is
-	  mandatory for innd to start so cancel messages are not fed to
-	  control.
-
-	* control/pgpverify.in, doc/man/pgpverify.1: Typos.
-
-	* doc/man/simpleftp.1, doc/pod/simpleftp.pod, scripts/Makefile,
-	  scripts/simpleftp.in: Rewrite simpleftp to use Net::FTP. Indeed,
-	  ftp.pl is no longer shipped with Perl 5 and the script does not
-	  work.
-	  
-	  * Add support for usernames, passwords and ports. * Fix typos in
-	  the documentation. * Remove the use of fixscript on simpleftp. *
-	  Perl warnings are now on.
-
-	* innfeed/endpoint.c: Fix a problem with innfeed continuously
-	  segfaulting on amd64 hardware (and possibly on lots of 64 bits
-	  platforms); sig_atomic_t is indeed a long and not an integer
-	  there.
-	  
-	  Patch from Ollivier Robert. Many thanks to him and also to Kai
-	  Gallasch for having reported the problem and provided the FreeBSD
-	  server to debug it.
-
-	* backends/send-uucp.in: Fix a bug in the display of the used
-	  compressor (cunbatch was put if arguments were passed to gzip or
-	  bzip2).
-
-	* HACKING, doc/man/active.5, doc/man/active.times.5,
-	  doc/man/auth_krb5.8, doc/man/auth_smb.8, doc/man/ckpasswd.8,
-	  doc/man/control.ctl.5, doc/man/convdate.1,
-	  doc/man/cycbuff.conf.5, doc/man/distrib.pats.5, doc/man/domain.8,
-	  doc/man/expire.ctl.5, doc/man/expireover.8, doc/man/fastrm.1,
-	  doc/man/grephistory.1, doc/man/ident.8, doc/man/inews.1,
-	  doc/man/inn.conf.5, doc/man/innconfval.1, doc/man/innd.8,
-	  doc/man/inndf.8, doc/man/inndstart.8, doc/man/innmail.1,
-	  doc/man/innupgrade.8, doc/man/libauth.3, doc/man/libinnhist.3,
-	  doc/man/list.3, doc/man/mailpost.8, doc/man/makehistory.8,
-	  doc/man/motd.news.5, doc/man/newsfeeds.5, doc/man/ninpaths.8,
-	  doc/man/nnrpd.8, doc/man/ovdb.5, doc/man/ovdb_init.8,
-	  doc/man/ovdb_monitor.8, doc/man/ovdb_server.8,
-	  doc/man/ovdb_stat.8, doc/man/passwd.nntp.5, doc/man/pgpverify.1,
-	  doc/man/pullnews.1, doc/man/qio.3, doc/man/radius.8,
-	  doc/man/radius.conf.5, doc/man/rc.news.8, doc/man/readers.conf.5,
-	  doc/man/sasl.conf.5, doc/man/send-uucp.8, doc/man/sendinpaths.8,
-	  doc/man/simpleftp.1, doc/man/sm.1, doc/man/subscriptions.5,
-	  doc/man/tdx-util.8, doc/man/tst.3, doc/man/uwildmat.3: Generate
-	  fresh man pages for INN 2.4.4.
-
-	* CONTRIBUTORS: Typos.
-
-	* backends/Makefile: Add missing man page generation for send-uucp.
-
-	* control/perl-nocem.in, doc/man/perl-nocem.8: * perl-nocem will
-	  now check for a timeout and re-open the socket if required.
-	  Additionally, perl-nocem will switch to cancel_ctlinnd in case
-	  cancel_nntp fails after sending the Message-ID. Thanks to
-	  Christoph Biedl for the patch. * Fix the count of the time spent
-	  in do_nocem(): the $start and $diff variables were consecutive. *
-	  Use "%d" instead of "$nr" in sprintf. * Documentation fixes: *
-	  perl-nocem does not expect a message but a token. * Add
-	  "--no-default-keyring" because gpg otherwise uses the one in
-	  ~/.gnupg (strange). * Mention the keyring and improve a lot this
-	  documentation.
-
-	* frontends/ovdb_init.c: Patch daemonize-ovdb_init to make
-	  ovdb_init properly close stdin/out/err when it becomes a daemon.
-	  The issue was reported by Viktor Pilpenok and fixed by Marco
-	  d'Itri. Thanks to both of them.
-
-	* nnrpd/list.c, nnrpd/nnrpd.c: * In response to a LIST [file]
-	  command, if the file does not exist, we assume it is not
-	  maintained and return 503 instead of 215 and an empty file. *
-	  Typo in the answer for LIST MOTD (two final dots). * Add
-	  capability to LIST ACTIVE.TIMES for a wildmat pattern as its
-	  third argument (LIST ACTIVE.TIMES *nntp). * The "moderators"
-	  keyword was missing in the answer for HELP.
-
-	* doc/pod/newsfeeds.pod, innd/art.c, innd/innd.h, innd/newsfeeds.c,
-	  innd/site.c, scripts/inncheck.in: Implementation of the Diablo
-	  quickhash and hashfeed algorithms. It allows to distribute the
-	  messages among several peers (new Q flag for newsfeeds).
+	* NEWS, doc/pod/news.pod, lib/perl.c: Fixed a hang in Perl hooks on
+	  (at least) HP/PA since Perl 5.10. On such architectures,
+	  pthread_mutex_lock() hangs inside perl_parse() if
+	  PERL_SYS_INIT3() hasn't been called.
 	  
-	  Thanks to Miquel van Smoorenburg for this implementation in INN.
-
-	* support/config.guess, support/config.sub: Update support files
-	  for autoconf to their last stable version.
-
-	* samples/control.ctl: A more up-to-date control.ctl file from the
-	  ISC.
-
-	* authprogs/Makefile, backends/Makefile, expire/Makefile,
-	  frontends/Makefile, history/Makefile, innd/Makefile,
-	  innfeed/Makefile, lib/Makefile, nnrpd/Makefile, storage/Makefile:
-	  Update dependencies.
+	  Also rewrite "do" and "eval" calls to use perl_eval_pv().
 
-	* LICENSE: Update license information.
+2008-06-25  iulius
 
-2008-01-19  eagle
-
-	* innd/innd.c: Fix a variable reference in catch_terminate in the
-	  non-sigaction case.
-
-2007-02-10  eagle
-
-	* lib/dbz.c: Don't use ints; we lose with large files on many
-	  systems. Use xpwrite instead of pwrite to get complete writes.
-	  Based on a patch by Chris Caputo.
-
-	* storage/buffindexed/buffindexed.c: When calculating the length of
-	  a buffer, cast the calculation to off_t since it may be longer
-	  than unsigned long. Thanks, Kirill Berezin.
-
-2007-02-09  eagle
+	* samples/innreport.conf.in: For two sections in innreport.conf
+	  there is a mismatch between sort function and sorted hash.
+	  
+	  Thanks to Alexander Bartolich for this patch.
 
-	* include/inn/mmap.h, lib/dbz.c, lib/mmap.c,
-	  storage/tradindexed/tdx-data.c, storage/tradindexed/tdx-group.c:
-	  Rename mapcntl to inn_mapcntl and avoid having the function and
-	  the wrapper define have the same name. It looks like at least
-	  some compilers don't like this (and reasonably so).
+2008-06-24  iulius
 
-2007-01-16  eagle
+	* NEWS, doc/pod/news.pod, scripts/innreport_inn.pm: Fix another
+	  long-standing bug in innreport which prevented it from correctly
+	  reporting innfeed log messages.
 
-	* innd/cc.c, lib/inndcomm.c: Fix incomplete checking of packet
-	  sizes in the ctlinnd interface in the no-Unix-domain-sockets
-	  case. This is a potential buffer overflow in dead code since
-	  basically all systems INN builds on support Unix domain sockets
-	  these days, but let's not have that code sitting around anyway.
-	  
-	  Also track the buffer size more correctly in the client side of
-	  this interface for the Unix domain socket case (we were thinking
-	  it was smaller than it actually was).
-	  
-	  Thanks to zybadawg333@hushmail.com for the report.
+	* scripts/innreport_inn.pm: Suppress a few other nnrpd and
+	  controlchan notices in innreport.
 
-2006-11-22  eagle
+2008-06-23  iulius
 
-	* control/controlchan.in: Pring the newline and not $_, not the
-	  other way around.
+	* NEWS, doc/pod/news.pod: Add changelog for innreport.
 
-	* control/controlchan.in: When printing the blank line between
-	  headers, don't also try to print $_; it's undefined at that
-	  point.
+	* NEWS, doc/pod/news.pod: Changelog for INN 2.4.5 :-)
 
-2006-11-21  eagle
+	* doc/hook-python: Update the auto-generated documentation for INN
+	  2.4.5.
 
-	* contrib/README: Various updates for new files and verb tense.
-	  Remove ninpaths, which is now included in the main part of INN.
-	  Patch from Julien ÉLIE.
+	* scripts/innreport_inn.pm: Fix a long-standing bug in innreport
+	  which prevented it from correctly reporting nnrpd log messages.
 
-	* control/modules/newgroup.pl: Don't send mail if the action is no
-	  change. Patch from Julien ÉLIE.
+	* scripts/innreport_inn.pm: Suppress a few warnings in innreport
+	  (especially from Python hooks and nnrpd). Also backport some
+	  other improvements made in TRUNK.
 
-2006-09-11  eagle
+	* site, site/.cvsignore, site/Makefile: Install nnrpd.py which
+	  previously was not.
 
-	* tests/runtests.c: Work around a bad interaction between the glibc
-	  headers and gcc 4.1 that causes the sys/wait.h W* macros to fail
-	  to compile when run on an int member of a const struct.
+	* MANIFEST, samples/nnrpd_access.py, samples/nnrpd_auth.py,
+	  samples/nnrpd_dynamic.py, site, site/.cvsignore, site/Makefile:
+	  Update the Python nnrpd filter. New samples for access and
+	  dynamic hooks.
 
-	* TODO: Remove the link to Dave Barr's old INN site; that page
-	  seems to have gone away.
+2008-06-22  iulius
 
-2006-09-07  eagle
+	* samples/filter_innd.py: Update the Python innd filter.
 
-	* samples/control.ctl: Update to new upstream version.
+	* doc/pod/hook-python.pod: Typo (canceled -> cancelled).
 
-2006-09-04  eagle
+	* samples/nnrpd_access_wrapper.py, samples/nnrpd_auth_wrapper.py,
+	  samples/nnrpd_dynamic_wrapper.py: Update old Python wrappers.
 
-	* samples/control.ctl: Update to current upstream version.
+	* samples/INN.py, samples/nnrpd.py: Update stub Python scripts. Fix
+	  a compilation problem with INN.py (undefined variable) and add
+	  missing methods.
 
-2006-08-30  eagle
+	* doc/hook-python, doc/man/readers.conf.5, doc/pod/hook-python.pod,
+	  doc/pod/readers.conf.pod: Update POD documentation for Python
+	  hooks. It is a complete proof-reading.
 
-	* doc/pod/control.ctl.pod: Clarify the differences between
-	  verify-*, verify-*=mail, doit, and doit=mail and correct some
-	  inaccuracies noted by Iulius.
+	* nnrpd/python.c: No need to check the existence of methods not
+	  used by the hooked script.
 
-	* control/controlchan.in: Handle wire format messages. Patch from
-	  Iulius.
+	* innd/python.c, nnrpd/python.c: Fix an issue with Python exception
+	  handling.
 
-2006-08-28  eagle
+	* nnrpd/python.c: Fix typos.
 
-	* Makefile.global.in, authprogs/Makefile, authprogs/ckpasswd.c,
-	  configure, configure.in, include/config.h.in: If compiling with
-	  BerkeleyDB, use its ndbm compatibility layer for ckpasswd in
-	  preference to searching for a traditional dbm library. Based on a
-	  proposal by Marco d'Itri.
+	* nnrpd/python.c: Fix a segfault when one closes and then reopens
+	  Python in the same process. files and dynamic_file are still
+	  pointing to the old freed memory and INN blithely tries to write
+	  to it. Thanks to Russ Allbery for the patch.
 
-	* frontends/ovdb_stat.c: Support for BerkeleyDB 4.4. Patch from
-	  Marco d'Itri.
+2008-06-21  iulius
 
-	* innfeed/host.c: Fix another mistake I made when merging. *sigh*
+	* innd/python.c: Better be more careful when decrementing the
+	  reference count for these objects.
 
-	* innfeed/host.c: Fix typo in the previous change.
+2008-06-16  iulius
 
-	* doc/man/innfeed.conf.5, innfeed/host.c, innfeed/innfeed.h,
-	  samples/innfeed.conf: Add a force-ipv4 peer configuration option
-	  for innfeed that, if set, tells innfeed to never attempt an IPv6
-	  connection to that host. Patch from Marco d'Itri.
+	* doc/external-auth, doc/hook-perl, doc/hook-python,
+	  doc/man/active.5, doc/man/active.times.5, doc/man/auth_krb5.8,
+	  doc/man/auth_smb.8, doc/man/ckpasswd.8, doc/man/control.ctl.5,
+	  doc/man/convdate.1, doc/man/cycbuff.conf.5,
+	  doc/man/distrib.pats.5, doc/man/domain.8, doc/man/expire.ctl.5,
+	  doc/man/expireover.8, doc/man/fastrm.1, doc/man/grephistory.1,
+	  doc/man/ident.8, doc/man/inews.1, doc/man/inn.conf.5,
+	  doc/man/innconfval.1, doc/man/innd.8, doc/man/inndf.8,
+	  doc/man/inndstart.8, doc/man/innmail.1, doc/man/innupgrade.8,
+	  doc/man/libauth.3, doc/man/libinnhist.3, doc/man/list.3,
+	  doc/man/mailpost.8, doc/man/makehistory.8, doc/man/motd.news.5,
+	  doc/man/newsfeeds.5, doc/man/ninpaths.8, doc/man/nnrpd.8,
+	  doc/man/ovdb.5, doc/man/ovdb_init.8, doc/man/ovdb_monitor.8,
+	  doc/man/ovdb_server.8, doc/man/ovdb_stat.8,
+	  doc/man/passwd.nntp.5, doc/man/qio.3, doc/man/radius.8,
+	  doc/man/radius.conf.5, doc/man/rc.news.8, doc/man/readers.conf.5,
+	  doc/man/sasl.conf.5, doc/man/sendinpaths.8, doc/man/simpleftp.1,
+	  doc/man/sm.1, doc/man/subscriptions.5, doc/man/tdx-util.8,
+	  doc/man/tst.3, doc/man/uwildmat.3: Update version number for INN
+	  2.4.5 documentation.
 
-	* innfeed/host.c: Tell getaddrinfo that we need a SOCK_STREAM so
-	  that it won't return each address for a hostname three times, one
-	  with each supported socket type. Patch from Henning Makholm by
-	  way of Marco d'Itri.
+2008-06-11  iulius
 
-	* samples/radius.conf: The RADIUS configuration has to be wrapped
-	  in a server {} block. Thanks to Marco d'Itri for the patch.
+	* support/config.guess, support/config.sub: Update support files
+	  for autoconf to their last stable version.
 
-2006-08-27  eagle
+2008-06-10  iulius
 
-	* doc/man/innfeed.conf.5: Fix a mistaken backlog-limit-high instead
-	  of backlog-limit-highwater and document backlog-rotate-period.
+	* innd/python.c: Fix the name of a variable used in Python filters.
 
-2006-08-26  eagle
+2008-06-09  iulius
 
-	* control/perl-nocem.in: Update the documentation to use
-	  --primary-keyring for importing keys and to drop
-	  --allow-non-selfsigned-uid from the default options but describe
-	  when it might be necessary.
+	* innd/python.c: Fix a bug when reloading Python filters. They
+	  might not be correctly reloaded. They must be reimported before
+	  being reloaded.
 
-	* control/perl-nocem.in: "error" is not a syslog level. Replace
-	  with "err" instead. Reported by various people, including
-	  Christoph Biedl.
+	* nnrpd/python.c: Fix a segfault when generating access groups with
+	  embedded Python filters for nnrpd. Thanks to David Hlacik for the
+	  bug report.
 
-	* innd/status.c: Report an error if we can't open the status file.
-	  Reported by Bjoern A Zeeb.
+2008-06-08  iulius
 
-	* configure, include/config.h.in: Regenerate.
+	* frontends/pullnews.in: Two minor issues resolved with this patch
+	  by Geraint Edwards: * an off-by-one error on the limit to the
+	  amount of articles to get; * when an article is not available, we
+	  may have redundantly retried that article.
 
-	* nnrpd/commands.c: Fix another instance of treating article
-	  numbers as signed.
+2008-06-07  iulius
 
-	* nnrpd/list.c: Fix another occurrence of treating article numbers
-	  as signed.
+	* doc/pod/cycbuff.conf.pod, doc/pod/hook-perl.pod,
+	  doc/pod/hook-python.pod, innd/python.c, samples/filter_innd.pl:
+	  Fix the use of "ctlinnd reload something 'reason'" in
+	  documentation.
 
-	* nnrpd/article.c, nnrpd/group.c: Print out article numbers as
-	  unsigned long with appropriate casts. Thanks to Piotr Meyer for
-	  pointing out places where INN was assuming signed article
-	  numbers.
+2008-06-05  iulius
 
-	* nnrpd/nnrpd.c: Address2Name6 should lowercase the hostname just
-	  like Address2Name since wildmat matching is case-sensitive.
-	  Thanks to Brandon Hume for the patch.
+	* doc/hook-perl, doc/hook-python, doc/pod/hook-perl.pod,
+	  doc/pod/hook-python.pod, innd/innd.c, innd/innd.h,
+	  samples/filter_innd.py: Add access to several new headers within
+	  Perl and Python hooks for innd. Thanks to Matija Nalis for the
+	  patch.
+	  
+	  Also update the POD documentation and the Python sample.
 
-	* nnrpd/group.c: Empty LISTGROUP replies need to be terminated.
-	  Thanks to David Canzi for the patch.
+	* doc/man/pullnews.1, doc/pod/pullnews.pod, frontends/pullnews.in:
+	  A new improved version of pullnews. Great thanks to Geraint A.
+	  Edwards for all his work. He added no more than 16 flags, fixed
+	  some bugs and integrated the backupfeed contrib script by Kai
+	  Henningsen, adding again 6 other flags.
+	  
+	  A long-standing but very minor bug in the -g option was
+	  especially fixed and items from the to-do list implemented.
+	  
+	  From TODO:
+	  
+	  + reset highwater mark to match server (-w) + reset highwater
+	  mark to zero (also -w) + add group to config (-G) + drop articles
+	  with headers matching (or not matching) regexp (-m)
+	  
+	  From backupfeed:
+	  
+	  + pull only a proportion (factor) of articles (-f) + sleeps
+	  between articles/groups (-z/-Z) + Path: fake hop insert (-F) +
+	  NNTP connection timeout (-N) + overall session timeout (-S)
+	  
+	  Other new flags/features:
+	  
+	  -l logfile log to logfile (rather than /dev/null when rnews'ing!)
+	  -s host:port add local port option (can use -p already) -t
+	  retries attempt connect to upstream retries times -T retry_pause
+	  wait between retries -k checkpt checkpoint the config file every
+	  checkpt arts -C width when writing the progress bar - use width
+	  columns -d debug_level self-explanatory -M max_arts only process
+	  max_arts articles per run -H headers remove these headers from
+	  articles -Q quietness set how quiet we are -R be a reader -n
+	  no-op -P paths feed articles depending on number of hops in Path:
 
-	* samples/control.ctl: Update chi.* and the alt.* comment.
+2008-05-25  iulius
 
-2006-08-12  eagle
+	* control/modules/newgroup.pl: Fix a Perl warning.
 
-	* doc/pod/ckpasswd.pod: Update URL for the Linux-PAM System
-	  Administrator's Guide.
+2008-05-24  iulius
 
-2006-04-15  eagle
+	* nnrpd/tls.c: When an article of a size greater than remaining
+	  stack is retrieved via SSL, a segmentation fault will occur due
+	  to the use of alloca(). The below patch uses heap based realloc()
+	  instead of stack based alloca(), with a static buffer growing as
+	  needed. It uses realloc() instead of malloc() for performance
+	  reasons since this function is called frequently. The caveat is
+	  that the memory is never free()'ed, so if more correct code is
+	  desired, it should be adjusted.
+	  
+	  Thanks to Chris Caputo for this patch.
 
-	* doc/pod/hacking.pod: Document the version of svn2cl required.
+2008-05-19  iulius
 
-2006-04-10  eagle
+	* innd/Makefile, nnrpd/line.c: Implementation of the "alarm signal"
+	  around SSL_read so that to prevent dead connections from leading
+	  nnrpd processes to wait forever in SSL_read(). "clienttimeout"
+	  now also works on SSL connections.
+	  
+	  Thanks to Matija Nalis for the patch.
 
-	* scripts/inncheck.in: Expect fewer things to be private to the
-	  news user. Most of the configuration files will never contain
-	  private information like passwords.
+	* nnrpd/tls.c: Implementation on systems that support it of
+	  SO_KEEPALIVE in SSL TCP connections, allowing system detection
+	  and closing the dead TCP SSL connections automatically after
+	  system-specified time (usually at least 2 hours as recommended by
+	  RFC (on Linux, see /proc/sys/net/ipv4/tcp_keepalive_*).
+	  
+	  Thanks to Matija Nalis for the patch.
 
-	* site/Makefile: If creating a new history file, set the ownership
-	  and mode appropriately. Reported by Ernst Boetsch.
+2008-05-18  iulius
 
-2006-04-02  eagle
+	* innfeed/host.c: Fix a problem of undefined constant.
 
-	* tests/lib/snprintf-t.c: The %n test was written incorrectly on
-	  AMD64. Thanks, Ernst Boetsch.
+2008-05-14  iulius
 
-2006-03-31  eagle
+	* innfeed/host.c: Fix a bug in ipAddrs which contained thrice the
+	  same IPs. Rotating the peer IP addresses was a bit slower than it
+	  could be.
+	  
+	  Thanks, D. Stussy, for having seen that. Miquel van Smoorenburg
+	  provided the patch.
 
-	* samples/newsfeeds.in: Clarify the comment about the ME line.
+	* Makefile.global.in: Bump the revision number to 2.4.5 (in case it
+	  is released one day).
 
diff -Nrup inn-2.4.4/MANIFEST inn-2.4.5/MANIFEST
--- inn-2.4.4/MANIFEST	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/MANIFEST	2008-06-29 10:56:57.000000000 -0700
@@ -566,12 +566,14 @@ samples/newsgroups.minimal            Mi
 samples/nnrpd.py                      Python hooks for nnrpd
 samples/nnrpd.track                   Reader tracking configuration
 samples/nnrpd_access.pl.in            Sample nnrpd Perl access hooks
+samples/nnrpd_access.py               Sample nnrpd Python access hooks
 samples/nnrpd_access_wrapper.pl.in    Wrapper around old Perl access hooks
 samples/nnrpd_access_wrapper.py       Wrapper around old Python access hooks
 samples/nnrpd_auth.pl.in              Sample nnrpd Perl authorization hooks
 samples/nnrpd_auth.py                 Sample nnrpd Python authorization hooks
 samples/nnrpd_auth_wrapper.pl.in      Wrapper around old Perl auth hooks
 samples/nnrpd_auth_wrapper.py         Wrapper around old Python auth hooks
+samples/nnrpd_dynamic.py              Sample nnrpd Python dynamic access hooks
 samples/nnrpd_dynamic_wrapper.py      Wrapper around old Python dynamic hooks
 samples/nntpsend.ctl                  Outgoing nntpsend feed configuration
 samples/ovdb.conf                     Berkeley DB overview configuration
diff -Nrup inn-2.4.4/Makefile.global.in inn-2.4.5/Makefile.global.in
--- inn-2.4.4/Makefile.global.in	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/Makefile.global.in	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-##  $Id: Makefile.global.in 7565 2006-08-28 02:42:54Z eagle $
+##  $Id: Makefile.global.in 7830 2008-05-14 18:57:39Z iulius $
 ##
 ##  This file is meant to be the central Makefile that configure works with
 ##  and that all other Makefiles include.  No Makefile other than this one
@@ -14,7 +14,7 @@
 ##  put your own version information in $VERSION_EXTRA.  If it's set to
 ##  "CVS prerelease", the build time will be automatically included.
 
-VERSION         = 2.4.4
+VERSION         = 2.4.5
 VERSION_EXTRA   =
 
 ##  If you want to install INN relative to a root directory other than /,
diff -Nrup inn-2.4.4/NEWS inn-2.4.5/NEWS
--- inn-2.4.4/NEWS	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/NEWS	2008-06-29 10:56:57.000000000 -0700
@@ -1,3 +1,71 @@
+Changes in 2.4.5
+
+    * Fixed the "alarm signal" around "SSL_read" in nnrpd:  it allows a
+      proper disconnection of news clients which were previously hanging
+      when posting an article through a SSL connection.  Moreover, the
+      *clienttimeout* parameter now works on SSL connections.  Thanks to
+      Matija Nalis for the patch.
+
+    * SO_KEEPALIVE is now implemented for SSL TCP connections on systems
+      which support it, allowing system detection and closing the dead TCP
+      SSL connections automatically after system-specified time.  Thanks to
+      Matija Nalis for the patch.
+
+    * Fixed a segmentation fault when an article of a size greater than
+      remaining stack is retrieved via SSL.  Thanks to Chris Caputo for this
+      patch.
+
+    * Fixed a few segfaults and bugs which affected both Python innd and
+      nnrpd hooks.  They no longer check the existence of methods not used
+      by the hooked script.  An issue with Python exception handling was
+      also fixed, as well as a segfault fixed by Russ Allbery which happened
+      whenever one closes and then reopens Python in the same process. 
+      Julien Elie also fixed a bug when reloading Python filters (they were
+      not always correctly reloaded) and a segfault when generating access
+      groups with embedded Python filters for nnrpd.  Many thanks to David
+      Hlacik for its bug reports.
+
+    * The nnrpd.py stub file in order to test Python nnrpd hooks, as
+      mentioned in their documentation, is now installed; only INN.py was
+      previously installed in *pathfilter*.  Also fixed a bug in INN.py and
+      add missing methods to it.
+
+    * Fixed a long-standing bug in innreport which prevented it from
+      correctly reporting nnrpd and innfeed log messages.
+
+    * Fixed a hang in Perl hooks on (at least) HP/PA since Perl 5.10.
+
+    * Fixed a compilation problem on some platforms because of AF_INET6
+      which was not inside a HAVE_INET6 block in innfeed.
+
+    * Fixed a bug in innfeed which contained thrice the same IPs for each
+      peer; it unnecessarily slowed the peer IP rotation for innfeed. 
+      Thanks, D. Stussy, for having seen that.  Miquel van Smoorenburg
+      provided the patch.
+
+    * A new *heavily* improved version of pullnews is shipped with this INN
+      release.  This new version is provided by Geraint Edwards.  He added
+      no more than 16 flags, fixed some bugs and integrated the backupfeed
+      contrib script by Kai Henningsen, adding again 6 other flags.  A
+      long-standing but very minor bug in the -g option was especially fixed
+      and items from the to-do list implemented.  Many thanks again to
+      Geraint Edwards.
+
+    * New headers are accessible through Perl and Python innd filtering
+      hooks.  You will find the exact list in the INN Python Filtering and
+      Authentication Hooks documentation (doc/hook-python) and in Python
+      samples.  Thanks to Matija Nalis for this addition of new useful
+      headers.
+
+    * New samples for Python nnrpd hooks are shipped with INN: 
+      nnrpd_access.py for access control and nnrpd_dynamic.py for dynamic
+      access control.  The nnrpd_auth.py script is now only used for
+      authorization control.  See the readers.conf man page for more
+      information (especially the *python_auth*, *python_access* and
+      *python_dynamic* parameters).  The documention about INN Python
+      Filtering and Authentication Hooks has also been improved by Julien
+      Elie.
+
 Changes in 2.4.4
 
     * Fixed incomplete checking of packet sizes in the ctlinnd interface in
diff -Nrup inn-2.4.4/control/modules/newgroup.pl inn-2.4.5/control/modules/newgroup.pl
--- inn-2.4.4/control/modules/newgroup.pl	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/control/modules/newgroup.pl	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-##  $Id: newgroup.pl 7743 2008-04-06 10:04:43Z iulius $
+##  $Id: newgroup.pl 7849 2008-05-25 17:11:32Z iulius $
 ##
 ##  newgroup control message handler.
 ##
@@ -139,9 +139,9 @@ END
             update_desc($ngname, $ngdesc) if $ngdesc and $ngname eq $groupname;
         }
         
-        if ($log ne 'mail' or $status ne 'no change') {
+        if ($log) {
             logger($log, "newgroup $groupname $modcmd $status $sender",
-                   $headers, $body) if $log;
+                   $headers, $body) if ($log ne 'mail' or $status ne 'no change');
         }
     }
     return;
diff -Nrup inn-2.4.4/doc/external-auth inn-2.4.5/doc/external-auth
--- inn-2.4.4/doc/external-auth	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/external-auth	2008-06-29 10:56:57.000000000 -0700
@@ -1,6 +1,7 @@
 NNRPD External Authentication Support
 
-    This is $Revision: 7141 $ dated $Date: 2005-03-17 03:42:46 -0800 (Thu, 17 Mar 2005) $.
+    This is $Revision: 7880 $ dated $Date: 2005-03-17 12:42:46 +0100 (Thu,
+    17 Mar 2005) $.
 
     A fundamental part of the readers.conf(5)-based authorization mechanism
     is the interface to external authenticator and resolver programs.  This
diff -Nrup inn-2.4.4/doc/hook-perl inn-2.4.5/doc/hook-perl
--- inn-2.4.4/doc/hook-perl	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/hook-perl	2008-06-29 10:56:57.000000000 -0700
@@ -1,6 +1,7 @@
 INN Perl Filtering and Authentication Support
 
-    This is $Revision: 6221 $ dated $Date: 2003-02-09 19:21:27 -0800 (Sun, 09 Feb 2003) $.
+    This is $Revision: 7880 $ dated $Date: 2008-06-07 14:46:49 +0200 (Sat,
+    07 Jun 2008) $.
 
     This file documents INN's built-in support for Perl filtering and reader
     authentication.  The code is based very heavily on work by Christophe
@@ -46,8 +47,8 @@ The innd Perl Filter
     cause it to be reloaded.
 
     filter_innd.pl, on the other hand, can be reloaded on command (with
-    "ctlinnd reload filter.perl").  Whenever filter_innd.pl is loaded,
-    including the first time at innd startup, the Perl function
+    "ctlinnd reload filter.perl 'reason'").  Whenever filter_innd.pl is
+    loaded, including the first time at innd startup, the Perl function
     filter_before_reload() is called before it's reloaded and the function
     filter_after_reload() is called after it's reloaded (if the functions
     exist).  Additionally, any code in either startup_innd.pl or
@@ -64,13 +65,13 @@ The innd Perl Filter
     load data that was preserved on disk across a stop and restart of innd
     (perhaps using filter_mode() -- see below).
 
-    As mentioned above, "ctlinnd reload filter.perl" (or "ctlinnd reload
-    all") will cause filter_innd.pl to be reloaded.  If the function
-    filter_art() is defined after the file has been reloaded, filtering is
-    turned on.  Otherwise, filtering is turned off.  (Note that due to the
-    way Perl stores functions, once you've defined filter_art(), you can't
-    undefine it just by deleting it from the file and reloading the filter. 
-    You'll need to replace it with an empty sub.)
+    As mentioned above, "ctlinnd reload filter.perl 'reason'" (or "ctlinnd
+    reload all 'reason'") will cause filter_innd.pl to be reloaded.  If the
+    function filter_art() is defined after the file has been reloaded,
+    filtering is turned on.  Otherwise, filtering is turned off.  (Note that
+    due to the way Perl stores functions, once you've defined filter_art(),
+    you can't undefine it just by deleting it from the file and reloading
+    the filter.  You'll need to replace it with an empty sub.)
 
     The Perl function filter_art() is the heart of a Perl filter.  Whenever
     an article is received from a peer, via either IHAVE or TAKETHIS,
@@ -83,34 +84,45 @@ The innd Perl Filter
     of the standard headers present in the article and their values.  The
     standard headers are:
 
-            Approved, Control, Date, Distribution, Expires, From, Lines,
-            Message-ID, Newsgroups, Path, Reply-To, Sender, Subject,
-            Supersedes, Bytes, Also-Control, References, Keywords, X-Trace,
-            NNTP-Posting-Host, Followup-To, Organization, Content-Type,
-            Content-Base, Content-Disposition, X-Newsreader, X-Mailer,
-            X-Cancelled-By, X-Canceled-By, Cancel-Key
-
-    (so, for example, the Newsgroups header of the article is accessible
-    inside the Perl filter as $hdr{Newsgroups}).  In addition,
-    $hdr{__BODY__} will contain the full body of the article and
-    $hdr{__LINES__} will contain the number of lines in the body of the
-    article.
+        Also-Control, Approved, Bytes, Cancel-Key, Cancel-Lock,
+        Content-Base, Content-Disposition, Content-Transfer-Encoding,
+        Content-Type, Control, Date, Date-Received, Distribution, Expires,
+        Face, Followup-To, From, In-Reply-To, Injection-Date, Injection-Info,
+        Keywords, Lines, List-ID, Message-ID, MIME-Version, Newsgroups,
+        NNTP-Posting-Date, NNTP-Posting-Host, Organization, Originator,
+        Path, Posted, Posting-Version, Received, References, Relay-Version,
+        Reply-To, Sender, Subject, Supersedes, User-Agent,
+        X-Auth, X-Canceled-By, X-Cancelled-By, X-Complaints-To, X-Face,
+        X-HTTP-UserAgent, X-HTTP-Via, X-Mailer, X-Modbot, X-Modtrace,
+        X-Newsposter, X-Newsreader, X-No-Archive, X-Original-Message-ID,
+        X-Original-Trace, X-Originating-IP, X-PGP-Key, X-PGP-Sig,
+        X-Poster-Trace, X-Postfilter, X-Proxy-User, X-Submissions-To,
+        X-Trace, X-Usenet-Provider, Xref.
+
+    Note that all the above headers are as they arrived, not modified by
+    your INN (especially, the Xref: header, if present, is the one of the
+    remote site which sent you the article, and not yours).
+
+    For example, the Newsgroups: header of the article is accessible inside
+    the Perl filter as $hdr{'Newsgroups'}.  In addition, $hdr{'__BODY__'}
+    will contain the full body of the article and $hdr{'__LINES__'} will
+    contain the number of lines in the body of the article.
 
     The contents of the %hdr hash for a typical article may therefore look
     something like this:
 
-            %hdr = (Subject      => 'MAKE MONEY FAST!!', 
-                    From         => 'Joe Spamer <him@example.com>',
-                    Date         => '10 Sep 1996 15:32:28 UTC',
-                    Newsgroups   => 'alt.test',
-                    Path         => 'news.example.com!not-for-mail',
-                    Organization => 'Spammers Anonymous',
-                    Lines        => '5',
-                    Distribution => 'usa',
-                    'Message-ID' => '<6.20232.842369548@example.com>',
-                    __BODY__     => 'Send five dollars to the ISC, c/o ...',
-                    __LINES__    => 5
-            );
+        %hdr = (Subject      => 'MAKE MONEY FAST!!', 
+            From         => 'Joe Spamer <him@example.com>',
+            Date         => '10 Sep 1996 15:32:28 UTC',
+            Newsgroups   => 'alt.test',
+            Path         => 'news.example.com!not-for-mail',
+            Organization => 'Spammers Anonymous',
+            Lines        => '5',
+            Distribution => 'usa',
+            'Message-ID' => '<6.20232.842369548@example.com>',
+            __BODY__     => 'Send five dollars to the ISC, c/o ...',
+            __LINES__    => 5
+        );
 
     Note that the value of $hdr{Lines} is the contents of the Lines: header
     of the article and may bear no resemblence to the actual length of the
@@ -164,9 +176,9 @@ The innd Perl Filter
     arguments and returns no value, but it has access to a global hash %mode
     that contains three values:
 
-            Mode       The current server mode (throttled, paused, or running)
-            NewMode    The new mode the server is going to
-            reason     The reason that was given to ctlinnd
+        Mode       The current server mode (throttled, paused, or running)
+        NewMode    The new mode the server is going to
+        reason     The reason that was given to ctlinnd
 
     One possible use for this function is to save filter state across a
     restart of innd.  There isn't any Perl function which is called when INN
@@ -346,7 +358,7 @@ Changes to Perl Authentication Support f
     Scripts (like those from the old mechanism) are listed in readers.conf
     using perl_auth in the same manner other authenticators are using auth:
 
-            perl_auth: "/path/to/script/auth1.pl"
+        perl_auth: "/path/to/script/auth1.pl"
 
     The file given as argument to perl_auth should contain the same
     procedures as before. The global hash %attributes remains the same,
diff -Nrup inn-2.4.4/doc/hook-python inn-2.4.5/doc/hook-python
--- inn-2.4.4/doc/hook-python	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/hook-python	2008-06-29 10:56:57.000000000 -0700
@@ -1,118 +1,133 @@
 INN Python Filtering and Authentication Support
 
-    This is $Revision: 7134 $, dated $Date: 2005-03-05 13:19:44 -0800 (Sat, 05 Mar 2005) $.
-
     This file documents INN's built-in optional support for Python article
-    filtering.  It is patterned after the TCL and Perl hooks previously
-    added by Bob Heiney and Christophe Wolfhugel.
+    filtering.  It is patterned after the Perl and (now obsolete) TCL hooks
+    previously added by Bob Heiney and Christophe Wolfhugel.
 
-    For this filter to work successfully, you will need to have Python 1.5.2
-    (the latest at this writing) installed.  You can obtain it from
-    <http://www.python.org>.
+    For this filter to work successfully, you will need to have at least
+    Python 1.5.2 installed.  You can obtain it from
+    <http://www.python.org/>.
 
     The innd Python interface and the original Python filtering
-    documentation was written by Greg Andruk (nee Fluffy)
+    documentation were written by Greg Andruk (nee Fluffy)
     <gerglery@usa.net>.  The Python authentication and authorization support
-    for nnrpd and the original documentation for it was written by Ilya
-    Etingof <ilya@glas.net>, 12/1999.
-
-NOTE TO RED HAT LINUX USERS
+    for nnrpd as well as the original documentation for it were written by
+    Ilya Etingof <ilya@glas.net> in December 1999.
 
-    Python will be preinstalled, but it may not include all the headers and
-    libraries required for embedding into INN.  You will need to add the
-    development package.  Better yet, get the source kit from the above URL
-    and build it yourself.  Be sure when installing Python on Red Hat, to
-    run configure with "--prefix=/usr" so that there are no version
-    conflicts with the "factory" installation.  You can also find a
-    selection of well made RPMs at
-    <ftp://starship.python.net/pub/crew/andrich/>.
-
-INSTALLATION
+Installation
 
     Once you have built and installed Python, you can cause INN to use it by
-    adding the "--with-python" switch to your configure command.
+    adding the --with-python switch to your "configure" command.  You will
+    need to have all the headers and libraries required for embedding Python
+    into INN; they can be found in Python development packages, which
+    include header files and static libraries.
+
+    You will then be able to use Python authentication, dynamic access group
+    generation and dynamic access control support in nnrpd along with
+    filtering support in innd.
 
     See the ctlinnd(8) manual page to learn how to enable, disable and
-    reload Python filters on a running server ("ctlinnd mode", "ctlinnd
-    python y|n", "ctlinnd reload filter.python").
+    reload Python filters on a running server (especially "ctlinnd mode",
+    "ctlinnd python y|n" and "ctlinnd reload filter.python 'reason'").
+
+    Also, see the filter_innd.py, nnrpd_auth.py, nnrpd_access.py and
+    nnrpd_dynamic.py samples in your filters directory for a demonstration
+    of how to get all this working.
 
-    Also, see the example filter_innd.py script in your filters directory
-    for a demonstration of how to get all this working.
+Writing an innd Filter
 
-WRITING AN INND FILTER
+  Introduction
 
     You need to create a filter_innd.py module in INN's filter directory
-    (see the pathfilter setting in inn.conf).  A heavily-commented sample is
-    provided that you can use as a template for your own filter.  There is
+    (see the *pathfilter* setting in inn.conf).  A heavily-commented sample
+    is provided; you can use it as a template for your own filter.  There is
     also an INN.py module there which is not actually used by INN; it is
     there so you can test your module interactively.
 
     First, define a class containing the methods you want to provide to
     innd.  Methods innd will use if present are:
 
-    __init__(self)
+    __init__(*self*)
         Not explicitly called by innd, but will run whenever the filter
         module is (re)loaded.  This is a good place to initialize constants
-        or pick up where filter_before_reload or filter_close left off.
+        or pick up where "filter_before_reload" or "filter_close" left off.
 
-    filter_before_reload(self)
-        This will execute any time a "ctlinnd reload all" or "ctlinnd reload
-        filter.python" command is issued.  You can use it to save statistics
-        or reports for use after reloading.
-
-    filter_close(self)
-        This will run when a "ctlinnd shutdown" command is received.
-
-    filter_art(self, art)
-        art is a dictionary containing an article's headers and body.  This
-        method is called every time innd receives an article.  The following
-        can be defined:
-
-            Approved, Control, Date, Distribution, Expires, From, Lines,
-            Message-ID, Newsgroups, Path, Reply-To, Sender, Subject,
-            Supersedes, Bytes, Also-Control, References, Xref, Keywords,
-            X-Trace, NNTP-Posting-Host, Followup-To, Organization,
-            Content-Type, Content-Base, Content-Disposition, X-Newsreader,
-            X-Mailer, X-Newsposter, X-Cancelled-By, X-Canceled-By, Cancel-Key,
-            __LINES__, __BODY__
-
-        All the above values will be buffer objects holding the contents of
-        the same named article headers, except for the special __BODY__ and
-        __LINES__ items.  Items not present in the article will contain
-        None.
-
-        __BODY__ is a buffer object containing the article's entire body,
-        and __LINES__ is an int holding innd's reckoning of the number of
-        lines in the article.  All the other elements will be buffers with
-        the contents of the same-named article headers.
+    filter_before_reload(*self*)
+        This will execute any time a "ctlinnd reload all 'reason'" or
+        "ctlinnd reload filter.python 'reason'" command is issued.  You can
+        use it to save statistics or reports for use after reloading.
+
+    filter_close(*self*)
+        This will run when a "ctlinnd shutdown 'reason'" command is
+        received.
+
+    filter_art(*self*, *art*)
+        *art* is a dictionary containing an article's headers and body. 
+        This method is called every time innd receives an article.  The
+        following can be defined:
+
+            Also-Control, Approved, Bytes, Cancel-Key, Cancel-Lock,
+            Content-Base, Content-Disposition, Content-Transfer-Encoding,
+            Content-Type, Control, Date, Date-Received, Distribution, Expires,
+            Face, Followup-To, From, In-Reply-To, Injection-Date, Injection-Info,
+            Keywords, Lines, List-ID, Message-ID, MIME-Version, Newsgroups,
+            NNTP-Posting-Date, NNTP-Posting-Host, Organization, Originator,
+            Path, Posted, Posting-Version, Received, References, Relay-Version,
+            Reply-To, Sender, Subject, Supersedes, User-Agent,
+            X-Auth, X-Canceled-By, X-Cancelled-By, X-Complaints-To, X-Face,
+            X-HTTP-UserAgent, X-HTTP-Via, X-Mailer, X-Modbot, X-Modtrace,
+            X-Newsposter, X-Newsreader, X-No-Archive, X-Original-Message-ID,
+            X-Original-Trace, X-Originating-IP, X-PGP-Key, X-PGP-Sig,
+            X-Poster-Trace, X-Postfilter, X-Proxy-User, X-Submissions-To,
+            X-Trace, X-Usenet-Provider, Xref, __BODY__, __LINES__.
+
+        Note that all the above values are as they arrived, not modified by
+        your INN (especially, the Xref: header, if present, is the one of
+        the remote site which sent you the article, and not yours).
+
+        These values will be buffer objects holding the contents of the same
+        named article headers, except for the special "__BODY__" and
+        "__LINES__" items.  Items not present in the article will contain
+        "None".
+
+        "art('__BODY__')" is a buffer object containing the article's entire
+        body, and "art('__LINES__')" is an int holding innd's reckoning of
+        the number of lines in the article.  All the other elements will be
+        buffers with the contents of the same-named article headers.
 
-        If you want to accept an article, return None or an empty string. 
+        The Newsgroups: header of the article is accessible inside the
+        Python filter as "art['Newsgroups']".
+
+        If you want to accept an article, return "None" or an empty string. 
         To reject, return a non-empty string.  The rejection strings will be
         shown to local clients and your peers, so keep that in mind when
         phrasing your rejection responses.
 
-    filter_messageid(self, msgid)
-        msgid is a buffer object containing the ID of an article being
-        offered by IHAVE or CHECK.  Like with filter_art(), the message will
+    filter_messageid(*self*, *msgid*)
+        *msgid* is a buffer object containing the ID of an article being
+        offered by IHAVE or CHECK.  Like with "filter_art", the message will
         be refused if you return a non-empty string.  If you use this
         feature, keep it light because it is called at a rather busy place
         in innd's main loop.  Also, do not rely on this function alone to
-        reject by ID; you should repeat the tests in filter_art() to catch
+        reject by ID; you should repeat the tests in "filter_art" to catch
         articles sent with TAKETHIS but no CHECK.
 
-    filter_mode(self, oldmode, newmode, reason)
-        When the operator issues a ctlinnd pause, throttle or go command,
-        this function can be used to do something sensible in accordance
-        with the state change.  Stamp a log file, save your state on
-        throttle, etc.  oldmode and newmode will be strings containing one
-        of the values in ('running', 'throttled', 'paused', 'unknown') --
-        oldmode is the state innd was in before ctlinnd was run, newmode is
-        the state innd will be in after the command finishes.  reason is the
-        comment string provided on the ctlinnd command line.
+    filter_mode(*self*, *oldmode*, *newmode*, *reason*)
+        When the operator issues a ctlinnd "pause", "throttle", "go",
+        "shutdown" or "xexec" command, this function can be used to do
+        something sensible in accordance with the state change.  Stamp a log
+        file, save your state on throttle, etc.  *oldmode* and *newmode*
+        will be strings containing one of the values in ("running",
+        "throttled", "paused", "shutdown", "unknown").  *oldmode* is the
+        state innd was in before ctlinnd was run, *newmode* is the state
+        innd will be in after the command finishes.  *reason* is the comment
+        string provided on the ctlinnd command line.
+
+  How to Use these Methods with innd
 
     To register your methods with innd, you need to create an instance of
     your class, import the built-in INN module, and pass the instance to
-    INN.set_filter_hook().  For example:
+    "INN.set_filter_hook".  For example:
 
         class Filter:
             def filter_art(self, art):
@@ -130,40 +145,39 @@ WRITING AN INND FILTER
         INN.set_filter_hook(myfilter)
 
     When writing and testing your Python filter, don't be afraid to make use
-    of try:/except: and the provided INN.syslog() function.  stdout and
+    of "try:"/"except:" and the provided "INN.syslog" function.  stdout and
     stderr will be disabled, so your filter will die silently otherwise.
 
     Also, remember to try importing your module interactively before loading
     it, to ensure there are no obvious errors.  One typo can ruin your whole
-    filter.  A dummy INND.py module is provided to facilitate testing
-    outside the server.  To test, change into your filter directory and use
-    a command like:
+    filter.  A dummy INN.py module is provided to facilitate testing outside
+    the server.  To test, change into your filter directory and use a
+    command like:
 
         python -ic 'import INN, filter_innd'
 
     You can define as many or few of the methods listed above as you want in
-    your filter class (it's fine to define more methods for your own use;
-    innd won't use them but your filter can).  If you *do* define the above
-    methods, GET THE PARAMETER COUNTS RIGHT.  There are checks in innd to
-    see if the methods exist and are callable, but if you define one and get
-    the parameter counts wrong, INND WILL DIE.  You have been warned.  Be
-    careful with your return values, too.  The filter_art() and
-    filter_messageid() methods have to return strings, or None.  If you
-    return something like an int, innd will not be happy.
-
-WHAT'S THE DEAL WITH THESE BUFFER OBJECTS?
-
-    Buffer objects are cousins of strings, new in Python 1.5.2.  They are
-    supported, but at this writing you won't yet find much about them in the
-    Python documentation.  Using buffer objects may take some getting used
-    to, but we can create buffers much faster and with less memory than
-    strings.
-
-    For most of the operations you will perform in filters (like re.search,
-    string.find, md5.digest) you can treat buffers just like strings, but
-    there are a few important differences you should know about:
+    your filter class (it is fine to define more methods for your own use;
+    innd will not be using them but your filter can).  If you *do* define
+    the above methods, GET THE PARAMETER COUNTS RIGHT.  There are checks in
+    innd to see whether the methods exist and are callable, but if you
+    define one and get the parameter counts wrong, innd WILL DIE.  You have
+    been warned.  Be careful with your return values, too.  The "filter_art"
+    and "filter_messageid" methods have to return strings, or "None".  If
+    you return something like an int, innd will *not* be happy.
+
+  A Note regarding Buffer Objects
+
+    Buffer objects are cousins of strings, new in Python 1.5.2.  Using
+    buffer objects may take some getting used to, but we can create buffers
+    much faster and with less memory than strings.
+
+    For most of the operations you will perform in filters (like
+    "re.search", "string.find", "md5.digest") you can treat buffers just
+    like strings, but there are a few important differences you should know
+    about:
 
-        # Make a string and a two buffers.
+        # Make a string and two buffers.
         s = "abc"
         b = buffer("def")
         bs = buffer("abc")
@@ -173,23 +187,40 @@ WHAT'S THE DEAL WITH THESE BUFFER OBJECT
         s == str(bs)     # - This is also true, but buffer() is faster.
         s[:2] == bs[:2]  # - True.  Buffer slices are strings.
 
-        # While most string methods will take either a buffer or string,
-        # string.join insists on using only strings.
-        string.join([str(b), s], '.')   # returns 'def.abc'
+        # While most string methods will take either a buffer or a string,
+        # string.join (in the string module) insists on using only strings.
+        import string
+        string.join([str(b), s], '.')  # Returns 'def.abc'.
+        '.'.join([str(b), s])          # Returns 'def.abc' too.
+        '.'.join([b, s])               # This raises a TypeError.
 
-        e = s + b        # This raises a TypeError, but...
+        e = s + b                      # This raises a TypeError, but...
 
-        # ...these two both return the string 'abcdef'. The first one
+        # ...these two both return the string 'abcdef'.  The first one
         # is faster -- choose buffer() over str() whenever you can.
         e = buffer(s) + b
         f = s + str(b)
 
-        g = b + '>'      # This is legal, returns the string 'def>'.
+        g = b + '>'                    # This is legal, returns the string 'def>'.
 
-FUNCTIONS SUPPLIED BY THE BUILT-IN INND MODULE
+  Functions Supplied by the Built-in innd Module
 
-    Not only can innd use Python, but your filter can use some of innd's
-    features too.  Here is some sample Python code to show what you get:
+    Besides "INN.set_filter_hook" which is used to register your methods
+    with innd as it has already been explained above, the following
+    functions are available from Python scripts:
+
+    addhist(*message-id*)
+    article(*message-id*)
+    cancel(*message-id*)
+    havehist(*message-id*)
+    hashstring(*string*)
+    head(*message-id*)
+    newsgroup(*groupname*)
+    syslog(*level*, *message*)
+
+    Therefore, not only can innd use Python, but your filter can use some of
+    innd's features too.  Here is some sample Python code to show what you
+    get with the previously listed functions.
 
         import INN
 
@@ -198,7 +229,7 @@ FUNCTIONS SUPPLIED BY THE BUILT-IN INND 
         # tells the Unix syslogger what severity to use; you can
         # abbreviate down to one letter and it's case insensitive.
         # Available levels are (in increasing levels of seriousness)
-        # Debug, Info, Notice, Warning, Err, Crit, and Alert. (If you
+        # Debug, Info, Notice, Warning, Err, Crit, and Alert.  (If you
         # provide any other string, it will be defaulted to Notice.)  The
         # second parameter is the message text.  The syslog entries will
         # go to the same log files innd itself uses, with a 'python:'
@@ -212,15 +243,15 @@ FUNCTIONS SUPPLIED BY THE BUILT-IN INND 
         # local server; it doesn't send out a control message or anything
         # scary like that.  Returns 1 if successful, else 0.
         if INN.cancel('<meow$123.456@solvangpastries.edu>'):
-            canceled = "yup"
+            cancelled = "yup"
         else:
-            canceled = "nope"
+            cancelled = "nope"
 
-        # Check if a given message is in history. This doesn't
-        # necessarily mean the article is on your spool; canceled and
+        # Check if a given message is in history.  This doesn't
+        # necessarily mean the article is on your spool; cancelled and
         # expired articles hang around in history for a while, and
         # rejected articles will be in there if you have enabled
-        # remember_trash in inn.conf. Returns 1 if found, else 0.
+        # remembertrash in inn.conf.  Returns 1 if found, else 0.
         if INN.havehist('<z456$789.abc@isc.org>'):
             comment = "*yawn* I've already seen this article."
         else:
@@ -229,8 +260,8 @@ FUNCTIONS SUPPLIED BY THE BUILT-IN INND 
         # Here we are running a local spam filter, so why eat all those
         # cancels?  We can add fake entries to history so they'll get
         # refused.  Returns 1 on success, 0 on failure.
-        canceled_id = buffer('<meow$123.456@isc.org>')
-        if INN.addhist("<cancel." + canceled_id[1:]):
+        cancelled_id = buffer('<meow$123.456@isc.org>')
+        if INN.addhist("<cancel." + cancelled_id[1:]):
             thought = "Eat my dust, roadkill!"
         else:
             thought = "Darn, someone beat me to it."
@@ -242,6 +273,10 @@ FUNCTIONS SUPPLIED BY THE BUILT-IN INND 
         artbody = INN.article('<foo$bar.baz@bungmunch.edu>')
         artheader = INN.head('<foo$bar.baz@bungmunch.edu>')
 
+        # As we can compute a hash digest for a string, we can obtain one
+        # for artbody.  It might be of help to detect spam.
+        digest = INN.hashstring(artbody)
+
         # Finally, do you want to see if a given newsgroup is moderated or
         # whatever?  INN.newsgroup returns the last field of a group's
         # entry in active as a string.
@@ -255,288 +290,325 @@ FUNCTIONS SUPPLIED BY THE BUILT-IN INND 
         else:
             moderated = "something else"
 
-CHANGES TO PYTHON AUTHENTICATION AND ACCESS CONTROL SUPPORT FOR
-NNRPD
+Writing an nnrpd Filter
+
+  Changes to Python Authentication and Access Control Support for nnrpd
 
     The old authentication and access control functionality has been
     combined with the new readers.conf mechanism by Erik Klavon
-    <erik@eriq.org>; bug reports should however go to inn-bugs@isc.org, not
-    Erik.
+    <erik@eriq.org>; bug reports should however go to <inn-bugs@isc.org>,
+    not Erik.
 
     The remainder of this section is an introduction to the new mechanism
-    (which uses the python_auth, python_access, and python_dynamic
+    (which uses the *python_auth*, *python_access*, and *python_dynamic*
     readers.conf parameters) with porting/migration suggestions for people
     familiar with the old mechanism (identifiable by the now deprecated
-    nnrpperlauth: parameter in inn.conf).
+    *nnrpperlauth* parameter in inn.conf).
 
     Other people should skip this section.
 
-    The python_auth parameter allows the use of Python to authenticate a
-    user. Authentication scripts (like those from the old mechanism) are
-    listed in readers.conf using python_auth in the same manner other
-    authenticators are using auth:
+    The *python_auth* parameter allows the use of Python to authenticate a
+    user.  Authentication scripts (like those from the old mechanism) are
+    listed in readers.conf using *python_auth* in the same manner other
+    authenticators are using *auth*:
 
-            python_auth: "auth1.py"
+        python_auth: "nnrpd_auth"
+
+    It uses the script named nnrpd_auth.py (note that ".py" is not present
+    in the *python_auth* value).
 
     Scripts should be placed as before in the filter directory (see the
-    *pathfilter* setting in inn.conf). The new hook method authen_init takes
-    no arguments and its return value is ignored; its purpose is to provide
-    a means for authentication specific initialization. The hook method
-    authen_close is the more specific analogue to the old close method.
-    These method hooks are not required.
-
-    The argument dictionary passed to authenticate remains the same, except
-    for the removal of the "type" entry which is no longer needed in this
-    modification and the addition of several new entries (port, intipaddr,
-    intport) described below. The return tuple now only contains either two
-    or three elements, the first of which is the NNTP response code. The
-    second is an error string which is passed to the client if the response
-    code indicates that the authentication attempt has failed. This allows a
-    specific error message to be generated by the Python script in place of
-    the generic message "Authentication failed". An optional third return
-    element, if present, will be used to match the connection with the user:
-    parameter in access groups and will also be the username logged. If this
-    element is absent, the username supplied by the client during
-    authentication will be used, as was the previous behavior.
+    *pathfilter* setting in inn.conf).  The new hook method "authen_init"
+    takes no arguments and its return value is ignored; its purpose is to
+    provide a means for authentication specific initialization.  The hook
+    method "authen_close" is the more specific analogue to the old "close"
+    method.  These two method hooks are not required, contrary to
+    "authenticate", the main method.
+
+    The argument dictionary passed to "authenticate" remains the same,
+    except for the removal of the *type* entry which is no longer needed in
+    this modification and the addition of several new entries (*port*,
+    *intipaddr*, *intport*) described below.  The return tuple now only
+    contains either two or three elements, the first of which is the NNTP
+    response code.  The second is an error string which is passed to the
+    client if the response code indicates that the authentication attempt
+    has failed.  This allows a specific error message to be generated by the
+    Python script in place of the generic message "Authentication failed". 
+    An optional third return element, if present, will be used to match the
+    connection with the *user* parameter in access groups and will also be
+    the username logged.  If this element is absent, the username supplied
+    by the client during authentication will be used, as was the previous
+    behaviour.
 
-    The python_access parameter (described below) is new; it allows the
+    The *python_access* parameter (described below) is new; it allows the
     dynamic generation of an access group of an incoming connection using a
-    Python script. If a connection matches an auth group which has a
-    python_access parameter, all access groups in readers.conf are ignored;
-    instead the procedure described below is used to generate an access
-    group. This concept is due to Jeffrey M. Vinocur.
+    Python script.  If a connection matches an auth group which has a
+    *python_access* parameter, all access groups in readers.conf are
+    ignored; instead the procedure described below is used to generate an
+    access group.  This concept is due to Jeffrey M. Vinocur and you can add
+    this line to readers.conf in order to use the nnrpd_access.py Python
+    script in *pathfilter*:
+
+        python_access: "nnrpd_access"
 
     In the old implementation, the authorization method allowed for access
-    control on a per-group basis. That functionality is preserved in the new
-    implementation by the inclusion of the python_dynamic parameter in
-    readers.conf. The only change is the corresponding method name of
-    "dynamic" as opposed to "authorize"; "domain" and "range" are the same
-    as before except for the addition of several new entries to the argument
-    dictionary (port, intipaddr, intport) described below. Additionally, the
-    associated optional housekeeping methods dynamic_init and dynamic_close
-    may be implemented if needed.
+    control on a per-group basis.  That functionality is preserved in the
+    new implementation by the inclusion of the *python_dynamic* parameter in
+    readers.conf.  The only change is the corresponding method name of
+    "dynamic" as opposed to "authorize".  Additionally, the associated
+    optional housekeeping methods "dynamic_init" and "dynamic_close" may be
+    implemented if needed.  In order to use nnrpd_dynamic.py in
+    *pathfilter*, you can add this line to readers.conf:
+
+        python_dynamic: "nnrpd_dynamic"
 
     This new implementation should provide all of the previous capabilities
     of the Python hooks, in combination with the flexibility of readers.conf
     and the use of other authentication and resolving programs (including
-    the Perl hooks!). To use Python code that predates the new mechanism,
+    the Perl hooks!).  To use Python code that predates the new mechanism,
     you would need to modify the code slightly (see below for the new
-    specification) and supply a simple readers.conf file. If you don't want
-    to modify your code, the sample directory has nnrpd_auth_wrapper.py,
-    nnrpd_access_wrapper.py, and nnrpd_dynamic_wrapper.py which should allow
-    you to use your old code without needing to change it.
+    specification) and supply a simple readers.conf file.  If you do not
+    want to modify your code, the sample directory has
+    nnrpd_auth_wrapper.py, nnrpd_access_wrapper.py and
+    nnrpd_dynamic_wrapper.py which should allow you to use your old code
+    without needing to change it.
 
     However, before trying to use your old Python code, you may want to
-    consider replacing it entirely with non-Python authentication. (With
+    consider replacing it entirely with non-Python authentication.  (With
     readers.conf and the regular authenticator and resolver programs, much
     of what once required Python can be done directly.)  Even if the
     functionality is not available directly, you may wish to write a new
     authenticator or resolver (which can be done in whatever language you
     prefer).
 
-PYTHON AUTHENTICATION SUPPORT FOR NNRPD
-
-    Python authentication, dynamic access group generation and dynamic
-    access control support in nnrpd along with filtering support in innd may
-    be compiled in by passing "--with-python" "configure".
+  Python Authentication Support for nnrpd
 
     Support for authentication via Python is provided in nnrpd by the
-    inclusion of a python_auth: parameter in a readers.conf auth group.
-    python_auth: works exactly like the auth: parameter in readers.conf,
+    inclusion of a *python_auth* parameter in a readers.conf auth group. 
+    *python_auth* works exactly like the *auth* parameter in readers.conf,
     except that it calls the script given as argument using the Python hook
-    rather then treating it as an external program. Multiple, mixed use of
-    python_auth: with other auth: statements including perl_auth: is
-    permitted. Each auth: statement will be tried in the order they appear
+    rather then treating it as an external program.  Multiple, mixed use of
+    *python_auth* with other *auth* statements including *perl_auth* is
+    permitted.  Each *auth* statement will be tried in the order they appear
     in the auth group until either one succeeds or all are exhausted.
 
-    If the processing of readers.conf requires that a python_auth: statement
-    be used for authentication, Python is loaded (if it has yet to be) and
-    the file given as argument to the python_auth: parameter is loaded as
-    well. If a Python object with a method authen_init is hooked in during
-    the loading of that file, then that method is called immediately after
-    the file is loaded. If no errors have occurred, the method authenticate
-    is called. Depending on the NNTP response code returned by authenticate,
-    the authentication hook either succeeds or fails, after which the
-    processing of the auth group continues as usual. When the connection
-    with the client is closed, the method authen_close is called if it
-    exists.
+    If the processing of readers.conf requires that a *python_auth*
+    statement be used for authentication, Python is loaded (if it has yet to
+    be) and the file given as argument to the *python_auth* parameter is
+    loaded as well (do not include the ".py" extension of this file in the
+    value of *python_auth*).  If a Python object with a method "authen_init"
+    is hooked in during the loading of that file, then that method is called
+    immediately after the file is loaded.  If no errors have occurred, the
+    method "authenticate" is called.  Depending on the NNTP response code
+    returned by "authenticate", the authentication hook either succeeds or
+    fails, after which the processing of the auth group continues as usual. 
+    When the connection with the client is closed, the method "authen_close"
+    is called if it exists.
 
-DYNAMIC GENERATION OF ACCESS GROUPS
+  Dynamic Generation of Access Groups
 
     A Python script may be used to dynamically generate an access group
-    which is then used to determine the access rights of the client. This
-    occurs whenever the python_access: parameter is specified in an auth
-    group which has successfully matched the client. Only one python_access:
-    statement is allowed in an auth group. This parameter should not be
-    mixed with a perl_access: statement in the same auth group.
-
-    When a python_access: parameter is encountered, Python is loaded (if it
-    has yet to be) and the file given as argument is loaded as well. If a
-    Python object with a method "access_init" is hooked in during the
-    loading of that file, then that method is called immediately after the
-    file is loaded. If no errors have occurred, the method "access" is
-    called. The dictionary returned by "access" is used to generate an
-    access group that is then used to determine the access rights of the
-    client. When the connection with the client is closed, the method
-    "access_close" is called, if it exists.
-
-    While you may include the users: parameter in a dynamically generated
-    access group, some care should be taken (unless your pattern is just *
-    which is equivalent to leaving the parameter out). The group created
+    which is then used to determine the access rights of the client.  This
+    occurs whenever the *python_access* parameter is specified in an auth
+    group which has successfully matched the client.  Only one
+    *python_access* statement is allowed in an auth group.  This parameter
+    should not be mixed with a *perl_access* statement in the same auth
+    group.
+
+    When a *python_access* parameter is encountered, Python is loaded (if it
+    has yet to be) and the file given as argument is loaded as well (do not
+    include the ".py" extension of this file in the value of
+    *python_access*).  If a Python object with a method "access_init" is
+    hooked in during the loading of that file, then that method is called
+    immediately after the file is loaded.  If no errors have occurred, the
+    method "access" is called.  The dictionary returned by "access" is used
+    to generate an access group that is then used to determine the access
+    rights of the client.  When the connection with the client is closed,
+    the method "access_close" is called, if it exists.
+
+    While you may include the *users* parameter in a dynamically generated
+    access group, some care should be taken (unless your pattern is just "*"
+    which is equivalent to leaving the parameter out).  The group created
     with the values returned from the Python script is the only one
     considered when nnrpd attempts to find an access group matching the
-    connection. If a users: parameter is included and it doesn't match the
-    connection, then the client will be denied access since there are no
+    connection.  If a *users* parameter is included and it does not match
+    the connection, then the client will be denied access since there are no
     other access groups which could match the connection.
 
-DYNAMIC ACCESS CONTROL
+  Dynamic Access Control
 
     If you need to have access control rules applied immediately without
     having to restart all the nnrpd processes, you may apply access control
     on a per newsgroup basis using the Python dynamic hooks (as opposed to
-    readers.conf, which does the same on per user basis). These hooks are
-    activated through the inclusion of the python_dynamic: parameter in a
-    readers.conf auth group. Only one python_dynamic: statement is allowed
+    readers.conf, which does the same on per user basis).  These hooks are
+    activated through the inclusion of the *python_dynamic* parameter in a
+    readers.conf auth group.  Only one *python_dynamic* statement is allowed
     in an auth group.
 
-    When a python_dynamic: parameter is encountered, Python is loaded (if it
-    has yet to be) and the file given as argument is loaded as well. If a
-    Python object with a method "dynamic_init" is hooked in during the
-    loading of that file, then that method is called immediately after the
-    file is loaded. Every time a reader asks nnrpd to read or post an
-    article, the Python method "dynamic" is invoked before proceeding with
-    the requested operation. Based on the value returned by "dynamic", the
-    operation is either permitted or denied. When the connection with the
-    client is closed, the method "access_close" is called if it exists.
+    When a *python_dynamic* parameter is encountered, Python is loaded (if
+    it has yet to be) and the file given as argument is loaded as well (do
+    not include the ".py" extension of this file in the value of
+    *python_dynamic*).  If a Python object with a method "dynamic_init" is
+    hooked in during the loading of that file, then that method is called
+    immediately after the file is loaded.  Every time a reader asks nnrpd to
+    read or post an article, the Python method "dynamic" is invoked before
+    proceeding with the requested operation.  Based on the value returned by
+    "dynamic", the operation is either permitted or denied.  When the
+    connection with the client is closed, the method "access_close" is
+    called if it exists.
 
-WRITING A PYTHON NNRPD AUTHENTICATION MODULE
+  Writing a Python nnrpd Authentication Module
 
     You need to create a nnrpd_auth.py module in INN's filter directory (see
     the *pathfilter* setting in inn.conf) where you should define a class
     holding certain methods depending on which hooks you want to use.
 
+    Note that you will have to use different Python scripts for
+    authentication and access:  the values of *python_auth*, *python_access*
+    and *python_dynamic* have to be distinct for your scripts to work.
+
     The following methods are known to nnrpd:
 
-    __init__(self)
+    __init__(*self*)
         Not explicitly called by nnrpd, but will run whenever the auth
-        module is loaded. Use this method to initialize any general
-        variables or open a common database connection. This method may be
+        module is loaded.  Use this method to initialize any general
+        variables or open a common database connection.  This method may be
         omitted.
 
-    authen_init(self)
-        Initialization function specific to authentication. This method may
+    authen_init(*self*)
+        Initialization function specific to authentication.  This method may
         be omitted.
 
-    authenticate(self, attributes)
-        Called when a python_auth statement is reached in the processing of
-        readers.conf. Connection attributes are passed in the "attributes"
-        dictionary. Returns a response code, an error string, and an
-        optional string to be used in place of the client-supplied username
-        (both for logging and for matching the connection with an access
-        group).
+    authenticate(*self*, *attributes*)
+        Called when a *python_auth* statement is reached in the processing
+        of readers.conf.  Connection attributes are passed in the
+        *attributes* dictionary.  Returns a response code, an error string,
+        and an optional string to be used in place of the client-supplied
+        username (both for logging and for matching the connection with an
+        access group).
 
-    authen_close(self)
+    authen_close(*self*)
         This method is invoked on nnrpd termination.  You can use it to save
-        state information or close a database connection.
+        state information or close a database connection.  This method may
+        be omitted.
 
-    access_init(self)
-        Initialization function specific to generation of an access group.
+    access_init(*self*)
+        Initialization function specific to generation of an access group. 
         This method may be omitted.
 
-    access(self, attributes)
-        Called when a python_access statement is reached in the processing
-        of readers.conf. Connection attributes are passed in the
-        "attributes" dictionary. Returns a dictionary of values representing
-        statements to be included in an access group.
-
-    access_close(self)
-        This method is invoked on nnrpd termination. You can use it to save
-        state information or close a database connection.
+    access(*self*, *attributes*)
+        Called when a *python_access* statement is reached in the processing
+        of readers.conf.  Connection attributes are passed in the
+        *attributes* dictionary.  Returns a dictionary of values
+        representing statements to be included in an access group.
 
-    dynamic_init(self)
-        Initialization function specific to dynamic access control. This
+    access_close(*self*)
+        This method is invoked on nnrpd termination.  You can use it to save
+        state information or close a database connection.  This method may
+        be omitted.
+
+    dynamic_init(*self*)
+        Initialization function specific to dynamic access control.  This
         method may be omitted.
 
-    dynamic(self, attributes)
+    dynamic(*self*, *attributes*)
         Called when a client requests a newsgroup, an article or attempts to
-        post. Connection attributes are passed in the "attributes"
+        post.  Connection attributes are passed in the *attributes*
         dictionary.  Returns "None" to grant access, or a non-empty string
         (which will be reported back to the client) otherwise.
 
-    dynamic_close(self)
+    dynamic_close(*self*)
         This method is invoked on nnrpd termination.  You can use it to save
-        state information or close a database connection.
+        state information or close a database connection.  This method may
+        be omitted.
+
+  The *attributes* Dictionary
+
+    The keys and associated values of the *attributes* dictionary are
+    described below.
 
-    attributes dictionary
-        The keys and associated values of the "attributes" dictionary are
-        described below.
+    *type*
+        "read" or "post" values specify the authentication type; only valid
+        for the "dynamic" method.
 
-        type
-            "read" or "post" values specify the authentication type; only
-            valid for the "dynamic" method
+    *hostname*
+        It is the resolved hostname (or IP address if resolution fails) of
+        the connected reader.
 
-        hostname
-            resolved hostname (or IP address if resolution fails) of
-            connected reader
+    *ipaddress*
+        The IP address of the connected reader.
 
-        ipaddress
-            IP address of connected reader
+    *port*
+        The port of the connected reader.
 
-        port
-            port of connected reader
+    *interface*
+        The hostname of the local endpoint of the NNTP connection.
 
-        interface
-            hostname of the local endpoint of the NNTP connection
+    *intipaddr*
+        The IP address of the local endpoint of the NNTP connection.
 
-        intipaddr
-            IP address of the local endpoint of the NNTP connection
+    *intport*
+        The port of the local endpoint of the NNTP connection.
 
-        intport
-            port of the local endpoint of the NNTP connection
+    *user*
+        The username as passed with AUTHINFO command, or "None" if not
+        applicable.
 
-        user
-            username as reader passed with AUTHINFO command, or None if not
-            applicable
+    *pass*
+        The password as passed with AUTHINFO command, or "None" if not
+        applicable.
 
-        pass
-            password as reader passed with AUTHINFO command, or None if not
-            applicible
+    *newsgroup*
+        The name of the newsgroup to which the reader requests read or post
+        access; only valid for the "dynamic" method.
 
-        newsgroup
-            name of the newsgroup reader requests read or post access to;
-            only valid for the "dynamic" method
+    All the above values are buffer objects (see the notes above on what
+    buffer objects are).
 
-        All the above values are buffer objects (see the notes above on what
-        buffer objects are).
+  How to Use these Methods with nnrpd
 
     To register your methods with nnrpd, you need to create an instance of
     your class, import the built-in nnrpd module, and pass the instance to
-    nnrpd.set_auth_hook().  For example:
+    "nnrpd.set_auth_hook".  For example:
 
         class AUTH:
-            def authenticate(self, attributes):
+            def authen_init(self):
+                ...
+                blah blah
                 ...
 
-            def authorize(self, attributes):
+            def authenticate(self, attributes):
+                ...
+                yadda yadda
                 ...
 
         import nnrpd
         myauth = AUTH()
         nnrpd.set_auth_hook(myauth)
 
-    There is also an nnrpd.py module there that is not actually used by
-    nnrpd but provides the same set of functions as built-in nnrpd module. 
-    This stub module may be used when debugging your own module.
+    When writing and testing your Python filter, don't be afraid to make use
+    of "try:"/"except:" and the provided "nnrpd.syslog" function.  stdout
+    and stderr will be disabled, so your filter will die silently otherwise.
+
+    Also, remember to try importing your module interactively before loading
+    it, to ensure there are no obvious errors.  One typo can ruin your whole
+    filter.  A dummy nnrpd.py module is provided to facilitate testing
+    outside the server.  It is not actually used by nnrpd but provides the
+    same set of functions as built-in nnrpd module. This stub module may be
+    used when debugging your own module.  To test, change into your filter
+    directory and use a command like:
+
+        python -ic 'import nnrpd, nnrpd_auth'
 
-FUNCTIONS SUPPLIED BY THE BUILT-IN NNRPD MODULE
+  Functions Supplied by the Built-in nnrpd Module
 
-    As of this writing, nnrpd built-in module exports the following
-    functions:
+    Besides "nnrpd.set_auth_hook" used to pass a reference to the instance
+    of authentication and authorization class to nnrpd, the nnrpd built-in
+    module exports the following function:
 
-    set_auth_hook()
-        used to pass a reference to the instance of authentication and
-        authorization class to nnrpd
+    syslog(*level*, *message*)
+        It is intended to be a replacement for a Python native syslog.  It
+        works like "INN.syslog", seen above.
 
-    syslog()
-        intended to be a replacement for a Python native syslog
+    $Id: hook-python 7926 2008-06-29 08:27:41Z iulius $
 
diff -Nrup inn-2.4.4/doc/man/active.5 inn-2.4.5/doc/man/active.5
--- inn-2.4.4/doc/man/active.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/active.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "ACTIVE 5"
-.TH ACTIVE 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH ACTIVE 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 active \- List of newsgroups carried by the server
 .SH "DESCRIPTION"
@@ -214,7 +214,7 @@ alias.
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.  Converted to
 \&\s-1POD\s0 by Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: active.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: active.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIactive.times\fR\|(5), \fIcontrolchan\fR\|(8), \fIctlinnd\fR\|(8), \fIinn.conf\fR\|(5), \fIinnd\fR\|(8),
diff -Nrup inn-2.4.4/doc/man/active.times.5 inn-2.4.5/doc/man/active.times.5
--- inn-2.4.4/doc/man/active.times.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/active.times.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "ACTIVE.TIMES 5"
-.TH ACTIVE.TIMES 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH ACTIVE.TIMES 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 active.times \- List of local creation times of newsgroups
 .SH "DESCRIPTION"
@@ -157,7 +157,7 @@ given to \fBctlinnd\fR.
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.  Converted to
 \&\s-1POD\s0 by Russ Allbery <rra@stanford.edu>
 .PP
-$Id: active.times.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: active.times.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIactive\fR\|(5), \fIctlinnd\fR\|(8), \fIinn.conf\fR\|(5), \fIinnd\fR\|(8), \fInnrpd\fR\|(8)
diff -Nrup inn-2.4.4/doc/man/auth_krb5.8 inn-2.4.5/doc/man/auth_krb5.8
--- inn-2.4.4/doc/man/auth_krb5.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/auth_krb5.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "AUTH_KRB5 8"
-.TH AUTH_KRB5 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH AUTH_KRB5 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 auth_krb5 \- nnrpd Kerberos v5 authenticator
 .SH "SYNOPSIS"
@@ -200,7 +200,7 @@ Originally written by Christopher P. Lin
 written by Russ Allbery <rra@stanford.edu> based on Christopher's original
 \&\s-1README\s0 file.
 .PP
-$Id: auth_krb5.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: auth_krb5.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fInnrpd\fR\|(8), \fIreaders.conf\fR\|(5)
diff -Nrup inn-2.4.4/doc/man/auth_smb.8 inn-2.4.5/doc/man/auth_smb.8
--- inn-2.4.4/doc/man/auth_smb.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/auth_smb.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "AUTH_SMB 8"
-.TH AUTH_SMB 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH AUTH_SMB 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 auth_smb \- nnrpd Samba authenticator
 .SH "SYNOPSIS"
@@ -176,7 +176,7 @@ Originally written October 2000 by Krisc
 based heavily on pam_smb v1.1.6 by David Airlie <airlied@samba.org>.
 This documentation was written by Jeffrey M. Vinocur <jeff@litech.org>.
 .PP
-$Id: auth_smb.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: auth_smb.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fInnrpd\fR\|(8), \fIreaders.conf\fR\|(5)
diff -Nrup inn-2.4.4/doc/man/ckpasswd.8 inn-2.4.5/doc/man/ckpasswd.8
--- inn-2.4.4/doc/man/ckpasswd.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/ckpasswd.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "CKPASSWD 8"
-.TH CKPASSWD 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH CKPASSWD 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 ckpasswd \- nnrpd password authenticator
 .SH "SYNOPSIS"
@@ -301,7 +301,7 @@ it will print some sort of error message
 .IX Header "HISTORY"
 Written by Russ Allbery <rra@stanford.edu> for InterNetNews.
 .PP
-$Id: ckpasswd.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: ckpasswd.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIreaders.conf\fR\|(5), \fInnrpd\fR\|(8)
diff -Nrup inn-2.4.4/doc/man/control.ctl.5 inn-2.4.5/doc/man/control.ctl.5
--- inn-2.4.4/doc/man/control.ctl.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/control.ctl.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "CONTROL.CTL 5"
-.TH CONTROL.CTL 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH CONTROL.CTL 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 control.ctl \- Specify handling of Usenet control messages
 .SH "DESCRIPTION"
@@ -310,7 +310,7 @@ probably intended to do (yet).
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.  Rewritten in
 \&\s-1POD\s0 by Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: control.ctl.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: control.ctl.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIcontrolchan\fR\|(8), \fIinn.conf\fR\|(5), \fIinnd\fR\|(8), \fInewsfeeds\fR\|(5), \fIpgpverify\fR\|(8), \fIsh\fR\|(1).
diff -Nrup inn-2.4.4/doc/man/convdate.1 inn-2.4.5/doc/man/convdate.1
--- inn-2.4.4/doc/man/convdate.1	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/convdate.1	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "CONVDATE 1"
-.TH CONVDATE 1 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH CONVDATE 1 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 convdate \- Convert time/date strings and numbers
 .SH "SYNOPSIS"
@@ -230,7 +230,7 @@ determine (or at least override) the loc
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net>, rewritten and updated by Russ
 Allbery <rra@stanford.edu> for the \fB\-d\fR and \fB\-l\fR flags.
 .PP
-$Id: convdate.1 7736 2008-04-06 09:27:49Z iulius $
+$Id: convdate.1 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIparsedate\fR\|(3).
diff -Nrup inn-2.4.4/doc/man/cycbuff.conf.5 inn-2.4.5/doc/man/cycbuff.conf.5
--- inn-2.4.4/doc/man/cycbuff.conf.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/cycbuff.conf.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "CYCBUFF.CONF 5"
-.TH CYCBUFF.CONF 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH CYCBUFF.CONF 5 "2008-06-07" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 cycbuff.conf \- Configuration file for INN CNFS storage method
 .SH "DESCRIPTION"
@@ -210,7 +210,7 @@ metacycbuff line.
 .PP
 \&\fBinnd\fR only reads \fIcycbuff.conf\fR on startup, so if you change anything
 in this file and want \fBinnd\fR to pick up the changes, you have to stop and
-restart it.  \f(CW\*(C`ctlinnd reload ''\*(C'\fR is not sufficient.
+restart it.  \f(CW\*(C`ctlinnd reload all ''\*(C'\fR is not sufficient.
 .PP
 When articles are stored, the cycbuff into which they're stored is saved
 as part of the article token.  In order for \s-1INN\s0 to retrieve articles from
@@ -314,7 +314,7 @@ where \s-1ONE\s0 will be whatever you ca
 Written by Katsuhiro Kondou <kondou@nec.co.jp> for InterNetNews.
 Rewritten into \s-1POD\s0 by Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: cycbuff.conf.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: cycbuff.conf.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIctlinnd\fR\|(8), \fIinnd\fR\|(8), \fInnrpd\fR\|(8), \fIsm\fR\|(1), \fIstorage.conf\fR\|(5)
diff -Nrup inn-2.4.4/doc/man/distrib.pats.5 inn-2.4.5/doc/man/distrib.pats.5
--- inn-2.4.4/doc/man/distrib.pats.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/distrib.pats.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "DISTRIB.PATS 5"
-.TH DISTRIB.PATS 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH DISTRIB.PATS 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 distrib.pats \- Default values for the Distribution header
 .SH "DESCRIPTION"
@@ -168,7 +168,7 @@ header will be added.
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.  Converted to
 \&\s-1POD\s0 by Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: distrib.pats.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: distrib.pats.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIinn.conf\fR\|(5), \fInnrpd\fR\|(8), \fIuwildmat\fR\|(3)
diff -Nrup inn-2.4.4/doc/man/domain.8 inn-2.4.5/doc/man/domain.8
--- inn-2.4.4/doc/man/domain.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/domain.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "DOMAIN 8"
-.TH DOMAIN 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH DOMAIN 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 domain \- nnrpd domain resolver
 .SH "SYNOPSIS"
@@ -181,7 +181,7 @@ If so, the example above should reflect 
 .IX Header "HISTORY"
 This documentation was written by Jeffrey M. Vinocur <jeff@litech.org>.
 .PP
-$Id: domain.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: domain.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fInnrpd\fR\|(8), \fIreaders.conf\fR\|(5)
diff -Nrup inn-2.4.4/doc/man/expire.ctl.5 inn-2.4.5/doc/man/expire.ctl.5
--- inn-2.4.4/doc/man/expire.ctl.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/expire.ctl.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXPIRE.CTL 5"
-.TH EXPIRE.CTL 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH EXPIRE.CTL 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 expire.ctl \- Configuration file for article expiration
 .SH "DESCRIPTION"
@@ -312,7 +312,7 @@ When \fIgroupbaseexpiry\fR is false, for
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.  Converted to
 \&\s-1POD\s0 by Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: expire.ctl.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: expire.ctl.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIexpire\fR\|(8), \fIexpireover\fR\|(8), \fIinn.conf\fR\|(5), \fIinnd\fR\|(8), \fInews.daily\fR\|(8),
diff -Nrup inn-2.4.4/doc/man/expireover.8 inn-2.4.5/doc/man/expireover.8
--- inn-2.4.4/doc/man/expireover.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/expireover.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "EXPIREOVER 8"
-.TH EXPIREOVER 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH EXPIREOVER 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 expireover \- Expire entries from the news overview database
 .SH "SYNOPSIS"
@@ -260,7 +260,7 @@ Written by Rob Robertson <rob@violet.ber
 <rsalz@uunet.uu.net> (with help from Dave Lawrence <tale@uunet.uu.net>)
 for InterNetNews.
 .PP
-$Id: expireover.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: expireover.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIactive\fR\|(5), \fIctlinnd\fR\|(8), \fIexpire\fR\|(8), \fIexpire.ctl\fR\|(5), \fIinn.conf\fR\|(5),
diff -Nrup inn-2.4.4/doc/man/fastrm.1 inn-2.4.5/doc/man/fastrm.1
--- inn-2.4.4/doc/man/fastrm.1	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/fastrm.1	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "FASTRM 1"
-.TH FASTRM 1 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH FASTRM 1 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 fastrm \- Quickly remove a list of files
 .SH "SYNOPSIS"
@@ -302,7 +302,7 @@ general fast file removal program.
 \&\fBfastrm\fR was originally written by kre@munnari.oz.au.  This manual page
 rewritten in \s-1POD\s0 by Russ Allbery <rra@stanford.edu> for InterNetNews.
 .PP
-$Id: fastrm.1 7736 2008-04-06 09:27:49Z iulius $
+$Id: fastrm.1 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIexpirerm\fR\|(8)
diff -Nrup inn-2.4.4/doc/man/grephistory.1 inn-2.4.5/doc/man/grephistory.1
--- inn-2.4.4/doc/man/grephistory.1	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/grephistory.1	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "GREPHISTORY 1"
-.TH GREPHISTORY 1 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH GREPHISTORY 1 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 grephistory \- Query the INN history database
 .SH "SYNOPSIS"
@@ -194,7 +194,7 @@ any other requested information.  This f
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.  Rewritten in
 \&\s-1POD\s0 by Russ Allbery <rra@stanford.edu>.
 .Sp
-$Id: grephistory.1 7736 2008-04-06 09:27:49Z iulius $
+$Id: grephistory.1 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIhistory\fR\|(5), \fIinn.conf\fR\|(5)
diff -Nrup inn-2.4.4/doc/man/ident.8 inn-2.4.5/doc/man/ident.8
--- inn-2.4.4/doc/man/ident.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/ident.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "IDENT 8"
-.TH IDENT 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH IDENT 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 ident \- nnrpd ident resolver
 .SH "SYNOPSIS"
@@ -186,7 +186,7 @@ network whose machines respond to ident 
 .IX Header "HISTORY"
 This documentation was written by Jeffrey M. Vinocur <jeff@litech.org>.
 .PP
-$Id: ident.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: ident.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fInnrpd\fR\|(8), \fIreaders.conf\fR\|(5)
diff -Nrup inn-2.4.4/doc/man/inews.1 inn-2.4.5/doc/man/inews.1
--- inn-2.4.4/doc/man/inews.1	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/inews.1	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "INEWS 1"
-.TH INEWS 1 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH INEWS 1 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 inews \- Post a Usenet article to the local news server
 .SH "SYNOPSIS"
diff -Nrup inn-2.4.4/doc/man/inn.conf.5 inn-2.4.5/doc/man/inn.conf.5
--- inn-2.4.4/doc/man/inn.conf.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/inn.conf.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "INN.CONF 5"
-.TH INN.CONF 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH INN.CONF 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 inn.conf \- Configuration data for InterNetNews programs
 .SH "DESCRIPTION"
@@ -1211,7 +1211,7 @@ values for reference.
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews and since
 modified, updated, and reorganized by innumerable other people.
 .PP
-$Id: inn.conf.5 7751 2008-04-06 14:35:40Z iulius $
+$Id: inn.conf.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIinews\fR\|(1), \fIinnd\fR\|(8), \fIinnwatch\fR\|(8), \fInnrpd\fR\|(8), \fIrnews\fR\|(1).
diff -Nrup inn-2.4.4/doc/man/innconfval.1 inn-2.4.5/doc/man/innconfval.1
--- inn-2.4.4/doc/man/innconfval.1	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/innconfval.1	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "INNCONFVAL 1"
-.TH INNCONFVAL 1 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH INNCONFVAL 1 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 innconfval \- Get configuration parameters from inn.conf
 .SH "SYNOPSIS"
@@ -192,7 +192,7 @@ Print \s-1INN\s0's version.  This is equ
 .IX Header "HISTORY"
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.
 .PP
-$Id: innconfval.1 7736 2008-04-06 09:27:49Z iulius $
+$Id: innconfval.1 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIinn.conf\fR\|(5)
diff -Nrup inn-2.4.4/doc/man/innd.8 inn-2.4.5/doc/man/innd.8
--- inn-2.4.4/doc/man/innd.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/innd.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "INND 8"
-.TH INND 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH INND 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 innd \- InterNetNews daemon
 .SH "SYNOPSIS"
@@ -593,7 +593,7 @@ disables source routing.
 .IX Header "HISTORY"
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.
 .PP
-$Id: innd.8 7751 2008-04-06 14:35:40Z iulius $
+$Id: innd.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIactive\fR\|(5), \fIctlinnd\fR\|(8), \fIdbz\fR\|(3), \fIhistory\fR\|(5), \fIincoming.conf\fR\|(5), \fIinn.conf\fR\|(5),
diff -Nrup inn-2.4.4/doc/man/inndf.8 inn-2.4.5/doc/man/inndf.8
--- inn-2.4.4/doc/man/inndf.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/inndf.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "INNDF 8"
-.TH INNDF 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH INNDF 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 inndf \- Report free disk, inodes, and overview information
 .SH "SYNOPSIS"
diff -Nrup inn-2.4.4/doc/man/inndstart.8 inn-2.4.5/doc/man/inndstart.8
--- inn-2.4.4/doc/man/inndstart.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/inndstart.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "INNDSTART 8"
-.TH INNDSTART 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH INNDSTART 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 inndstart \- Start innd
 .SH "SYNOPSIS"
@@ -388,7 +388,7 @@ The binary that is executed as \fBinnd\f
 .IX Header "HISTORY"
 Written by Russ Allbery <rra@stanford.edu> for InterNetNews.
 .PP
-$Id: inndstart.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: inndstart.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIinn.conf\fR\|(5), \fIinnd\fR\|(8)
diff -Nrup inn-2.4.4/doc/man/innmail.1 inn-2.4.5/doc/man/innmail.1
--- inn-2.4.4/doc/man/innmail.1	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/innmail.1	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "INNMAIL 1"
-.TH INNMAIL 1 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH INNMAIL 1 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 innmail \- Simple mail\-sending program
 .SH "SYNOPSIS"
diff -Nrup inn-2.4.4/doc/man/innupgrade.8 inn-2.4.5/doc/man/innupgrade.8
--- inn-2.4.4/doc/man/innupgrade.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/innupgrade.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "INNUPGRADE 8"
-.TH INNUPGRADE 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH INNUPGRADE 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 innupgrade \- Upgrade INN configuration files
 .SH "SYNOPSIS"
@@ -201,4 +201,4 @@ alternate file.
 .IX Header "HISTORY"
 Written by Russ Allbery <rra@stanford.edu> for InterNetNews.
 .PP
-$Id: innupgrade.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: innupgrade.8 7880 2008-06-16 20:37:13Z iulius $
diff -Nrup inn-2.4.4/doc/man/libauth.3 inn-2.4.5/doc/man/libauth.3
--- inn-2.4.4/doc/man/libauth.3	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/libauth.3	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "libauth 3"
-.TH libauth 3 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH libauth 3 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 libauth \- routines for writing nnrpd resolvers and authenticators
 .SH "SYNOPSIS"
@@ -201,7 +201,7 @@ respectively?
 .IX Header "HISTORY"
 Written by Jeffrey M. Vinocur <jeff@litech.org> for InterNetNews.
 .PP
-$Id: libauth.3 7736 2008-04-06 09:27:49Z iulius $
+$Id: libauth.3 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fInnrpd\fR\|(8), \fIreaders.conf\fR\|(5), \fIdoc/external\-auth\fR
diff -Nrup inn-2.4.4/doc/man/libinnhist.3 inn-2.4.5/doc/man/libinnhist.3
--- inn-2.4.4/doc/man/libinnhist.3	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/libinnhist.3	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "libinnhist 3"
-.TH libinnhist 3 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH libinnhist 3 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 his \- routines for managing INN history
 .SH "SYNOPSIS"
@@ -418,4 +418,4 @@ type \fBtime_t\fR and will not be modifi
 .IX Header "HISTORY"
 Written by Alex Kiernan <alexk@demon.net> for InterNetNews 2.4.0.
 .Sp
-$Id: libinnhist.3 7736 2008-04-06 09:27:49Z iulius $
+$Id: libinnhist.3 7880 2008-06-16 20:37:13Z iulius $
diff -Nrup inn-2.4.4/doc/man/list.3 inn-2.4.5/doc/man/list.3
--- inn-2.4.4/doc/man/list.3	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/list.3	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "list 3"
-.TH list 3 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH list 3 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 list \- list routines
 .SH "SYNOPSIS"
@@ -208,4 +208,4 @@ to the caller.
 .IX Header "HISTORY"
 Written by Alex Kiernan <alex.kiernan@thus.net> for InterNetNews 2.4.0.
 .PP
-$Id: list.3 7736 2008-04-06 09:27:49Z iulius $
+$Id: list.3 7880 2008-06-16 20:37:13Z iulius $
diff -Nrup inn-2.4.4/doc/man/mailpost.8 inn-2.4.5/doc/man/mailpost.8
--- inn-2.4.4/doc/man/mailpost.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/mailpost.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "MAILPOST 8"
-.TH MAILPOST 8 "2008-04-26" "INN 2.4.4" "InterNetNews Documentation"
+.TH MAILPOST 8 "2008-04-26" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 mailpost \- Feed an e\-mail message into a newsgroup
 .SH "SYNOPSIS"
@@ -252,7 +252,7 @@ The default database files which record 
 Written by Paul Vixie long ago and then hacked up by James Brister for \s-1INN\s0 
 integration.
 .PP
-$Id: mailpost.8 7798 2008-04-26 08:47:01Z iulius $
+$Id: mailpost.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIactive\fR\|(5), \fIinews\fR\|(1), \fIinn.conf\fR\|(5), \fInnrpd\fR\|(8), \fIuwildmat\fR\|(3).
diff -Nrup inn-2.4.4/doc/man/makehistory.8 inn-2.4.5/doc/man/makehistory.8
--- inn-2.4.4/doc/man/makehistory.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/makehistory.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "MAKEHISTORY 8"
-.TH MAKEHISTORY 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH MAKEHISTORY 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 makehistory \- Initialize or rebuild INN history database
 .SH "SYNOPSIS"
@@ -301,7 +301,7 @@ Where temporary files are written unless
 Originally written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews and
 updated by various other people since.
 .PP
-$Id: makehistory.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: makehistory.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIdbz\fR\|(3), \fIactive\fR\|(5), \fIhistory\fR\|(5), \fIinn.conf\fR\|(5), \fIctlinnd\fR\|(8), \fIinnd\fR\|(8),
diff -Nrup inn-2.4.4/doc/man/motd.news.5 inn-2.4.5/doc/man/motd.news.5
--- inn-2.4.4/doc/man/motd.news.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/motd.news.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "MOTD.NEWS 5"
-.TH MOTD.NEWS 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH MOTD.NEWS 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 motd.news \- Message of the day information for readers
 .SH "DESCRIPTION"
@@ -148,7 +148,7 @@ the client an empty response.
 .IX Header "HISTORY"
 Rewritten in \s-1POD\s0 by Russ Allbery <rra@stanford.edu> for InterNetNews.
 .PP
-$Id: motd.news.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: motd.news.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIinn.conf\fR\|(5)
diff -Nrup inn-2.4.4/doc/man/newsfeeds.5 inn-2.4.5/doc/man/newsfeeds.5
--- inn-2.4.4/doc/man/newsfeeds.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/newsfeeds.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "NEWSFEEDS 5"
-.TH NEWSFEEDS 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH NEWSFEEDS 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 newsfeeds \- Determine where Usenet articles are sent
 .SH "DESCRIPTION"
@@ -904,7 +904,7 @@ the standard newsfeeds entries used by m
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.  Reformatted
 and rewritten in \s-1POD\s0 by Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: newsfeeds.5 7741 2008-04-06 09:51:47Z iulius $
+$Id: newsfeeds.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIactive\fR\|(5), \fIbuffchan\fR\|(8), \fIcontrolchan\fR\|(8), \fIctlinnd\fR\|(8), \fIinn.conf\fR\|(5), \fIinnd\fR\|(8),
diff -Nrup inn-2.4.4/doc/man/ninpaths.8 inn-2.4.5/doc/man/ninpaths.8
--- inn-2.4.4/doc/man/ninpaths.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/ninpaths.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "NINPATHS 8"
-.TH NINPATHS 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH NINPATHS 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 ninpaths \- Report Usenet Path statistics (new inpaths)
 .SH "SYNOPSIS"
diff -Nrup inn-2.4.4/doc/man/nnrpd.8 inn-2.4.5/doc/man/nnrpd.8
--- inn-2.4.4/doc/man/nnrpd.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/nnrpd.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "NNRPD 8"
-.TH NNRPD 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH NNRPD 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 nnrpd \- NNTP server for reader clients
 .SH "SYNOPSIS"
@@ -376,7 +376,7 @@ support added by Rob Robertston <rob@vio
 January, 1993.  Exponential backoff (for posting) added by Dave Hayes in
 Febuary 1998.
 .PP
-$Id: nnrpd.8 7751 2008-04-06 14:35:40Z iulius $
+$Id: nnrpd.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIctlinnd\fR\|(8), \fIinnd\fR\|(8), \fIinn.conf\fR\|(5), \fIsignal\fR\|(2), \fIuwildmat\fR\|(3).
diff -Nrup inn-2.4.4/doc/man/ovdb.5 inn-2.4.5/doc/man/ovdb.5
--- inn-2.4.4/doc/man/ovdb.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/ovdb.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "OVDB 5"
-.TH OVDB 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH OVDB 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 ovdb \- Overview storage method for INN
 .SH "DESCRIPTION"
diff -Nrup inn-2.4.4/doc/man/ovdb_init.8 inn-2.4.5/doc/man/ovdb_init.8
--- inn-2.4.4/doc/man/ovdb_init.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/ovdb_init.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "OVDB_INIT 8"
-.TH OVDB_INIT 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH OVDB_INIT 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 ovdb_init \- Prepare ovdb database for use
 .SH "SYNOPSYS"
diff -Nrup inn-2.4.4/doc/man/ovdb_monitor.8 inn-2.4.5/doc/man/ovdb_monitor.8
--- inn-2.4.4/doc/man/ovdb_monitor.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/ovdb_monitor.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "OVDB_MONITOR 8"
-.TH OVDB_MONITOR 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH OVDB_MONITOR 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 ovdb_monitor \- Database maintenance
 .SH "SYNOPSYS"
diff -Nrup inn-2.4.4/doc/man/ovdb_server.8 inn-2.4.5/doc/man/ovdb_server.8
--- inn-2.4.4/doc/man/ovdb_server.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/ovdb_server.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "OVDB_SERVER 8"
-.TH OVDB_SERVER 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH OVDB_SERVER 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 ovdb_server \- overview 'helper' server
 .SH "SYNOPSYS"
diff -Nrup inn-2.4.4/doc/man/ovdb_stat.8 inn-2.4.5/doc/man/ovdb_stat.8
--- inn-2.4.4/doc/man/ovdb_stat.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/ovdb_stat.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "OVDB_STAT 8"
-.TH OVDB_STAT 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH OVDB_STAT 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 ovdb_stat \- Display information from the ovdb database
 .SH "SYNOPSYS"
diff -Nrup inn-2.4.4/doc/man/passwd.nntp.5 inn-2.4.5/doc/man/passwd.nntp.5
--- inn-2.4.4/doc/man/passwd.nntp.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/passwd.nntp.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "PASSWD.NNTP 5"
-.TH PASSWD.NNTP 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH PASSWD.NNTP 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 passwd.nntp \- passwords for connecting to remote NNTP servers
 .SH "DESCRIPTION"
@@ -175,7 +175,7 @@ This file should not be world\-readable.
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.  This is
 revision \f(CW$Revision:\fR 5089 $, dated \f(CW$Date:\fR 2002\-02\-03 20:03:41 +0100 (dim, 03 fév 2002) $.
 .PP
-$Id: passwd.nntp.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: passwd.nntp.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIinn.conf\fR\|(5), \fIinnd\fR\|(8), \fIlibinn\fR\|(3).
diff -Nrup inn-2.4.4/doc/man/pullnews.1 inn-2.4.5/doc/man/pullnews.1
--- inn-2.4.4/doc/man/pullnews.1	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/pullnews.1	2008-06-29 10:56:57.000000000 -0700
@@ -129,16 +129,21 @@
 .\" ========================================================================
 .\"
 .IX Title "PULLNEWS 1"
-.TH PULLNEWS 1 "2008-04-26" "INN 2.4.4" "InterNetNews Documentation"
+.TH PULLNEWS 1 "2008-06-05" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
-pullnews \- Pull news from one news server and feed it to another
+pullnews \- Pull news from multiple news servers and feed it to another
 .SH "SYNOPSIS"
 .IX Header "SYNOPSIS"
-\&\fBpullnews\fR [\fB\-hqx\fR] [\fB\-c\fR \fIconfig\fR] [\fB\-g\fR \fIgroups\fR] [\fB\-p\fR \fIport\fR]
-[\fB\-r\fR \fIfile\fR] [\fB\-s\fR \fIto-server\fR] [<from\-server> ...]
+\&\fBpullnews\fR [\fB\-hnqRx\fR] [\fB\-b\fR \fIfraction\fR] [\fB\-c\fR \fIconfig\fR] [\fB\-C\fR \fIwidth\fR]
+[\fB\-d\fR \fIlevel\fR] [\fB\-f\fR \fIfraction\fR] [\fB\-F\fR \fIfakehop\fR] [\fB\-g\fR \fIgroups\fR]
+[\fB\-G\fR \fInewsgroups\fR] [\fB\-H\fR \fIheaders\fR] [\fB\-k\fR \fIcheckpt\fR] [\fB\-l\fR \fIlogfile\fR]
+[\fB\-m\fR \fIheader_pats\fR] [\fB\-M\fR \fInum\fR] [\fB\-N\fR \fItimeout\fR] [\fB\-p\fR \fIport\fR]
+[\fB\-P\fR \fIhop_limit\fR] [\fB\-Q\fR \fIlevel\fR] [\fB\-r\fR \fIfile\fR] [\fB\-s\fR \fIto-server\fR[:\fIport\fR]]
+[\fB\-S\fR \fImax-run\fR] [\fB\-t\fR \fIretries\fR] [\fB\-T\fR \fIconnect-pause\fR] [\fB\-w\fR \fInum\fR]
+[\fB\-z\fR \fIarticle-pause\fR] [\fB\-Z\fR \fIgroup-pause\fR] [\fIfrom-server\fR ...]
 .SH "REQUIREMENTS"
 .IX Header "REQUIREMENTS"
-The Net::NNTP module must be installed.  This module is available as part
+The \f(CW\*(C`Net::NNTP\*(C'\fR module must be installed.  This module is available as part
 of the libnet distribution and comes with recent versions of Perl.  For
 older versions of Perl, you can download it from <http://www.cpan.org/>.
 .SH "DESCRIPTION"
@@ -147,62 +152,167 @@ older versions of Perl, you can download
 (normally called \fI~/.pullnews\fR) and connects to the upstream servers
 given there as a reader client.  By default, it connects to all servers
 listed in the configuration file, but you can limit \fBpullnews\fR to
-specific servers by listing them on the command line.  For each server it
-connects to, it pulls over articles and feeds them to the destination
-server via the \s-1IHAVE\s0 command.  This means that the system \fBpullnews\fR is
-run on must have feeding access to the destination news server.
+specific servers by listing them on the command line:  a whitespace-separated
+list of server names can be specified, like \fIfrom-server\fR for one of them.
+For each server it connects to, it pulls over articles and feeds them to the
+destination server via the \s-1IHAVE\s0 or \s-1POST\s0 commands.  This means that the system
+\&\fBpullnews\fR is run on must have feeding access to the destination news server.
 .PP
-\&\fBpullnews\fR is designed for very small sites that don't want to bother
+\&\fBpullnews\fR is designed for very small sites that do not want to bother
 setting up traditional peering and is not meant for handling large feeds.
 .SH "OPTIONS"
 .IX Header "OPTIONS"
+.IP "\fB\-b\fR \fIfraction\fR" 4
+.IX Item "-b fraction"
+Backtrack on server numbering reset.  Specify the proportion (\f(CW0.0\fR to \f(CW1.0\fR)
+of a group's articles to pull when the server's article number is less than
+our high for that group.  When \fIfraction\fR is \f(CW1.0\fR, pull all the articles on
+a renumbered server.  The default is to do nothing.
 .IP "\fB\-c\fR \fIconfig\fR" 4
 .IX Item "-c config"
 Normally, the config file is stored in \fI~/.pullnews\fR for the user running
 \&\fBpullnews\fR.  If \fB\-c\fR is given, \fIconfig\fR will be used as the config file
 instead.  This is useful if you're running \fBpullnews\fR as a system user on
 an automated basis out of cron rather than as an individual user.
+.Sp
+See \*(L"\s-1CONFIG\s0 \s-1FILE\s0\*(R" below for the format of this file.
+.IP "\fB\-C\fR \fIwidth\fR" 4
+.IX Item "-C width"
+Use \fIwidth\fR characters per line for the progress table.  The default value
+is \f(CW50\fR.
+.IP "\fB\-d\fR \fIlevel\fR" 4
+.IX Item "-d level"
+Set the debugging level to the integer \fIlevel\fR; more debugging output
+will be logged as this increases.  The default value is \f(CW0\fR.
+.IP "\fB\-f\fR \fIfraction\fR" 4
+.IX Item "-f fraction"
+This changes the proportion of articles to get from each group to
+\&\fIfraction\fR and should be in the range \f(CW0.0\fR to \f(CW1.0\fR (\f(CW1.0\fR being
+the default).
+.IP "\fB\-F\fR \fIfakehop\fR" 4
+.IX Item "-F fakehop"
+Prepend \fIfakehop\fR as a host to the Path: header of articles fed.
 .IP "\fB\-g\fR \fIgroups\fR" 4
 .IX Item "-g groups"
-Specifies a collection of groups to get.  \fIgroups\fR is a list of
+Specify a collection of groups to get.  \fIgroups\fR is a list of
 newsgroups separated by commas (only commas, no spaces).  Each group must
 be defined in the config file, and only the remote hosts that carry those
 groups will be contacted.  Note that this is a simple list of groups, not
 a wildmat expression, and wildcards are not supported.
+.IP "\fB\-G\fR \fInewsgroups\fR" 4
+.IX Item "-G newsgroups"
+Add the comma-separated list of groups \fInewsgroups\fR to each server in the
+configuration file (see also \fB\-g\fR and \fB\-w\fR).
 .IP "\fB\-h\fR" 4
 .IX Item "-h"
 Print a usage message and exit.
+.IP "\fB\-H\fR \fIheaders\fR" 4
+.IX Item "-H headers"
+Remove these named headers (colon\-separated list) from fed articles.
+.IP "\fB\-k\fR \fIcheckpt\fR" 4
+.IX Item "-k checkpt"
+Checkpoint (save) the config file every \fIcheckpt\fR articles
+(default is \f(CW0\fR, that is to say at the end of the session).
+.IP "\fB\-l\fR \fIlogfile\fR" 4
+.IX Item "-l logfile"
+Log progress/stats to \fIlogfile\fR (default is \f(CW\*(C`stdout\*(C'\fR).
+.IP "\fB\-m\fR \fIheader_pats\fR" 4
+.IX Item "-m header_pats"
+Feed an article based on header matching.  The argument is a number of
+whitespace-separated tuples (each tuple being a colon-separated header and
+regular expression).  For instance:
+.Sp
+.Vb 1
+\&    Hdr1:regexp1 !Hdr2:regexp2
+.Ve
+.Sp
+specifies that the article will be passed only if the \f(CW\*(C`Hdr1:\*(C'\fR header
+matches \f(CW\*(C`regexp1\*(C'\fR and the \f(CW\*(C`Hdr2:\*(C'\fR header does not match \f(CW\*(C`regexp2\*(C'\fR.
+.IP "\fB\-M\fR \fInum\fR" 4
+.IX Item "-M num"
+Specify the maximum number of articles (per group) to process.
+The default is to process all new articles.  See also \fB\-f\fR.
+.IP "\fB\-n\fR" 4
+.IX Item "-n"
+Do nothing but read articles \-\-\ does not feed articles downstream,
+writes no \fBrnews\fR file, does not update the config file.
+.IP "\fB\-N\fR \fItimeout\fR" 4
+.IX Item "-N timeout"
+Specify the timeout length, as \fItimeout\fR seconds,
+when establishing an \s-1NNTP\s0 connection.
 .IP "\fB\-p\fR \fIport\fR" 4
 .IX Item "-p port"
 Connect to the destination news server on a port other than the default of
-119.  This option does not change the port used to connect to the remote
+\&\f(CW119\fR.  This option does not change the port used to connect to the source
 news servers.
+.IP "\fB\-P\fR \fIhop_limit\fR" 4
+.IX Item "-P hop_limit"
+Restrict feeding an article based on the number of hops it has already made.
+Count the hops in the Path: header (\fIhop_count\fR), feeding the article only
+when \fIhop_limit\fR is \f(CW\*(C`+num\*(C'\fR and \fIhop_count\fR is more than \fInum\fR;
+or \fIhop_limit\fR is \f(CW\*(C`\-num\*(C'\fR and \fIhop_count\fR is less than \fInum\fR.
 .IP "\fB\-q\fR" 4
 .IX Item "-q"
 Print out less status information while running.
+.IP "\fB\-Q\fR \fIlevel\fR" 4
+.IX Item "-Q level"
+Set the quietness level (\f(CW\*(C`\-Q 2\*(C'\fR is equivalent to \f(CW\*(C`\-q\*(C'\fR).  The higher this
+value, the less gets logged.  The default is \f(CW0\fR.
 .IP "\fB\-r\fR \fIfile\fR" 4
 .IX Item "-r file"
-Rather than feeding the downloaded articles to a local server, instead
+Rather than feeding the downloaded articles to a destination server, instead
 create a batch file that can later be fed to a server using \fBrnews\fR.  See
 \&\fIrnews\fR\|(1) for more information about the batch file format.
-.IP "\fB\-s\fR \fIto-server\fR" 4
-.IX Item "-s to-server"
+.IP "\fB\-R\fR" 4
+.IX Item "-R"
+Be a reader (use \s-1MODE\s0 \s-1READER\s0 and \s-1POST\s0 commands) to the downstream
+server.  The default is to use the \s-1IHAVE\s0 command.
+.IP "\fB\-s\fR \fIto-server\fR[:\fIport\fR]" 4
+.IX Item "-s to-server[:port]"
 Normally, \fBpullnews\fR will feed the articles it retrieves to the news
 server running on localhost.  To connect to a different host, specify a
-server with the \fB\-s\fR flag.
+server with the \fB\-s\fR flag.  You can also specify the port with this same
+flag or use \fB\-p\fR.
+.IP "\fB\-S\fR \fImax-run\fR" 4
+.IX Item "-S max-run"
+Specify the maximum time \fImax-run\fR in seconds for \fBpullnews\fR to run.
+.IP "\fB\-t\fR \fIretries\fR" 4
+.IX Item "-t retries"
+The maximum number (\fIretries\fR) of attempts to connect to a server
+(see also \fB\-T\fR).  The default is \f(CW0\fR.
+.IP "\fB\-T\fR \fIconnect-pause\fR" 4
+.IX Item "-T connect-pause"
+Pause \fIconnect-pause\fR seconds between connection retries (see also \fB\-t\fR).
+The default is \f(CW1\fR.
+.IP "\fB\-w\fR \fInum\fR" 4
+.IX Item "-w num"
+Set each group's high watermark (last received article number) to \fInum\fR.
+If \fInum\fR is negative, calculate \fICurrent\fR+\fInum\fR instead (i.e. get the last
+\&\fInum\fR articles).  Therefore, a \fInum\fR of \f(CW0\fR will re-get all articles on the
+server; whereas a \fInum\fR of \f(CW\*(C`\-0\*(C'\fR will get no old articles, setting the
+watermark to \fICurrent\fR (the most recent article on the server).
 .IP "\fB\-x\fR" 4
 .IX Item "-x"
 If the \fB\-x\fR flag is used, an Xref: header is added to any article
 that lacks one.  It can be useful for instance if articles are fed
 to a news server which has \fIxrefslave\fR set in \fIinn.conf\fR.
+.IP "\fB\-z\fR \fIarticle-pause\fR" 4
+.IX Item "-z article-pause"
+Sleep \fIarticle-pause\fR seconds between articles.  The default is \f(CW0\fR.
+.IP "\fB\-Z\fR \fIgroup-pause\fR" 4
+.IX Item "-Z group-pause"
+Sleep \fIgroup-pause\fR seconds between groups.  The default is \f(CW0\fR.
 .SH "CONFIG FILE"
 .IX Header "CONFIG FILE"
 The config file for \fBpullnews\fR is divided into blocks, one block for each
 remote server to connect to.  A block begins with the host line, which
 must have no leading whitespace and contains just the hostname of the
-remote server.  Following this line should be one or more newsgroup lines
-which start with whitespace followed by the name of a newsgroup to
-retrieve.  Only one newsgroup should be listed on each line.
+remote server, optionally followed by authentication details (username
+and password for that server).
+.PP
+Following the host line should be one or more newsgroup lines which start
+with whitespace followed by the name of a newsgroup to retrieve.  Only one
+newsgroup should be listed on each line.
 .PP
 \&\fBpullnews\fR will update the config file to include the time the group was
 last checked and the highest numbered article successfully retrieved and
@@ -218,8 +328,7 @@ The full syntax is:
 .Ve
 .PP
 where the <host> line must not have leading whitespace and the <group>
-lines must.  Note that you may optionally specify a username and password
-for basic authentication to the remote server if necessary.
+lines must.
 .PP
 A typical configuration file would be:
 .PP
@@ -239,16 +348,26 @@ were just added by the user and have not
 .PP
 The nnrp.vix.com server requires authentication, and \fBpullnews\fR will use
 the username \f(CW\*(C`pull\*(C'\fR and the password \f(CW\*(C`sekret\*(C'\fR.
-.SH "BUGS"
-.IX Header "BUGS"
-\&\fBpullnews\fR is very simple and is lacking in more sophisticated features
-(like killing articles based on user-defined conditions) that better pull
-feeders most certainly have. It also doesn't keep or log much detail on
-articles transferred.
+.SH "FILES"
+.IX Header "FILES"
+.IP "\fIpathbin\fR/pullnews" 4
+.IX Item "pathbin/pullnews"
+The Perl script itself used to pull news from upstream servers and feed
+it to another news server.
+.IP "\fI$HOME\fR/.pullnews" 4
+.IX Item "$HOME/.pullnews"
+The default config file.  It is in the running user's home directory
+(normally called \fI~/.pullnews\fR).
 .SH "HISTORY"
 .IX Header "HISTORY"
-pullnews was written by James Brister for \s-1INN\s0.  The documentation was
+\&\fBpullnews\fR was written by James Brister for \s-1INN\s0.  The documentation was
 rewritten in \s-1POD\s0 by Russ Allbery <rra@stanford.edu>.
+.PP
+Geraint A. Edwards greatly improved \fBpullnews\fR, adding no more than 16\ new
+recognized flags, fixing some bugs and integrating the \fBbackupfeed\fR
+contrib script by Kai Henningsen, adding again 6\ other flags.
+.PP
+$Id: pullnews.pod 7853 2008\-05\-27 19:07:45Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
-\&\fIincoming.conf\fR\|(5)
+\&\fIincoming.conf\fR\|(5), \fIrnews\fR\|(1).
diff -Nrup inn-2.4.4/doc/man/qio.3 inn-2.4.5/doc/man/qio.3
--- inn-2.4.4/doc/man/qio.3	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/qio.3	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "qio 3"
-.TH qio 3 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH qio 3 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 qio \- Quick I/O routines for reading files
 .SH "SYNOPSIS"
@@ -239,4 +239,4 @@ printing out each line preceeded by its 
 Written by Rich \f(CW$alz\fR <rsalz@uunet.uu.net> for InterNetNews.  Updated by
 Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: qio.3 7736 2008-04-06 09:27:49Z iulius $
+$Id: qio.3 7880 2008-06-16 20:37:13Z iulius $
diff -Nrup inn-2.4.4/doc/man/radius.8 inn-2.4.5/doc/man/radius.8
--- inn-2.4.4/doc/man/radius.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/radius.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "RADIUS 8"
-.TH RADIUS 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH RADIUS 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 radius \- nnrpd RADIUS password authenticator
 .SH "SYNOPSIS"
@@ -188,7 +188,7 @@ implement it correctly.
 The \s-1RADIUS\s0 authenticator was originally written by Aidan Cully.  This
 documentation was written by Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: radius.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: radius.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fInnrpd\fR\|(8), \fIradius.conf\fR\|(5), \fIreaders.conf\fR\|(5)
diff -Nrup inn-2.4.4/doc/man/radius.conf.5 inn-2.4.5/doc/man/radius.conf.5
--- inn-2.4.4/doc/man/radius.conf.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/radius.conf.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "RADIUS.CONF 5"
-.TH RADIUS.CONF 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH RADIUS.CONF 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 radius.conf \- Configuration for nnrpd RADIUS authenticator
 .SH "DESCRIPTION"
@@ -220,7 +220,7 @@ The shared secret with the \s-1RADIUS\s0
 This documentation was written by Russ Allbery <rra@stanford.edu> based on
 the comments in the sample radius.conf file by Yury B. Razbegin.
 .PP
-$Id: radius.conf.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: radius.conf.5 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIradius\fR\|(1)
diff -Nrup inn-2.4.4/doc/man/rc.news.8 inn-2.4.5/doc/man/rc.news.8
--- inn-2.4.4/doc/man/rc.news.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/rc.news.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "RC.NEWS 8"
-.TH RC.NEWS 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH RC.NEWS 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 rc.news \- Start or stop INN daemons
 .SH "SYNOPSIS"
@@ -205,7 +205,7 @@ user \s-1ID\s0.
 This manual page written by Jeffrey M. Vinocur <jeff@litech.org> for
 InterNetNews.
 .PP
-$Id: rc.news.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: rc.news.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIctlinnd\fR\|(8),
diff -Nrup inn-2.4.4/doc/man/readers.conf.5 inn-2.4.5/doc/man/readers.conf.5
--- inn-2.4.4/doc/man/readers.conf.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/readers.conf.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "READERS.CONF 5"
-.TH READERS.CONF 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH READERS.CONF 5 "2008-06-22" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 readers.conf \- Access control and configuration for nnrpd
 .SH "DESCRIPTION"
@@ -404,16 +404,17 @@ valid if \s-1INN\s0 is compiled with Per
 configure).  More information may be found in \fIdoc/hook\-perl\fR.
 .IP "\fBpython_auth:\fR" 4
 .IX Item "python_auth:"
-A python script for authentication.  The python_auth: parameter works
-exactly like auth:, except that it calls the named script using the
-python hook rather then an external program.  Multiple/mixed use of
-the auth, perl_auth, and python_auth parameters is permitted within any
-auth group; each line is tried in the order it appears.  python_auth:
-has more power than auth: in that it provides the authentication
-program with additional information about the client and the ability
-to return an error string and a username.  This parameter is only
-valid if \s-1INN\s0 is compiled with Python support (\fB\-\-with\-python\fR passed
-to configure).  More information may be found in \fIdoc/hook\-python\fR.
+A Python script for authentication.  The \fIpython_auth\fR parameter works
+exactly like \fIauth\fR, except that it calls the named script (without its
+\&\f(CW\*(C`.py\*(C'\fR extension) using the Python hook rather then an external program.
+Multiple/mixed use of the \fIauth\fR, \fIperl_auth\fR, and \fIpython_auth\fR
+parameters is permitted within any auth group; each line is tried
+in the order it appears.  \fIpython_auth\fR has more power than \fIauth\fR
+in that it provides the authentication program with additional information
+about the client and the ability to return an error string and a username.
+This parameter is only valid if \s-1INN\s0 is compiled with Python support
+(\fB\-\-with\-python\fR passed to \fBconfigure\fR).  More information may be
+found in \fIdoc/hook\-python\fR.
 .IP "\fBdefault:\fR" 4
 .IX Item "default:"
 The default username for connections matching this auth group.  This is
@@ -454,27 +455,28 @@ support (\fB\-\-with\-perl\fR passed to 
 found in the file \fIdoc/hook\-perl\fR.
 .IP "\fBpython_access:\fR" 4
 .IX Item "python_access:"
-A python script for dynamically generating an access group.  If
-an auth group matches successfully and contains a python_access parameter,
-then the argument script will be used to create an access group.
-This group will then determine the access rights of the client,
-overriding any access groups in \fIreaders.conf\fR.  If and only if a
-successful auth group contains the python_access parameter, \fIreaders.conf\fR
+A Python script for dynamically generating an access group.  If
+an auth group matches successfully and contains a \fIpython_access\fR parameter,
+then the argument script (without its \f(CW\*(C`.py\*(C'\fR extension) will be used to
+create an access group.  This group will then determine the access rights
+of the client, overriding any access groups in \fIreaders.conf\fR.  If and only
+if a successful auth group contains the \fIpython_access\fR parameter, \fIreaders.conf\fR
 access groups are ignored and the client's rights are instead determined
 dynamically.  This parameter is only valid if \s-1INN\s0 is compiled with Python
-support (\fB\-\-with\-python\fR passed to configure).  More information may be
+support (\fB\-\-with\-python\fR passed to \fBconfigure\fR).  More information may be
 found in the file \fIdoc/hook\-python\fR.
 .IP "\fBpython_dynamic:\fR" 4
 .IX Item "python_dynamic:"
-A python script for applying access control dynamically on a per newsgroup
+A Python script for applying access control dynamically on a per newsgroup
 basis.  If an auth group matches successfully and contains a
-python_dynamic parameter, then the argument script will be used to
-determine the clients rights each time the user attempts to view a
-newsgroup, or read or post an article.  Access rights as determined by
-python_dynamic override the values of access group parameters such as
-newsgroups, read, and post.  This parameter is only valid if \s-1INN\s0 is
-compiled with Python support (\fB\-\-with\-python\fR passed to configure).  More
-information may be found in the file \fIdoc/hook\-python\fR.
+\&\fIpython_dynamic\fR parameter, then the argument script (without its
+\&\f(CW\*(C`.py\*(C'\fR extension) will be used to determine the clients rights each time
+the user attempts to view a newsgroup, or read or post an article.  Access
+rights as determined by \fIpython_dynamic\fR override the values of access
+group parameters such as \fInewsgroups\fR, \fIread\fR and \fIpost\fR.  This parameter
+is only valid if \s-1INN\s0 is compiled with Python support (\fB\-\-with\-python\fR
+passed to \fBconfigure\fR).  More information may be found in the file
+\&\fIdoc/hook\-python\fR.
 .SH "ACCESS GROUP PARAMETERS"
 .IX Header "ACCESS GROUP PARAMETERS"
 .IP "\fBusers:\fR" 4
@@ -564,8 +566,8 @@ disconnected with a \*(L"Permission deni
 display the reason to the user.
 .IP "\fBmax_rate:\fR" 4
 .IX Item "max_rate:"
-If this parameter is present (and nonzero) it is used for nnrpd's 
-rate-limiting code.  The client will only be able to download at this 
+If this parameter is present (and nonzero), it is used for \fBnnrpd\fR's
+rate-limiting code.  The client will only be able to download at this
 speed (in bytes/second).  Note that if \s-1SSL\s0 is being used, limiting
 is applied to the pre-encryption datastream.
 .IP "\fBlocaltime:\fR" 4
@@ -595,13 +597,14 @@ filter even if it is otherwise enabled. 
 default is true.
 .IP "\fBvirtualhost:\fR" 4
 .IX Item "virtualhost:"
-Set this parameter to make \fBnnrpd\fR behave as if it's running on a server
-with a different name than it actually is.  If you set this parameter, you
-must also set either pathhost: or domain: to something different than is
-set in \fIinn.conf\fR.  All articles displayed to clients will then have
+Set this parameter to true in order to make \fBnnrpd\fR behave as if it is
+running on a server with a different name than it actually is.  If you
+set this parameter to true, you must also set either pathhost: or domain:
+in the relevant access group in \fIreaders.conf\fR to something different
+than is set in \fIinn.conf\fR.  All articles displayed to clients will then have
 their Path: and Xref: headers altered to appear to be from the server
 named in pathhost: or domain: (whichever is set), and posted articles will
-use that server name in the Path:, Message\-ID;, and X\-Trace: headers.
+use that server name in the Path:, Message\-ID:, and X\-Trace: headers.
 .Sp
 Note that setting this parameter requires the server modify all posts
 before presenting them to the client and therefore may decrease
@@ -609,12 +612,16 @@ performance slightly.
 .PP
 In addition, all of the following parameters are valid in access groups
 and override the global setting in \fIinn.conf\fR.  See \fIinn.conf\fR\|(5) for the
-descriptions of these parameters:  addnntppostingdate, addnntppostinghost,
-backoff_auth, backoff_db, backoff_k, backoff_postfast, backoff_postslow,
-backoff_trigger, checkincludedtext, clienttimeout, complaints, domain,
-fromhost, localmaxartsize, moderatormailer, nnrpdauthsender,
-nnrpdcheckart, nnrpdoverstats, nnrpdposthost, nnrpdpostport, organization,
-pathhost, readertrack, spoolfirst, and strippostcc.
+descriptions of these parameters:
+.PP
+.Vb 6
+\&    addnntppostingdate, addnntppostinghost, backoff_auth, backoff_db,
+\&    backoff_k, backoff_postfast, backoff_postslow, backoff_trigger,
+\&    checkincludedtext, clienttimeout, complaints, domain,
+\&    fromhost, localmaxartsize, moderatormailer, nnrpdauthsender,
+\&    nnrpdcheckart, nnrpdoverstats, nnrpdposthost, nnrpdpostport, organization,
+\&    pathhost, readertrack, spoolfirst, strippostcc.
+.Ve
 .SH "SUMMARY"
 .IX Header "SUMMARY"
 Here's a basic summary of what happens when a client connects:
@@ -710,7 +717,7 @@ usernames and passwords, and then agains
 .PP
 .Vb 4
 \&    auth all {
-\&        auth: "ckpasswd \-d /usr/local/news/db/newsusers"
+\&        auth: "ckpasswd \-d <pathdb in inn.conf>/newsusers"
 \&        auth: "ckpasswd \-s"
 \&    }
 .Ve
@@ -764,7 +771,7 @@ cannot.
 .PP
 .Vb 5
 \&    auth default {
-\&        auth: "ckpasswd \-f /usr/local/news/db/newsusers"
+\&        auth: "ckpasswd \-f <pathdb in inn.conf>/newsusers"
 \&        default: <FAIL>
 \&        default\-domain: example.com
 \&    }
@@ -904,7 +911,8 @@ some auth groups with a restrictive host
 above, with ones having global applicability below.
 .IP "\(bu" 4
 Consider running a \f(CW\*(C`nnrpd \-S\*(C'\fR (with \f(CW\*(C`\-D\*(C'\fR, or out of \*(L"super\-server\*(R"
-like inetd) on the nntps port (563) for clients that support \s-1SSL\s0.  You
+like \fBinetd\fR) on the \s-1NNTPS\s0 port (563) for clients that support \s-1SSL\s0.  See
+\&\fInnrpd\fR\|(8) for more details about how to configure that.  You
 can use the require_ssl: parameter, or \f(CW\*(C`\-c\*(C'\fR to specify an alternate
 \&\fIreaders.conf\fR if you want a substantially different configuration for
 this case.
@@ -917,7 +925,8 @@ tunnel), use the localaddress: parameter
 Written by Aidan Cully <aidan@panix.com> for InterNetNews.  Substantially
 expanded by Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: readers.conf.5 7736 2008-04-06 09:27:49Z iulius $
+$Id: readers.conf.5 7895 2008-06-22 17:54:10Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
-\&\fIckpasswd\fR\|(8), \fIinn.conf\fR\|(5), \fIinnd\fR\|(8), \fInewsfeeds\fR\|(5), \fInnrpd\fR\|(8), \fIuwildmat\fR\|(3)
+\&\fIauth_krb5\fR\|(8), \fIauth_smb\fR\|(8), \fIckpasswd\fR\|(8), \fIinn.conf\fR\|(5), \fIinnd\fR\|(8), \fInewsfeeds\fR\|(5),
+\&\fInnrpd\fR\|(8), \fIuwildmat\fR\|(3).
diff -Nrup inn-2.4.4/doc/man/sasl.conf.5 inn-2.4.5/doc/man/sasl.conf.5
--- inn-2.4.4/doc/man/sasl.conf.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/sasl.conf.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SASL.CONF 5"
-.TH SASL.CONF 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH SASL.CONF 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 sasl.conf \- SASL Configuration file for nnrpd.
 .SH "DESCRIPTION"
diff -Nrup inn-2.4.4/doc/man/sendinpaths.8 inn-2.4.5/doc/man/sendinpaths.8
--- inn-2.4.4/doc/man/sendinpaths.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/sendinpaths.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SENDINPATHS 8"
-.TH SENDINPATHS 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH SENDINPATHS 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 sendinpaths \- Send Usenet Path statistics via e\-mail
 .SH "SYNOPSIS"
diff -Nrup inn-2.4.4/doc/man/simpleftp.1 inn-2.4.5/doc/man/simpleftp.1
--- inn-2.4.4/doc/man/simpleftp.1	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/simpleftp.1	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SIMPLEFTP 1"
-.TH SIMPLEFTP 1 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH SIMPLEFTP 1 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 simpleftp \- Rudimentary FTP client
 .SH "SYNOPSIS"
@@ -166,7 +166,7 @@ with the same name in the local director
 Tossed off by David C Lawrence <tale@isc.org> for InterNetNews.
 Rewritten to use Net::FTP by Julien Elie <julien@trigofacile.com>.
 .PP
-$Id: simpleftp.1 7739 2008-04-06 09:38:31Z iulius $
+$Id: simpleftp.1 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIactsync\fR\|(8).
diff -Nrup inn-2.4.4/doc/man/sm.1 inn-2.4.5/doc/man/sm.1
--- inn-2.4.4/doc/man/sm.1	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/sm.1	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SM 1"
-.TH SM 1 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH SM 1 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 sm \- Command\-line interface to the INN storage manager
 .SH "SYNOPSIS"
@@ -205,7 +205,7 @@ succeeded, you should run sm on one toke
 Written by Katsuhiro Kondou <kondou@nec.co.jp> for InterNetNews.
 Rewritten in \s-1POD\s0 by Russ Allbery <rra@stanford.edu>.
 .PP
-$Id: sm.1 7736 2008-04-06 09:27:49Z iulius $
+$Id: sm.1 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIctlinnd\fR\|(8), \fIgrephistory\fR\|(1), \fIhistory\fR\|(5), \fIrnews\fR\|(1), \fIstorage.conf\fR\|(5).
diff -Nrup inn-2.4.4/doc/man/subscriptions.5 inn-2.4.5/doc/man/subscriptions.5
--- inn-2.4.4/doc/man/subscriptions.5	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/subscriptions.5	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SUBSCRIPTIONS 5"
-.TH SUBSCRIPTIONS 5 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH SUBSCRIPTIONS 5 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 subscriptions \- Default recommended subscriptions
 .SH "DESCRIPTION"
diff -Nrup inn-2.4.4/doc/man/tdx-util.8 inn-2.4.5/doc/man/tdx-util.8
--- inn-2.4.4/doc/man/tdx-util.8	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/tdx-util.8	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "TDX-UTIL 8"
-.TH TDX-UTIL 8 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH TDX-UTIL 8 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 tdx\-util \- Tradindexed overview manipulation utility
 .SH "SYNOPSIS"
@@ -298,7 +298,7 @@ using the tradspool article storage meth
 .IX Header "HISTORY"
 Written by Russ Allbery <rra@stanford.edu> for InterNetNews.
 .PP
-$Id: tdx-util.8 7736 2008-04-06 09:27:49Z iulius $
+$Id: tdx-util.8 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fImakehistory\fR\|(8)
diff -Nrup inn-2.4.4/doc/man/tst.3 inn-2.4.5/doc/man/tst.3
--- inn-2.4.4/doc/man/tst.3	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/tst.3	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "tst 3"
-.TH tst 3 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH tst 3 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 tst \- ternary search trie functions
 .SH "SYNOPSIS"
@@ -201,4 +201,4 @@ Converted to \s-1POD\s0 from Peter A. Fr
 documentation by Alex Kiernan <alex.kiernan@thus.net> for InterNetNews
 2.4.0.
 .PP
-$Id: tst.3 7736 2008-04-06 09:27:49Z iulius $
+$Id: tst.3 7880 2008-06-16 20:37:13Z iulius $
diff -Nrup inn-2.4.4/doc/man/uwildmat.3 inn-2.4.5/doc/man/uwildmat.3
--- inn-2.4.4/doc/man/uwildmat.3	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/man/uwildmat.3	2008-06-29 10:56:57.000000000 -0700
@@ -129,7 +129,7 @@
 .\" ========================================================================
 .\"
 .IX Title "uwildmat 3"
-.TH uwildmat 3 "2008-04-06" "INN 2.4.4" "InterNetNews Documentation"
+.TH uwildmat 3 "2008-04-06" "INN 2.4.5" "InterNetNews Documentation"
 .SH "NAME"
 uwildmat, uwildmat_simple, uwildmat_poison \- Perform wildmat matching
 .SH "SYNOPSIS"
@@ -284,7 +284,7 @@ substantial differences, including the e
 characters, and has noticable functionality changes.  Any bugs present in
 it aren't Rich's fault.
 .PP
-$Id: uwildmat.3 7736 2008-04-06 09:27:49Z iulius $
+$Id: uwildmat.3 7880 2008-06-16 20:37:13Z iulius $
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
 \&\fIgrep\fR\|(1), \fIfnmatch\fR\|(3), \fIregex\fR\|(3), \fIregexp\fR\|(3).
diff -Nrup inn-2.4.4/doc/pod/cycbuff.conf.pod inn-2.4.5/doc/pod/cycbuff.conf.pod
--- inn-2.4.4/doc/pod/cycbuff.conf.pod	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/pod/cycbuff.conf.pod	2008-06-29 10:56:57.000000000 -0700
@@ -86,7 +86,7 @@ metacycbuff line.
 
 B<innd> only reads F<cycbuff.conf> on startup, so if you change anything
 in this file and want B<innd> to pick up the changes, you have to stop and
-restart it.  C<ctlinnd reload ''> is not sufficient.
+restart it.  C<ctlinnd reload all ''> is not sufficient.
 
 When articles are stored, the cycbuff into which they're stored is saved
 as part of the article token.  In order for INN to retrieve articles from
@@ -192,7 +192,7 @@ where ONE will be whatever you called yo
 Written by Katsuhiro Kondou <kondou@nec.co.jp> for InterNetNews.
 Rewritten into POD by Russ Allbery <rra@stanford.edu>.
 
-$Id: cycbuff.conf.pod 6247 2003-02-28 00:05:40Z kondou $
+$Id: cycbuff.conf.pod 7860 2008-06-07 12:46:49Z iulius $
 
 =head1 SEE ALSO
 
diff -Nrup inn-2.4.4/doc/pod/hook-perl.pod inn-2.4.5/doc/pod/hook-perl.pod
--- inn-2.4.4/doc/pod/hook-perl.pod	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/pod/hook-perl.pod	2008-06-29 10:56:57.000000000 -0700
@@ -1,6 +1,6 @@
 =head1 INN Perl Filtering and Authentication Support
 
-This is $Revision: 6221 $ dated $Date: 2003-02-09 19:21:27 -0800 (Sun, 09 Feb 2003) $.
+This is $Revision: 7860 $ dated $Date: 2008-06-07 05:46:49 -0700 (Sat, 07 Jun 2008) $.
 
 This file documents INN's built-in support for Perl filtering and reader
 authentication.  The code is based very heavily on work by Christophe
@@ -46,7 +46,7 @@ won't be noticed by innd; only stopping 
 to be reloaded.
 
 F<filter_innd.pl>, on the other hand, can be reloaded on command (with
-C<ctlinnd reload filter.perl>).  Whenever F<filter_innd.pl> is loaded,
+C<ctlinnd reload filter.perl 'reason'>).  Whenever F<filter_innd.pl> is loaded,
 including the first time at innd startup, the Perl function
 filter_before_reload() is called before it's reloaded and the function
 filter_after_reload() is called after it's reloaded (if the functions
@@ -64,8 +64,8 @@ initialization code that should only run
 was preserved on disk across a stop and restart of innd (perhaps using
 filter_mode() -- see below).
 
-As mentioned above, C<ctlinnd reload filter.perl> (or C<ctlinnd reload
-all>) will cause F<filter_innd.pl> to be reloaded.  If the function
+As mentioned above, C<ctlinnd reload filter.perl 'reason'> (or C<ctlinnd reload
+all 'reason'>) will cause F<filter_innd.pl> to be reloaded.  If the function
 filter_art() is defined after the file has been reloaded, filtering is
 turned on.  Otherwise, filtering is turned off.  (Note that due to the way
 Perl stores functions, once you've defined filter_art(), you can't
@@ -83,34 +83,46 @@ filter_art() has access to a global hash
 the standard headers present in the article and their values.  The
 standard headers are:
 
-        Approved, Control, Date, Distribution, Expires, From, Lines,
-        Message-ID, Newsgroups, Path, Reply-To, Sender, Subject,
-        Supersedes, Bytes, Also-Control, References, Keywords, X-Trace,
-        NNTP-Posting-Host, Followup-To, Organization, Content-Type,
-        Content-Base, Content-Disposition, X-Newsreader, X-Mailer,
-        X-Cancelled-By, X-Canceled-By, Cancel-Key
-
-(so, for example, the Newsgroups header of the article is accessible
-inside the Perl filter as C<$hdr{Newsgroups}>).  In addition,
-C<$hdr{__BODY__}> will contain the full body of the article and
-C<$hdr{__LINES__}> will contain the number of lines in the body of the
+    Also-Control, Approved, Bytes, Cancel-Key, Cancel-Lock,
+    Content-Base, Content-Disposition, Content-Transfer-Encoding,
+    Content-Type, Control, Date, Date-Received, Distribution, Expires,
+    Face, Followup-To, From, In-Reply-To, Injection-Date, Injection-Info,
+    Keywords, Lines, List-ID, Message-ID, MIME-Version, Newsgroups,
+    NNTP-Posting-Date, NNTP-Posting-Host, Organization, Originator,
+    Path, Posted, Posting-Version, Received, References, Relay-Version,
+    Reply-To, Sender, Subject, Supersedes, User-Agent,
+    X-Auth, X-Canceled-By, X-Cancelled-By, X-Complaints-To, X-Face,
+    X-HTTP-UserAgent, X-HTTP-Via, X-Mailer, X-Modbot, X-Modtrace,
+    X-Newsposter, X-Newsreader, X-No-Archive, X-Original-Message-ID,
+    X-Original-Trace, X-Originating-IP, X-PGP-Key, X-PGP-Sig,
+    X-Poster-Trace, X-Postfilter, X-Proxy-User, X-Submissions-To,
+    X-Trace, X-Usenet-Provider, Xref.
+
+Note that all the above headers are as they arrived, not modified by
+your INN (especially, the Xref: header, if present, is the one of
+the remote site which sent you the article, and not yours).
+
+For example, the Newsgroups: header of the article is accessible
+inside the Perl filter as C<$hdr{'Newsgroups'}>.  In addition,
+C<$hdr{'__BODY__'}> will contain the full body of the article and
+C<$hdr{'__LINES__'}> will contain the number of lines in the body of the
 article.
 
 The contents of the %hdr hash for a typical article may therefore look
 something like this:
 
-        %hdr = (Subject      => 'MAKE MONEY FAST!!', 
-                From         => 'Joe Spamer <him@example.com>',
-                Date         => '10 Sep 1996 15:32:28 UTC',
-                Newsgroups   => 'alt.test',
-                Path         => 'news.example.com!not-for-mail',
-                Organization => 'Spammers Anonymous',
-                Lines        => '5',
-                Distribution => 'usa',
-                'Message-ID' => '<6.20232.842369548@example.com>',
-                __BODY__     => 'Send five dollars to the ISC, c/o ...',
-                __LINES__    => 5
-        );
+    %hdr = (Subject      => 'MAKE MONEY FAST!!', 
+        From         => 'Joe Spamer <him@example.com>',
+        Date         => '10 Sep 1996 15:32:28 UTC',
+        Newsgroups   => 'alt.test',
+        Path         => 'news.example.com!not-for-mail',
+        Organization => 'Spammers Anonymous',
+        Lines        => '5',
+        Distribution => 'usa',
+        'Message-ID' => '<6.20232.842369548@example.com>',
+        __BODY__     => 'Send five dollars to the ISC, c/o ...',
+        __LINES__    => 5
+    );
 
 Note that the value of C<$hdr{Lines}> is the contents of the Lines: header
 of the article and may bear no resemblence to the actual length of the
@@ -163,9 +175,9 @@ the Perl function filter_mode() is calle
 arguments and returns no value, but it has access to a global hash %mode
 that contains three values:
 
-        Mode       The current server mode (throttled, paused, or running)
-        NewMode    The new mode the server is going to
-        reason     The reason that was given to ctlinnd
+    Mode       The current server mode (throttled, paused, or running)
+    NewMode    The new mode the server is going to
+    reason     The reason that was given to ctlinnd
 
 One possible use for this function is to save filter state across a
 restart of innd.  There isn't any Perl function which is called when INN
@@ -358,7 +370,7 @@ The perl_auth parameter allows the use o
 Scripts (like those from the old mechanism) are listed in F<readers.conf>
 using perl_auth in the same manner other authenticators are using auth:
 
-        perl_auth: "/path/to/script/auth1.pl"
+    perl_auth: "/path/to/script/auth1.pl"
 
 The file given as argument to perl_auth should contain the same
 procedures as before. The global hash %attributes remains the same,
diff -Nrup inn-2.4.4/doc/pod/hook-python.pod inn-2.4.5/doc/pod/hook-python.pod
--- inn-2.4.4/doc/pod/hook-python.pod	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/pod/hook-python.pod	2008-06-29 10:56:57.000000000 -0700
@@ -1,124 +1,138 @@
 =head1 INN Python Filtering and Authentication Support
 
-This is $Revision: 7134 $, dated $Date: 2005-03-05 13:19:44 -0800 (Sat, 05 Mar 2005) $.
-
 This file documents INN's built-in optional support for Python article
-filtering.  It is patterned after the TCL and Perl hooks previously added
-by Bob Heiney and Christophe Wolfhugel.
+filtering.  It is patterned after the Perl and (now obsolete) TCL hooks
+previously added by Bob Heiney and Christophe Wolfhugel.
+
+For this filter to work successfully, you will need to have at least
+S<Python 1.5.2> installed.  You can obtain it from L<http://www.python.org/>.
 
-For this filter to work successfully, you will need to have Python 1.5.2
-(the latest at this writing) installed.  You can obtain it from
-<http://www.python.org>.
-
-The innd Python interface and the original Python filtering documentation
-was written by Greg Andruk (nee Fluffy) <gerglery@usa.net>.  The Python
-authentication and authorization support for nnrpd and the original
-documentation for it was written by Ilya Etingof <ilya@glas.net>, 12/1999.
-
-=head1 NOTE TO RED HAT LINUX USERS
-
-Python will be preinstalled, but it may not include all the headers and
-libraries required for embedding into INN.  You will need to add the
-development package.  Better yet, get the source kit from the above URL
-and build it yourself.  Be sure when installing Python on Red Hat, to run
-configure with C<--prefix=/usr> so that there are no version conflicts
-with the "factory" installation.  You can also find a selection of well
-made RPMs at <ftp://starship.python.net/pub/crew/andrich/>.
+The B<innd> Python interface and the original Python filtering documentation
+were written by Greg Andruk (nee Fluffy) <gerglery@usa.net>.  The Python
+authentication and authorization support for B<nnrpd> as well as the original
+documentation for it were written by Ilya Etingof <ilya@glas.net> in
+December 1999.
 
-=head1 INSTALLATION
+=head1 Installation
 
 Once you have built and installed Python, you can cause INN to use it by
-adding the C<--with-python> switch to your configure command.
+adding the B<--with-python> switch to your C<configure> command.  You will
+need to have all the headers and libraries required for embedding Python
+into INN; they can be found in Python development packages, which include
+header files and static libraries.
+
+You will then be able to use Python authentication, dynamic access group
+generation and dynamic access control support in B<nnrpd> along with
+filtering support in B<innd>.
 
 See the ctlinnd(8) manual page to learn how to enable, disable and reload
-Python filters on a running server (C<ctlinnd mode>, C<ctlinnd python
-y|n>, C<ctlinnd reload filter.python>).
+Python filters on a running server (especially C<ctlinnd mode>,
+C<ctlinnd python y|n> and C<ctlinnd reload filter.python 'reason'>).
+
+Also, see the F<filter_innd.py>, F<nnrpd_auth.py>, F<nnrpd_access.py>
+and F<nnrpd_dynamic.py> samples in your filters directory for
+a demonstration of how to get all this working.
 
-Also, see the example F<filter_innd.py> script in your filters directory
-for a demonstration of how to get all this working.
+=head1 Writing an B<innd> Filter
 
-=head1 WRITING AN INND FILTER
+=head2 Introduction
 
 You need to create a F<filter_innd.py> module in INN's filter directory
-(see the pathfilter setting in F<inn.conf>).  A heavily-commented sample
-is provided that you can use as a template for your own filter.  There is
+(see the I<pathfilter> setting in F<inn.conf>).  A heavily-commented sample
+is provided; you can use it as a template for your own filter.  There is
 also an F<INN.py> module there which is not actually used by INN; it is
 there so you can test your module interactively.
 
-First, define a class containing the methods you want to provide to innd.
-Methods innd will use if present are:
+First, define a class containing the methods you want to provide to B<innd>.
+Methods B<innd> will use if present are:
 
 =over 4
 
-=item __init__(self)
+=item __init__(I<self>)
 
-Not explicitly called by innd, but will run whenever the filter module is
+Not explicitly called by B<innd>, but will run whenever the filter module is
 (re)loaded.  This is a good place to initialize constants or pick up where
-filter_before_reload or filter_close left off.
+C<filter_before_reload> or C<filter_close> left off.
 
-=item filter_before_reload(self)
+=item filter_before_reload(I<self>)
 
-This will execute any time a C<ctlinnd reload all> or C<ctlinnd reload
-filter.python> command is issued.  You can use it to save statistics or
+This will execute any time a C<ctlinnd reload all 'reason'> or C<ctlinnd reload
+filter.python 'reason'> command is issued.  You can use it to save statistics or
 reports for use after reloading.
 
-=item filter_close(self)
+=item filter_close(I<self>)
 
-This will run when a C<ctlinnd shutdown> command is received.
+This will run when a C<ctlinnd shutdown 'reason'> command is received.
 
-=item filter_art(self, art)
+=item filter_art(I<self>, I<art>)
 
-art is a dictionary containing an article's headers and body.  This method
-is called every time innd receives an article.  The following can be
+I<art> is a dictionary containing an article's headers and body.  This method
+is called every time B<innd> receives an article.  The following can be
 defined:
-            
-    Approved, Control, Date, Distribution, Expires, From, Lines,
-    Message-ID, Newsgroups, Path, Reply-To, Sender, Subject,
-    Supersedes, Bytes, Also-Control, References, Xref, Keywords,
-    X-Trace, NNTP-Posting-Host, Followup-To, Organization,
-    Content-Type, Content-Base, Content-Disposition, X-Newsreader,
-    X-Mailer, X-Newsposter, X-Cancelled-By, X-Canceled-By, Cancel-Key,
-    __LINES__, __BODY__
-
-All the above values will be buffer objects holding the contents of the
-same named article headers, except for the special __BODY__ and __LINES__
-items.  Items not present in the article will contain None.
-
-__BODY__ is a buffer object containing the article's entire body, and
-__LINES__ is an int holding innd's reckoning of the number of lines in the
-article.  All the other elements will be buffers with the contents of the
-same-named article headers.
 
-If you want to accept an article, return None or an empty string.  To
+    Also-Control, Approved, Bytes, Cancel-Key, Cancel-Lock,
+    Content-Base, Content-Disposition, Content-Transfer-Encoding,
+    Content-Type, Control, Date, Date-Received, Distribution, Expires,
+    Face, Followup-To, From, In-Reply-To, Injection-Date, Injection-Info,
+    Keywords, Lines, List-ID, Message-ID, MIME-Version, Newsgroups,
+    NNTP-Posting-Date, NNTP-Posting-Host, Organization, Originator,
+    Path, Posted, Posting-Version, Received, References, Relay-Version,
+    Reply-To, Sender, Subject, Supersedes, User-Agent,
+    X-Auth, X-Canceled-By, X-Cancelled-By, X-Complaints-To, X-Face,
+    X-HTTP-UserAgent, X-HTTP-Via, X-Mailer, X-Modbot, X-Modtrace,
+    X-Newsposter, X-Newsreader, X-No-Archive, X-Original-Message-ID,
+    X-Original-Trace, X-Originating-IP, X-PGP-Key, X-PGP-Sig,
+    X-Poster-Trace, X-Postfilter, X-Proxy-User, X-Submissions-To,
+    X-Trace, X-Usenet-Provider, Xref, __BODY__, __LINES__.
+
+Note that all the above values are as they arrived, not modified
+by your INN (especially, the Xref: header, if present, is the one
+of the remote site which sent you the article, and not yours).
+
+These values will be buffer objects holding the contents of the
+same named article headers, except for the special C<__BODY__> and C<__LINES__>
+items.  Items not present in the article will contain C<None>.
+
+C<art('__BODY__')> is a buffer object containing the article's entire body, and
+C<art('__LINES__')> is an int holding B<innd>'s reckoning of the number of lines
+in the article.  All the other elements will be buffers with the contents
+of the same-named article headers.
+
+The Newsgroups: header of the article is accessible inside the Python
+filter as C<art['Newsgroups']>.
+
+If you want to accept an article, return C<None> or an empty string.  To
 reject, return a non-empty string.  The rejection strings will be shown to
 local clients and your peers, so keep that in mind when phrasing your
 rejection responses.
 
-=item filter_messageid(self, msgid)
+=item filter_messageid(I<self>, I<msgid>)
 
-msgid is a buffer object containing the ID of an article being offered by
-IHAVE or CHECK.  Like with filter_art(), the message will be refused if
+I<msgid> is a buffer object containing the ID of an article being offered by
+IHAVE or CHECK.  Like with C<filter_art>, the message will be refused if
 you return a non-empty string.  If you use this feature, keep it light
-because it is called at a rather busy place in innd's main loop.  Also, do
+because it is called at a rather busy place in B<innd>'s main loop.  Also, do
 not rely on this function alone to reject by ID; you should repeat the
-tests in filter_art() to catch articles sent with TAKETHIS but no CHECK.
+tests in C<filter_art> to catch articles sent with TAKETHIS but no CHECK.
 
-=item filter_mode(self, oldmode, newmode, reason)
+=item filter_mode(I<self>, I<oldmode>, I<newmode>, I<reason>)
 
-When the operator issues a ctlinnd pause, throttle or go command, this
-function can be used to do something sensible in accordance with the state
-change.  Stamp a log file, save your state on throttle, etc.  oldmode and
-newmode will be strings containing one of the values in ('running',
-'throttled', 'paused', 'unknown') -- oldmode is the state innd was in
-before ctlinnd was run, newmode is the state innd will be in after the
-command finishes.  reason is the comment string provided on the ctlinnd
-command line.
+When the operator issues a B<ctlinnd> C<pause>, C<throttle>, C<go>, C<shutdown>
+or C<xexec> command, this function can be used to do something sensible in accordance
+with the state change.  Stamp a log file, save your state on throttle,
+etc.  I<oldmode> and I<newmode> will be strings containing one of the values in
+(C<running>, C<throttled>, C<paused>, C<shutdown>, C<unknown>).  I<oldmode> is
+the state B<innd> was in before B<ctlinnd> was run, I<newmode> is the state B<innd>
+will be in after the command finishes.  I<reason> is the comment string
+provided on the B<ctlinnd> command line.
 
 =back
 
-To register your methods with innd, you need to create an instance of your
+=head2 How to Use these Methods with B<innd>
+
+To register your methods with B<innd>, you need to create an instance of your
 class, import the built-in INN module, and pass the instance to
-INN.set_filter_hook().  For example:
+C<INN.set_filter_hook>.  For example:
 
     class Filter:
         def filter_art(self, art):
@@ -136,39 +150,38 @@ INN.set_filter_hook().  For example:
     INN.set_filter_hook(myfilter)
 
 When writing and testing your Python filter, don't be afraid to make use
-of try:/except: and the provided INN.syslog() function.  stdout and stderr
+of C<try:>/C<except:> and the provided C<INN.syslog> function.  stdout and stderr
 will be disabled, so your filter will die silently otherwise.
 
 Also, remember to try importing your module interactively before loading
 it, to ensure there are no obvious errors.  One typo can ruin your whole
-filter.  A dummy INND.py module is provided to facilitate testing outside
+filter.  A dummy F<INN.py> module is provided to facilitate testing outside
 the server.  To test, change into your filter directory and use a command
 like:
 
     python -ic 'import INN, filter_innd'
 
 You can define as many or few of the methods listed above as you want in
-your filter class (it's fine to define more methods for your own use; innd
-won't use them but your filter can).  If you I<do> define the above
-methods, GET THE PARAMETER COUNTS RIGHT.  There are checks in innd to see
-if the methods exist and are callable, but if you define one and get the
-parameter counts wrong, INND WILL DIE.  You have been warned.  Be careful
-with your return values, too.  The filter_art() and filter_messageid()
-methods have to return strings, or None.  If you return something like an
-int, innd will B<not> be happy.
-
-=head1 WHAT'S THE DEAL WITH THESE BUFFER OBJECTS?
-
-Buffer objects are cousins of strings, new in Python 1.5.2.  They are
-supported, but at this writing you won't yet find much about them in the
-Python documentation.  Using buffer objects may take some getting used to,
-but we can create buffers much faster and with less memory than strings.
+your filter class (it is fine to define more methods for your own use; B<innd>
+will not be using them but your filter can).  If you I<do> define the above
+methods, GET THE PARAMETER COUNTS RIGHT.  There are checks in B<innd> to see
+whether the methods exist and are callable, but if you define one and get the
+parameter counts wrong, B<innd> WILL DIE.  You have been warned.  Be careful
+with your return values, too.  The C<filter_art> and C<filter_messageid>
+methods have to return strings, or C<None>.  If you return something like an
+int, B<innd> will I<not> be happy.
+
+=head2 A Note regarding Buffer Objects
+
+Buffer objects are cousins of strings, new in S<Python 1.5.2>.  Using buffer
+objects may take some getting used to, but we can create buffers much faster
+and with less memory than strings.
 
-For most of the operations you will perform in filters (like re.search,
-string.find, md5.digest) you can treat buffers just like strings, but
+For most of the operations you will perform in filters (like C<re.search>,
+C<string.find>, C<md5.digest>) you can treat buffers just like strings, but
 there are a few important differences you should know about:
 
-    # Make a string and a two buffers.
+    # Make a string and two buffers.
     s = "abc"
     b = buffer("def")
     bs = buffer("abc")
@@ -178,23 +191,51 @@ there are a few important differences yo
     s == str(bs)     # - This is also true, but buffer() is faster.
     s[:2] == bs[:2]  # - True.  Buffer slices are strings.
 
-    # While most string methods will take either a buffer or string,
-    # string.join insists on using only strings.
-    string.join([str(b), s], '.')   # returns 'def.abc'
+    # While most string methods will take either a buffer or a string,
+    # string.join (in the string module) insists on using only strings.
+    import string
+    string.join([str(b), s], '.')  # Returns 'def.abc'.
+    '.'.join([str(b), s])          # Returns 'def.abc' too.
+    '.'.join([b, s])               # This raises a TypeError.
 
-    e = s + b        # This raises a TypeError, but...
+    e = s + b                      # This raises a TypeError, but...
 
-    # ...these two both return the string 'abcdef'. The first one
+    # ...these two both return the string 'abcdef'.  The first one
     # is faster -- choose buffer() over str() whenever you can.
     e = buffer(s) + b
     f = s + str(b)
 
-    g = b + '>'      # This is legal, returns the string 'def>'.
+    g = b + '>'                    # This is legal, returns the string 'def>'.
+
+=head2 Functions Supplied by the Built-in B<innd> Module
+
+Besides C<INN.set_filter_hook> which is used to register your methods
+with B<innd> as it has already been explained above, the following functions
+are available from Python scripts:
+
+=over 4
+
+=item addhist(I<message-id>)
 
-=head1 FUNCTIONS SUPPLIED BY THE BUILT-IN INND MODULE
+=item article(I<message-id>)
 
-Not only can innd use Python, but your filter can use some of innd's
-features too.  Here is some sample Python code to show what you get:
+=item cancel(I<message-id>)
+
+=item havehist(I<message-id>)
+
+=item hashstring(I<string>)
+
+=item head(I<message-id>)
+
+=item newsgroup(I<groupname>)
+
+=item syslog(I<level>, I<message>)
+
+=back
+
+Therefore, not only can B<innd> use Python, but your filter can use some of
+B<innd>'s features too.  Here is some sample Python code to show what you get
+with the previously listed functions.
 
     import INN
 
@@ -203,7 +244,7 @@ features too.  Here is some sample Pytho
     # tells the Unix syslogger what severity to use; you can
     # abbreviate down to one letter and it's case insensitive.
     # Available levels are (in increasing levels of seriousness)
-    # Debug, Info, Notice, Warning, Err, Crit, and Alert. (If you
+    # Debug, Info, Notice, Warning, Err, Crit, and Alert.  (If you
     # provide any other string, it will be defaulted to Notice.)  The
     # second parameter is the message text.  The syslog entries will
     # go to the same log files innd itself uses, with a 'python:'
@@ -217,15 +258,15 @@ features too.  Here is some sample Pytho
     # local server; it doesn't send out a control message or anything
     # scary like that.  Returns 1 if successful, else 0.
     if INN.cancel('<meow$123.456@solvangpastries.edu>'):
-        canceled = "yup"
+        cancelled = "yup"
     else:
-        canceled = "nope"
+        cancelled = "nope"
 
-    # Check if a given message is in history. This doesn't
-    # necessarily mean the article is on your spool; canceled and
+    # Check if a given message is in history.  This doesn't
+    # necessarily mean the article is on your spool; cancelled and
     # expired articles hang around in history for a while, and
     # rejected articles will be in there if you have enabled
-    # remember_trash in inn.conf. Returns 1 if found, else 0.
+    # remembertrash in inn.conf.  Returns 1 if found, else 0.
     if INN.havehist('<z456$789.abc@isc.org>'):
         comment = "*yawn* I've already seen this article."
     else:
@@ -234,8 +275,8 @@ features too.  Here is some sample Pytho
     # Here we are running a local spam filter, so why eat all those
     # cancels?  We can add fake entries to history so they'll get
     # refused.  Returns 1 on success, 0 on failure.
-    canceled_id = buffer('<meow$123.456@isc.org>')
-    if INN.addhist("<cancel." + canceled_id[1:]):
+    cancelled_id = buffer('<meow$123.456@isc.org>')
+    if INN.addhist("<cancel." + cancelled_id[1:]):
         thought = "Eat my dust, roadkill!"
     else:
         thought = "Darn, someone beat me to it."
@@ -247,6 +288,10 @@ features too.  Here is some sample Pytho
     artbody = INN.article('<foo$bar.baz@bungmunch.edu>')
     artheader = INN.head('<foo$bar.baz@bungmunch.edu>')
 
+    # As we can compute a hash digest for a string, we can obtain one
+    # for artbody.  It might be of help to detect spam.
+    digest = INN.hashstring(artbody)
+
     # Finally, do you want to see if a given newsgroup is moderated or
     # whatever?  INN.newsgroup returns the last field of a group's
     # entry in active as a string.
@@ -260,324 +305,353 @@ features too.  Here is some sample Pytho
     else:
         moderated = "something else"
 
-=head1 CHANGES TO PYTHON AUTHENTICATION AND ACCESS CONTROL SUPPORT FOR
-NNRPD
+=head1 Writing an B<nnrpd> Filter
+
+=head2 Changes to Python Authentication and Access Control Support for B<nnrpd>
 
 The old authentication and access control functionality has been
-combined with the new readers.conf mechanism by Erik Klavon
-<erik@eriq.org>; bug reports should however go to inn-bugs@isc.org,
+combined with the new F<readers.conf> mechanism by Erik Klavon
+<erik@eriq.org>; bug reports should however go to <inn-bugs@isc.org>,
 not Erik.
 
 The remainder of this section is an introduction to the new mechanism
-(which uses the python_auth, python_access, and python_dynamic
+(which uses the I<python_auth>, I<python_access>, and I<python_dynamic>
 F<readers.conf> parameters) with porting/migration suggestions for
 people familiar with the old mechanism (identifiable by the now
-deprecated nnrpperlauth: parameter in F<inn.conf>).
+deprecated I<nnrpperlauth> parameter in F<inn.conf>).
 
 Other people should skip this section.
 
-The python_auth parameter allows the use of Python to authenticate a
-user. Authentication scripts (like those from the old mechanism) are
-listed in F<readers.conf> using python_auth in the same manner other
-authenticators are using auth:
+The I<python_auth> parameter allows the use of Python to authenticate a
+user.  Authentication scripts (like those from the old mechanism) are
+listed in F<readers.conf> using I<python_auth> in the same manner other
+authenticators are using I<auth>:
 
-        python_auth: "auth1.py"
+    python_auth: "nnrpd_auth"
+
+It uses the script named F<nnrpd_auth.py> (note that C<.py> is not present
+in the I<python_auth> value).
 
 Scripts should be placed as before in the filter directory (see the
-I<pathfilter> setting in F<inn.conf>). The new hook method authen_init
+I<pathfilter> setting in F<inn.conf>).  The new hook method C<authen_init>
 takes no arguments and its return value is ignored; its purpose is to
-provide a means for authentication specific initialization. The hook
-method authen_close is the more specific analogue to the old close
-method. These method hooks are not required.
-
-The argument dictionary passed to authenticate remains the same,
-except for the removal of the C<type> entry which is no longer needed
-in this modification and the addition of several new entries (port,
-intipaddr, intport) described below. The return tuple now only
+provide a means for authentication specific initialization.  The hook
+method C<authen_close> is the more specific analogue to the old C<close>
+method.  These two method hooks are not required, contrary to
+C<authenticate>, the main method.
+
+The argument dictionary passed to C<authenticate> remains the same,
+except for the removal of the I<type> entry which is no longer needed
+in this modification and the addition of several new entries (I<port>,
+I<intipaddr>, I<intport>) described below.  The return tuple now only
 contains either two or three elements, the first of which is the NNTP
-response code. The second is an error string which is passed to the
+response code.  The second is an error string which is passed to the
 client if the response code indicates that the authentication attempt
-has failed. This allows a specific error message to be generated by
-the Python script in place of the generic message "Authentication
-failed". An optional third return element, if present, will be used to
-match the connection with the user: parameter in access groups and
-will also be the username logged. If this element is absent, the
+has failed.  This allows a specific error message to be generated by
+the Python script in place of the generic message C<Authentication
+failed>.  An optional third return element, if present, will be used to
+match the connection with the I<user> parameter in access groups and
+will also be the username logged.  If this element is absent, the
 username supplied by the client during authentication will be used, as
-was the previous behavior.
+was the previous behaviour.
 
-The python_access parameter (described below) is new; it allows the
+The I<python_access> parameter (described below) is new; it allows the
 dynamic generation of an access group of an incoming connection using
-a Python script. If a connection matches an auth group which has a
-python_access parameter, all access groups in readers.conf are
+a Python script.  If a connection matches an auth group which has a
+I<python_access> parameter, all access groups in F<readers.conf> are
 ignored; instead the procedure described below is used to generate an
-access group. This concept is due to Jeffrey M. Vinocur.
+access group.  This concept is due to Jeffrey S<M. Vinocur> and you can
+add this line to F<readers.conf> in order to use the F<nnrpd_access.py>
+Python script in I<pathfilter>:
+
+    python_access: "nnrpd_access"
 
 In the old implementation, the authorization method allowed for access
-control on a per-group basis. That functionality is preserved in the
-new implementation by the inclusion of the python_dynamic parameter in
-F<readers.conf>. The only change is the corresponding method name of
-C<dynamic> as opposed to C<authorize>; C<domain> and C<range> are the
-same as before except for the addition of several new entries to the
-argument dictionary (port, intipaddr, intport) described
-below. Additionally, the associated optional housekeeping methods
-dynamic_init and dynamic_close may be implemented if needed.
+control on a per-group basis.  That functionality is preserved in the
+new implementation by the inclusion of the I<python_dynamic> parameter in
+F<readers.conf>.  The only change is the corresponding method name of
+C<dynamic> as opposed to C<authorize>.  Additionally, the associated
+optional housekeeping methods C<dynamic_init> and C<dynamic_close>
+may be implemented if needed.  In order to use F<nnrpd_dynamic.py> in
+I<pathfilter>, you can add this line to F<readers.conf>:
+
+    python_dynamic: "nnrpd_dynamic"
 
 This new implementation should provide all of the previous
 capabilities of the Python hooks, in combination with the flexibility
-of readers.conf and the use of other authentication and resolving
-programs (including the Perl hooks!). To use Python code that predates
+of F<readers.conf> and the use of other authentication and resolving
+programs (including the Perl hooks!).  To use Python code that predates
 the new mechanism, you would need to modify the code slightly (see
-below for the new specification) and supply a simple readers.conf
-file. If you don't want to modify your code, the sample directory has
-F<nnrpd_auth_wrapper.py>, F<nnrpd_access_wrapper.py>, and
+below for the new specification) and supply a simple F<readers.conf>
+file.  If you do not want to modify your code, the sample directory has
+F<nnrpd_auth_wrapper.py>, F<nnrpd_access_wrapper.py> and
 F<nnrpd_dynamic_wrapper.py> which should allow you to use your old
 code without needing to change it.
 
 However, before trying to use your old Python code, you may want to
-consider replacing it entirely with non-Python authentication. (With
-readers.conf and the regular authenticator and resolver programs, much
+consider replacing it entirely with non-Python authentication.  (With
+F<readers.conf> and the regular authenticator and resolver programs, much
 of what once required Python can be done directly.)  Even if the
 functionality is not available directly, you may wish to write a new
 authenticator or resolver (which can be done in whatever language you
 prefer).
 
-=head1 PYTHON AUTHENTICATION SUPPORT FOR NNRPD
+=head2 Python Authentication Support for B<nnrpd>
 
-Python authentication, dynamic access group generation and dynamic
-access control support in nnrpd along with filtering support in innd
-may be compiled in by passing C<--with-python> C<configure>.
-
-Support for authentication via Python is provided in nnrpd by the
-inclusion of a python_auth: parameter in a F<readers.conf> auth
-group. python_auth: works exactly like the auth: parameter in
+Support for authentication via Python is provided in B<nnrpd> by the
+inclusion of a I<python_auth> parameter in a F<readers.conf> auth
+group.  I<python_auth> works exactly like the I<auth> parameter in
 F<readers.conf>, except that it calls the script given as argument
 using the Python hook rather then treating it as an external
-program. Multiple, mixed use of python_auth: with other auth:
-statements including perl_auth: is permitted. Each auth: statement
+program.  Multiple, mixed use of I<python_auth> with other I<auth>
+statements including I<perl_auth> is permitted.  Each I<auth> statement
 will be tried in the order they appear in the auth group until either
 one succeeds or all are exhausted.
 
-If the processing of readers.conf requires that a python_auth:
+If the processing of F<readers.conf> requires that a I<python_auth>
 statement be used for authentication, Python is loaded (if it has yet
-to be) and the file given as argument to the python_auth: parameter is
-loaded as well. If a Python object with a method authen_init is hooked in
-during the loading of that file, then that method is called
-immediately after the file is loaded. If no errors have occurred, the
-method authenticate is called. Depending on the NNTP response code
-returned by authenticate, the authentication hook either succeeds or
-fails, after which the processing of the auth group continues as
-usual. When the connection with the client is closed, the method
-authen_close is called if it exists.
+to be) and the file given as argument to the I<python_auth> parameter is
+loaded as well (do not include the C<.py> extension of this file in
+the value of I<python_auth>).  If a Python object with a method
+C<authen_init> is hooked in during the loading of that file, then
+that method is called immediately after the file is loaded.  If no
+errors have occurred, the method C<authenticate> is called.  Depending
+on the NNTP response code returned by C<authenticate>, the authentication
+hook either succeeds or fails, after which the processing of the
+auth group continues as usual.  When the connection with the client
+is closed, the method C<authen_close> is called if it exists.
 
-=head1 DYNAMIC GENERATION OF ACCESS GROUPS
+=head2 Dynamic Generation of Access Groups
 
 A Python script may be used to dynamically generate an access group
-which is then used to determine the access rights of the client. This
-occurs whenever the python_access: parameter is specified in an auth group
-which has successfully matched the client. Only one python_access:
-statement is allowed in an auth group. This parameter should not be
-mixed with a perl_access: statement in the same auth group.
-
-When a python_access: parameter is encountered, Python is loaded (if
-it has yet to be) and the file given as argument is loaded as well. If
-a Python object with a method C<access_init> is hooked in during the
+which is then used to determine the access rights of the client.  This
+occurs whenever the I<python_access> parameter is specified in an auth group
+which has successfully matched the client.  Only one I<python_access>
+statement is allowed in an auth group.  This parameter should not be
+mixed with a I<perl_access> statement in the same auth group.
+
+When a I<python_access> parameter is encountered, Python is loaded (if
+it has yet to be) and the file given as argument is loaded as well (do not
+include the C<.py> extension of this file in the value of I<python_access>).
+If a Python object with a method C<access_init> is hooked in during the
 loading of that file, then that method is called immediately after the
-file is loaded. If no errors have occurred, the method C<access> is
-called. The dictionary returned by C<access> is used to generate an
+file is loaded.  If no errors have occurred, the method C<access> is
+called.  The dictionary returned by C<access> is used to generate an
 access group that is then used to determine the access rights of the
-client. When the connection with the client is closed, the method
+client.  When the connection with the client is closed, the method
 C<access_close> is called, if it exists.
 
-While you may include the users: parameter in a dynamically generated
+While you may include the I<users> parameter in a dynamically generated
 access group, some care should be taken (unless your pattern is just
-* which is equivalent to leaving the parameter out). The group created
+C<*> which is equivalent to leaving the parameter out).  The group created
 with the values returned from the Python script is the only one
-considered when nnrpd attempts to find an access group matching the
-connection. If a users: parameter is included and it doesn't match the
+considered when B<nnrpd> attempts to find an access group matching the
+connection.  If a I<users> parameter is included and it does not match the
 connection, then the client will be denied access since there are no
 other access groups which could match the connection.
 
-=head1 DYNAMIC ACCESS CONTROL
+=head2 Dynamic Access Control
 
 If you need to have access control rules applied immediately without
-having to restart all the nnrpd processes, you may apply access
+having to restart all the B<nnrpd> processes, you may apply access
 control on a per newsgroup basis using the Python dynamic hooks (as
 opposed to F<readers.conf>, which does the same on per user
-basis). These hooks are activated through the inclusion of the
-python_dynamic: parameter in a F<readers.conf> auth group. Only one
-python_dynamic: statement is allowed in an auth group.
-
-When a python_dynamic: parameter is encountered, Python is loaded (if
-it has yet to be) and the file given as argument is loaded as well. If
-a Python object with a method C<dynamic_init> is hooked in during the
+basis).  These hooks are activated through the inclusion of the
+I<python_dynamic> parameter in a F<readers.conf> auth group.  Only one
+I<python_dynamic> statement is allowed in an auth group.
+
+When a I<python_dynamic> parameter is encountered, Python is loaded (if
+it has yet to be) and the file given as argument is loaded as well (do not
+include the C<.py> extension of this file in the value of I<python_dynamic>).
+If a Python object with a method C<dynamic_init> is hooked in during the
 loading of that file, then that method is called immediately after the
-file is loaded. Every time a reader asks nnrpd to read or post an
+file is loaded.  Every time a reader asks B<nnrpd> to read or post an
 article, the Python method C<dynamic> is invoked before proceeding with
-the requested operation. Based on the value returned by C<dynamic>, the
-operation is either permitted or denied. When the connection with the
+the requested operation.  Based on the value returned by C<dynamic>, the
+operation is either permitted or denied.  When the connection with the
 client is closed, the method C<access_close> is called if it exists.
 
-=head1 WRITING A PYTHON NNRPD AUTHENTICATION MODULE
+=head2 Writing a Python B<nnrpd> Authentication Module
 
 You need to create a F<nnrpd_auth.py> module in INN's filter directory
 (see the I<pathfilter> setting in F<inn.conf>) where you should define a
 class holding certain methods depending on which hooks you want to use.
 
-The following methods are known to nnrpd:
+Note that you will have to use different Python scripts for authentication
+and access:  the values of I<python_auth>, I<python_access> and I<python_dynamic>
+have to be distinct for your scripts to work.
+
+The following methods are known to B<nnrpd>:
 
 =over 4
 
-=item __init__(self)
+=item __init__(I<self>)
 
-Not explicitly called by nnrpd, but will run whenever the auth module is
-loaded. Use this method to initialize any general variables or open
-a common database connection. This method may be omitted.
+Not explicitly called by B<nnrpd>, but will run whenever the auth module is
+loaded.  Use this method to initialize any general variables or open
+a common database connection.  This method may be omitted.
 
-=item authen_init(self)
+=item authen_init(I<self>)
 
-Initialization function specific to authentication. This method may be
+Initialization function specific to authentication.  This method may be
 omitted.
 
-=item authenticate(self, attributes)
+=item authenticate(I<self>, I<attributes>)
 
-Called when a python_auth statement is reached in the processing of
-readers.conf. Connection attributes are passed in the C<attributes>
-dictionary. Returns a response code, an error string, and an optional
+Called when a I<python_auth> statement is reached in the processing of
+F<readers.conf>.  Connection attributes are passed in the I<attributes>
+dictionary.  Returns a response code, an error string, and an optional
 string to be used in place of the client-supplied username (both for
 logging and for matching the connection with an access group).
 
-=item authen_close(self)
+=item authen_close(I<self>)
 
-This method is invoked on nnrpd termination.  You can use it to save
-state information or close a database connection.
+This method is invoked on B<nnrpd> termination.  You can use it to save
+state information or close a database connection.  This method may be omitted.
 
-=item access_init(self)
+=item access_init(I<self>)
 
-Initialization function specific to generation of an access group. This
+Initialization function specific to generation of an access group.  This
 method may be omitted.
 
-=item access(self, attributes)
+=item access(I<self>, I<attributes>)
 
-Called when a python_access statement is reached in the processing of
-readers.conf. Connection attributes are passed in the C<attributes>
-dictionary. Returns a dictionary of values representing statements to
+Called when a I<python_access> statement is reached in the processing of
+F<readers.conf>.  Connection attributes are passed in the I<attributes>
+dictionary.  Returns a dictionary of values representing statements to
 be included in an access group.
 
-=item access_close(self)
+=item access_close(I<self>)
 
-This method is invoked on nnrpd termination. You can use it to save
-state information or close a database connection.
+This method is invoked on B<nnrpd> termination.  You can use it to save
+state information or close a database connection.  This method may be omitted.
 
-=item dynamic_init(self)
+=item dynamic_init(I<self>)
 
-Initialization function specific to dynamic access control. This
+Initialization function specific to dynamic access control.  This
 method may be omitted.
 
-=item dynamic(self, attributes)
+=item dynamic(I<self>, I<attributes>)
 
 Called when a client requests a newsgroup, an article or attempts to
-post. Connection attributes are passed in the C<attributes> dictionary.
+post.  Connection attributes are passed in the I<attributes> dictionary.
 Returns C<None> to grant access, or a non-empty string (which will be
 reported back to the client) otherwise.
 
-=item dynamic_close(self)
+=item dynamic_close(I<self>)
+
+This method is invoked on B<nnrpd> termination.  You can use it to save
+state information or close a database connection.  This method may be omitted.
 
-This method is invoked on nnrpd termination.  You can use it to save
-state information or close a database connection.
+=back
 
-=item attributes dictionary
+=head2 The I<attributes> Dictionary
 
-The keys and associated values of the C<attributes> dictionary are
+The keys and associated values of the I<attributes> dictionary are
 described below.
 
 =over 4
 
-=item type
+=item I<type>
 
-C<read> or C<post> values specify the authentication
-type; only valid for the C<dynamic> method
+C<read> or C<post> values specify the authentication type; only valid
+for the C<dynamic> method.
 
-=item hostname
+=item I<hostname>
 
-resolved hostname (or IP address if resolution fails) of connected
-reader
+It is the resolved hostname (or IP address if resolution fails) of
+the connected reader.
 
-=item ipaddress
+=item I<ipaddress>
 
-IP address of connected reader
+The IP address of the connected reader.
 
-=item port
+=item I<port>
 
-port of connected reader
+The port of the connected reader.
 
-=item interface
+=item I<interface>
 
-hostname of the local endpoint of the NNTP connection
+The hostname of the local endpoint of the NNTP connection.
 
-=item intipaddr
+=item I<intipaddr>
 
-IP address of the local endpoint of the NNTP connection
+The IP address of the local endpoint of the NNTP connection.
 
-=item intport
+=item I<intport>
 
-port of the local endpoint of the NNTP connection
+The port of the local endpoint of the NNTP connection.
 
-=item user
+=item I<user>
 
-username as reader passed with AUTHINFO command, or None if not
-applicable
+The username as passed with AUTHINFO command, or C<None> if not
+applicable.
 
-=item pass
+=item I<pass>
 
-password as reader passed with AUTHINFO command, or None if not
-applicible
+The password as passed with AUTHINFO command, or C<None> if not
+applicable.
 
-=item newsgroup
+=item I<newsgroup>
 
-name of the newsgroup reader requests read or post access to; only
-valid for the C<dynamic> method
+The name of the newsgroup to which the reader requests read or post access;
+only valid for the C<dynamic> method.
 
 =back
 
 All the above values are buffer objects (see the notes above on what
 buffer objects are).
 
-=back
+=head2 How to Use these Methods with B<nnrpd>
 
-To register your methods with nnrpd, you need to create an instance of
-your class, import the built-in nnrpd module, and pass the instance to
-nnrpd.set_auth_hook().  For example:
+To register your methods with B<nnrpd>, you need to create an instance of
+your class, import the built-in B<nnrpd> module, and pass the instance to
+C<nnrpd.set_auth_hook>.  For example:
 
     class AUTH:
-        def authenticate(self, attributes):
+        def authen_init(self):
+            ...
+            blah blah
             ...
 
-        def authorize(self, attributes):
+        def authenticate(self, attributes):
+            ...
+            yadda yadda
             ...
 
     import nnrpd
     myauth = AUTH()
     nnrpd.set_auth_hook(myauth)
 
-There is also an F<nnrpd.py> module there that is not actually used by
-nnrpd but provides the same set of functions as built-in nnrpd module.
-This stub module may be used when debugging your own module.
-
-=head1 FUNCTIONS SUPPLIED BY THE BUILT-IN NNRPD MODULE
+When writing and testing your Python filter, don't be afraid to make use
+of C<try:>/C<except:> and the provided C<nnrpd.syslog> function.  stdout and stderr
+will be disabled, so your filter will die silently otherwise.
 
-As of this writing, nnrpd built-in module exports the following functions:
+Also, remember to try importing your module interactively before loading
+it, to ensure there are no obvious errors.  One typo can ruin your whole
+filter.  A dummy F<nnrpd.py> module is provided to facilitate testing outside
+the server.  It is not actually used by B<nnrpd> but provides the same set
+of functions as built-in B<nnrpd> module. This stub module may be used
+when debugging your own module.  To test, change into your filter directory
+and use a command like:
+
+    python -ic 'import nnrpd, nnrpd_auth'
+
+=head2 Functions Supplied by the Built-in B<nnrpd> Module
+
+Besides C<nnrpd.set_auth_hook> used to pass a reference to the instance
+of authentication and authorization class to B<nnrpd>, the B<nnrpd> built-in
+module exports the following function:
 
 =over 4
 
-=item set_auth_hook()
-
-used to pass a reference to the instance of authentication and
-authorization class to nnrpd
+=item syslog(I<level>, I<message>)
 
-=item syslog()
-
-intended to be a replacement for a Python native syslog
+It is intended to be a replacement for a Python native syslog.  It works
+like C<INN.syslog>, seen above.
 
 =back
 
+$Id: hook-python.pod 7926 2008-06-29 08:27:41Z iulius $
+
 =cut
diff -Nrup inn-2.4.4/doc/pod/news.pod inn-2.4.5/doc/pod/news.pod
--- inn-2.4.4/doc/pod/news.pod	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/pod/news.pod	2008-06-29 10:56:57.000000000 -0700
@@ -1,3 +1,93 @@
+=head1 Changes in 2.4.5
+
+=over 2
+
+=item *
+
+Fixed the "alarm signal" around C<SSL_read> in B<nnrpd>:  it allows
+a proper disconnection of news clients which were previously hanging
+when posting an article through a SSL connection.  Moreover, the
+I<clienttimeout> parameter now works on SSL connections.  Thanks to
+Matija Nalis for the patch.
+
+=item *
+
+SO_KEEPALIVE is now implemented for SSL TCP connections on systems
+which support it, allowing system detection and closing the dead
+TCP SSL connections automatically after system-specified time.  Thanks
+to Matija Nalis for the patch.
+
+=item *
+
+Fixed a segmentation fault when an article of a size greater than remaining
+stack is retrieved via SSL.  Thanks to Chris Caputo for this patch.
+
+=item *
+
+Fixed a few segfaults and bugs which affected both Python B<innd> and B<nnrpd>
+hooks.  They no longer check the existence of methods not used by the hooked
+script.  An issue with Python exception handling was also fixed, as well as
+a segfault fixed by Russ Allbery which happened whenever one closes and then
+reopens Python in the same process.  Julien Elie also fixed a bug when reloading
+Python filters (they were not always correctly reloaded) and a segfault when
+generating access groups with embedded Python filters for B<nnrpd>.
+Many thanks to David Hlacik for its bug reports.
+
+=item *
+
+The F<nnrpd.py> stub file in order to test Python B<nnrpd> hooks, as
+mentioned in their documentation, is now installed; only F<INN.py> was
+previously installed in I<pathfilter>.  Also fixed a bug in F<INN.py>
+and add missing methods to it.
+
+=item *
+
+Fixed a long-standing bug in B<innreport> which prevented it from
+correctly reporting B<nnrpd> and B<innfeed> log messages.
+
+=item *
+
+Fixed a hang in Perl hooks on (at least) HP/PA since S<Perl 5.10>.
+
+=item *
+
+Fixed a compilation problem on some platforms because of AF_INET6 which
+was not inside a HAVE_INET6 block in B<innfeed>.
+
+=item *
+
+Fixed a bug in B<innfeed> which contained thrice the same IPs for each
+peer; it unnecessarily slowed the peer IP rotation for B<innfeed>.  Thanks,
+S<D. Stussy>, for having seen that.  Miquel van Smoorenburg provided the patch.
+
+=item *
+
+A new I<heavily> improved version of B<pullnews> is shipped with this
+INN release.  This new version is provided by Geraint Edwards.  He added
+no more than S<16 flags>, fixed some bugs and integrated the B<backupfeed>
+contrib script by Kai Henningsen, adding again S<6 other> flags.  A
+long-standing but very minor bug in the B<-g> option was especially fixed
+and items from the to-do list implemented.  Many thanks again to Geraint Edwards.
+
+=item *
+
+New headers are accessible through Perl and Python B<innd> filtering
+hooks.  You will find the exact list in the INN Python Filtering and
+Authentication Hooks documentation (F<doc/hook-python>) and in Python
+samples.  Thanks to Matija Nalis for this addition of new useful headers.
+
+=item *
+
+New samples for Python B<nnrpd> hooks are shipped with INN:  F<nnrpd_access.py>
+for access control and F<nnrpd_dynamic.py> for dynamic access control.  The
+F<nnrpd_auth.py> script is now only used for authorization control.  See the
+F<readers.conf> man page for more information (especially the I<python_auth>,
+I<python_access> and I<python_dynamic> parameters).  The documention about
+INN Python Filtering and Authentication Hooks has also been improved by
+Julien Elie.
+
+=back
+
 =head1 Changes in 2.4.4
 
 =over 2
diff -Nrup inn-2.4.4/doc/pod/pullnews.pod inn-2.4.5/doc/pod/pullnews.pod
--- inn-2.4.4/doc/pod/pullnews.pod	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/pod/pullnews.pod	2008-06-29 10:56:57.000000000 -0700
@@ -1,15 +1,20 @@
 =head1 NAME
 
-pullnews - Pull news from one news server and feed it to another
+pullnews - Pull news from multiple news servers and feed it to another
 
 =head1 SYNOPSIS
 
-B<pullnews> [B<-hqx>] [B<-c> I<config>] [B<-g> I<groups>] [B<-p> I<port>]
-[B<-r> I<file>] [B<-s> I<to-server>] [<from-server> ...]
+B<pullnews> [B<-hnqRx>] [B<-b> I<fraction>] [B<-c> I<config>] [B<-C> I<width>]
+[B<-d> I<level>] [B<-f> I<fraction>] [B<-F> I<fakehop>] [B<-g> I<groups>]
+[B<-G> I<newsgroups>] [B<-H> I<headers>] [B<-k> I<checkpt>] [B<-l> I<logfile>]
+[B<-m> I<header_pats>] [B<-M> I<num>] [B<-N> I<timeout>] [B<-p> I<port>]
+[B<-P> I<hop_limit>] [B<-Q> I<level>] [B<-r> I<file>] [B<-s> I<to-server>[:I<port>]]
+[B<-S> I<max-run>] [B<-t> I<retries>] [B<-T> I<connect-pause>] [B<-w> I<num>]
+[B<-z> I<article-pause>] [B<-Z> I<group-pause>] [I<from-server> ...]
 
 =head1 REQUIREMENTS
 
-The Net::NNTP module must be installed.  This module is available as part
+The C<Net::NNTP> module must be installed.  This module is available as part
 of the libnet distribution and comes with recent versions of Perl.  For
 older versions of Perl, you can download it from L<http://www.cpan.org/>.
 
@@ -19,18 +24,26 @@ B<pullnews> reads a config file in the r
 (normally called F<~/.pullnews>) and connects to the upstream servers
 given there as a reader client.  By default, it connects to all servers
 listed in the configuration file, but you can limit B<pullnews> to
-specific servers by listing them on the command line.  For each server it
-connects to, it pulls over articles and feeds them to the destination
-server via the IHAVE command.  This means that the system B<pullnews> is
-run on must have feeding access to the destination news server.
+specific servers by listing them on the command line:  a whitespace-separated
+list of server names can be specified, like I<from-server> for one of them.
+For each server it connects to, it pulls over articles and feeds them to the
+destination server via the IHAVE or POST commands.  This means that the system
+B<pullnews> is run on must have feeding access to the destination news server.
 
-B<pullnews> is designed for very small sites that don't want to bother
+B<pullnews> is designed for very small sites that do not want to bother
 setting up traditional peering and is not meant for handling large feeds.
 
 =head1 OPTIONS
 
 =over 4
 
+=item B<-b> I<fraction>
+
+Backtrack on server numbering reset.  Specify the proportion (C<0.0> to C<1.0>)
+of a group's articles to pull when the server's article number is less than
+our high for that group.  When I<fraction> is C<1.0>, pull all the articles on
+a renumbered server.  The default is to do nothing.
+
 =item B<-c> I<config>
 
 Normally, the config file is stored in F<~/.pullnews> for the user running
@@ -38,39 +51,145 @@ B<pullnews>.  If B<-c> is given, I<confi
 instead.  This is useful if you're running B<pullnews> as a system user on
 an automated basis out of cron rather than as an individual user.
 
+See L<CONFIG FILE> below for the format of this file.
+
+=item B<-C> I<width>
+
+Use I<width> characters per line for the progress table.  The default value
+is C<50>.
+
+=item B<-d> I<level>
+
+Set the debugging level to the integer I<level>; more debugging output
+will be logged as this increases.  The default value is C<0>.
+
+=item B<-f> I<fraction>
+
+This changes the proportion of articles to get from each group to
+I<fraction> and should be in the range C<0.0> to C<1.0> (C<1.0> being
+the default).
+
+=item B<-F> I<fakehop>
+
+Prepend I<fakehop> as a host to the Path: header of articles fed.
+
 =item B<-g> I<groups>
 
-Specifies a collection of groups to get.  I<groups> is a list of
+Specify a collection of groups to get.  I<groups> is a list of
 newsgroups separated by commas (only commas, no spaces).  Each group must
 be defined in the config file, and only the remote hosts that carry those
 groups will be contacted.  Note that this is a simple list of groups, not
 a wildmat expression, and wildcards are not supported.
 
+=item B<-G> I<newsgroups>
+
+Add the comma-separated list of groups I<newsgroups> to each server in the
+configuration file (see also B<-g> and B<-w>).
+
 =item B<-h>
 
 Print a usage message and exit.
 
+=item B<-H> I<headers>
+
+Remove these named headers (colon-separated list) from fed articles.
+
+=item B<-k> I<checkpt>
+
+Checkpoint (save) the config file every I<checkpt> articles
+(default is C<0>, that is to say at the end of the session).
+
+=item B<-l> I<logfile>
+
+Log progress/stats to I<logfile> (default is C<stdout>).
+
+=item B<-m> I<header_pats>
+
+Feed an article based on header matching.  The argument is a number of
+whitespace-separated tuples (each tuple being a colon-separated header and
+regular expression).  For instance:
+
+    Hdr1:regexp1 !Hdr2:regexp2
+
+specifies that the article will be passed only if the C<Hdr1:> header
+matches C<regexp1> and the C<Hdr2:> header does not match C<regexp2>.
+
+=item B<-M> I<num>
+
+Specify the maximum number of articles (per group) to process.
+The default is to process all new articles.  See also B<-f>.
+
+=item B<-n>
+
+Do nothing but read articles S<-- does> not feed articles downstream,
+writes no B<rnews> file, does not update the config file.
+
+=item B<-N> I<timeout>
+
+Specify the timeout length, as I<timeout> seconds,
+when establishing an NNTP connection.
+
 =item B<-p> I<port>
 
 Connect to the destination news server on a port other than the default of
-119.  This option does not change the port used to connect to the remote
+C<119>.  This option does not change the port used to connect to the source
 news servers.
 
+=item B<-P> I<hop_limit>
+
+Restrict feeding an article based on the number of hops it has already made.
+Count the hops in the Path: header (I<hop_count>), feeding the article only
+when I<hop_limit> is C<+num> and I<hop_count> is more than I<num>;
+or I<hop_limit> is C<-num> and I<hop_count> is less than I<num>.
+
 =item B<-q>
 
 Print out less status information while running.
 
+=item B<-Q> I<level>
+
+Set the quietness level (C<-Q 2> is equivalent to C<-q>).  The higher this
+value, the less gets logged.  The default is C<0>.
+
 =item B<-r> I<file>
 
-Rather than feeding the downloaded articles to a local server, instead
+Rather than feeding the downloaded articles to a destination server, instead
 create a batch file that can later be fed to a server using B<rnews>.  See
 rnews(1) for more information about the batch file format.
 
-=item B<-s> I<to-server>
+=item B<-R>
+
+Be a reader (use MODE READER and POST commands) to the downstream
+server.  The default is to use the IHAVE command.
+
+=item B<-s> I<to-server>[:I<port>]
 
 Normally, B<pullnews> will feed the articles it retrieves to the news
 server running on localhost.  To connect to a different host, specify a
-server with the B<-s> flag.
+server with the B<-s> flag.  You can also specify the port with this same
+flag or use B<-p>.
+
+=item B<-S> I<max-run>
+
+Specify the maximum time I<max-run> in seconds for B<pullnews> to run.
+
+=item B<-t> I<retries>
+
+The maximum number (I<retries>) of attempts to connect to a server
+(see also B<-T>).  The default is C<0>.
+
+=item B<-T> I<connect-pause>
+
+Pause I<connect-pause> seconds between connection retries (see also B<-t>).
+The default is C<1>.
+
+=item B<-w> I<num>
+
+Set each group's high watermark (last received article number) to I<num>.
+If I<num> is negative, calculate S<I<Current>+I<num>> instead (i.e. get the last
+I<num> articles).  Therefore, a I<num> of C<0> will re-get all articles on the
+server; whereas a I<num> of C<-0> will get no old articles, setting the
+watermark to I<Current> (the most recent article on the server).
 
 =item B<-x>
 
@@ -78,6 +197,14 @@ If the B<-x> flag is used, an Xref: head
 that lacks one.  It can be useful for instance if articles are fed
 to a news server which has I<xrefslave> set in F<inn.conf>.
 
+=item B<-z> I<article-pause>
+
+Sleep I<article-pause> seconds between articles.  The default is C<0>.
+
+=item B<-Z> I<group-pause>
+
+Sleep I<group-pause> seconds between groups.  The default is C<0>.
+
 =back
 
 =head1 CONFIG FILE
@@ -85,9 +212,12 @@ to a news server which has I<xrefslave> 
 The config file for B<pullnews> is divided into blocks, one block for each
 remote server to connect to.  A block begins with the host line, which
 must have no leading whitespace and contains just the hostname of the
-remote server.  Following this line should be one or more newsgroup lines
-which start with whitespace followed by the name of a newsgroup to
-retrieve.  Only one newsgroup should be listed on each line.
+remote server, optionally followed by authentication details (username
+and password for that server).
+
+Following the host line should be one or more newsgroup lines which start
+with whitespace followed by the name of a newsgroup to retrieve.  Only one
+newsgroup should be listed on each line.
 
 B<pullnews> will update the config file to include the time the group was
 last checked and the highest numbered article successfully retrieved and
@@ -101,8 +231,7 @@ The full syntax is:
             <group> [<time> <high>]
 
 where the <host> line must not have leading whitespace and the <group>
-lines must.  Note that you may optionally specify a username and password
-for basic authentication to the remote server if necessary.
+lines must.
 
 A typical configuration file would be:
 
@@ -121,20 +250,35 @@ were just added by the user and have not
 The nnrp.vix.com server requires authentication, and B<pullnews> will use
 the username C<pull> and the password C<sekret>.
 
-=head1 BUGS
+=head1 FILES
+
+=over 4
+
+=item I<pathbin>/pullnews
+
+The Perl script itself used to pull news from upstream servers and feed
+it to another news server.
 
-B<pullnews> is very simple and is lacking in more sophisticated features
-(like killing articles based on user-defined conditions) that better pull
-feeders most certainly have. It also doesn't keep or log much detail on
-articles transferred.
+=item I<$HOME>/.pullnews
+
+The default config file.  It is in the running user's home directory
+(normally called F<~/.pullnews>).
+
+=back
 
 =head1 HISTORY
 
-pullnews was written by James Brister for INN.  The documentation was
+B<pullnews> was written by James Brister for INN.  The documentation was
 rewritten in POD by Russ Allbery <rra@stanford.edu>.
 
+Geraint A. Edwards greatly improved B<pullnews>, adding no more than S<16 new>
+recognized flags, fixing some bugs and integrating the B<backupfeed>
+contrib script by Kai Henningsen, adding again S<6 other> flags.
+
+$Id: pullnews.pod 7853 2008-05-27 19:07:45Z iulius $
+
 =head1 SEE ALSO
 
-incoming.conf(5)
+incoming.conf(5), rnews(1).
 
 =cut
diff -Nrup inn-2.4.4/doc/pod/readers.conf.pod inn-2.4.5/doc/pod/readers.conf.pod
--- inn-2.4.4/doc/pod/readers.conf.pod	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/doc/pod/readers.conf.pod	2008-06-29 10:56:57.000000000 -0700
@@ -267,16 +267,17 @@ configure).  More information may be fou
 
 =item B<python_auth:>
 
-A python script for authentication.  The python_auth: parameter works
-exactly like auth:, except that it calls the named script using the
-python hook rather then an external program.  Multiple/mixed use of
-the auth, perl_auth, and python_auth parameters is permitted within any
-auth group; each line is tried in the order it appears.  python_auth:
-has more power than auth: in that it provides the authentication
-program with additional information about the client and the ability
-to return an error string and a username.  This parameter is only
-valid if INN is compiled with Python support (B<--with-python> passed
-to configure).  More information may be found in F<doc/hook-python>.
+A Python script for authentication.  The I<python_auth> parameter works
+exactly like I<auth>, except that it calls the named script (without its
+C<.py> extension) using the Python hook rather then an external program.
+Multiple/mixed use of the I<auth>, I<perl_auth>, and I<python_auth>
+parameters is permitted within any auth group; each line is tried
+in the order it appears.  I<python_auth> has more power than I<auth>
+in that it provides the authentication program with additional information
+about the client and the ability to return an error string and a username.
+This parameter is only valid if INN is compiled with Python support
+(B<--with-python> passed to B<configure>).  More information may be
+found in F<doc/hook-python>.
 
 =item B<default:>
 
@@ -323,28 +324,29 @@ found in the file F<doc/hook-perl>.
 
 =item B<python_access:>
 
-A python script for dynamically generating an access group.  If
-an auth group matches successfully and contains a python_access parameter,
-then the argument script will be used to create an access group.
-This group will then determine the access rights of the client,
-overriding any access groups in F<readers.conf>.  If and only if a
-successful auth group contains the python_access parameter, F<readers.conf>
+A Python script for dynamically generating an access group.  If
+an auth group matches successfully and contains a I<python_access> parameter,
+then the argument script (without its C<.py> extension) will be used to
+create an access group.  This group will then determine the access rights
+of the client, overriding any access groups in F<readers.conf>.  If and only
+if a successful auth group contains the I<python_access> parameter, F<readers.conf>
 access groups are ignored and the client's rights are instead determined
 dynamically.  This parameter is only valid if INN is compiled with Python
-support (B<--with-python> passed to configure).  More information may be
+support (B<--with-python> passed to B<configure>).  More information may be
 found in the file F<doc/hook-python>.
 
 =item B<python_dynamic:>
 
-A python script for applying access control dynamically on a per newsgroup
+A Python script for applying access control dynamically on a per newsgroup
 basis.  If an auth group matches successfully and contains a
-python_dynamic parameter, then the argument script will be used to
-determine the clients rights each time the user attempts to view a
-newsgroup, or read or post an article.  Access rights as determined by
-python_dynamic override the values of access group parameters such as
-newsgroups, read, and post.  This parameter is only valid if INN is
-compiled with Python support (B<--with-python> passed to configure).  More
-information may be found in the file F<doc/hook-python>.
+I<python_dynamic> parameter, then the argument script (without its
+C<.py> extension) will be used to determine the clients rights each time
+the user attempts to view a newsgroup, or read or post an article.  Access
+rights as determined by I<python_dynamic> override the values of access
+group parameters such as I<newsgroups>, I<read> and I<post>.  This parameter
+is only valid if INN is compiled with Python support (B<--with-python>
+passed to B<configure>).  More information may be found in the file
+F<doc/hook-python>.
 
 =back
 
@@ -452,8 +454,8 @@ display the reason to the user.
 
 =item B<max_rate:>
 
-If this parameter is present (and nonzero) it is used for nnrpd's 
-rate-limiting code.  The client will only be able to download at this 
+If this parameter is present (and nonzero), it is used for B<nnrpd>'s
+rate-limiting code.  The client will only be able to download at this
 speed (in bytes/second).  Note that if SSL is being used, limiting
 is applied to the pre-encryption datastream.
 
@@ -489,13 +491,14 @@ default is true.
 
 =item B<virtualhost:>
 
-Set this parameter to make B<nnrpd> behave as if it's running on a server
-with a different name than it actually is.  If you set this parameter, you
-must also set either pathhost: or domain: to something different than is
-set in F<inn.conf>.  All articles displayed to clients will then have
+Set this parameter to true in order to make B<nnrpd> behave as if it is
+running on a server with a different name than it actually is.  If you
+set this parameter to true, you must also set either pathhost: or domain:
+in the relevant access group in F<readers.conf> to something different
+than is set in F<inn.conf>.  All articles displayed to clients will then have
 their Path: and Xref: headers altered to appear to be from the server
 named in pathhost: or domain: (whichever is set), and posted articles will
-use that server name in the Path:, Message-ID;, and X-Trace: headers.
+use that server name in the Path:, Message-ID:, and X-Trace: headers.
 
 Note that setting this parameter requires the server modify all posts
 before presenting them to the client and therefore may decrease
@@ -505,12 +508,14 @@ performance slightly.
 
 In addition, all of the following parameters are valid in access groups
 and override the global setting in F<inn.conf>.  See inn.conf(5) for the
-descriptions of these parameters:  addnntppostingdate, addnntppostinghost,
-backoff_auth, backoff_db, backoff_k, backoff_postfast, backoff_postslow,
-backoff_trigger, checkincludedtext, clienttimeout, complaints, domain,
-fromhost, localmaxartsize, moderatormailer, nnrpdauthsender,
-nnrpdcheckart, nnrpdoverstats, nnrpdposthost, nnrpdpostport, organization,
-pathhost, readertrack, spoolfirst, and strippostcc.
+descriptions of these parameters:
+
+    addnntppostingdate, addnntppostinghost, backoff_auth, backoff_db,
+    backoff_k, backoff_postfast, backoff_postslow, backoff_trigger,
+    checkincludedtext, clienttimeout, complaints, domain,
+    fromhost, localmaxartsize, moderatormailer, nnrpdauthsender,
+    nnrpdcheckart, nnrpdoverstats, nnrpdposthost, nnrpdpostport, organization,
+    pathhost, readertrack, spoolfirst, strippostcc.
 
 =head1 SUMMARY
 
@@ -615,7 +620,7 @@ username and password are first checked 
 usernames and passwords, and then against the system shadow password file:
 
     auth all {
-        auth: "ckpasswd -d /usr/local/news/db/newsusers"
+        auth: "ckpasswd -d <pathdb in inn.conf>/newsusers"
         auth: "ckpasswd -s"
     }
 
@@ -665,7 +670,7 @@ staff can also post messages with Approv
 cannot.
 
     auth default {
-        auth: "ckpasswd -f /usr/local/news/db/newsusers"
+        auth: "ckpasswd -f <pathdb in inn.conf>/newsusers"
         default: <FAIL>
         default-domain: example.com
     }
@@ -795,7 +800,8 @@ above, with ones having global applicabi
 =item *
 
 Consider running a C<nnrpd -S> (with C<-D>, or out of "super-server"
-like inetd) on the nntps port (563) for clients that support SSL.  You
+like B<inetd>) on the NNTPS port (563) for clients that support SSL.  See
+nnrpd(8) for more details about how to configure that.  You
 can use the require_ssl: parameter, or C<-c> to specify an alternate
 F<readers.conf> if you want a substantially different configuration for
 this case.
@@ -813,10 +819,11 @@ tunnel), use the localaddress: parameter
 Written by Aidan Cully <aidan@panix.com> for InterNetNews.  Substantially
 expanded by Russ Allbery <rra@stanford.edu>.
 
-$Id: readers.conf.pod 7384 2005-07-05 01:28:43Z eagle $
+$Id: readers.conf.pod 7895 2008-06-22 17:54:10Z iulius $
 
 =head1 SEE ALSO
 
-ckpasswd(8), inn.conf(5), innd(8), newsfeeds(5), nnrpd(8), uwildmat(3)
+auth_krb5(8), auth_smb(8), ckpasswd(8), inn.conf(5), innd(8), newsfeeds(5),
+nnrpd(8), uwildmat(3).
 
 =cut
diff -Nrup inn-2.4.4/frontends/pullnews.in inn-2.4.5/frontends/pullnews.in
--- inn-2.4.4/frontends/pullnews.in	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/frontends/pullnews.in	2008-06-29 10:56:57.000000000 -0700
@@ -1,59 +1,44 @@
-#! /usr/bin/perl
-# 
+#! /usr/bin/perl -w
+#
 # Author:       James Brister <brister@vix.com> -- berkeley-unix --
 # Start Date:   Sat, 10 Oct 1998 21:40:11 +0200
 # Project:      INN
 # File:         pullnews.pl
-# RCSId:        $Id: pullnews.in 7796 2008-04-26 08:36:58Z iulius $
-# Time-stamp:	<Friday, 7 April 2000 15:17:12 by brister@nominum.com>
-# Description:  A very simple pull feeder. Connects to multiple remote 
-#		machines (in the guise of a reader), and pulls over articles 
-#		and feeds them to the local server (in the guise of a feeder).
-# 		
-# 		Uses a simple configuration file: $HOME/.pullnews to define
-# 		which machines to pull articles from and which groups at each
-# 		machine to pull over. There is no support yet for more specific
-# 		configurations like cross-posted newsgroups to kill etc.
-# 		
-# 		A configuration file looks like:
-# 		
-# 			data.pa.vix.com 
-# 				news.software.nntp 0 0
-# 				comp.lang.c 0 0
-#			news.uu.net username passwd
-#				uunet.announce 0 0
-# 				uunet.help 0 0
-# 		
-#		hostname line has no leading space on it and an optional
-#		username and password after the hostname.and all the
-#		subsequent group lines for that host must have leading
-#		spaces. The two integers on the group line will be updated by
-#		the program when it runs. They are the unix time the group was
-#		accessed, and the highest numbered article that was pulled
-#		over.
-
+# RCSId:        $Id: pullnews.in 7862 2008-06-08 09:15:41Z iulius $
 #
+# History:      May 2008:  Geraint A. Edwards greatly improved pullnews, adding
+#               -b, -C, -d, -G, -H, -k, -l, -m, -M, -n, -P, -Q, -R, -t, -T, -w and
+#               improving -s as well as fixing some bugs.
+#               He also integrated the backupfeed contrib script by Kai Henningsen,
+#               adding -f, -F, -N, -S, -z and -Z to pullnews.
 #
-# NOTE NOTE NOTE NOTE:
+# Description:  A simple pull feeder.  Connects to multiple upstream 
+#               machines (in the guise of a reader), and pulls over articles 
+#               and feeds them to a downstream server (in the guise of a feeder).
 #
-# The Packages Net::NNTP is required *AND* the function Net::NNTP::new is 
-# redefined in this file. If you're using a new release of Net::NTTP *AND* 
-# if the Net::NNTP::new function supplied there does NOT call the 
-# $obj->reader() function, then you can remove the redefinition in here.
+#               Uses a simple configuration file:  $HOME/.pullnews to define
+#               which machines to pull articles from and which groups at each
+#               machine to pull over.  There is also support for more specific
+#               configurations like cross-posted newsgroups to kill, thanks to
+#               the -m flag which allows articles with headers matching regexp
+#               to be dropped.
 #
-# Net::NNTP is part of the libnet bundle by Graham Barr and is available
-# from CPAN or his site:
+#               A configuration file looks like:
 #
-# 		http://www.connect.net/gbarr/
-# 		
-
-# TODO
-#	- Have option to reset the highwater marks to match whatever 
-#	  is on the remote server.
-#	- Have an option to reset the highwater marks to zero.
-# 	- Have an option to add a group to the config.
-#	- Be able to specify articles to drop if they match a crossposted 
-#	  group or regexp.
+#                       data.pa.vix.com 
+#                               news.software.nntp 0 0
+#                               comp.lang.c 0 0
+#                       news.uu.net username password
+#                               uunet.announce 0 0
+#                               uunet.help 0 0
+#
+#               Hostname lines have no leading space and may have an optional
+#               username and password after the hostname; all the
+#               subsequent group lines for that host must have leading
+#               spaces.  The two integers on the group line will be updated by
+#               the program when it runs.  They are the Unix time the group was
+#               accessed, and the highest numbered article that was pulled
+#               over.
 #
 
 require 5.004;
@@ -61,15 +46,17 @@ require 5.004;
 $0 =~ s!.*/!!;
 
 my $rcsID =<<'EOM';
-$Id: pullnews.in 7796 2008-04-26 08:36:58Z iulius $
+$Id: pullnews.in 7862 2008-06-08 09:15:41Z iulius $
 EOM
 
-$SIG{INT} = \&outtaHere ;
-$SIG{QUIT} = \&bail ;
+$SIG{INT} = \&outtaHere;
+$SIG{QUIT} = \&bail;
 
-use Net::NNTP;
-use Getopt::Std ;
+use Net::NNTP 2.18; # With libnet 1.0606 (10-Dec-1998) because older versions
+                    # issued MODE READER with Net::NNTP::new().
+use Getopt::Std;
 use IO::Handle;
+use POSIX qw(ceil floor);
 use Fcntl;
 use Fcntl qw(:flock);
 use strict;
@@ -78,85 +65,207 @@ my $usage = $0;
 my $defaultConfig = "$ENV{HOME}/.pullnews";
 my $defaultPort = 119;
 my $defaultHost = "localhost";
+my $defaultCheckPoint = 0;
+my $defaultRetries = 0;
+my $defaultDebug = 0;
+my $defaultRetryTime = 1;
+my $defaultProgressWidth = 50;
+my $defaultMaxArts;
 
 $usage =~ s!.*/!!;
-$usage .= " [ -h -q -x -r file -g groups -c config -s host -p port ]
+$usage .= " [ -hnqRx -b fraction -c config -C width -d level
+        -f fraction -F fakehop -g groups -G newsgroups -H headers
+        -k checkpt -l logfile -m header_pats -M num -N num
+        -p port -P hop_limit -Q level -r file -s host[:port] -S num
+        -t retries -T seconds -w num -z num -Z num ]
+        [ upstream_host ... ]
 
-  -g groups	specifies a collection of groups to get. The value must be 
-		a single argument with commas between group names:
-		
-			-g comp.lang.c,comp.lang.lisp,comp.lang.python
-		
-		the groups must be defined in the config file somewhere. 
-		Only the hosts that carry those groups will be contacted.
+  -b fraction   backtrack on server numbering reset.  The proportion
+                (0.0 to 1.0) of a group's articles to pull when the
+                server's article number is less than our high for that
+                group.  When fraction is 1.0, pull all the articles on
+                the server.  The default is to do nothing.
 
-  -c config	specifies the configuration file instead of the 
-		default of $ENV{HOME}/.pullnews
+  -c config     specify the configuration file instead of the 
+                default of $ENV{HOME}/.pullnews (also called ~/.pullnews).
 
-  -s host	specifies the hostname to feed articles to (default 
-		is $defaultHost)
+  -C width      use width characters for progress (default is $defaultProgressWidth).
 
-  -p port	specifies the port to connect to to feed articles (default 
-		is: $defaultPort).
+  -d level      set debugging level to this integer (default is $defaultDebug).
 
-  -r file	instead of feeding to a server $0 will instead
-		create an rnews-compatible file.
+  -f fraction   proportion of articles to get in each group (0.0 to 1.0).
 
-  -x 		insert an Xref header in any article that lacks one.
+  -F fakehop    prepend fakehop as a host to the Path: header.
 
-  -q 		$0 will normally be verbose about what it's doing. This 
-		option will make it quiet.
+  -g groups     specify a collection of groups to get.  The value must be 
+                a single argument with commas between group names:
 
-  -h		prints this message.
-";
+                        -g comp.lang.c,comp.lang.lisp,comp.lang.python
 
+                The groups must be defined in the config file somewhere. 
+                Only the hosts that carry those groups will be contacted.
 
-use vars qw($opt_q $opt_r $opt_x $opt_s $opt_c $opt_g $opt_p $opt_h);
-getopts("r:c:s:qxg:p:h") || die $usage;
+  -G newsgroups add these groups to the configuration (see -g and -w).
 
-die $usage if $opt_h;
+  -h            print this message.
 
-my @groupsToGet = ();		# empty list means all groups in config file.
-my $rnews = $opt_r;
-my $groupFile = $opt_c || $defaultConfig;
-my $localServer = $opt_s || $defaultHost ;
-my $localPort = $opt_p || $defaultPort;
-my $quiet = $opt_q;
+  -H headers    remove these named headers (colon-separated list).
 
-die "can\'t have both ``-s'' and ``-r''\n" if $opt_s && $opt_r;
-die "``-p'' value not an integer: $opt_p\n" if $localPort !~ m!^\d+$!;
+  -k checkpt    checkpoint the config file every checkpt articles
+                (default is $defaultCheckPoint).  A value of 0 means
+                normally (at end).
+
+  -l logfile    log progress/stats to logfile (default is stdout).
+
+  -m 'Hdr1:regexp1 !Hdr2:regexp2 ...'
+                feed article only if:
+                the Hdr1: header matches regexp1
+                and the Hdr2: header does not match regexp2.
+
+  -M num        maximum number of articles (per group) to process before
+                bailing out.
+
+  -n            do nothing -- just fake it.
+
+  -N num        timeout length when establishing NNTP connection.
+
+  -p port       specify the port to connect to in order to feed articles
+                (default is $defaultPort).
+
+  -P hop_limit  count hops ('!') in the Path: header, feed article only if: 
+                hop_limit is '+num' and hop_count is more than num;
+                or hop_limit is '-num' and hop_count is less than num.
+
+  -q            $0 will normally be verbose about what it is doing.  This 
+                option will make it quiet.
 
-@groupsToGet = map { s!^\s*(\S+)s*!$1!; $_ } split (",", $opt_g) if $opt_g;
+  -Q level      set the quietness level (-Q 2 is equivalent to -q).
 
-$| = 1 ;
+  -r file       rather than feeding to a server, $0 will instead
+                create an rnews-compatible file.
 
-my $servers = {} ;
-my $sname = undef ;
-my %fed = () ;
+  -R            be a reader (use MODE READER and POST)
+
+  -s host[:port]
+                specify the downstream hostname (and optional port)
+                (default is $defaultHost).
+
+  -S num        specify the maximum time (in seconds) to run.
+
+  -t retries    number of attempts to connect to a server
+                (default is $defaultRetries, see also -T).
+
+  -T secs       time (in seconds) to pause between retries
+                (default is $defaultRetryTime, see also -t).
+
+  -w num        set highwater mark to num (if num is negative, use Current+num
+                instead); a num of 0 will re-get all articles on the server;
+                but a num of -0 will get no old articles, set mark to Current.
+
+  -x            insert an Xref: header in any article that lacks one.
+
+  -z num        time (in seconds) to sleep between articles.
+
+  -Z num        time (in seconds) to sleep between groups.
+";
+
+
+use vars qw($opt_b $opt_c $opt_C $opt_d $opt_f $opt_F $opt_g $opt_G
+            $opt_h $opt_H $opt_k $opt_l $opt_m $opt_M $opt_n
+            $opt_N $opt_p $opt_P $opt_q $opt_Q $opt_r $opt_R $opt_s
+            $opt_S $opt_t $opt_T $opt_w $opt_x $opt_z $opt_Z);
+getopts("b:c:C:d:f:F:g:G:hH:k:l:m:M:nN:p:P:qQ:r:Rs:S:t:T:w:xz:Z:") || die $usage;
+
+die $usage if $opt_h;
+
+my @groupsToGet         = ();        # Empty list means all groups in config file.
+my @groupsToAdd         = ();
+my $rnews               = $opt_r;
+my $groupFile           = $opt_c || $defaultConfig;
+my $localServer         = $opt_s || $defaultHost;
+my $localPort           = $opt_p || $defaultPort;
+my $quiet               = $opt_q;
+my $watermark           = $opt_w;
+my $retries             = $opt_t || $defaultRetries;
+my $retryTime           = $opt_T || $defaultRetryTime;
+my $checkPoint          = $opt_k || $defaultCheckPoint;
+my $debug               = $opt_d || $defaultDebug;
+my $progressWidth       = $opt_C || $defaultProgressWidth;
+my $maxArts             = $opt_M || $defaultMaxArts;
+my $no_op               = $opt_n || 0;
+my $reader              = $opt_R || 0;
+my $quietness           = $opt_Q || 0;
+my $skip_headers        = lc($opt_H) || '';
+my $logFile             = '>&STDOUT';
+$logFile                = ">>$opt_l" if $opt_l;
+my @hdr_to_match        = split(/\s+/, $opt_m) if defined $opt_m;
+my $pathSteps           = $opt_P if defined $opt_P;
+my $path_limit;
+
+$localPort = $1 if not defined $opt_p and $localServer =~ s/:(\d+)$//;
+
+die "can\'t have both ``-s'' and ``-r''\n"  if $opt_s && $opt_r;
+
+die "``-b'' value not 0.0-1.0: $opt_b\n"    if defined $opt_b and $opt_b !~ /^([01](\.0*)?|0?\.\d+)$/;
+die "``-C'' value not an integer: $opt_C\n" if $progressWidth !~ m!^\d+$!;
+die "``-d'' value not an integer: $opt_d\n" if $debug !~ m!^\d+$!;
+die "``-f'' value not 0.0-1.0: $opt_f\n"    if defined $opt_f and $opt_f !~ /^([01](\.0*)?|0?\.\d+)$/;
+die "``-F'' value not a hostname: $opt_F\n" if defined $opt_f and $opt_f !~ m!^[\w\-\.]+$!;
+die "``-k'' value not an integer: $opt_k\n" if $checkPoint !~ m!^\d+$!;
+die "``-M'' value not an integer: $opt_M\n" if defined $maxArts and $maxArts !~ m!^\d+$!;
+die "``-N'' value not an integer: $opt_N\n" if defined $opt_N and $opt_N !~ /^\d+$/;
+die "``-p'' value not an integer: $opt_p\n" if $localPort !~ m!^\d+$!;
+if (defined $pathSteps) {
+        die "``-P'' value not a signed integer: $opt_P\n" if $pathSteps !~ /^[-+](\d+)$/;
+        $path_limit = $1;
+}
+die "option ``-r -'' needs ``-l'' option\n" if defined $opt_r and $opt_r eq '-' and not $opt_l;
+die "``-S'' value not an integer: $opt_S\n" if defined $opt_S and $opt_S !~ /^\d+$/;
+die "``-t'' value not an integer: $opt_t\n" if $retries !~ m!^\d+$!;
+die "``-w'' value not an integer: $opt_w\n" if defined $watermark and $watermark !~ /^-?\d+$/;
+die "``-z'' value not an integer: $opt_z\n" if defined $opt_z and $opt_z !~ /^\d+$/;
+die "``-Z'' value not an integer: $opt_Z\n" if defined $opt_Z and $opt_Z !~ /^\d+$/;
+
+$quiet = 1 if $quietness > 1;
+my %NNTP_Args = ();
+$NNTP_Args{'Timeout'} = $opt_N if defined $opt_N;
+
+@groupsToGet = map { s!^\s*(\S+)\s*!$1!; $_ } split (",", $opt_g) if $opt_g;
+@groupsToAdd = map { s!^\s*(\S+)\s*!$1!; $_ } split (",", $opt_G) if $opt_G;
+
+$| = 1;
+
+my $servers = {};
+my $sname = undef;
+my %fed = ();
 my %refused = ();
 my %rejected = ();
-my $pulled = {} ;
+my $pulled = {};
 my %passwd = ();
+my %info        = (
+        fed      => 0,
+        refused  => 0,
+        rejected => 0,
+        bytes    => 0,
+);
 
 if ($rnews) {
-    open(RNEWS, ">$rnews") || 
-	die "cant open rnews-format ouptut: $rnews: $!\n";
-    if ($rnews eq "-") {
-	open(LOG, ">/dev/null") || die "can\'t open /dev/null!: $!\n";
+    if ($no_op) {
+        print "Would write to rnews file $rnews\n";
     } else {
-	open(LOG, ">&STDOUT") || die "can't dup stdout!: $!\n";
+        open(RNEWS, ">$rnews") ||
+            die "can't open rnews-format output: $rnews: $!\n";
     }
-}  else {
-    open(LOG, ">&STDOUT") || die "can't dup stdout!: $!\n";
 }
+open(LOG, $logFile) || die "can't open logfile ($logFile)!: $!\n";
 
-my $oldfh = select ;
-$| = 1; select LOG ; $| = 1; select $oldfh;
+my $oldfh = select;
+$| = 1; select LOG; $| = 1; select $oldfh;
 
 my $lockfile = $ENV{HOME} . "/.pullnews.pid";
 sysopen (LOCK, "$lockfile", O_RDWR | O_CREAT, 0700) ||
-    die "cant create lock file ($lockfile): $!\n";
-$oldfh = select ; select LOCK ; $| = 1; select $oldfh;
+    die "can't create lock file ($lockfile): $!\n";
+$oldfh = select; select LOCK; $| = 1; select $oldfh;
 
 if (!flock (LOCK, LOCK_EX | LOCK_NB)) {
     seek LOCK, 0, 0;
@@ -167,400 +276,547 @@ if (!flock (LOCK, LOCK_EX | LOCK_NB)) {
 
 print LOCK "$$\n";
 
-print LOG "Starting: ", scalar(localtime(time)), "\n\n" unless $quiet;
+print LOG scalar(localtime(time)), " start\n\n" unless $quiet;
 
 if (@groupsToGet && ! $quiet) {
     print LOG "Checking for specific groups:\n";
-    map { printf LOG "\t%s\n", $_ } @groupsToGet ;
+    map { printf LOG "\t%s\n", $_ } @groupsToGet;
     print LOG "\n";
 }
 
-open(FILE, "<$groupFile") || die "can't open group file $groupFile\n" ;
+open(FILE, "<$groupFile") || die "can't open group file $groupFile\n";
 while (<FILE>) {
-    next if m!^\s*\#! || m!^\s*$! ;
+    next if m!^\s*\#! || m!^\s*$!;
 
-    if (m!^(\S+)\s*((\S+)\s+(\S+))?$!) {
-	$sname = $1 ;
-	$servers->{$sname} = {} ;
-	$passwd{$sname} = [ $3, $4 ] if ($3 ne "");
+    if (m!^(\S+)(\s+(\S+)\s+(\S+))?\s*$!) {
+        $sname = $1;
+        $servers->{$sname} = {};
+        $passwd{$sname} = [ $3, $4 ] if defined $3 and $3 ne "";
     } elsif (m!^\s+(\S+)\s+(\d+)\s+(\d+)!) {
-	my ($group,$date,$high) = ($1,$2,$3) ;
-	$servers->{$sname}->{$group} = [ $date, $high ];
+        my ($group,$date,$high) = ($1,$2,$3);
+        $servers->{$sname}->{$group} = [ $date, $high ];
     } elsif (m!^\s+(\S+)\s*$!) {
-	# assume this is a new group
-	my ($group,$date,$high) = ($1,0,0) ;
-	print LOG "Looking for new group $group on $sname\n" unless $quiet ;
-	$servers->{$sname}->{$group} = [ $date, $high ]; 
+        # Assume this is a new group.
+        my ($group,$date,$high) = ($1,0,0);
+        print LOG "Looking for new group $group on $sname\n" unless $quiet;
+        $servers->{$sname}->{$group} = [ $date, $high ]; 
     } else { 
-	die "Fatal error in $groupFile: $.: $_\n" ;
+        die "Fatal error in $groupFile: $.: $_\n";
     }
 }
-close FILE ;
+close FILE;
 
-my @servers = (@ARGV || sort keys %$servers) ;
+my @servers = (@ARGV || sort keys %$servers);
 
-die "No servers!\n" if ! @servers ;
+die "No servers!\n" if ! @servers;
 
 my $localcxn;
 
-if ( ! $rnews ) {
+if ( not $rnews ) {
     print LOG "Connecting to downstream host: $localServer " .
-	"port: $localPort ..."
-	unless $quiet;
+        "port: $localPort ..."
+        unless $quiet;
 
-    my %localopts = ("Port" => "$localPort");
+    my %localopts = ("Port" => "$localPort", "Reader" => $reader, %NNTP_Args);
     $localcxn = Net::NNTP->new($localServer, %localopts) ||
-	die "Cant connect to server $localServer\n" ;
+        die "Can't connect to server $localServer\n";
 }
 
-if ( !$quiet ) {
+if ( not $quiet and not $quietness ) {
     print LOG "done.\n\n";
     print LOG "Legend: ``.'' is an article the downstream server refused\n";
     print LOG "        ``*'' is an article the downstream server rejected\n";
     print LOG "        ``+'' is an article the downstream server accepted\n";
     print LOG "        ``x'' is an article the upstream server couldn't ";
-    print LOG "give out.\n";
+    print LOG "give out\n";
+    print LOG "        ``m'' is an article skipped due to headers (-m)\n";
     print LOG "\n";
+    print LOG "Writing to rnews-format output: $rnews\n\n" if $rnews;
 }
 
 foreach my $server (@servers) {
     my ($username, $passwd);
 
+    foreach my $addGroup (@groupsToAdd) {
+        next if defined $servers->{$server}->{$addGroup};
+        $servers->{$server}->{$addGroup} = [ 0, 0 ];
+    }
+
     if (@groupsToGet > 0) {
-	my $ok;
-	foreach my $sgroup (keys %{$servers->{$server}}) {
-	    $ok = 1 if grep($_ eq $sgroup, @groupsToGet);
-	}
-
-	if (! $ok) {
-	    # user gave -g and the server doesn't have those groups 
-	    warn "Skipping server $server. Doesn't have specified groups\n";
-	    next;
-	}
+        my $ok;
+        foreach my $sgroup (keys %{$servers->{$server}}) {
+            $ok = 1 if grep($_ eq $sgroup, @groupsToGet);
+        }
+
+        if (! $ok) {
+            # User gave -g and the server doesn't have those groups.
+            warn "Skipping server $server.  Doesn't have specified groups.\n";
+            next;
+        }
     }
 
     if (exists $passwd{$server}) {
-	($username, $passwd) = @{$passwd{$server}} ;
+        ($username, $passwd) = @{$passwd{$server}};
     }
 
     if (!exists($servers->{$server})) {
-	warn "No such upstream host $server configured.\n" ;
-	next ;
+        warn "No such upstream host $server configured.\n";
+        next;
     }
 
-    my $shash = $servers->{$server} ;
+    my $shash = $servers->{$server};
 
-    print LOG "connecting to upstream server $server..." unless $quiet ;
-    my $upstream = Net::NNTP->new($server) ;
+    my $connectionAttempts = 0;
+    my $upstream;
+    {{
+        print LOG "connecting to upstream server $server..." unless $quiet;
+        $upstream = Net::NNTP->new($server, %NNTP_Args);
+        $connectionAttempts++;
+        if (!$upstream && $connectionAttempts <= $retries) {
+            sleep $retryTime;
+            next;
+        }
+    }}
 
     if (!$upstream) {
-	print LOG "failed." unless $quiet;
-	warn "cant connect to upstream server $server: $!\n" ;
-	next ;
+        print LOG "failed.\n" unless $quiet;
+        warn "can't connect to upstream server $server: $!\n";
+        next;
     } else {
-	print LOG "done.\n" unless $quiet ;
-    }
-
-    if (!$upstream->reader()) {
-	warn sprintf ("Cant issue MODE READER command: %s %s\n",
-		      $upstream->code(), $upstream->message());
-	warn "We\'ll try anyway\n" ;
+        print LOG "done.\n" unless $quiet;
     }
 
     if ($username && !$upstream->authinfo($username, $passwd)) {
-	warn sprintf ("failed to authorize: %s %s\n",
-		      $upstream->code(), $upstream->message());
-	next;
+        warn sprintf ("failed to authorize: %s %s\n",
+                      $upstream->code(), $upstream->message());
+        next;
     }
 
+    $info{server}->{$server}->{bytes} = 0;
+    $info{server}->{$server}->{fed} = 0;
+    $info{server}->{$server}->{refused} = 0;
+    $info{server}->{$server}->{rejected} = 0;
+
     foreach my $group (sort keys %{$servers->{$server}}) {
-	next if (@groupsToGet && !grep ($_ eq $group, @groupsToGet));
+        next if (@groupsToGet && !grep ($_ eq $group, @groupsToGet));
 
-	last if !crossFeedGroup ($upstream,$localcxn,$server,$group,$shash) ;
+        last if !crossFeedGroup ($upstream,$localcxn,$server,$group,$shash);
+        last if defined $opt_S and time >= $^T+$opt_S;
+        sleep $opt_Z if defined $opt_Z;
     }
 
-    $upstream->quit() ;
+    $upstream->quit();
+    last if defined $opt_S and time >= $^T+$opt_S;
 }
 
-saveConfig () ;
-stats() unless $quiet ;
+saveConfig ();
+stats() unless $quiet;
+
+if ($rnews) {
+    if (not $no_op and not close RNEWS) {
+        print LOG "\nRNEWS close failure: $!";
+    }
+    unlink $rnews if -f $rnews and not -s $rnews;
+}
 
 print LOG "\nDone ", scalar(localtime(time)), "\n" unless $quiet;
 
-exit (0) ;
+cleanLock();
+exit (0);
 
-#########################
+###############################################################################
 
 sub stats {
-    my $ltotal ;
-    my $reftotal ;
-    my $rejtotal ;
+    my $ltotal = 0;
+    my $reftotal = 0;
+    my $rejtotal = 0;
     my $sum;
 
     map { $reftotal += $refused{$_} } keys %refused;
     map { $rejtotal += $rejected{$_} } keys %rejected;
-    map { $ltotal += $fed{$_} } keys %fed ;
-    
+    map { $ltotal += $fed{$_} } keys %fed;
+
     $sum = $reftotal + $rejtotal + $ltotal;
 
-    printf LOG "\n%d article%s were offered to server on $localServer\n",
-        $sum, ($sum != 1 ? "s" : "") ;
+    if ($quiet) {
+        printf LOG localtime() . " [$$] %d article%s to $localServer\n",
+            $sum, ($sum != 1 ? "s" : "");
+    } else {
+        printf LOG "\n%d article%s offered to server on $localServer\n",
+            $sum, ($sum != 1 ? "s were" : " was");
+    }
 
     return if ($sum == 0);
 
-    printf LOG "%d article%s accepted\n",
-        $ltotal, ($ltotal != 1 ? "s were" : " was") 
-	    if ($ltotal != 0);
-    printf LOG "%d article%s refused\n",
-        $reftotal, ($reftotal != 1 ? "s were" : " was") 
-	    if ($reftotal != 0);
-    printf LOG "%d article%s rejected\n",
-        $rejtotal, ($rejtotal != 1 ? "s were" : " was") 
-	    if ($rejtotal != 0);
+    if ($quiet) {
+        print LOG localtime() . " [$$] $ltotal ok, $reftotal ref, $rejtotal rej\n";
+    } else {
+        printf LOG "%d article%s accepted\n",
+            $ltotal, ($ltotal != 1 ? "s were" : " was") 
+                if ($ltotal != 0);
+        printf LOG "%d article%s refused\n",
+            $reftotal, ($reftotal != 1 ? "s were" : " was") 
+                if ($reftotal != 0);
+        printf LOG "%d article%s rejected\n",
+            $rejtotal, ($rejtotal != 1 ? "s were" : " was") 
+                if ($rejtotal != 0);
+    }
 
     map { 
-	print LOG "\nUpstream server $_:\n" ; 
-	my $server = $_;
-	my $width = 0;
-
-	map {
-	    $width = length if length > $width;
-	} sort keys %{$pulled->{$server}};
-
-	map { 
-	    printf LOG "\t%${width}s %d\n", $_, $pulled->{$server}->{$_};
-	} sort keys %{$pulled->{$server}};
-    } sort keys %{$pulled} ;
+        print LOG "\nUpstream server $_:\n" if not $quiet; 
+        my $server = $_;
+        my $width = 0;
+
+        map {
+            $width = length if length > $width;
+        } sort keys %{$pulled->{$server}} if not $quiet;
+
+        map { 
+            if ($quiet) {
+                printf LOG "%s [$$] from $server $_ %s\n", localtime(), $pulled->{$server}->{$_};
+            } else {
+                printf LOG "\t%${width}s %d\n", $_, $pulled->{$server}->{$_};
+            }
+        } sort keys %{$pulled->{$server}};
+    } sort keys %{$pulled};
 }
 
 sub saveConfig {
+    return if $no_op;
+
     $SIG{INT} = $SIG{QUIT} = 'IGNORE';
 
-    open(FILE,">$groupFile") || die "can't open $groupFile: $!\n" ;
-    my $server ;
-    my $group ;
-
-    print LOG "\nSaving config\n" unless $quiet ;
-    print FILE "# Format: (date is epoch seconds)\n" ;
-    print FILE "# hostname [username passwd]\n" ;
-    print FILE "# 	group date high\n" ;
+    open(FILE,">$groupFile") || die "can't open $groupFile: $!\n";
+    my $server;
+    my $group;
+
+    print LOG "\nSaving config\n" unless $quiet;
+    print FILE "# Format: (date is epoch seconds)\n";
+    print FILE "# hostname [username password]\n";
+    print FILE "#         group date high\n";
     foreach $server (sort keys %$servers) {
-	print FILE "$server" ;
-	if (defined $passwd{$server}) {
-	    printf FILE " %s %s", $passwd{$server}->[0], $passwd{$server}->[1];
-	}
-	print FILE "\n";
-	foreach $group (sort keys %{$servers->{$server}}) {
-	    my ($date,$high) = @{$servers->{$server}->{$group}} ;
-	    printf FILE "\t%s %d %d\n",$group,$date,$high ;
-	}
+        print FILE "$server";
+        if (defined $passwd{$server}) {
+            printf FILE " %s %s", $passwd{$server}->[0], $passwd{$server}->[1];
+        }
+        print FILE "\n";
+        foreach $group (sort keys %{$servers->{$server}}) {
+            my ($date,$high) = @{$servers->{$server}->{$group}};
+            printf FILE "\t%s %d %d\n",$group,$date,$high;
+        }
     }
-    close FILE ;
+    close FILE;
 }
 
 
 sub outtaHere {
-    saveConfig() ;
-    exit (0) ;
+    saveConfig();
+    cleanLock();
+    exit (0);
+}
+
+sub cleanLock {
+    flock (LOCK, LOCK_UN);
+    unlink $lockfile if defined $lockfile;
 }
 
 sub bail {
-    warn "received QUIT signal. Not saving config.\n";
+    warn "received QUIT signal.  Not saving config.\n";
+    cleanLock();
     exit (0);
 }
 
 sub crossFeedGroup {
-    my ($fromServer,$toServer,$server,$group,$shash) = @_ ;
-    my ($date,$high) = @{$shash->{$group}} ;
-    my ($prevDate,$prevHigh) = @{$shash->{$group}} ;
+    my ($fromServer,$toServer,$server,$group,$shash) = @_;
+    my ($date,$high) = @{$shash->{$group}};
+    my ($prevDate,$prevHigh) = @{$shash->{$group}};
     my ($narticles,$first,$last,$name) = $fromServer->group($group);
-    my $count ;
-    my $code ;
+    my $count = 0;
+    my $code;
     my $startTime = time;
+    my ($prevRefused, $prevRejected) = ($info{refused}, $info{rejected});
 
-    if (!defined($narticles)) { # group command failed.
-	warn sprintf ("Group command failed: %s %s\n",
-		      $fromServer->code(), $fromServer->message());
-	return undef;
-    }
-
-    printf LOG "\n%s:\n", $name;
-    printf LOG "\tlast checked: %s\n", scalar(localtime($prevDate));
-    printf LOG "\t%d articles available. First %d Last %d\n",
-           $narticles, $first, $last ;
-    printf LOG "\tOur current highest: %d", $prevHigh, ;
-    
-    return 0 if ! $name ;
-    if ($narticles  == 0) {
-	print LOG " (nothing to get)\n";
-	return 1 ;
-    }
-
-    if ($prevHigh == -1 || $last <= $prevHigh) {
-	# we connected OK but there's nothing there, or we just want 
-	# to reset our highwater mark.
-	$shash->{$group} = [ time, $high ];
-	print LOG " (nothing to get)\n";
-	return 1 ;
-    } else {
-	my $toget = (($last - $prevHigh) < $narticles ?
-		     $last - $prevHigh : $narticles);
-
-	printf LOG " (%d to get)\n", $toget;
+    if (!defined($narticles)) { # Group command failed.
+        warn sprintf ("Group command failed: %s %s\n",
+                      $fromServer->code(), $fromServer->message());
+        return undef;
+    }
+
+    if (not $quiet) {
+        printf LOG "\n%s:\n", $name;
+        printf LOG "\tlast checked: %s\n", scalar(localtime($prevDate));
+        printf LOG "\t%d articles available.  First %d Last %d\n",
+               $narticles, $first, $last;
+    }
+    if (defined $watermark) {
+        printf LOG "\tOur previous highest: %d\n", $prevHigh if not $quiet;
+        $high = $watermark;
+        $high = $last+$watermark if substr($watermark, 0, 1) eq '-';
+        $high = 0 if $high < 0;
+        $shash->{$group} = [ time, $high ];
+    }
+    printf LOG "\tOur current highest: %d", $high if not $quiet;
+
+    return 0 if ! $name;
+    if ($narticles == 0) {
+        print LOG " (nothing to get)\n" unless $quiet;
+        return 1;
+    }
+
+    my $toget = (($last - $high) < $narticles ?
+                     $last - $high : $narticles);
+    $toget = ceil($toget * $opt_f) if defined $opt_f;
+    if ($last < $high and $opt_b) {
+        $high = $first+floor(($last-$first+1)*(1-$opt_b));
+        $toget = $last - $high;
+        print LOG " (reset highwater mark to $high)" unless $quiet;
+    } elsif ($prevHigh == -1 || $last <= $prevHigh) {
+        # We connected OK but there's nothing there, or we just want
+        # to reset our highwater mark.
+        $shash->{$group} = [ time, $high ];
+        print LOG " (nothing to get)\n" unless $quiet;
+        return 1;
     }
-    
+    print LOG " ($toget to get)\n" unless $quiet;
+
     my $i;
+    my @warns;
     for ($i = ($first > $high ? $first : $high + 1) ; $i <= $last ; $i++) {
-	$count++ ;
-	my $article = $fromServer->article($i) ;
-	if ($article) {
-	    my $msgid ;
-	    my $xref = 0;
-	    my $headers = 1;
-	    my $idx;
-
-	    for ($idx = 0 ; $idx < @{$article} ; $idx++) {
-		if ($article->[$idx] =~ m!^message-id:\s*(\S+)!i) {
-		    $msgid = $1 ;
-		}
-
-		if ($opt_x && $article->[$idx] =~ m!^xref:!i) {
-		    $xref = 1;
-		}
-
-		# catch some of the more common problems with articles.
-		if ($article->[$idx] =~ m!^\s+\n$!) {
-		    $article->[$idx] = "\n";
-		    warn "Fixing bad header line: $article->[$idx]\n";
-		}
-
-		last if ($article->[$idx] eq "\n");
-	    }
-
-	    if (!$msgid) {
-		warn "No message-id found in article\n" ;
-		next ;
-	    }
-	    
-	    # some old servers lack Xref: which bothers a downstream INN if
-	    # it has xrefslave set, so add one just before the blank line.
-	    if ($opt_x && !$xref) {
-		warn "No xref found in article, adding\n";
-		splice(@{$article}, $idx, 0, "Xref: $server $group: $i\n");
-	    }
-
-	    $pulled->{$server}->{$group}++;
-	    
-	    if ($rnews) {
-		my $len = 0;
-		map { $len += length($_) } @{$article};
-		printf RNEWS "#! rnews %d\n", $len;
-		map { print RNEWS $_ } @{$article};
-		print LOG "+" unless $quiet;
-	    } else {
-		if (!$toServer->ihave($msgid,$article)) {
-			my $code = $toServer->code() ;
-			if ($code == 435) {
-			    print LOG "." unless $quiet;
-			    $refused{$group}++;
-			} elsif ($code == 437) {
-			    print LOG "*" unless $quiet;
-			    $rejected{$group}++;
-			} else {
-			    warn "Transfer to local server failed: ",
-			        $toServer->message,"\n" ;
-			        $toServer->quit() ;
-	
-		    		saveConfig() ;
-		    		exit (1);
-			}
-	    	} else {
-			print LOG "+" unless $quiet;
-			$fed{$group}++ ;
-	    	}
-	    }
-	    
-	    $shash->{$group} = [ time, $i ];
-	} else {
-	    print LOG "x" unless $quiet;
-##	    printf LOG ("\nDEBUGGING %d %d\n", $fromServer->code(),
-##			$fromServer->message());
-	}
-	print LOG "\n" if (!$quiet && (($count % 50) == 0)) ;
+        last if defined $maxArts and $count >= $maxArts;
+        last if defined $opt_f and $count >= $toget;
+        $count++;
+        sleep $opt_z if defined $opt_z and $count > 1;
+        my $article = $fromServer->article($i);
+        if ($article) {
+            my $msgid;
+            my $xref = 0;
+            my $headers = 1;
+            my $idx;
+            my $len = 0;                 # Received article length (bytes) (for stats).
+            my $tx_len = 0;              # Transmitted article length (bytes) (for rnews).
+            my @header_nums_to_go = ();
+            my $match_all_hdrs = 1;      # Assume no headers to match.
+            my $skip_due_to_hdrs = 0;
+            my %m_found_hdrs = ();
+            my $curr_hdr = '';
+
+            for ($idx = 0 ; $idx < @{$article} ; $idx++) {
+                $len += length($article->[$idx]);
+                $tx_len += length($article->[$idx]);
+                next if not $headers;
+
+                $curr_hdr = lc($1) if $article->[$idx] =~ /^([^:[:blank:]]+):/;
+                $curr_hdr = '    ' if $article->[$idx] eq "\n";
+
+                if ($match_all_hdrs and @hdr_to_match and $article->[$idx] =~ /^[^[:blank:]]/) {
+                    # Check header matches -m flag if new header.
+
+                    # Unfold this header (with following lines).
+                    my $unfolded_art_hdr = $article->[$idx];
+                    for (my $idx_step = $idx+1;  $article->[$idx_step] =~ /^[[:space:]](.+)/; $idx_step++) {
+                        # While next line is continuation...
+                        my $more_line = $1;
+                        chomp $unfolded_art_hdr;
+                        $unfolded_art_hdr .= $more_line;
+                    }
+
+                    my ($hdr_un, $val_un) = split(':', $unfolded_art_hdr, 2);
+                    $val_un = '' if not defined $val_un;
+                    $val_un =~ s/^\s*//;
+                    for my $tuple_match (@hdr_to_match) {
+                        my ($hdr_m, $val_m) = split(':', $tuple_match, 2);
+                        my $negate_h = ($hdr_m =~ s/^!//);
+                        next if lc($hdr_un) ne lc($hdr_m);
+                        $m_found_hdrs{lc($hdr_m)} = 1;
+                        if ($negate_h) {
+                            if ($val_un =~ /$val_m/i) {
+                                print LOG "\tDEBUGGING $i\t-- $hdr_un [$1]\n" if $debug >= 2;
+                                $match_all_hdrs = 0;
+                            }
+                        } elsif (not $val_un =~ /$val_m/i) {
+                            print LOG "\tDEBUGGING $i\t++ $hdr_un [$1]\n" if $debug >= 2;
+                            $match_all_hdrs = 0;
+                        }
+                        last if not $match_all_hdrs;
+                    }
+                }
+
+                if (grep { $curr_hdr eq $_ } split(':', $skip_headers)) {
+                    print LOG "\tDEBUGGING $i\tskip_hdr $idx\t$curr_hdr\n" if $debug >= 2;
+                    push @header_nums_to_go, $idx;
+                }
+                if ($article->[$idx] =~ m!^message-id:\s*(\S+)!i) {
+                    $msgid = $1;
+                }
+                if (not $skip_due_to_hdrs and defined $pathSteps and $article->[$idx] =~ m!^Path:\s*!i) {
+                    my $path_count = $article->[$idx];
+                    $path_count = ($path_count =~ s@!@@g) || 0;
+                    if (substr($pathSteps, 0, 1) eq '-') {
+                        $skip_due_to_hdrs = 1 if $path_count >= $path_limit;
+                    } elsif (substr($pathSteps, 0, 1) eq '+') {
+                        $skip_due_to_hdrs = 1 if $path_count <= $path_limit;
+                    }
+                    if ($skip_due_to_hdrs) {
+                        print LOG "\tDEBUGGING $i\tNpath_skip_art $i\n" if $debug >= 2;
+                    } elsif (defined $opt_F) {
+                        $tx_len += length($opt_F)+1;
+                        $article->[$idx] =~ s/^Path:\s*/$&$opt_F!/i;
+                    }
+                }
+
+                if ($opt_x && $article->[$idx] =~ m!^xref:!i) {
+                    $xref = 1;
+                }
+
+                # Catch some of the more common problems with articles.
+                if ($article->[$idx] =~ m!^\s+\n$! and $curr_hdr ne 'subject') {
+                    print STDERR "Fixing bad header line[$idx]-1: $article->[$idx-1]" if $idx > 0;
+                    print STDERR "Fixing bad header line[$idx]::: $article->[$idx]";
+                    print STDERR "Fixing bad header line[$idx]+1: $article->[$idx+1]";
+                    $tx_len -= length($article->[$idx])-1;
+                    $article->[$idx] = "\n";
+                }
+
+                $headers = 0 if $article->[$idx] eq "\n";
+            }
+            if (@hdr_to_match and (not $match_all_hdrs or @hdr_to_match != scalar(keys %m_found_hdrs))) {
+                print LOG "\tDEBUGGING $i\thdr_skip_art $i\n" if $debug >= 2;
+                $skip_due_to_hdrs = 1;
+            }
+            while (@header_nums_to_go) {
+                my $idx = pop @header_nums_to_go;  # Start from last.
+                my $cut = join("\n\t", splice(@{$article}, $idx, 1));
+                $tx_len -= length($cut);
+                print LOG "\tDEBUGGING $i\tcut1 $cut" if $debug >= 2;
+                while ($article->[$idx] =~ /^[[:space:]](.+)/) {
+                    # Folded lines.
+                    my $cut = join("\n\t", splice(@{$article}, $idx, 1));
+                    $tx_len -= length($cut);
+                    print LOG "\tDEBUGGING $i\tcut_ $cut" if $debug >= 2;
+                }
+            }
+
+            if (!$msgid) {
+                warn "No Message-ID: header found in article\n";
+                next;
+            } else {
+                print LOG "\tDEBUGGING $i\tMessage-ID: $msgid\n" if $debug >= 2;
+            }
+
+            # Some old servers lack Xref:, which bothers a downstream INN if
+            # it has xrefslave set, so add one just before the blank line.
+            if ($opt_x && !$xref) {
+                warn "No Xref: header found in article, adding\n";
+                my $xref_h = "Xref: $server $group: $i\n";
+                splice(@{$article}, $idx, 0, $xref_h);
+                $tx_len += length($xref_h);
+            }
+
+            $pulled->{$server}->{$group}++;
+            $info{server}->{$server}->{bytes} += $len;
+            $info{bytes} += $len;
+
+            if ($skip_due_to_hdrs) {
+                print LOG "m" unless $quiet;
+            } elsif ($rnews) {
+                printf RNEWS "#! rnews %d\n", $tx_len;
+                map { print RNEWS $_ } @{$article};
+                print LOG "+" unless $quiet;
+            } else {
+                if ($no_op) {
+                    print "Would offer $msgid\n";
+
+                } elsif ($reader and not $toServer->post($article)) {
+                    #   240 article posted ok
+                    #   340 send article to be posted.  End with <CR-LF>.<CR-LF>
+                    #   440 posting not allowed
+                    #   441 posting failed
+                    my $code = $toServer->code();
+                    my $msg = $toServer->message();
+                    print LOG "\tDEBUGGING $i\tPost $code: Msg: <" . join('//', split(/\r?\n/, $msg)) . ">\n" if $debug >= 2;
+                    $msg =~ s/^340 .*?\n(?=.)//o;
+                    if ($msg =~ /^240 /) {
+                        print LOG "+" unless $quiet;
+                        push @warns, "Post $i ok ($code): $msg";
+                        $fed{$group}++;
+                        $info{server}->{$server}->{fed}++;
+                        $info{fed}++;
+                    } elsif ($msg =~ /^435 / or $msg =~ /duplicate message-id/io) {
+                        print LOG "." unless $quiet;
+                        push @warns, "Post $i to server declined ($code): $msg"
+                                            if $msg !~ /^435 $msgid$/
+                                            and $msg !~ /duplicate message-id/io;
+                        $refused{$group}++;
+                        $info{server}->{$server}->{refused}++;
+                        $info{refused}++;
+                    } else {
+                        warn "Post $i to server failed ($code): $msg\n";
+                        $toServer->quit();
+                    }
+
+                } elsif (not $reader and not $toServer->ihave($msgid,$article)) {
+                    #   235 article transferred ok
+                    #   335 send article to be transferred.  End with <CR-LF>.<CR-LF>
+                    #   435 article not wanted -- do not send it
+                    #   436 transfer failed -- try again later
+                    #   437 article rejected -- do not try again
+                    my $code = $toServer->code();
+                    my $msg = $toServer->message();
+                    print LOG "\tDEBUGGING $i\tPost $code: Msg: <" . join('//', split(/\r?\n/, $msg)) . ">\n" if $debug >= 2;
+                    if ($code == 435) {
+                        print LOG "." unless $quiet;
+                        $refused{$group}++;
+                        $info{server}->{$server}->{refused}++;
+                        $info{refused}++;
+                    } elsif ($code == 437) {
+                        print LOG "*" unless $quiet;
+                        $rejected{$group}++;
+                        $info{server}->{$server}->{rejected}++;
+                        $info{rejected}++;
+                    } else {
+                        warn "Transfer to server failed ($code): $msg\n";
+                        $toServer->quit();
+                        saveConfig();
+                        exit (1);
+                    }
+
+                    } else {
+                    my $code = $toServer->code();
+                    my $msg = $toServer->message();
+                    print LOG "\tDEBUGGING $i\tPost $code: Msg: <" . join('//', split(/\r?\n/, $msg)) . ">\n" if $debug >= 2;
+                    print LOG "+" unless $quiet;
+                    $fed{$group}++;
+                    $info{server}->{$server}->{fed}++;
+                    $info{fed}++;
+                    }
+            }
+
+            $shash->{$group} = [ time, $high = $i ];
+        } else {
+            $shash->{$group} = [ time, $high = $i ] if $fromServer->code() == 430;    # no such article, do not retry
+            print LOG "x" unless $quiet;
+            printf LOG ("\nDEBUGGING $i %s %s\n", $fromServer->code(),
+                        $fromServer->message()) if $debug >= 2;
+        }
+        saveConfig() if $checkPoint and ($count % $checkPoint) == 0;
+        print LOG "\n" if (!$quiet && (($count % $progressWidth) == 0));
+        last if defined $opt_S and time >= $^T+$opt_S;
     }
     print LOG "\n" unless $quiet;
-    printf LOG "%s article%s retrieved in %d seconds\n",
-                  $count, ($count == 1 ? "" : "s"), (time - $startTime + 1);
-
+    print LOG join("\n\t", '', @warns) . "\n\n" if @warns;
+    my $elapsed_time = time - $startTime + 1;
+    if ($quiet) {
+        my $rejectedDiff = $info{rejected}-$prevRejected;
+        my $refusedDiff = $info{refused}-$prevRefused;
+        my $destServer = ($localServer ne $defaultHost ? " to $localServer" : '');
+        print LOG localtime() . "[$$] $server$destServer $name $narticles $first-$last : $count $prevHigh-" .
+                                ($high == $last ? '' : $high) . " $refusedDiff $rejectedDiff\n"
+                        unless $prevHigh == $high and $count == 0;
+    } else {
+        printf LOG "%s article%s retrieved in %d seconds (%d bytes, %d cps)\n",
+                $count, ($count == 1 ? "" : "s"), $elapsed_time,
+                $info{server}->{$server}->{bytes},
+                int($info{server}->{$server}->{bytes}*100/$elapsed_time)/100;
+    }
     return 1;
 }
-
-package Net::NNTP ;
-
-## Slightly modified implementation of the Net::NNTP::new function.  The
-## original definition automatically sent a MODE READER command over which
-## breaks when trying to feed INN via IHAVE.
-
-sub new
-{
- my $self = shift;
- my $type = ref($self) || $self;
- my $host = shift if @_ % 2;
- my %arg  = @_;
- my $obj;
-
- $host ||= $ENV{NNTPSERVER} || $ENV{NEWSHOST};
-
- my $hosts = defined $host ? [ $host ] : $NetConfig{nntp_hosts};
-
- @{$hosts} = qw(news)
-        unless @{$hosts};
-
- my $h;
- foreach $h (@{$hosts})
-  {
-   $obj = $type->SUPER::new(PeerAddr => ($host = $h), 
-                            PeerPort => $arg{Port} || 'nntp(119)',
-                            Proto    => 'tcp',
-                            Timeout  => defined $arg{Timeout}
-                                                ? $arg{Timeout}
-                                                : 120
-                           ) and last;
-  }
-
- return undef
-        unless defined $obj;
-
- ${*$obj}{'net_nntp_host'} = $host;
-
- $obj->autoflush(1);
- $obj->debug(exists $arg{Debug} ? $arg{Debug} : undef);
-
- unless ($obj->response() == CMD_OK)
-  {
-   $obj->close;
-   return undef;
-  }
-
-##++ brister removed the bit below.
-## my $c = $obj->code;
-## my @m = $obj->message;
-##
-## # if server is INN and we have transfer rights the we are currently
-## # talking to innd not nnrpd
-## if($obj->reader)
-##  {
-##   # If reader suceeds the we need to consider this code to determine postok
-##   $c = $obj->code;
-##  }
-## else
-##  {
-##   # I want to ignore this failure, so restore the previous status.
-##   $obj->set_status($c,\@m);
-##  }
-## ${*$obj}{'net_nntp_post'} = $c >= 200 && $c <= 209 ? 1 : 0;
-##--
-
- $obj;
-}
-
diff -Nrup inn-2.4.4/innd/Makefile inn-2.4.5/innd/Makefile
--- inn-2.4.4/innd/Makefile	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/innd/Makefile	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-##  $Id: Makefile 7746 2008-04-06 10:38:54Z iulius $
+##  $Id: Makefile 7837 2008-05-19 17:14:15Z iulius $
 
 include ../Makefile.global
 
@@ -198,11 +198,11 @@ python.o: python.c ../include/config.h .
 rc.o: rc.c ../include/config.h ../include/inn/defines.h \
   ../include/inn/system.h ../include/clibrary.h ../include/config.h \
   ../include/portable/socket.h ../include/config.h \
-  ../include/inn/innconf.h ../include/inn/defines.h innd.h \
-  ../include/portable/time.h ../include/inn/buffer.h \
-  ../include/inn/history.h ../include/inn/messages.h \
-  ../include/inn/timer.h ../include/libinn.h ../include/nntp.h \
-  ../include/paths.h ../include/storage.h
+  ../include/inn/innconf.h ../include/inn/defines.h \
+  ../include/inn/vector.h innd.h ../include/portable/time.h \
+  ../include/inn/buffer.h ../include/inn/history.h \
+  ../include/inn/messages.h ../include/inn/timer.h ../include/libinn.h \
+  ../include/nntp.h ../include/paths.h ../include/storage.h
 site.o: site.c ../include/config.h ../include/inn/defines.h \
   ../include/inn/system.h ../include/clibrary.h ../include/config.h \
   ../include/inn/innconf.h ../include/inn/defines.h innd.h \
diff -Nrup inn-2.4.4/innd/innd.c inn-2.4.5/innd/innd.c
--- inn-2.4.4/innd/innd.c	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/innd/innd.c	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-/*  $Id: innd.c 7748 2008-04-06 13:49:56Z iulius $
+/*  $Id: innd.c 7858 2008-06-05 18:51:20Z iulius $
 **
 **  Variable definitions, miscellany, and main().
 */
@@ -138,10 +138,64 @@ const ARTHEADER ARTheaders[] = {
 /* #define HDR__CANCELKEY			36 */
   ARTHEADERINIT("User-Agent",		HTstd),
 /* #define HDR__USER_AGENT			37 */
-  ARTHEADERINIT("X-Original-Message-ID",	HTstd)
+  ARTHEADERINIT("X-Original-Message-ID",	HTstd),
 /* #define HDR__X_ORIGINAL_MESSAGE_ID		38 */
+  ARTHEADERINIT("Cancel-Lock",		HTstd),
+/* #define HDR__CANCEL_LOCK			39 */
+  ARTHEADERINIT("Content-Transfer-Encoding",	HTstd),
+/* #define HDR__CONTENT_TRANSFER_ENCODING	40 */
+  ARTHEADERINIT("Face",			HTstd),
+/* #define HDR__FACE				41 */
+  ARTHEADERINIT("Injection-Info",	HTstd),
+/* #define HDR__INJECTION_INFO			42 */
+  ARTHEADERINIT("List-ID",		HTstd),
+/* #define HDR__LIST_ID				43 */
+  ARTHEADERINIT("MIME-Version",		HTstd),
+/* #define HDR__MIME_VERSION			44 */
+  ARTHEADERINIT("Originator",		HTstd),
+/* #define HDR__ORIGINATOR			45 */
+  ARTHEADERINIT("X-Auth",		HTstd),
+/* #define HDR__X_AUTH				46 */
+  ARTHEADERINIT("X-Complaints-To",	HTstd),
+/* #define HDR__X_COMPLAINTS_TO			47 */
+  ARTHEADERINIT("X-Face",		HTstd),
+/* #define HDR__X_FACE				48 */
+  ARTHEADERINIT("X-HTTP-UserAgent",	HTstd),
+/* #define HDR__X_HTTP_USERAGENT		49 */
+  ARTHEADERINIT("X-HTTP-Via",		HTstd),
+/* #define HDR__X_HTTP_VIA			50 */
+  ARTHEADERINIT("X-Modbot",		HTstd),
+/* #define HDR__X_MODBOT			51 */
+  ARTHEADERINIT("X-Modtrace",		HTstd),
+/* #define HDR__X_MODTRACE			52 */
+  ARTHEADERINIT("X-No-Archive",		HTstd),
+/* #define HDR__X_NO_ARCHIVE			53 */
+  ARTHEADERINIT("X-Original-Trace",	HTstd),
+/* #define HDR__X_ORIGINAL_TRACE		54 */
+  ARTHEADERINIT("X-Originating-IP",	HTstd),
+/* #define HDR__X_ORIGINATING_IP		55 */
+  ARTHEADERINIT("X-PGP-Key",		HTstd),
+/* #define HDR__X_PGP_KEY			56 */
+  ARTHEADERINIT("X-PGP-Sig",		HTstd),
+/* #define HDR__X_PGP_SIG			57 */
+  ARTHEADERINIT("X-Poster-Trace",	HTstd),
+/* #define HDR__X_POSTER_TRACE			58 */
+  ARTHEADERINIT("X-Postfilter",		HTstd),
+/* #define HDR__X_POSTFILTER			59 */
+  ARTHEADERINIT("X-Proxy-User",		HTstd),
+/* #define HDR__X_PROXY_USER			60 */
+  ARTHEADERINIT("X-Submissions-To",	HTstd),
+/* #define HDR__X_SUBMISSIONS_TO		61 */
+  ARTHEADERINIT("X-Usenet-Provider",	HTstd),
+/* #define HDR__X_USENET_PROVIDER		62 */
+  ARTHEADERINIT("In-Reply-To",		HTstd),
+/* #define HDR__IN_REPLY_TO			63 */
+  ARTHEADERINIT("Injection-Date",	HTstd),
+/* #define HDR__INJECTION_DATE			64 */
+  ARTHEADERINIT("NNTP-Posting-Date",	HTstd)
+/* #define HDR__NNTP_POSTING_DATE		65 */
 };
-/* #define MAX_ARTHEADER			39 */
+/* #define MAX_ARTHEADER			66 */
 
 
 /*
diff -Nrup inn-2.4.4/innd/innd.h inn-2.4.5/innd/innd.h
--- inn-2.4.4/innd/innd.h	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/innd/innd.h	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-/*  $Id: innd.h 7748 2008-04-06 13:49:56Z iulius $
+/*  $Id: innd.h 7858 2008-06-05 18:51:20Z iulius $
 **
 **  Many of the data types used here have abbreviations, such as CT
 **  for CHANNELTYPE.  Here are a list of the conventions and meanings:
@@ -177,9 +177,36 @@ typedef struct _HDRCONTENT {
 #define HDR__XCANCELEDBY	35
 #define HDR__CANCELKEY		36
 #define HDR__USER_AGENT		37
-#define HDR__X_ORIGINAL_MESSAGE_ID		38
+#define HDR__X_ORIGINAL_MESSAGE_ID	38
+#define HDR__CANCEL_LOCK	39
+#define HDR__CONTENT_TRANSFER_ENCODING	40
+#define HDR__FACE		41
+#define HDR__INJECTION_INFO	42
+#define HDR__LIST_ID		43
+#define HDR__MIME_VERSION	44
+#define HDR__ORIGINATOR		45
+#define HDR__X_AUTH		46
+#define HDR__X_COMPLAINTS_TO	47
+#define HDR__X_FACE		48
+#define HDR__X_HTTP_USERAGENT	49
+#define HDR__X_HTTP_VIA		50
+#define HDR__X_MODBOT		51
+#define HDR__X_MODTRACE		52
+#define HDR__X_NO_ARCHIVE	53
+#define HDR__X_ORIGINAL_TRACE	54
+#define HDR__X_ORIGINATING_IP	55
+#define HDR__X_PGP_KEY		56
+#define HDR__X_PGP_SIG		57
+#define HDR__X_POSTER_TRACE	58
+#define HDR__X_POSTFILTER	59
+#define HDR__X_PROXY_USER	60
+#define HDR__X_SUBMISSIONS_TO	61
+#define HDR__X_USENET_PROVIDER	62
+#define HDR__IN_REPLY_TO	63
+#define HDR__INJECTION_DATE	64
+#define HDR__NNTP_POSTING_DATE	65
 
-#define MAX_ARTHEADER		39
+#define MAX_ARTHEADER           66
 
 /*
 **  Miscellaneous data we want to keep on an article.  All the fields
diff -Nrup inn-2.4.4/innd/python.c inn-2.4.5/innd/python.c
--- inn-2.4.4/innd/python.c	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/innd/python.c	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-/*  $Id: python.c 6650 2004-01-25 22:22:14Z rra $
+/*  $Id: python.c 7891 2008-06-22 09:59:11Z iulius $
 **
 **  python.c: Embed Python in the style of innd's TCL and Perl stuff.
 ** 
@@ -9,6 +9,14 @@
 **
 **  The astute reader may notice the commission of blatant atrocities
 **  against Python's OO model here.  Don't tell Guido.
+**
+**  A quick note regarding Python exceptions:  functions like
+**      PyObject_GetAttrString(PyObject *o, const char *attr_name)
+**  raise an exception when they fail, even though they return NULL.
+**  And as exceptions accumulate from caller to caller and so on,
+**  it generates weird issues with Python scripts afterwards.  So such
+**  uses should be checked before.  For instance with:
+**      PyObject_HasAttrString(PyObject *o, const char *attr_name).
 */
 
 #include "config.h"
@@ -207,7 +215,7 @@ PYmode(Mode, NewMode, reason)
 
     result = PyObject_CallFunction(mode_method, "sss",
 				   oldmode, newmode, reason);
-    Py_DECREF(result);
+    Py_XDECREF(result);
 }
 
 
@@ -570,7 +578,17 @@ PYdefonemethod(methptr, methname)
     char	*methname;
 {
     Py_XDECREF(*methptr);
-    *methptr = PyObject_GetAttrString(PYFilterObject, methname);
+
+    /* We check with HasAttrString() the existence of the method because
+     * otherwise, in case it does not exist, an exception is raised by Python,
+     * although the result of the function is NULL. */
+    if (PyObject_HasAttrString(PYFilterObject, (char *) methname) == 1) {
+        /* Get a pointer to given method. */
+        *methptr = PyObject_GetAttrString(PYFilterObject, (char *) methname);
+    } else {
+        *methptr = NULL;
+    }
+                
     if (*methptr == NULL)
 	syslog(L_NOTICE, "python method %s not found", methname);
     else if (PyCallable_Check(*methptr) == 0) {
@@ -599,7 +617,7 @@ PYdefmethods(void)
 
 
 /*
-**  Used by `ctlinnd reload filter.python'
+**  Used by "ctlinnd reload filter.python 'reason'".
 */
 int
 PYreadfilter(void)
@@ -618,20 +636,39 @@ PYreadfilter(void)
 	Py_XDECREF(result);
     }
 
+    /* We need to reimport the module before reloading it because otherwise,
+     * it might not be taken into account by Python.
+     * See Python API documentation:
+     *     If a module is syntactically correct but its initialization fails,
+     *     the first import statement for it does not bind its name locally,
+     *     but does store a (partially initialized) module object in
+     *     sys.modules.  To reload the module, you must first import it again
+     *     (this will bind the name to the partially initialized module object)
+     *     before you can reload() it.
+     */
+    PYFilterModule = PyImport_ImportModule((char *) _PATH_PYTHON_STARTUP_M);
+    if (PYFilterModule == NULL) {
+        syslog(L_ERROR, "failed to reimport external python module");
+    }
+
     if ((newmodule = PyImport_ReloadModule(PYFilterModule)) == NULL) {
 	syslog(L_ERROR, "cant reload python filter module");
 	PYfilter(false);
 	return 0;
     }
-    Py_DECREF(PYFilterModule);
+
+    Py_XDECREF(PYFilterModule);
     PYFilterModule = newmodule;
+
     if (PYFilterObject == NULL) {
 	syslog(L_ERROR, "python reload error, filter object not defined");
 	PYfilter(false);
 	return 0;
     }
+
     PYfilter(true);
     PYdefmethods();
+
     return 1;
 }
 
diff -Nrup inn-2.4.4/innfeed/host.c inn-2.4.5/innfeed/host.c
--- inn-2.4.4/innfeed/host.c	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/innfeed/host.c	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-/*  $Id: host.c 7801 2008-04-26 11:32:18Z iulius $
+/*  $Id: host.c 7833 2008-05-18 20:04:35Z iulius $
 **
 **  The implementation of the innfeed Host class.
 **
@@ -1158,6 +1158,7 @@ struct sockaddr *hostIpAddr (Host host, 
 
       memset(&hints, 0, sizeof(hints));
       hints.ai_family = family ? family : AF_UNSPEC;
+      hints.ai_socktype = SOCK_STREAM;
 #ifdef AI_ADDRCONFIG
       hints.ai_flags = AI_ADDRCONFIG;
 #endif
@@ -1333,11 +1334,13 @@ void printHostInfo (Host host, FILE *fp,
   
   fprintf (fp,"%s    peer-name : %s\n",indent,host->params->peerName) ;
   fprintf (fp,"%s    ip-name : %s\n",indent,host->params->ipName) ;
+#ifdef HAVE_INET6
   if (host->params->family == AF_INET6)
     {
       fprintf (fp,"%s    bindaddress : none\n",indent);
     }
   else
+#endif
     {
       fprintf (fp,"%s    bindaddress : %s\n",indent,
       host->params->bindAddr == NULL ||
diff -Nrup inn-2.4.4/lib/perl.c inn-2.4.5/lib/perl.c
--- inn-2.4.4/lib/perl.c	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/lib/perl.c	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-/*  $Id: perl.c 7815 2008-05-05 08:43:58Z iulius $
+/*  $Id: perl.c 7929 2008-06-29 17:55:04Z iulius $
 **
 **  Embedded Perl support for INN.
 **
@@ -96,49 +96,45 @@ PerlFilter(bool value)
     }
 }
 
-static void PerlParse (void)
-{
-    const char *argv[] = { "innd",
-                           "-e", "sub _load_ { do $_[0] }",
-                           "-e", "sub _eval_ { eval $_[0] }",
-                           NULL } ;
-
-    /* We can't call 'eval' and 'do' directly for some reason, so we define
-       some wrapper functions to give us access. */
-        
-    perl_parse (PerlCode,xs_init,5,(char **)argv,NULL) ;
-}
-
 
 
 /*
-** Loads a setup Perl module. startupfile is the name of the file loaded
-** one-time at startup. filterfile is the file containing the filter
-** functions which is loaded at startup and at each reload. function is a
-** function name that must be defined after the file file is loaded for
+** Loads a setup Perl module.  startupfile is the name of the file loaded
+** one-time at startup.  filterfile is the file containing the filter
+** functions which is loaded at startup and at each reload.  function is a
+** function name that must be defined after the filterfile file is loaded for
 ** filtering to be turned on to start with.
 */
 void PERLsetup (char *startupfile, char *filterfile, const char *function)
 {
     if (PerlCode == NULL) {
+        /* Perl waits on standard input if not called with '-e'. */
+        int argc = 3;
+        const char *argv[] = { "innd", "-e", "0", NULL };
+        char *env[]  = { NULL };
+#ifdef PERL_SYS_INIT3
+        PERL_SYS_INIT3(&argc, &argv, &env);
+#endif
         PerlCode = perl_alloc();
         perl_construct(PerlCode);
-        PerlParse () ;
+        perl_parse(PerlCode, xs_init, argc, (char **)argv, env) ;
     }
     
     if (startupfile != NULL && filterfile != NULL) {
-        char *argv[2] ;
-        int rc ;
+        char *evalfile = NULL;
+        size_t length;
         dSP;
     
         ENTER ;
         SAVETMPS ;
-    
-        argv[0] = startupfile ;
-        argv[1] = NULL ;
+
+        /* The Perl expression which will be evaluated. */
+        length = strlen("do '%s'") + strlen(startupfile);
+        evalfile = xmalloc(length);
+        snprintf(evalfile, length, "do '%s'", startupfile);
 
         PerlSilence();
-        rc = perl_call_argv ("_load_",G_DISCARD, argv) ;
+        perl_eval_pv(evalfile, TRUE);
         PerlUnSilence();
         
         SPAGAIN ;
@@ -168,13 +164,13 @@ void PERLsetup (char *startupfile, char 
 int PERLreadfilter(char *filterfile, const char *function)
 {
     dSP ;
-    char *argv [3] ;
-    
+    char *argv[] = { NULL };
+    char *evalfile = NULL;
+    size_t length;
+
     ENTER ;
     SAVETMPS ;
     
-    argv[0] = NULL;
-
     if (perl_get_cv("filter_before_reload", false) != NULL)    {
         perl_call_argv("filter_before_reload", G_EVAL|G_DISCARD|G_NOARGS, argv);
         if (SvTRUE(ERRSV))     /* check $@ */ {
@@ -185,13 +181,18 @@ int PERLreadfilter(char *filterfile, con
         }
     }
 
-    argv[0] = filterfile ;
-    argv[1] = NULL ;
-    
+    /* The Perl expression which will be evaluated. */
+    length = strlen("do '%s'") + strlen(filterfile);
+    evalfile = xmalloc(length);
+    snprintf(evalfile, length, "do '%s'", filterfile);
+
     PerlSilence();
-    perl_call_argv ("_load_", 0, argv) ;
+    perl_eval_pv(evalfile, TRUE);
     PerlUnSilence();
 
+    free(evalfile);
+    evalfile = NULL;
+
     if (SvTRUE(ERRSV))     /* check $@ */ {
         syslog (L_ERROR,"SERVER perl loading %s failed: %s",
                 filterfile, SvPV(ERRSV, PL_na)) ;
@@ -199,20 +200,19 @@ int PERLreadfilter(char *filterfile, con
         
         /* If the reload failed we don't want the old definition hanging
            around. */
-        argv[0] = xmalloc (strlen (function) + strlen ("undef &%s")) ;
-        sprintf (argv[0],"undef &%s",function) ;
-        perl_call_argv ("_eval_",0,argv) ;
+        length = strlen("undef &%s") + strlen(function);
+        evalfile = xmalloc(length);
+        snprintf(evalfile, length, "undef &%s", function);
+        perl_eval_pv(evalfile, TRUE);
 
         if (SvTRUE(ERRSV))     /* check $@ */ {
             syslog (L_ERROR,"SERVER perl undef &%s failed: %s",
                     function, SvPV(ERRSV, PL_na)) ;
         }
-        free (argv[0]) ;
     } else if ((perl_filter_cv = perl_get_cv(function, false)) == NULL) {
         PerlFilter (false) ;
     }
     
-    argv[0] = NULL;
     if (perl_get_cv("filter_after_reload", false) != NULL) {
         perl_call_argv("filter_after_reload", G_EVAL|G_DISCARD|G_NOARGS, argv);
         if (SvTRUE(ERRSV))     /* check $@ */ {
@@ -237,6 +237,9 @@ void PerlClose(void)
 {
    perl_destruct(PerlCode);
    perl_free(PerlCode);
+#ifdef PERL_SYS_TERM
+   PERL_SYS_TERM();
+#endif
    PerlFilterActive = false;
 }
 
diff -Nrup inn-2.4.4/nnrpd/line.c inn-2.4.5/nnrpd/line.c
--- inn-2.4.4/nnrpd/line.c	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/nnrpd/line.c	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-/*  $Id: line.c 7756 2008-04-10 19:59:21Z iulius $
+/*  $Id: line.c 7837 2008-05-19 17:14:15Z iulius $
 **
 **  Line by line reading support from sockets/pipes
 **
@@ -23,6 +23,7 @@
 
 #ifdef HAVE_SSL
 #include <openssl/ssl.h>
+#include <signal.h>
 extern SSL *tls_conn;
 #endif
 
@@ -40,6 +41,19 @@ line_free(struct line *line)
     }
 }
 
+#ifdef HAVE_SSL
+/*
+**  Alarm signal handler for client timeout.
+*/
+static void
+alarmHandler(int s)
+{
+    SSL_shutdown(tls_conn);
+    tls_conn = NULL;
+    errno = ECONNRESET;
+}
+#endif
+  
 /*
 **  initialise a new line structure
 */
@@ -53,15 +67,21 @@ line_init(struct line *line)
 }
 
 static ssize_t
-line_doread(void *p, size_t len)
+line_doread(void *p, size_t len, int timeout)
 {
     ssize_t n;
 
 #ifdef HAVE_SSL
     if (tls_conn) {
 	int err;
+        xsignal(SIGALRM, alarmHandler);
 	do {
-	    n = SSL_read(tls_conn, p, len);
+            alarm(timeout);
+            n = SSL_read(tls_conn, p, len);
+            alarm(0);
+            if (tls_conn == NULL) {
+                break;
+        }
 	    err = SSL_get_error(tls_conn, n);
 	    switch (err) {
 	    case SSL_ERROR_SYSCALL:
@@ -74,6 +94,7 @@ line_doread(void *p, size_t len)
 		break;
 	    }
 	} while (err == SSL_ERROR_WANT_READ);
+        xsignal(SIGALRM, SIG_DFL);
     } else {
 #endif
 	do {
@@ -185,8 +206,9 @@ line_read(struct line *line, int timeout
 #ifdef HAVE_SSL
             }
 #endif
-	    count = line_doread(where,
-				line->allocated - (where - line->start));
+            count = line_doread(where,
+                                line->allocated - (where - line->start), 
+                                timeout);
 
 	    /* give timeout for read errors */
 	    if (count < 0) {
diff -Nrup inn-2.4.4/nnrpd/python.c inn-2.4.5/nnrpd/python.c
--- inn-2.4.4/nnrpd/python.c	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/nnrpd/python.c	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-/*  $Id: python.c 6250 2003-03-03 15:32:13Z alexk $
+/*  $Id: python.c 7893 2008-06-22 10:24:42Z iulius $
 **
 **  python.c: Embed Python in the style of nnrpd's TCL and Perl stuff
 **            (authentication and authorization hooks only at this point).
@@ -8,6 +8,14 @@
 **  This code bases on Python work for innd filtering done by
 **  G.J. Andruk <meowing@banet.net>. Also it borrows some ideas from
 **  TCL/Perl work done by Bob Heiney and Christophe Wolfhugel.
+**
+**  A quick note regarding Python exceptions:  functions like
+**      PyObject_GetAttrString(PyObject *o, const char *attr_name)
+**  raise an exception when they fail, even though they return NULL.
+**  And as exceptions accumulate from caller to caller and so on,
+**  it generates weird issues with Python scripts afterwards.  So such
+**  uses should be checked before.  For instance with:
+**      PyObject_HasAttrString(PyObject *o, const char *attr_name). 
 */
 
 #include "config.h"
@@ -225,7 +233,7 @@ int PY_authenticate(char* file, char *Us
 */
 void PY_access(char* file, struct vector *access_vec, char *Username) {
     PyObject	*result, *key, *value, *proc;
-    char	*skey, *svalue, *temp;
+    char	*buffer;
     int		authnum;
     int		i;
 
@@ -281,7 +289,7 @@ void PY_access(char* file, struct vector
 
     /* Check the response */
     if (result == NULL || result == Py_None || !PyDict_Check(result)) {
-        syslog(L_ERROR, "python access method returned wrong result - expected a dictionary");
+        syslog(L_ERROR, "python access method returned wrong result -- expected a dictionary");
 	Reply("%d Internal Error (7).  Goodbye\r\n", NNTP_ACCESS_VAL);
 	ExitWithStats(1, true);
      }
@@ -291,6 +299,8 @@ void PY_access(char* file, struct vector
 
     /* store dict values in proper format in access vector */
     i = 0;
+    buffer = xmalloc(BIG_BUFFER);
+
     while(PyDict_Next(result, &i, &key, &value)) {
         if (!PyString_Check(key)) {
             syslog(L_ERROR, "python access method return dictionary key %i not a string", i);
@@ -302,22 +312,17 @@ void PY_access(char* file, struct vector
             Reply("%d Internal Error (7).  Goodbye\r\n", NNTP_ACCESS_VAL);
             ExitWithStats(1, false);
         }
-        
-        temp = PyString_AsString(key);
-        skey = xstrdup(temp);
-        
-        temp = PyString_AsString(value);
-        svalue = xstrdup(temp);
-        
-        skey = strcat(skey, ": \"");
-        skey = strcat(skey, svalue);
-        skey = strcat(skey, "\"\n");
-        vector_add(access_vec, skey);
-        
-        free(skey);
-        free(svalue);
+
+        strlcpy(buffer, PyString_AsString(key), BIG_BUFFER);
+        strlcat(buffer, ": \"", BIG_BUFFER);
+        strlcat(buffer, PyString_AsString(value), BIG_BUFFER);
+        strlcat(buffer, "\"\n", BIG_BUFFER);
+
+        vector_add(access_vec, xstrdup(buffer));
     }
- 
+
+    free(buffer);
+
     /* Clean up the dictionary object */
     PyDict_Clear(PYauthinfo);
     /* Clean up dictionary items */
@@ -413,7 +418,7 @@ int PY_dynamic(char *Username, char *New
     /* Check the response */
     if (result == NULL || (result != Py_None && !PyString_Check(result)))
     {
-        syslog(L_ERROR, "python dyanmic method (%s access) returned wrong result: %s", PostFlag ? "post" : "read", result);
+        syslog(L_ERROR, "python dynamic method (%s access) returned wrong result: %s", PostFlag ? "post" : "read", result);
 	Reply("%d Internal Error (7).  Goodbye\r\n", NNTP_ACCESS_VAL);
 	ExitWithStats(1, false);
     }
@@ -448,7 +453,9 @@ int PY_dynamic(char *Username, char *New
 
 
 /*
-**  This runs when nnrpd shuts down.
+**  This runs when nnrpd shuts down.  If Python is closed and reopened
+**  in the same process, files and dynamic_file are reused so they
+**  must point to NULL.
 */
 void
 PY_close_python(void)
@@ -456,9 +463,12 @@ PY_close_python(void)
     if (files != NULL) {
 	hash_traverse(files, file_trav, NULL);
 	hash_free(files);
+        files = NULL;
     }
-    if (dynamic_file != NULL)
+    if (dynamic_file != NULL) {
 	free(dynamic_file);
+        dynamic_file = NULL;
+    }
 }
 
 /*
@@ -565,7 +575,7 @@ void PY_load_python() {
         Py_Initialize();
     
         /* It makes Python sad when its stdout and stderr are closed. */
-        if (feof(stdout) || feof(stderr))
+        if ((fileno(stdout) == -1) || (fileno(stderr) == -1))
             PyRun_SimpleString("import sys; sys.stdout=sys.stderr=open('/dev/null', 'a')");
    
         /* See if Python initialized OK */
@@ -601,24 +611,37 @@ void PY_load_python() {
 **  the corresponding PyObject, or NULL if not found.
 */
 void
-PYdefonemethod(PyFile *fp, int type, int method, char *methname) {
+PYdefonemethod(PyFile *fp, int type, int method, char *methname, int realtype) {
     PyObject **methptr;
 
     methptr = &fp->procs[type][method];
+    /* There is no need to check the existence of methods useless for our realtype. */
+    if (type == realtype) {
+        /*
+        ** We check with HasAttrString() the existence of the method because
+        ** otherwise, in case it does not exist, an exception is raised by Python,
+        ** although the result of the function is NULL.
+        */
+        if (PyObject_HasAttrString(PYAuthObject, (char *) methname) == 1) {
+            /* Get a pointer to given method. */
+            *methptr = PyObject_GetAttrString(PYAuthObject, (char *) methname);
+        } else {
+            *methptr = NULL;
+        }
 
-    /* Get a pointer to given method */
-    *methptr = PyObject_GetAttrString(PYAuthObject, methname);
-
-    /* See if such method is defined */
-    if (*methptr == NULL)
-        syslog(L_NOTICE, "python method %s not found", methname);
-    else {
-        /* See if it is callable */
-        if (PyCallable_Check(*methptr) == 0) {
-	    syslog(L_ERROR, "python object %s found but not a function", methname);
-	    Py_DECREF(*methptr);
-	    *methptr = NULL;
-	}
+        /* See if such method is defined */
+        if (*methptr == NULL)
+            syslog(L_NOTICE, "python method %s not found", methname);
+        else {
+            /* See if it is callable */
+            if (PyCallable_Check(*methptr) == 0) {
+                syslog(L_ERROR, "python object %s found but not a function", methname);
+                Py_DECREF(*methptr);
+                *methptr = NULL;
+            }
+        }
+    } else {
+        *methptr = NULL;
     }
 }
 
@@ -628,34 +651,34 @@ PYdefonemethod(PyFile *fp, int type, int
 **  pointers to them so that we could call them from nnrpd.
 */
 void
-PYdefmethods(PyFile *fp)
+PYdefmethods(PyFile *fp, int realtype)
 {
     /* Get a reference to authenticate() method */
-    PYdefonemethod(fp, PYTHONauthen, PYTHONmain, "authenticate");
+    PYdefonemethod(fp, PYTHONauthen, PYTHONmain, "authenticate", realtype);
 
     /* Get a reference to authen_init() method */
-    PYdefonemethod(fp, PYTHONauthen, PYTHONinit, "authen_init");
+    PYdefonemethod(fp, PYTHONauthen, PYTHONinit, "authen_init", realtype);
     
     /* Get a reference to authen_close() method */
-    PYdefonemethod(fp, PYTHONauthen, PYTHONclose, "authen_close");
+    PYdefonemethod(fp, PYTHONauthen, PYTHONclose, "authen_close", realtype);
 
     /* Get a reference to access() method */
-    PYdefonemethod(fp, PYTHONaccess, PYTHONmain, "access");
+    PYdefonemethod(fp, PYTHONaccess, PYTHONmain, "access", realtype);
     
     /* Get a reference to access_init() method */
-    PYdefonemethod(fp, PYTHONaccess, PYTHONinit, "access_init");
+    PYdefonemethod(fp, PYTHONaccess, PYTHONinit, "access_init", realtype);
     
     /* Get a reference to access_close() method */
-    PYdefonemethod(fp, PYTHONaccess, PYTHONclose, "access_close");
+    PYdefonemethod(fp, PYTHONaccess, PYTHONclose, "access_close", realtype);
     
     /* Get a reference to dynamic() method */
-    PYdefonemethod(fp, PYTHONdynamic, PYTHONmain, "dynamic");
+    PYdefonemethod(fp, PYTHONdynamic, PYTHONmain, "dynamic", realtype);
     
     /* Get a reference to dynamic_init() method */
-    PYdefonemethod(fp, PYTHONdynamic, PYTHONinit, "dynamic_init");
+    PYdefonemethod(fp, PYTHONdynamic, PYTHONinit, "dynamic_init", realtype);
     
     /* Get a reference to dynamic_close() method */
-    PYdefonemethod(fp, PYTHONdynamic, PYTHONclose, "dynamic_close");
+    PYdefonemethod(fp, PYTHONdynamic, PYTHONclose, "dynamic_close", realtype);
 }
 
 
@@ -689,7 +712,7 @@ PY_setup(int type, int method, char *fil
             ExitWithStats(1, false);
         } else {
             /* Set up pointers to known Python methods */
-            PYdefmethods(fp);
+            PYdefmethods(fp, type);
         }
         hash_insert(files, file, fp);
 
diff -Nrup inn-2.4.4/nnrpd/tls.c inn-2.4.5/nnrpd/tls.c
--- inn-2.4.4/nnrpd/tls.c	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/nnrpd/tls.c	2008-06-29 10:56:57.000000000 -0700
@@ -32,37 +32,6 @@
 #include <sys/stat.h>
 #include <sys/uio.h>
 
-/* taken from lib/parsedate.c */
-#ifndef WRITEV_USE_ALLOCA
-#ifdef alloca
-#define WRITEV_USE_ALLOCA
-#else /* alloca not defined */
-#ifdef __GNUC__
-#define WRITEV_USE_ALLOCA
-#define alloca __builtin_alloca
-#else /* not GNU C.  */
-#if (!defined (__STDC__) && defined (sparc)) || defined (__sparc__) || defined (__sparc) || defined (__sgi) || (defined (__sun) && defined (__i386))
-#define WRITEV_USE_ALLOCA
-#include <alloca.h>
-#else /* not sparc */
-#if (defined (_MSDOS) || defined (_MSDOS_)) && !defined (__TURBOC__)
-#else /* not MSDOS, or __TURBOC__ */
-#if defined(_AIX)
- #pragma alloca
-#define WRITEV_USE_ALLOCA
-#endif /* not _AIX */
-#endif /* not MSDOS, or __TURBOC__ */
-#endif /* not sparc */
-#endif /* not GNU C */
-#endif /* alloca not defined */
-#endif /* WRITEV_USE_ALLOCA not defined */
-#ifdef WRITEV_USE_ALLOCA
-#define WRITEV_ALLOC alloca
-#else
-#define WRITEV_ALLOC malloc
-#endif
-
-
 #endif
 
 /* outside the ifdef so `make depend` works even ifndef HAVE_SSL */
@@ -611,6 +580,7 @@ static long bio_dump_cb(BIO * bio, int c
 int tls_start_servertls(int readfd, int writefd)
 {
     int     sts;
+    int     keepalive;
     SSL_SESSION *session;
     SSL_CIPHER *cipher;
 
@@ -633,6 +603,14 @@ int tls_start_servertls(int readfd, int 
     }
     SSL_clear(tls_conn);
 
+#if	defined(SOL_SOCKET) && defined(SO_KEEPALIVE)
+    /* Set KEEPALIVE to catch broken socket connections. */
+    keepalive = 1;
+    if (setsockopt(readfd, SOL_SOCKET, SO_KEEPALIVE, &keepalive, sizeof(keepalive)) < 0)
+        syslog(L_ERROR, "fd %d can't setsockopt(KEEPALIVE) %m", readfd);
+    if (setsockopt(writefd, SOL_SOCKET, SO_KEEPALIVE, &keepalive, sizeof(keepalive)) < 0)
+        syslog(L_ERROR, "fd %d can't setsockopt(KEEPALIVE) %m", writefd);
+#endif /* SOL_SOCKET && SO_KEEPALIVE */
     
     /* set the file descriptors for SSL to use */
     if (SSL_set_rfd(tls_conn, readfd)==0)
@@ -698,7 +676,8 @@ SSL_writev (ssl, vector, count)
      const struct iovec *vector;
      int count;
 {
-  char *buffer;
+  static char *buffer = NULL;
+  static size_t allocsize = 0;
   char *bp;
   size_t bytes, to_copy;
   int i;
@@ -706,8 +685,14 @@ SSL_writev (ssl, vector, count)
   bytes = 0;
   for (i = 0; i < count; ++i)
     bytes += vector[i].iov_len;
-  /* Allocate a temporary buffer to hold the data.  */
-  buffer = (char *) WRITEV_ALLOC (bytes);
+  /* Allocate a buffer to hold the data.  */
+  if (NULL == buffer) {
+    buffer = (char *) xmalloc(bytes);
+    allocsize = bytes;
+  } else if (bytes > allocsize) {
+    buffer = (char *) xrealloc (buffer, bytes);
+    allocsize = bytes;
+  }
   /* Copy the data into BUFFER.  */
   to_copy = bytes;
   bp = buffer;
diff -Nrup inn-2.4.4/samples/INN.py inn-2.4.5/samples/INN.py
--- inn-2.4.4/samples/INN.py	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/samples/INN.py	2008-06-29 10:56:57.000000000 -0700
@@ -1,6 +1,10 @@
-# This module supplies stub Python functions corresponding to the ones
-# provided by innd.  It is not used by the server; it is only here so
-# that you can test your filter scripts before loading.
+##  $Id: INN.py 7897 2008-06-22 18:04:31Z iulius $
+##
+##  This module supplies stub Python functions corresponding to the ones
+##  provided by innd.  It is not used by the server; it is only here so
+##  that you can test your filter scripts before loading.
+##  See the INN Python Filtering and Authentication Hooks documentation
+##  for more information.
 
 from types import *
 
@@ -10,20 +14,26 @@ def set_filter_hook(anObject):
     else:
         print "** <Your object is not a class instance.>"
 
+def addhist(messageid):
+    print "** addhist Message-ID: " + messageid
+
 def havehist(messageid):
-    print "** havehist message id: " + messageid
+    print "** havehist Message-ID: " + messageid
 
 def cancel(messageid):
-    print "** cancel message id: " + messageid
+    print "** cancel Message-ID: " + messageid
 
 def newsgroup(groupname):
-    print "** newsgroup: " + messageid
+    print "** newsgroup: " + groupname
 
 def head(messageid):
-    print "** head  message id: " + messageid
+    print "** head Message-ID: " + messageid
 
 def article(messageid):
-    print "** article message id: " + messageid
+    print "** article Message-ID: " + messageid
+
+def hashstring(mystring):
+    print "** hash: " + mystring
 
 def syslog(level, message):
     print "-- syslog level: %s message: %s" % (level, message)
diff -Nrup inn-2.4.4/samples/filter_innd.pl inn-2.4.5/samples/filter_innd.pl
--- inn-2.4.4/samples/filter_innd.pl	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/samples/filter_innd.pl	2008-06-29 10:56:57.000000000 -0700
@@ -1,11 +1,12 @@
 #
-# $Id: filter_innd.pl 3048 2000-04-04 23:40:09Z rra $
+# $Id: filter_innd.pl 7860 2008-06-07 12:46:49Z iulius $
 #
 # Sample Perl filtering file for the innd hooks.
 # 
 
-# This file gets loaded at innd process startup, and everytime a 'reload
-# perl xxx' or a 'reload all xxx' is done.
+# This file gets loaded at innd process startup, and everytime a
+# "ctlinnd reload filter.perl 'reason'" or a
+# "ctlinnd reload all 'reason'" is done.
 #
 # Before this file is loaded, the perl routine `filter_before_reload' is
 # called, and after it's finished loading, the perl routine
@@ -71,7 +72,7 @@ sub filter_art {
 	my $rval = "" ; # Assume we'll accept. Cannot be `0'
 
 ### Remove two leading '##' from the following section (and then
-### 'ctlinnd reload filter.perl' and the filter will reject articles that
+### "ctlinnd reload filter.perl 'reason'" and the filter will reject articles that
 ### have "make money" in the subject, or are posted to more than 10
 ### newsgroups. 
 
diff -Nrup inn-2.4.4/samples/filter_innd.py inn-2.4.5/samples/filter_innd.py
--- inn-2.4.4/samples/filter_innd.py	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/samples/filter_innd.py	2008-06-29 10:56:57.000000000 -0700
@@ -1,36 +1,95 @@
-#
-# $Id: filter_innd.py 4171 2000-11-07 12:58:18Z rra $
-#
-# This is a sample filter for the Python innd hook.
-#
-# For details, see the file doc/hook-python that came with INN.
-#
+##  $Id: filter_innd.py 7903 2008-06-22 20:41:59Z iulius $
+##
+##  This is a sample filter for the Python innd hook.
+##
+##  See the INN Python Filtering and Authentication Hooks documentation
+##  for more information.
+##
+##  You have access to the following methods from the module INN:
+##   - addhist(message-id)
+##   - article(message-id)
+##   - cancel(message-id)
+##   - havehist(message-id)
+##   - hashstring(string)
+##   - head(message-id)
+##   - newsgroup(groupname)
+##   - set_filter_hook(instance)
+##   - syslog(level, message)
 
 import re
 from string import *
 
-# This looks weird, but creating and interning these strings should
-# let us get faster access to header keys (which innd also interns) by
-# losing some strcmps under the covers.
-Approved = intern("Approved");           Control = intern("Control")
-Date = intern("Date");                   Distribution = intern("Distribution")
-Expires = intern("Expires");             From = intern("From")
-Lines = intern("Lines");                 Message_ID = intern("Message-ID")
-Newsgroups = intern("Newsgroups");       Path = intern("Path")
-Reply_To = intern("Reply-To");           Sender = intern("Sender")
-Subject = intern("Subject");             Supersedes = intern("Supersedes")
-Bytes = intern("Bytes");                 Also_Control = intern("Also-Control")
-References = intern("References");       Xref = intern("Xref")
-Keywords = intern("Keywords");           X_Trace = intern("X-Trace")
-NNTP_Posting_Host = intern("NNTP-Posting-Host")
-Followup_To = intern("Followup-To");     Organization = intern("Organization")
-Content_Type = intern("Content-Type");   Content_Base = intern("Content-Base")
+##  This looks weird, but creating and interning these strings should
+##  let us get faster access to header keys (which innd also interns) by
+##  losing some strcmps under the covers.
+Also_Control = intern("Also-Control")
+Approved = intern("Approved")
+Bytes = intern("Bytes")
+Cancel_Key = intern("Cancel-Key")
+Cancel_Lock = intern("Cancel-Lock")
+Content_Base = intern("Content-Base")
 Content_Disposition = intern("Content-Disposition")
-X_Newsreader = intern("X-Newsreader");   X_Mailer = intern("X-Mailer")
-X_Newsposter = intern("X-Newsposter")
+Content_Transfer_Encoding = intern("Content-Transfer-Encoding")
+Content_Type = intern("Content-Type")
+Control = intern("Control")
+Date = intern("Date")
+Date_Received = intern("Date-Received")
+Distribution = intern("Distribution")
+Expires = intern("Expires")
+Face = intern("Face")
+Followup_To = intern("Followup-To")
+From = intern("From")
+In_Reply_To = intern("In-Reply-To")
+Injection_Date = intern("Injection-Date")
+Injection_Info = intern("Injection-Info")
+Keywords = intern("Keywords")
+Lines = intern("Lines")
+List_ID = intern("List-ID")
+Message_ID = intern("Message-ID")
+MIME_Version = intern("MIME-Version")
+Newsgroups = intern("Newsgroups")
+NNTP_Posting_Date = intern("NNTP-Posting-Date")
+NNTP_Posting_Host = intern("NNTP-Posting-Host")
+Organization = intern("Organization")
+Originator = intern("Originator")
+Path = intern("Path")
+Posted = intern("Posted")
+Posting_Version = intern("Posting-Version")
+Received = intern("Received")
+References = intern("References")
+Relay_Version = intern("Relay-Version")
+Reply_To = intern("Reply-To")
+Sender = intern("Sender")
+Subject = intern("Subject")
+Supersedes = intern("Supersedes")
+User_Agent = intern("User-Agent")
+X_Auth = intern("X-Auth")
+X_Canceled_By = intern("X-Canceled-By")
 X_Cancelled_By = intern("X-Cancelled-By")
-X_Canceled_By = intern("X-Canceled-By"); Cancel_Key = intern("Cancel-Key")
-__BODY__ = intern("__BODY__");           __LINES__ = intern("__LINES__")
+X_Complaints_To = intern("X-Complaints-To")
+X_Face = intern("X-Face")
+X_HTTP_UserAgent = intern("X-HTTP-UserAgent")
+X_HTTP_Via = intern("X-HTTP-Via")
+X_Mailer = intern("X-Mailer")
+X_Modbot = intern("X-Modbot")
+X_Modtrace = intern("X-Modtrace")
+X_Newsposter = intern("X-Newsposter")
+X_Newsreader = intern("X-Newsreader")
+X_No_Archive = intern("X-No-Archive")
+X_Original_Message_ID = intern("X-Original-Message-ID")
+X_Original_Trace = intern("X-Original-Trace")
+X_Originating_IP = intern("X-Originating-IP")
+X_PGP_Key = intern("X-PGP-Key")
+X_PGP_Sig = intern("X-PGP-Sig")
+X_Poster_Trace = intern("X-Poster-Trace")
+X_Postfilter = intern("X-Postfilter")
+X_Proxy_User = intern("X-Proxy-User")
+X_Submissions_To = intern("X-Submissions-To")
+X_Trace = intern("X-Trace")
+X_Usenet_Provider = intern("X-Usenet-Provider")
+Xref = intern("Xref")
+__BODY__ = intern("__BODY__")
+_LINES__ = intern("__LINES__")
 
 
 class InndFilter:
@@ -38,13 +97,12 @@ class InndFilter:
 
     def __init__(self):
         """This runs every time the filter is loaded or reloaded.
-
         This is a good place to initialize variables and precompile
         regular expressions, or maybe reload stats from disk.
         """
         self.re_newrmgroup = re.compile('(?:new|rm)group\s')
         self.re_obsctl = re.compile('(?:sendsys|version|uuname)')
-        # msgid  pattern from a once-common spambot.
+        # Message-ID pattern from a once-common spambot.
         self.re_none44 = re.compile('none\d+\.yet>')
         # There is a mad newgrouper who likes to meow.
         self.re_meow = re.compile("^Meow\!", re.M)
@@ -68,7 +126,7 @@ class InndFilter:
         syslog('notice', "filter_close running, bye!")
 
     def filter_messageid(self, msgid):
-        """Filter articles just by their message IDs.
+        """Filter articles just by their Message-IDs.
 
         This method interacts with the IHAVE and CHECK NNTP commands.
         If you return a non-empty string here, the offered article
@@ -78,7 +136,7 @@ class InndFilter:
         offer the ID for examination, and a TAKETHIS isn't always
         preceded by a CHECK.)
         """
-        return ""               # deactivate the samples.
+        return ""               # Deactivate the samples.
         
         if self.re_none44.search(msgid):
             return "But I don't like spam!"
@@ -89,19 +147,26 @@ class InndFilter:
         """Decide whether to keep offered articles.
 
         art is a dictionary with a bunch of headers, the article's
-        body, and innd's reckoning of the line count.  Itens not
+        body, and innd's reckoning of the line count.  Items not
         in the article will have a value of None.
 
         The available headers are the ones listed near the top of
         innd/art.c.  At this writing, they are:
 
-            Approved, Control, Date, Distribution, Expires, From,
-            Lines, Message-ID, Newsgroups, Path, Reply-To, Sender,
-            Subject, Supersedes, Bytes, Also-Control, References,
-            Xref, Keywords, X-Trace, NNTP-Posting-Host, Folowup-To,
-            Organization, Content-Type, Content-Base,
-            Content-Disposition, X-Newsreader, X-Mailer, X-Newsposter,
-            X-Cancelled-By, X-Canceled-By and Cancel-Key.
+            Also-Control, Approved, Bytes, Cancel-Key, Cancel-Lock,
+            Content-Base, Content-Disposition, Content-Transfer-Encoding,
+            Content-Type, Control, Date, Date-Received, Distribution, Expires,
+            Face, Followup-To, From, In-Reply-To, Injection-Date, Injection-Info,
+            Keywords, Lines, List-ID, Message-ID, MIME-Version, Newsgroups,
+            NNTP-Posting-Date, NNTP-Posting-Host, Organization, Originator,
+            Path, Posted, Posting-Version, Received, References, Relay-Version,
+            Reply-To, Sender, Subject, Supersedes, User-Agent,
+            X-Auth, X-Canceled-By, X-Cancelled-By, X-Complaints-To, X-Face,
+            X-HTTP-UserAgent, X-HTTP-Via, X-Mailer, X-Modbot, X-Modtrace,
+            X-Newsposter, X-Newsreader, X-No-Archive, X-Original-Message-ID,
+            X-Original-Trace, X-Originating-IP, X-PGP-Key, X-PGP-Sig,
+            X-Poster-Trace, X-Postfilter, X-Proxy-User, X-Submissions-To,
+            X-Trace, X-Usenet-Provider, Xref.
 
         The body is the buffer in art['__BODY__'] and the INN-reckoned
         line count is held as an integer in art['__LINES__'].  (The
@@ -114,9 +179,9 @@ class InndFilter:
         and local posters will see them if their messages are
         rejected.
         """
-        return ""               # deactivate the samples.
+        return ""               # Deactivate the samples.
 
-        # catch bad IDs from articles fed with TAKETHIS but no CHECK.
+        # Catch bad Message-IDs from articles fed with TAKETHIS but no CHECK.
         idcheck = self.filter_messageid(art[Message_ID])
         if idcheck:
             return idcheck
@@ -147,39 +212,37 @@ class InndFilter:
         just left, and newmode is where we are going.  reason is
         usually just a comment string.
 
-        The possible values of newmode and oldmode are the four
-        strings 'running', 'paused', 'throttled' and 'unknown'.
-        Actually 'unknown' shouldn't happen, it's there in case
-        feeping creatures invade innd.
+        The possible values of newmode and oldmode are the five
+        strings 'running', 'paused', 'throttled', 'shutdown' and
+        'unknown'.  Actually 'unknown' shouldn't happen; it's there
+        in case feeping creatures invade innd.
         """
         syslog('notice', 'state change from %s to %s - %s'
                % (oldmode, newmode, reason))
 
 
-
 """
 Okay, that's the end of our class definition.  What follows is the
 stuff you need to do to get it all working inside innd.
 """
 
-# This import must succeed, or your filter won't work.  I'll repeat
-# that: You MUST import INN.
+##  This import must succeed, or your filter won't work.  I'll repeat
+##  that: You MUST import INN.
 from INN import *
 
-
-#   Some of the stuff below is gratuitous, just demonstrating how the
-#   INN.syslog call works.  That first thingy tells the Unix syslogger
-#   what severity to use; you can abbreviate down to one letter and
-#   it's case insensitive.  Available levels are (in increasing levels
-#   of seriousness) Debug, Info, Notice, Warning, Err, Crit, and
-#   Alert.  If you provide any other string, it will be defaulted to
-#   Notice.  You'll find the entries in the same log files innd itself
-#   uses, with an 'innd: python:' prefix.
-#
-#   The native Python syslog module seems to clash with INN, so use
-#   INN's.  Oh yeah -- you may notice that stdout and stderr have been
-#   redirected to /dev/null -- if you want to print stuff, open your
-#   own files.
+##  Some of the stuff below is gratuitous, just demonstrating how the
+##  INN.syslog call works.  That first thingy tells the Unix syslogger
+##  what severity to use; you can abbreviate down to one letter and
+##  it's case insensitive.  Available levels are (in increasing levels
+##  of seriousness) Debug, Info, Notice, Warning, Err, Crit, and
+##  Alert.  If you provide any other string, it will be defaulted to
+##  Notice.  You'll find the entries in the same log files innd itself
+##  uses, with an 'innd: python:' prefix.
+##
+##  The native Python syslog module seems to clash with INN, so use
+##  INN's.  Oh yeah -- you may notice that stdout and stderr have been
+##  redirected to /dev/null -- if you want to print stuff, open your
+##  own files.
 
 try:
     import sys
@@ -187,21 +250,21 @@ except Exception, errmsg:
     syslog('Error', "import boo-boo: " + errmsg[0])
 
 
-#     If you want to do something special when the server first starts
-#     up, this is how to find out when it's time.
+##  If you want to do something special when the server first starts
+##  up, this is how to find out when it's time.
 
 if 'spamfilter' not in dir():
-    syslog ('n', "First load, so I can do initialization stuff.")
-    #  You could unpickle a saved hash here, so that your hard-earned
-    #  spam scores aren't lost whenver you shut down innd.
+    syslog('n', "First load, so I can do initialization stuff.")
+    # You could unpickle a saved hash here, so that your hard-earned
+    # spam scores aren't lost whenever you shut down innd.
 else:
-    syslog ('NoTicE', "I'm just reloading, so skip the formalities.")
+    syslog('NoTicE', "I'm just reloading, so skip the formalities.")
 
 
-#  Finally, here is how we get our class on speaking terms with innd.
-#  The hook is refreshed on every reload, so that you can change the
-#  methods on a running server.  Don't forget to test your changes
-#  before reloading!
+##  Finally, here is how we get our class on speaking terms with innd.
+##  The hook is refreshed on every reload, so that you can change the
+##  methods on a running server.  Don't forget to test your changes
+##  before reloading!
 spamfilter = InndFilter()
 try:
     set_filter_hook(spamfilter)
diff -Nrup inn-2.4.4/samples/innreport.conf.in inn-2.4.5/samples/innreport.conf.in
--- inn-2.4.4/samples/innreport.conf.in	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/samples/innreport.conf.in	2008-06-29 10:56:57.000000000 -0700
@@ -1024,7 +1024,7 @@ section innd_python {
 section nocem {
         title   "NoCeM on Spool:";
 	data    "%nocem_goodsigs";
-	sort    "$nocem_ids{$b} <=> $nocem_ids{$a}";
+	sort    "$nocem_goodsigs{$b} <=> $nocem_goodsigs{$a}";
 	column {
 		name		"Id";
                	format		"%-47.47s";
@@ -2068,7 +2068,7 @@ section rnews_misc {
 
 section nnrpd_groups {
         title   "NNRP readership statistics:";
-	data    "%nnrpd_connect";
+	data    "%nnrpd_articles";
 	sort    "$nnrpd_articles{$b} <=> $nnrpd_articles{$a}";
 	numbering true;
         column {
diff -Nrup inn-2.4.4/samples/nnrpd.py inn-2.4.5/samples/nnrpd.py
--- inn-2.4.4/samples/nnrpd.py	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/samples/nnrpd.py	2008-06-29 10:56:57.000000000 -0700
@@ -1,6 +1,10 @@
-# This module supplies stub Python functions corresponding to the ones
-# provided by nnrpd.  It is not used by the server; it is only here so
-# that you can test your auth and filter scripts before loading.
+##  $Id: nnrpd.py 7897 2008-06-22 18:04:31Z iulius $
+##
+##  This module supplies stub Python functions corresponding to the ones
+##  provided by nnrpd.  It is not used by the server; it is only here so
+##  that you can test your filter scripts before loading.
+##  See the INN Python Filtering and Authentication Hooks documentation
+##  for more information.
 
 from types import *
 
diff -Nrup inn-2.4.4/samples/nnrpd_access.py inn-2.4.5/samples/nnrpd_access.py
--- inn-2.4.4/samples/nnrpd_access.py	1969-12-31 16:00:00.000000000 -0800
+++ inn-2.4.5/samples/nnrpd_access.py	2008-06-29 10:56:57.000000000 -0700
@@ -0,0 +1,92 @@
+##  $Id: nnrpd_access.py 7906 2008-06-23 05:44:49Z iulius $
+##
+##  This is a sample access module for the Python nnrpd hook.
+##
+##  See the INN Python Filtering and Authentication Hooks documentation
+##  for more information.
+##  The perl_access: parameter in readers.conf is used to load this script.
+##
+##  An instance of ACCESS class is passed to nnrpd via the set_auth_hook()
+##  function imported from nnrpd.  The following methods of that class
+##  are known to nnrpd:
+##
+##  __init__()                  - Use this method to initialize your
+##                                general variables or open a common
+##                                database connection.  May be omitted.
+##  access_init()               - Init function specific to access
+##                                control.  May be omitted.
+##  access(attributes)          - Called when a python_access
+##                                statement is reached in the
+##                                processing of readers.conf.  Returns
+##                                a dictionary of values representing
+##                                statements to be included in an
+##                                access group.
+##  access_close()              - Called on nnrpd termination.  Save
+##                                your state variables or close a
+##                                database connection.  May be omitted.
+##
+##  If there is a problem with return codes from any of these methods, then nnrpd
+##  will die and syslog the exact reason.
+##
+##  There are also a few Python functions defined in nnrpd:
+##
+##  set_auth_hook()             - Called by nnrpd as this module is loaded.
+##                              It is used to pass a reference to an
+##                              instance of authentication class to nnrpd.
+##  syslog()                    - An equivalent replacement for regular syslog.
+##                              One consideration for using it is to
+##                              uniform nnrpd logging.
+
+##  Sample access class.  It defines all access methods known to nnrpd.
+class ACCESS:
+    """Provide access callbacks to nnrpd."""
+
+    def __init__(self):
+        """This is a good place to initialize variables or open a
+           database connection."""
+        syslog('notice', 'nnrpd access class instance created')
+
+    def access_init(self):
+        """Called when this script is initialized."""
+        pass
+
+    def access(self, attributes):
+        """Called when python_access: is encountered in readers.conf."""
+
+	# Just for debugging purposes.
+	syslog('notice', 'n_a access() invoked: hostname %s, ipaddress %s, interface %s, user %s' % (\
+		attributes['hostname'], \
+		attributes['ipaddress'], \
+		attributes['interface'], \
+		attributes['user']))
+
+	# Allow newsreading from specific host only.
+        if '127.0.0.1' == str(attributes['ipaddress']):
+            syslog('notice', 'authentication access by IP address succeeded')
+            return {'read':'*', 'post':'*'}
+        else:
+            syslog('notice', 'authentication access by IP address failed')
+            return {'read':'!*', 'post':'!*'}
+
+    def access_close(self):
+        """Called on nnrpd termination."""
+        pass
+
+
+##  The rest is used to hook up the access module on nnrpd.  It is unlikely
+##  you will ever need to modify this.
+
+##  Import functions exposed by nnrpd.  This import must succeed, or nothing
+##  will work!
+from nnrpd import *
+
+##  Create a class instance.
+myaccess = ACCESS()
+
+##  ...and try to hook up on nnrpd.  This would make auth object methods visible
+##  to nnrpd.
+try:
+    set_auth_hook(myaccess)
+    syslog('notice', "access module successfully hooked into nnrpd")
+except Exception, errmsg:
+    syslog('error', "Cannot obtain nnrpd hook for access method: %s" % errmsg[0])
diff -Nrup inn-2.4.4/samples/nnrpd_access_wrapper.py inn-2.4.5/samples/nnrpd_access_wrapper.py
--- inn-2.4.4/samples/nnrpd_access_wrapper.py	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/samples/nnrpd_access_wrapper.py	2008-06-29 10:56:57.000000000 -0700
@@ -1,27 +1,32 @@
-# Example wrapper nnrpd_access_wrapper.py for support of old python
-# authentication scripts, by Erik Klavon. 
+##  $Id: nnrpd_access_wrapper.py 7899 2008-06-22 18:22:07Z iulius $
+##
+##  Example wrapper for support of old Python authentication scripts,
+##  by Erik Klavon. 
+##
+##  This file contains a sample Python script which can be used to
+##  duplicate the behaviour of the old nnrppythonauth functionality.
+##  This script only supports access control.
+##
+##  How to use this wrapper:
+##    - insert your authentication class into this file;
+##    - rename your authentication class OLDAUTH.
+##
+##  See the INN Python Filtering and Authentication Hooks documentation
+##  for more information.
+##  The use of this file is *discouraged*.
+
+##  Old AUTH class.
+##  Insert your old auth class here.
+##  Do not include the code which sets the hook.
 
-# This file contains a sample python script which can be used to
-# duplicate the behavior of the old nnrppythonauth functionality. This
-# script only supports access control.
-
-# How to use this wrapper:
-# - insert your authentication class into this file.
-# - rename your authentication class OLDAUTH
-#
-# Old AUTH class
-# Insert your old auth class here
-# do not include the code which sets the hook
 
 
 
-#
-# Wrapper AUTH class. It creates an instance of the old class and
-# calls its methods. Arguments and return values are munged as
-# needed to fit the new way of doing things.
-#
+##  Wrapper ACCESS class.  It creates an instance of the old class and
+##  calls its methods.  Arguments and return values are munged as
+##  needed to fit the new way of doing things.
 
-class MYAUTH:
+class MYACCESS:
     """Provide access callbacks to nnrpd."""
     def access_init(self):
         self.old = OLDAUTH()
@@ -39,22 +44,21 @@ class MYAUTH:
     def access_close(self):
         (self.old).close()
 
-#
-# The rest is used to hook up the auth module on nnrpd. It is unlikely
-# you will ever need to modify this.
-#
 
-# Import functions exposed by nnrpd. This import must succeed, or nothing
-# will work!
+##  The rest is used to hook up the access module on nnrpd.  It is unlikely
+##  you will ever need to modify this.
+
+##  Import functions exposed by nnrpd.  This import must succeed, or nothing
+##  will work!
 from nnrpd import *
 
-# Create a class instance
-myauth = MYAUTH()
+##  Create a class instance.
+myaccess = MYACCESS()
 
-# ...and try to hook up on nnrpd. This would make auth object methods visible
-# to nnrpd.
+##  ...and try to hook up on nnrpd.  This would make access object methods visible
+##  to nnrpd.
 try:
-    set_auth_hook(myauth)
-    syslog('notice', "authentication module successfully hooked into nnrpd")
+    set_auth_hook(myaccess)
+    syslog('notice', "access module successfully hooked into nnrpd")
 except Exception, errmsg:
-    syslog('error', "Cannot obtain nnrpd hook for authentication method: %s" % errmsg[0])
+    syslog('error', "Cannot obtain nnrpd hook for access method: %s" % errmsg[0])
diff -Nrup inn-2.4.4/samples/nnrpd_auth.py inn-2.4.5/samples/nnrpd_auth.py
--- inn-2.4.4/samples/nnrpd_auth.py	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/samples/nnrpd_auth.py	2008-06-29 10:56:57.000000000 -0700
@@ -1,169 +1,106 @@
-#
-#
-# This is a sample authentication and authorization module for python
-# nnrpd hook
-#
-# For details, see the file doc/hook-python that came with INN.
-#
-
-#
-# This file is loaded when one of the python_* readers.conf parameters
-# is encountered. An instance of AUTH class is passed to nnrpd via
-# set_auth_hook() function imported from nnrpd. The following methods
-# of that class are known to nnrpd:
-#
-#   __init__()                  - Use this method to initilalize your
-#                                 general variables or open a common
-#                                 database connection. May be omitted.
-#   access_init()               - Init function specific to access
-#                                 control. May be omitted
-#   access(attributes)          - Called when a python_access
-#                                 statement is reached in the
-#                                 processing of readers.conf. Returns
-#                                 a dictionary of values representing
-#                                 statements to be included in an
-#                                 access group. 
-#   access_close()              - Called on nnrpd termination. Save
-#                                 your state variables or close a
-#                                 database connection. May be omitted
-#   authen_init()               - Init function specific to
-#                                 authentication. May be omitted
-#   authenticate(attributes)    - Called when a python_auth statement
-#                                 is reached in the processing of
-#                                 readers.conf. Returns a response
-#                                 code, an error string and an
-#                                 optional string to appear in the
-#                                 logs as the username.
-#   authen_close()              - Called on nnrpd termination. Save
-#                                 your state variables or close a database
-#                                 connection. May be omitted
-#   dynamic_init()              - Init function specific to
-#                                 authentication. May be omitted
-#   dynamic(attributes)         - Called whenever a reader requests either
-#                                 read or post access to a
-#                                 newsgroup. Returns None to grant
-#                                 access, or a non-empty string (which
-#                                 will be reported back to reader)
-#                                 otherwise. 
-#   dynamic_close()             - Called on nnrpd termination. Save
-#                                 your state variables or close a database
-#                                 connection. May be omitted
-#
-# If there is a problem with return codes from any of these methods then nnrpd
-# will die and syslog the exact reason.
-#
-# There are also a few Python functions defined in nnrpd:
-#
-# set_auth_hook()               - Called by nnrpd as this module is loaded.
-#                                 It is used to pass a reference to an 
-#                                 instance of authentication class to nnrpd.
-# syslog()                      - An equivalent replacement for regular syslog.
-#                                 One consideration for using it is to
-#                                 uniform nnrpd logging.
-
-#
-# Sample authentication and authorization class. It defines all methods known
-# to nnrpd.
-#
+##  $Id: nnrpd_auth.py 7906 2008-06-23 05:44:49Z iulius $
+##
+##  This is a sample authentication module for the Python nnrpd hook.
+##
+##  See the INN Python Filtering and Authentication Hooks documentation
+##  for more information.
+##  The perl_auth: parameter in readers.conf is used to load this script.
+##
+##  An instance of AUTH class is passed to nnrpd via the set_auth_hook()
+##  function imported from nnrpd.  The following methods of that class
+##  are known to nnrpd:
+##
+##  __init__()                  - Use this method to initialize your
+##                                general variables or open a common
+##                                database connection.  May be omitted.
+##  authen_init()               - Init function specific to
+##                                authentication.  May be omitted.
+##  authenticate(attributes)    - Called when a python_auth statement
+##                                is reached in the processing of
+##                                readers.conf.  Returns a response
+##                                code, an error string and an
+##                                optional string to appear in the
+##                                logs as the username.
+##  authen_close()              - Called on nnrpd termination.  Save
+##                                your state variables or close a database
+##                                connection.  May be omitted.
+##
+##  If there is a problem with return codes from any of these methods, then nnrpd
+##  will die and syslog the exact reason.
+##
+##  There are also a few Python functions defined in nnrpd:
+##
+##  set_auth_hook()             - Called by nnrpd as this module is loaded.
+##                              It is used to pass a reference to an
+##                              instance of authentication class to nnrpd.
+##  syslog()                    - An equivalent replacement for regular syslog.
+##                              One consideration for using it is to
+##                              uniform nnrpd logging.
+
+##  Sample authentication class.  It defines all auth methods known to nnrpd.
 class AUTH:
-    """Provide authentication and authorization callbacks to nnrpd."""
+    """Provide authentication callbacks to nnrpd."""
+
     def __init__(self):
         """This is a good place to initialize variables or open a
-           database connection. 
-        """
-        # Create a list of NNTP codes to respond on connect
+           database connection."""
+
+        # Create a list of NNTP codes to respond on connect.
         self.connectcodes = {   'READPOST':200,
                                 'READ':201,
                                 'AUTHNEEDED':480,
                                 'PERMDENIED':502
         }
 
-        # Create a list of NNTP codes to respond on authentication
+        # Create a list of NNTP codes to respond on authentication.
         self.authcodes = {  'ALLOWED':281,
                             'DENIED':502
         }
 
         syslog('notice', 'nnrpd authentication class instance created')
 
+    def authen_init(self):
+        """Called when this script is initialized."""
+        pass
+
     def authenticate(self, attributes):
-        """Called when python_auth is encountered in readers.conf"""
+        """Called when python_auth: is encountered in readers.conf."""
 
-	# just for debugging purposes
+	# Just for debugging purposes.
 	syslog('notice', 'n_a authenticate() invoked: hostname %s, ipaddress %s, interface %s, user %s' % (\
 		attributes['hostname'], \
 		attributes['ipaddress'], \
 		attributes['interface'], \
 		attributes['user']))
 
-	# do username passworld authentication
+	# Do username password authentication.
         if 'foo' == str(attributes['user'])  \
-           and 'foo' == str(attributes['pass']):
+          and 'foo' == str(attributes['pass']):
             syslog('notice', 'authentication by username succeeded')
-            return ( self.authcodes['ALLOWED'], 'No error', 'default_user')
+            return (self.authcodes['ALLOWED'], 'No error', 'default_user')
         else:
             syslog('notice', 'authentication by username failed')
-            return ( self.authcodes['DENIED'], 'Access Denied!')
+            return (self.authcodes['DENIED'], 'Access Denied!')
 
-    def access(self, attributes):
-        """Called when python_access is encountered in readers.conf"""
+    def authen_close(self):
+        """Called on nnrpd termination."""
+        pass
 
-	# just for debugging purposes
-	syslog('notice', 'n_a access() invoked: hostname %s, ipaddress %s, interface %s, user %s' % (\
-		attributes['hostname'], \
-		attributes['ipaddress'], \
-		attributes['interface'], \
-		attributes['user']))
 
-	# allow newsreading from specific host only
-        if '127.0.0.1' == str(attributes['ipaddress']):
-            syslog('notice', 'authentication by IP address succeeded')
-            return {'read':'*','post':'*'}
-        else:
-            syslog('notice', 'authentication by IP address failed')
-            return {'read':'!*','post':'!*'}
+##  The rest is used to hook up the auth module on nnrpd.  It is unlikely
+##  you will ever need to modify this.
 
-    def dynamic(self, attributes):
-        """Called when python_dynamic was reached in the processing of
-           readers.conf and a reader requests either read or post
-           permission for particular newsgroup.
-        """
-	# just for debugging purposes
-	syslog('notice', 'n_a dyanmic() invoked against type %s, hostname %s, ipaddress %s, interface %s, user %s' % (\
-		attributes['type'], \
-		attributes['hostname'], \
-		attributes['ipaddress'], \
-		attributes['interface'], \
-		attributes['user']))
-
-	# Allow reading of any newsgroup but not posting
-        if 'post' == str(attributes['type']):
-            syslog('notice', 'authorization for post access denied')
-            return "no posting for you"
-        elif 'read' == str(attributes['type']):
-            syslog('notice', 'authorization for read access granted')
-            return None
-        else:
-            syslog('notice', 'authorization type is not known: %s' % attributes['type'])
-            return "Internal error";
-
-
-#
-# The rest is used to hook up the auth module on nnrpd. It is unlikely
-# you will ever need to modify this.
-#
-
-# Import functions exposed by nnrpd. This import must succeed, or nothing
-# will work!
+##  Import functions exposed by nnrpd.  This import must succeed, or nothing
+##  will work!
 from nnrpd import *
 
-# Create a class instance
+##  Create a class instance.
 myauth = AUTH()
 
-# ...and try to hook up on nnrpd. This would make auth object methods visible
-# to nnrpd.
+##  ...and try to hook up on nnrpd.  This would make auth object methods visible
+##  to nnrpd.
 try:
     set_auth_hook(myauth)
     syslog('notice', "authentication module successfully hooked into nnrpd")
 except Exception, errmsg:
     syslog('error', "Cannot obtain nnrpd hook for authentication method: %s" % errmsg[0])
-
diff -Nrup inn-2.4.4/samples/nnrpd_auth_wrapper.py inn-2.4.5/samples/nnrpd_auth_wrapper.py
--- inn-2.4.4/samples/nnrpd_auth_wrapper.py	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/samples/nnrpd_auth_wrapper.py	2008-06-29 10:56:57.000000000 -0700
@@ -1,26 +1,30 @@
-# Example wrapper nnrpd_auth_wrapper.py for support of old python
-# authentication scripts, by Erik Klavon. 
+##  $Id: nnrpd_auth_wrapper.py 7899 2008-06-22 18:22:07Z iulius $
+##
+##  Example wrapper for support of old Python authentication scripts,
+##  by Erik Klavon.
+##
+##  This file contains a sample Python script which can be used to
+##  duplicate the behaviour of the old nnrppythonauth functionality.
+##  This script only supports authentication.
+##
+##  How to use this wrapper:
+##    - insert your authentication class into this file;
+##    - rename your authentication class OLDAUTH.
+##
+##  See the INN Python Filtering and Authentication Hooks documentation
+##  for more information.
+##  The use of this file is *discouraged*.
+
+##  Old AUTH class.
+##  Insert your old auth class here.
+##  Do not include the code which sets the hook.
 
-# This file contains a sample python script which can be used to
-# duplicate the behavior of the old nnrppythonauth functionality. This
-# script only supports authentication.
 
-# How to use this wrapper:
-# - insert your authentication class into this file.
-# - rename your authentication class OLDAUTH
-#
 
-# Old AUTH class
-# Insert your old auth class here
-# do not include the code which sets the hook
 
-
-
-#
-# Wrapper AUTH class. It creates an instance of the old class and
-# calls its methods. Arguments and return values are munged as
-# needed to fit the new way of doing things.
-#
+##  Wrapper AUTH class.  It creates an instance of the old class and
+##  calls its methods.  Arguments and return values are munged as
+##  needed to fit the new way of doing things.
 
 class MYAUTH:
     """Provide auth callbacks to nnrpd."""
@@ -38,20 +42,19 @@ class MYAUTH:
     def authen_close(self):
         (self.old).close()
 
-#
-# The rest is used to hook up the auth module on nnrpd. It is unlikely
-# you will ever need to modify this.
-#
 
-# Import functions exposed by nnrpd. This import must succeed, or nothing
-# will work!
+##  The rest is used to hook up the auth module on nnrpd.  It is unlikely
+##  you will ever need to modify this.
+
+##  Import functions exposed by nnrpd.  This import must succeed, or nothing
+##  will work!
 from nnrpd import *
 
-# Create a class instance
+##  Create a class instance.
 myauth = MYAUTH()
 
-# ...and try to hook up on nnrpd. This would make auth object methods visible
-# to nnrpd.
+##  ...and try to hook up on nnrpd.  This would make auth object methods visible
+##  to nnrpd.
 try:
     set_auth_hook(myauth)
     syslog('notice', "authentication module successfully hooked into nnrpd")
diff -Nrup inn-2.4.4/samples/nnrpd_dynamic.py inn-2.4.5/samples/nnrpd_dynamic.py
--- inn-2.4.4/samples/nnrpd_dynamic.py	1969-12-31 16:00:00.000000000 -0800
+++ inn-2.4.5/samples/nnrpd_dynamic.py	2008-06-29 10:56:57.000000000 -0700
@@ -0,0 +1,99 @@
+##  $Id: nnrpd_dynamic.py 7906 2008-06-23 05:44:49Z iulius $
+##
+##  This is a sample dynamic access module for the Python nnrpd hook.
+##
+##  See the INN Python Filtering and Authentication Hooks documentation
+##  for more information.
+##  The perl_dynamic: parameter in readers.conf is used to load this script.
+##
+##  An instance of DYNACCESS class is passed to nnrpd via the set_auth_hook()
+##  function imported from nnrpd.  The following methods of that class
+##  are known to nnrpd:
+##
+##  __init__()                  - Use this method to initialize your
+##                                general variables or open a common
+##                                database connection.  May be omitted.
+##  dynamic_init()              - Init function specific to
+##                                authentication.  May be omitted.
+##  dynamic(attributes)         - Called whenever a reader requests either
+##                                read or post access to a
+##                                newsgroup.  Returns None to grant
+##                                access, or a non-empty string (which
+##                                will be reported back to reader)
+##                                otherwise.
+##  dynamic_close()             - Called on nnrpd termination.  Save
+##                                your state variables or close a database
+##                                connection.  May be omitted.
+##
+##  If there is a problem with return codes from any of these methods, then nnrpd
+##  will die and syslog the exact reason.
+##
+##  There are also a few Python functions defined in nnrpd:
+##
+##  set_auth_hook()             - Called by nnrpd as this module is loaded.
+##                              It is used to pass a reference to an
+##                              instance of authentication class to nnrpd.
+##  syslog()                    - An equivalent replacement for regular syslog.
+##                              One consideration for using it is to
+##                              uniform nnrpd logging.
+
+##  Sample dynamic access class.  It defines all dynamic access methods known
+##  to nnrpd.
+class DYNACCESS:
+    """Provide dynamic access callbacks to nnrpd."""
+
+    def __init__(self):
+        """This is a good place to initialize variables or open a
+           database connection."""
+        syslog('notice', 'nnrpd dynamic access class instance created')
+
+    def dynamic_init(self):
+        """Called when this script is initialized."""
+        pass
+
+    def dynamic(self, attributes):
+        """Called when python_dynamic: is reached in the processing of
+           readers.conf and a reader requests either read or post
+           permission for particular newsgroup."""
+
+	# Just for debugging purposes.
+	syslog('notice', 'n_a dynamic() invoked against type %s, hostname %s, ipaddress %s, interface %s, user %s' % (\
+		attributes['type'], \
+		attributes['hostname'], \
+		attributes['ipaddress'], \
+		attributes['interface'], \
+		attributes['user']))
+
+	# Allow reading of any newsgroup but not posting.
+        if 'post' == str(attributes['type']):
+            syslog('notice', 'dynamic authorization access for post access denied')
+            return "no posting for you"
+        elif 'read' == str(attributes['type']):
+            syslog('notice', 'dynamic authorization access for read access granted')
+            return None
+        else:
+            syslog('notice', 'dynamic authorization access type is not known: %s' % attributes['type'])
+            return "Internal error";
+
+    def dynamic_close(self):
+        """Called on nnrpd termination."""
+        pass
+
+
+##  The rest is used to hook up the dynamic access module on nnrpd.  It is unlikely
+##  you will ever need to modify this.
+
+##  Import functions exposed by nnrpd.  This import must succeed, or nothing
+##  will work!
+from nnrpd import *
+
+##  Create a class instance.
+mydynaccess = DYNACCESS()
+
+##  ...and try to hook up on nnrpd.  This would make auth object methods visible
+##  to nnrpd.
+try:
+    set_auth_hook(mydynaccess)
+    syslog('notice', "dynamic access module successfully hooked into nnrpd")
+except Exception, errmsg:
+    syslog('error', "Cannot obtain nnrpd hook for dynamic access method: %s" % errmsg[0])
diff -Nrup inn-2.4.4/samples/nnrpd_dynamic_wrapper.py inn-2.4.5/samples/nnrpd_dynamic_wrapper.py
--- inn-2.4.4/samples/nnrpd_dynamic_wrapper.py	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/samples/nnrpd_dynamic_wrapper.py	2008-06-29 10:56:57.000000000 -0700
@@ -1,28 +1,32 @@
-# Example wrapper nnrpd_dynamic_wrapper.py for support of old python
-# authentication scripts, by Erik Klavon. 
+##  $Id: nnrpd_dynamic_wrapper.py 7899 2008-06-22 18:22:07Z iulius $
+##
+##  Example wrapper for support of old Python authentication scripts,
+##  by Erik Klavon.
+##
+##  This file contains a sample Python script which can be used to
+##  duplicate the behaviour of the old nnrppythonauth functionality.
+##  This script only supports dynamic access control by group.
+##
+##  How to use this wrapper:
+##    - insert your authentication class into this file;
+##    - rename your authentication class OLDAUTH.
+##
+##  See the INN Python Filtering and Authentication Hooks documentation
+##  for more information.
+##  The use of this file is *discouraged*.
+
+##  Old AUTH class.
+##  Insert your old auth class here.
+##  Do not include the code which sets the hook.
 
-# This file contains a sample python script which can be used to
-# duplicate the behavior of the old nnrppythonauth functionality. This
-# script only supports dynamic access control by group.
 
-# How to use this wrapper:
-# - insert your authentication class into this file.
-# - rename your authentication class OLDAUTH
-#
 
-# Old AUTH class
-# Insert your old auth class here
-# do not include the code which sets the hook
 
+##  Wrapper DYNACCESS class.  It creates an instance of the old class and
+##  calls its methods.  Arguments and return values are munged as
+##  needed to fit the new way of doing things.
 
-
-#
-# Wrapper AUTH class. It creates an instance of the old class and
-# calls its methods. Arguments and return values are munged as
-# needed to fit the new way of doing things.
-#
-
-class MYAUTH:
+class MYDYNACCESS:
     """Provide dynamic access callbacks to nnrpd."""
     def dynamic_init(self):
         self.old = OLDAUTH()
@@ -33,22 +37,21 @@ class MYAUTH:
     def dynamic_close(self):
         (self.old).close()
 
-#
-# The rest is used to hook up the auth module on nnrpd. It is unlikely
-# you will ever need to modify this.
-#
 
-# Import functions exposed by nnrpd. This import must succeed, or nothing
-# will work!
+##  The rest is used to hook up the dynamic access module on nnrpd.  It is unlikely
+##  you will ever need to modify this.
+
+##  Import functions exposed by nnrpd.  This import must succeed, or nothing
+##  will work!
 from nnrpd import *
 
-# Create a class instance
-myauth = MYAUTH()
+##  Create a class instance.
+mydynaccess = MYDYNACCESS()
 
-# ...and try to hook up on nnrpd. This would make auth object methods visible
-# to nnrpd.
+##  ...and try to hook up on nnrpd.  This would make auth object methods visible
+##  to nnrpd.
 try:
-    set_auth_hook(myauth)
-    syslog('notice', "authentication module successfully hooked into nnrpd")
+    set_auth_hook(mydynaccess)
+    syslog('notice', "dynamic access module successfully hooked into nnrpd")
 except Exception, errmsg:
-    syslog('error', "Cannot obtain nnrpd hook for authentication method: %s" % errmsg[0])
+    syslog('error', "Cannot obtain nnrpd hook for dynamic access method: %s" % errmsg[0])
diff -Nrup inn-2.4.4/scripts/innreport_inn.pm inn-2.4.5/scripts/innreport_inn.pm
--- inn-2.4.4/scripts/innreport_inn.pm	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/scripts/innreport_inn.pm	2008-06-29 10:56:57.000000000 -0700
@@ -1,7 +1,7 @@
 ##########################################################
 # INN module for innreport (3.*).
 #
-# Sample file tested with INN 2.3, 2.2, 1.7.2 and 1.5.1
+# Sample file tested with INN 2.4, 2.3, 2.2, 1.7.2 and 1.5.1
 #
 # (c) 1997-1999 by Fabien Tassin <fta@sofaraway.org>
 # version 3.0.2
@@ -250,9 +250,15 @@ sub collect {
     }
     # Python filter
     return 1 if $left =~ /^defined python methods$/o;
+    return 1 if $left =~ /^reloading pyfilter$/o;
+    return 1 if $left =~ /^reloaded pyfilter OK$/o;
     return 1 if $left =~ /^python interpreter initialized OK$/o;
-    return 1 if $left =~ /^python: First load, so I can do initialization stuff.$/o;
+    return 1 if $left =~ /^python method \w+ not found$/o; 
+    return 1 if $left =~ /^python: First load, so I can do initialization stuff\.$/o;
+    return 1 if $left =~ /^python: filter_before_reload executing\.\.\.$/o;
+    return 1 if $left =~ /^python: I\'m just reloading, so skip the formalities\.$/o;
     return 1 if $left =~ /^python: spamfilter successfully hooked into INN$/o;
+    return 1 if $left =~ /^python: state change from \w+ to \w+ - /o;
     return 1 if $left =~ /^python: filter_close running, bye!$/o;
     # rejecting[perl]
     if ($left =~ /^rejecting\[perl\] <[^>]+> \d+ (.*)/o) {
@@ -273,8 +279,9 @@ sub collect {
       $cmd = $command unless $cmd;
       return 1 if $cmd eq 'flush'; # to avoid a double count
       $innd_control{"$cmd"}++;
+      return 1;
     }
-    # control command (by letter)
+    # old control command (by letter)
     if ($left =~ /^(\w)$/o) {
       my $command = $1;
       my $cmd = $ctlinnd{$command};
@@ -283,7 +290,7 @@ sub collect {
       $innd_control{"$cmd"}++;
       return 1;
     }
-    # control command (letter + reason)
+    # old control command (letter + reason)
     if ($left =~ /^(\w):.*$/o) {
       my $command = $1;
       my $cmd = $ctlinnd{$command};
@@ -635,14 +642,15 @@ sub collect {
     }
     # bad_newsfeeds no feeding sites
     return 1 if $left =~ /\S+ bad_newsfeeds no feeding sites/o;
-    # CNFS-sm: cycbuff rollover - possibly interesting
-    return 1 if $left =~ /CNFS-sm: cycbuff \S+ rollover to cycle/o;
-    # CNFS-sm: CNFSflushallheads: flushing - possibly interesting
-    return 1 if $left =~ /CNFS-sm: CNFSflushallheads: flushing /o;
-    # CNFS-sm: metacycbuff rollover with SEQUENTIAL
-    return 1 if $left =~ /CNFS-sm: metacycbuff \S+ cycbuff is moved to /o;
+    # CNFS: cycbuff rollover - possibly interesting
+    return 1 if $left =~ /CNFS(?:-sm)?: cycbuff \S+ rollover to cycle/o;
+    # CNFS: CNFSflushallheads: flushing - possibly interesting
+    return 1 if $left =~ /CNFS(?:-sm)?: CNFSflushallheads: flushing /o;
+    # CNFS: metacycbuff rollover with SEQUENTIAL
+    return 1 if $left =~ /CNFS(?:-sm)?: metacycbuff \S+ cycbuff is moved to /o;
     # Cleanfeed status reports
     return 1 if $left =~ /^filter: status/o;
+    return 1 if $left =~ /^filter: Reloading bad files/o;
   }
   ########
   ## innfeed
@@ -766,7 +774,7 @@ sub collect {
     # ME source lost . Exiting
     return 1 if $left =~ m/(?:SERVER|ME) source lost . Exiting/o;
     # ME starting innfeed (+version & date)
-    return 1 if $left =~ m/(?:SERVER|ME) starting innfeed/o;
+    return 1 if $left =~ m/(?:SERVER|ME) starting (?:innfeed|at)/o;
     # ME finishing at (date)
     return 1 if $left =~ m/(?:SERVER|ME) finishing at /o;
     # mode no-CHECK entered
@@ -785,9 +793,9 @@ sub collect {
     return 1 if $left =~ m/^cannot continue/o;
     if ($left =~ /^(?:SERVER|ME)/o) {
       # ME dropping articles into ...
-      return 1 if $left = ~/ dropping articles into /o;
+      return 1 if $left =~ / dropping articles into /o;
       # ME dropped ...
-      return 1 if $left = ~/ dropped /o;
+      return 1 if $left =~ / dropped /o;
       # ME internal bad data in checkpoint file
       return 1 if $left =~ m/ internal bad data in checkpoint/o;
       # ME two filenames for same article
@@ -1239,6 +1247,23 @@ sub collect {
     return 1 if $left =~ /perl filtering enabled$/o;
     # Python filtering enabled
     return 1 if $left =~ /Python filtering enabled$/o;
+    return 1 if $left =~ /^python interpreter initialized OK$/o;
+    return 1 if $left =~ /^python method \S+ not found$/o;
+    return 1 if $left =~ /^python authenticate method succeeded, return code \d+, error string /o;
+    return 1 if $left =~ /^python access method succeeded$/o;
+    return 1 if $left =~ /^python dynamic method \(\w+ access\) succeeded, refusion string: /o;
+    return 1 if $left =~ /^python: .+ module successfully hooked into nnrpd$/o;
+    return 1 if $left =~ /^python: nnrpd .+ class instance created$/o;
+    return 1 if $left =~ /^python: n_a authenticate\(\) invoked: hostname \S+, ipaddress \S+, interface \S+, user /o;
+    return 1 if $left =~ /^python: n_a access\(\) invoked: hostname \S+, ipaddress \S+, interface \S+, user /o;
+    return 1 if $left =~ /^python: n_a dynamic\(\) invoked against type \S+, hostname \S+, ipaddress \S+, interface \S+, user /o;
+    return 1 if $left =~ /^python: authentication by username succeeded$/o;
+    return 1 if $left =~ /^python: authentication by username failed$/o;
+    return 1 if $left =~ /^python: authentication access by IP address succeeded$/o;
+    return 1 if $left =~ /^python: authentication access by IP address failed$/o;
+    return 1 if $left =~ /^python: dynamic access module successfully hooked into nnrpd$/o;
+    return 1 if $left =~ /^python: dynamic authorization access for read access granted$/o;
+    return 1 if $left =~ /^python: dynamic authorization access type is not known: /o;
     # connect
     if ($left =~ /(\S+) (\([0-9a-fA-F:.]*\) )?connect$/o) {
       my $cust = $1;
@@ -1304,6 +1329,10 @@ sub collect {
       $nnrpd_no_permission{$cust}++;
       return 1;
     }
+    # Authentication failure
+    # User not known to the underlying authentication module
+    return 1 if $left =~ / ckpasswd: pam_authenticate failed: /o;
+    return 1 if $left =~ / ckpasswd: user .+ unknown$/o;
     # authinfo
     if ($left =~ /\S+ user (\S+)$/o) {
       my $user = $1;
@@ -1374,8 +1403,8 @@ sub collect {
       $nnrpd_timeout{$cust}++;
       return 1;
     }
-    # cant read Connection timed out
-    if ($left =~ /(\S+) cant read Connection timed out$/o) {
+    # can't read: Connection timed out
+    if ($left =~ /(\S+) can\'t read: Connection timed out$/o) {
       my $cust = $1;
       $cust = lc $cust unless $CASE_SENSITIVE;
       my $dom = &host2dom($cust);
@@ -1383,8 +1412,8 @@ sub collect {
       $nnrpd_timeout{$cust}++;
       return 1;
     }
-    # cant read Operation timed out
-    if ($left =~ /(\S+) cant read Operation timed out$/o) {
+    # can't read: Operation timed out
+    if ($left =~ /(\S+) can\'t read: Operation timed out$/o) {
       my $cust = $1;
       $cust = lc $cust unless $CASE_SENSITIVE;
       my $dom = &host2dom($cust);
@@ -1392,8 +1421,8 @@ sub collect {
       $nnrpd_timeout{$cust}++;
       return 1;
     }
-    # cant read Connection reset by peer
-    if ($left =~ /(\S+) cant read Connection reset by peer$/o) {
+    # can't read: Connection reset by peer
+    if ($left =~ /(\S+) can\'t read: Connection reset by peer$/o) {
       my $cust = $1;
       $cust = lc $cust unless $CASE_SENSITIVE;
       my $dom = &host2dom($cust);
@@ -1401,6 +1430,8 @@ sub collect {
       $nnrpd_reset_peer{$cust}++;
       return 1;
     }
+    # can't read: Network is unreachable
+    return 1 if $left =~ /(\S+) can\'t read: Network is unreachable$/o;
     # gethostbyaddr: xxx.yyy.zzz != a.b.c.d
     if ($left =~ /^gethostbyaddr: (.*)$/o) {
       my $msg = $1;
@@ -1419,6 +1450,10 @@ sub collect {
       $nnrpd_gethostbyaddr{"? (can't getpeername)"}++;
       return 1;
     }
+    # can't getsockname
+    return 1 if $left =~ /^\S+ can\'t getsockname$/o;
+    # reverse lookup failed
+    return 1 if $left =~ /^\? reverse lookup for \S+ failed: .* -- using IP address for access$/o;
     # profile timer
     # ME time X nnnn X(X) [...]
     # The exact timers change from various versions of INN, so try to deal
@@ -1435,25 +1470,35 @@ sub collect {
         my $average = $2 / ($3 || 1);
         $nnrpd_time_time{$name} += $2;
         $nnrpd_time_num{$name} += $3;
-        $nnrpd_time_min{$name} = $average
-          if ($3 && $nnrpd_time_min{$name} > $average);
-        $nnrpd_time_max{$name} = $average
-          if ($3 && $nnrpd_time_max{$name} < $average);
+        if ($3) {
+          my $min = $nnrpd_time_min{$name};
+          $nnrpd_time_min{$name} = $average
+            if (defined($min) && $min > $average);
+          my $max = $nnrpd_time_max{$name};
+          $nnrpd_time_max{$name} = $average
+            if (defined($max) && $max < $average);
+        }
       }
       return 1;
     }
     # ME dropping articles into ...
-    return 1 if $left = ~/ME dropping articles into /o;
+    return 1 if $left =~ /ME dropping articles into /o;
     # newnews (interesting but ignored till now)
     return 1 if $left =~ /^\S+ newnews /o;
     # cant fopen (ignored too)
     return 1 if $left =~ /^\S+ cant fopen /o;
-    # cant read No route to host
-    return 1 if $left =~ /cant read No route to host/o;
-    # cant read Broken pipe
-    return 1 if $left =~ /cant read Broken pipe/o;
+    # can't read: No route to host
+    return 1 if $left =~ /can\'t read: No route to host/o;
+    # can't read: Broken pipe
+    return 1 if $left =~ /can\'t read: Broken pipe/o;
+    # eof in post
+    return 1 if $left =~ /^\S+ eof in post$/o;
     # ioctl: ...
     return 1 if $left =~ /^ioctl: /o;
+    # other stats
+    return 1 if $left =~ /^\S+ overstats count \d+ hit \d+ miss \d+ time \d+ size \d+ dbz \d+ seek \d+ get \d+ artcheck \d+$/o;
+    # starttls
+    return 1 if $left =~ /^starttls: \S+ with cipher \S+ \(\d+\/\d+ bits\) no authentication$/o;
   }
   ########
   ## inndstart
@@ -1675,10 +1720,10 @@ sub collect {
     # unmoderated, m, etc. depending on what the control message says.  It
     # can even have multiple words, which we still don't handle.
     if ($left =~ m/^control_(\S+),    # type of msg
-		  \s(?:\S+)?          # newsgroup name
-		  (\s\S+)?            # optional
-		  \s(\S+)             # email
-                  \s\S+               # email
+                  \s(?:\S+)?          # newsgroup name
+                  (\s\S+)?            # optional
+                  \s(\S+)             # e-mail
+                  \s\S+               # e-mail
                   \s\S+,              # filename
                   \s\S+,              # server
                   \s([^=,]+(?:=\S+)?),            # action
@@ -1699,6 +1744,8 @@ sub collect {
       $controlchan_doit{$email}++ if $action eq 'doit';
       return 1;
     }
+    # checkgroups processed (no change or not)
+    return 1 if $left =~ /^checkgroups by \S+ processed/o;
   }
 
   ###########
@@ -1748,7 +1795,7 @@ sub collect {
       $cnfsstat{$buffer} = $class;
 
       # If the size changed, invalidate all of our running fill rate stats.
-      if ($size != $cnfsstat_size{$buffer}) {
+      if (!exists($cnfsstat_size{$buffer}) ||  $size != $cnfsstat_size{$buffer}) {
         delete $cnfsstat_rate{$buffer};
         delete $cnfsstat_samples{$buffer};
         delete $cnfsstat_time{$buffer};
@@ -1806,9 +1853,9 @@ sub adjust {
 	my $dom = &host2dom($serv);
 	if ($nnrpd_no_permission{$serv}) {
 	  $nnrpd_dom_connect{$dom} -= $nnrpd_connect{$serv}
-	    if defined $nnrpd_dom_connect{$dom};
+	    if defined $nnrpd_dom_connect{$dom} && defined $nnrpd_connect{$serv};
 	  $nnrpd_dom_groups{$dom}  -= $nnrpd_groups{$serv}
-	    if defined $nnrpd_dom_groups{$dom};
+	    if defined $nnrpd_dom_groups{$dom} && defined $nnrpd_groups{$serv};
 	  $nnrpd_dom_times{$dom}   -= $nnrpd_times{$serv}
 	    if defined $nnrpd_dom_times{$dom};
 	  $nnrpd_connect{$serv} -= $nnrpd_no_permission{$serv};
diff -Nrup inn-2.4.4/site/Makefile inn-2.4.5/site/Makefile
--- inn-2.4.4/site/Makefile	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/site/Makefile	2008-06-29 10:56:57.000000000 -0700
@@ -1,4 +1,4 @@
-##  $Revision: 7512 $
+##  $Revision: 7907 $
 include ../Makefile.global
 top = ..
 
@@ -20,9 +20,12 @@ PATH_TCL_STARTUP	= ${PATHFILTER}/startup
 PATH_TCL_FILTER		= ${PATHFILTER}/filter.tcl
 PATH_PYTHON_FILTER_INND = ${PATHFILTER}/filter_innd.py
 PATH_PYTHON_INN_MODULE  = ${PATHFILTER}/INN.py
+PATH_PYTHON_NNRPD_MODULE= ${PATHFILTER}/nnrpd.py
 PATH_NNRPAUTH           = ${PATHFILTER}/nnrpd_auth.pl
 PATH_NNRPYAUTH          = ${PATHFILTER}/nnrpd_auth.py
 PATH_NNRPACCESS         = ${PATHFILTER}/nnrpd_access.pl
+PATH_NNRPYACCESS        = ${PATHFILTER}/nnrpd_access.py
+PATH_NNRPYDYNAMIC       = ${PATHFILTER}/nnrpd_dynamic.py
 
 PATH_CONFIG		= ${PATHETC}/inn.conf
 PATH_CONTROLCTL		= ${PATHETC}/control.ctl
@@ -61,8 +64,9 @@ REST		= \
 	innwatch.ctl distrib.pats actsync.cfg actsync.ign \
 	motd.news storage.conf cycbuff.conf buffindexed.conf \
 	innfeed.conf startup_innd.pl filter_innd.pl filter_nnrpd.pl \
-	filter_innd.py INN.py \
+	filter_innd.py INN.py nnrpd.py \
 	startup.tcl filter.tcl nnrpd_auth.pl nnrpd_access.pl \
+	nnrpd_access.py nnrpd_dynamic.py \
         news2mail.cf readers.conf \
 	radius.conf nnrpd_auth.py ovdb.conf sasl.conf active.minimal \
 	newsgroups.minimal subscriptions
@@ -82,9 +86,10 @@ REST_INSTALLED	= \
 	$D$(PATH_INNFEEDCTL) $D$(PATH_PERL_STARTUP_INND) \
 	$D$(PATH_PERL_FILTER_INND) $D$(PATH_PERL_FILTER_NNRPD) \
 	$D$(PATH_PYTHON_FILTER_INND) $D$(PATH_PYTHON_INN_MODULE) \
-	$D$(PATH_TCL_STARTUP) $D$(PATH_TCL_FILTER) \
+	$D$(PATH_TCL_STARTUP) $D$(PATH_TCL_FILTER) $D$(PATH_PYTHON_NNRPD_MODULE) \
 	$D$(PATH_NNRPAUTH) $D$(PATHETC)/news2mail.cf $D$(PATH_READERSCONF) \
 	$D$(PATH_RADIUS_CONF) $D$(PATH_NNRPYAUTH) $D$(PATH_OVDB_CONF) \
+	$D$(PATH_NNRPYACCESS) $D$(PATH_NNRPYDYNAMIC) \
 	$D$(PATH_SASL_CONF) $D$(PATH_SUBSCRIPTIONS) $D$(PATH_NNRPACCESS)
 
 ALL_INSTALLED	= $(MOST_INSTALLED) $(REST_INSTALLED)
@@ -191,11 +196,14 @@ $D$(PATH_PERL_FILTER_INND): filter_innd.
 $D$(PATH_PERL_FILTER_NNRPD): filter_nnrpd.pl ; $(COPY_RPUB) $? $@
 $D$(PATH_PYTHON_FILTER_INND): filter_innd.py ; $(COPY_RPUB) $? $@
 $D$(PATH_PYTHON_INN_MODULE): INN.py ;	$(COPY_RPUB) $? $@
+$D$(PATH_PYTHON_NNRPD_MODULE): nnrpd.py ;   $(COPY_RPUB) $? $@
 $D$(PATH_TCL_STARTUP): startup.tcl	; $(COPY_RPUB) $? $@
 $D$(PATH_TCL_FILTER): filter.tcl	; $(COPY_RPUB) $? $@
 $D$(PATH_NNRPAUTH): nnrpd_auth.pl       ; $(COPY_RPUB) $? $@
-$D$(PATH_NNRPACCESS): nnrpd_access.pl     ; $(COPY_RPUB) $? $@
+$D$(PATH_NNRPACCESS): nnrpd_access.pl   ; $(COPY_RPUB) $? $@
 $D$(PATH_NNRPYAUTH): nnrpd_auth.py      ; $(COPY_RPUB) $? $@
+$D$(PATH_NNRPYACCESS): nnrpd_access.py  ; $(COPY_RPUB) $? $@
+$D$(PATH_NNRPYDYNAMIC): nnrpd_dynamic.py     ; $(COPY_RPUB) $? $@
 $D$(PATH_ACTSYNC_CFG): actsync.cfg	; $(COPY_RPUB) $? $@
 $D$(PATH_ACTSYNC_IGN): actsync.ign	; $(COPY_RPUB) $? $@
 $D$(PATH_MOTD): motd.news		; $(COPY_RPUB) $? $@
@@ -224,10 +232,13 @@ filter.tcl:	../samples/filter.tcl		; $(C
 nnrpd_auth.pl:  ../samples/nnrpd_auth.pl	; $(COPY) $? $@
 nnrpd_access.pl:  ../samples/nnrpd_access.pl	; $(COPY) $? $@
 nnrpd_auth.py:  ../samples/nnrpd_auth.py	; $(COPY) $? $@
+nnrpd_access.py: ../samples/nnrpd_access.py     ; $(COPY) $? $@
+nnrpd_dynamic.py: ../samples/nnrpd_dynamic.py   ; $(COPY) $? $@
 filter_innd.pl:	../samples/filter_innd.pl	; $(COPY) $? $@
 filter_nnrpd.pl: ../samples/filter_nnrpd.pl	; $(COPY) $? $@
 filter_innd.py:	../samples/filter_innd.py	; $(COPY) $? $@
 INN.py:		../samples/INN.py		; $(COPY) $? $@
+nnrpd.py:       ../samples/nnrpd.py             ; $(COPY) $? $@
 incoming.conf:	../samples/incoming.conf	; $(COPY) $? $@
 inn.conf:	../samples/inn.conf		; $(COPY) $? $@
 innreport.conf:	../samples/innreport.conf	; $(COPY) $? $@
diff -Nrup inn-2.4.4/support/config.guess inn-2.4.5/support/config.guess
--- inn-2.4.4/support/config.guess	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/support/config.guess	2008-06-29 10:56:57.000000000 -0700
@@ -4,7 +4,7 @@
 #   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
 #   Free Software Foundation, Inc.
 
-timestamp='2008-03-12'
+timestamp='2008-04-14'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -985,9 +985,6 @@ EOF
 	  a.out-i386-linux)
 		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
 		exit ;;
-	  coff-i386)
-		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
-		exit ;;
 	  "")
 		# Either a pre-BFD a.out linker (linux-gnuoldld) or
 		# one that does not give us useful --help.
diff -Nrup inn-2.4.4/support/config.sub inn-2.4.5/support/config.sub
--- inn-2.4.4/support/config.sub	2008-05-05 03:18:36.000000000 -0700
+++ inn-2.4.5/support/config.sub	2008-06-29 10:56:57.000000000 -0700
@@ -4,7 +4,7 @@
 #   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
 #   Free Software Foundation, Inc.
 
-timestamp='2008-03-26'
+timestamp='2008-04-14'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -530,6 +530,10 @@ case $basic_machine in
 		basic_machine=m88k-motorola
 		os=-sysv3
 		;;
+	dicos)
+		basic_machine=i686-pc
+		os=-dicos
+		;;
 	djgpp)
 		basic_machine=i586-pc
 		os=-msdosdjgpp
@@ -1392,6 +1396,9 @@ case $os in
 	-zvmoe)
 		os=-zvmoe
 		;;
+	-dicos*)
+		os=-dicos
+		;;
 	-none)
 		;;
 	*)