v2.2.0-alpha

2.2-alpha "Bad Woerishofen" : 06-Oct-2025
NOTES:
This release was made possible due to extensive contributions by
additional developers mentioned in the AUTHORS file.

ADDED FEATURES:

• Finally, the "posting allowed" flag is considered in POST :)
• New configuration with dedicated connectors.
• TLS 1.0-1.3 with native connectors and STARTTLS (including mTLS and
  CRL), thanks to Sven Liebert (@SvenLie). Also massive thanks to
  Michael Dunsky and Christoph Grill for their contributions on
  the TLS implementation of WendzelNNTPd!
• Docker environment for development purposes was provided by
  @SvenLie -- thanks for that!
• Add Docker image for production use (thanks to @oleludwig)
• EXPERIMENTAL:
  • EXP: Added Postgres database support (experimental), thanks to
    Christian Barthel for providing a massive patch!
  • EXP: Added option to store unique message ID and message body in
    the DB (postgres only), thanks to Christian Barthel for providing
    the patch!
• Added packages for several Linux distributions via openSUSE build
  service -- thx to @oleludwig.

FIXES:

• Fixed some memory leaks during postings that would occur on rather
  rare errors.
• Fixed two buffer overflows of PR#44; thanks to @oleludwig
• Once xhdr requested "date", all following responses were interpreted
  as "date" format, too. Solved this by resetting inf->speccmd = 0;
• Make sure that Sqlite3 statements with quotes are double-escaped to
  prevent SQL injections. *** security fix ***
• Fix database check in src/include/main.h, thx to @christian Barthel.
• Improved error handling in multiple locations.
• Fix OpenBSD compiler error and use cc instead of gcc under Open/Net/
  FreeBSD.
• Signal handler was improved. Some uncaught signals killed the server
  (thanks to @SvenLie)
• Fix the password hashing function. The last character of the password
  is no longer truncated and the hash is correctly converted to the
  hexadecimal representation. User databases need to be re-generated
  using wendzelnntpadm, see `upgrade' instructions in the documentation.
  Thanks to @oleludwig for sending the patch.
• Fix the SQL script mysql_db_struct.sql (thanks to @oleludwig):
  • Increase the size of the password column in the users table to 64 to
    be big enough for the password hashes
  • Use unique names for the foreign key constraints to avoid the error
    (errno: 121 "Duplicate key on write or update")
  • change the type of the of the header column in the postings table
    from VARCHAR to TEXT to stay under the limit of 16383 characters per
    column on databases which use the charset utfmb4 with 4 bytes per
    character
• Fix the detection of %z support in strftime for systems using gcc14
  or newer.
• Fix the detection of the PostgreSQL client library on openSUSE
• Fix some errors when compiling and executing wendzelnntpd on a 32 bit
  system but with 64 bit time_t.
• Fix the usage output of the script create_certificate.
• Fix formatting in the man page for wendzelnntpadm.

MISC:

• Applied NetBSD pkgsrc patch for err feature and for lexer/parser
  functions from Michael Baeuerle; thx for that!
  (reference: https://github.com/jgoerzen/libnbcompat)
• Applied NetBSD pkgsrc patch to handle VERSION macro definition that
  is also introduced by libmash from Michael Baeuerle; thx for that!
• Updated SBo script to work with v. 2.1.3; fixed bug that made
  /usr/doc/wendzelnntpd-$ver/docs inaccessible (+x permission was
  missing)
• Shifted manpages to docs/
• Prevent usernames with non-alphanumeric characters and newsgroups
  with non-alphanumeric/./- letters.
• Whitespacing cleanup (thanks to @christian Barthel for providing a
  patch!)
• 'configure' script enhancements and cleanup (thanks to @christian
  Barthel for providing a patch to the previous configure script).
• Tried clang instead of gcc, just for fun. Seems to work if you
  just replace "gcc" with "clang" in Makefile.inc. Note that clang is
  not officially supported.
• Fixed some typos in CHANGELOG and HISTORY files.
• Improved the documentation.
• Installed atomic switches for SIGTERM and SIGHUP. It is now a
  stateful kill. SIGHUP can be used to signal conditions in future.
  Thanks to @SvenLie for the patch.
• Rewrite the configure-script with autoconf (thanks to @oleludwig):
  • Generate configure with autoconf from autoconf.ac.
  • License autoconf.ac under GPLv3 like the rest of the project.
  • Replace Makefile and Makefile.inc with Makefile.in. The Makefile is
    generated by configure from Makefile.in.
  • Use macros from the Autoconf Macro Archive in configure.ac for the
    detection of compile flags, the mysql, postgresql, sqlite3 and
    openssl libraries and for bison and pthread support and place the
    macros in the m4 subdirectory.
  • Features are now enabled/disabled by CLI flags instead of environment
    variables:
    • --disable-sqlite replaces SQLITE=NO
    • --disable-mysql replaces MYSQL=NO
    • --disable-tls replaces TLS=NO
    • --enable-postgres replaces POSTGRES=YES
  • Compiler optimizations (-O2) are enabled by default when compiling
    with gcc.
  • The Makefile uses standardized variables from autoconf for the
    compiler flags and installation directories like @sysconfdir@ for the
    configfiles, @sbindir@ for the binaries, @DocDir@ for the
    documentation and @mandir@ for the manfiles.
    • Use @sysconfdir@ instead of CONFDIR
    • Use $(DESTDIR)$(sysconfdir) instead of FAKECDIR
  • The Makefile uses variables from autoconf for calling the install
    program in the install target. The variables can be overridden.
  • Define the versionnumber and releasename in configure.ac instead of
    main.h.
  • Add some files to .gitignore which are autogenerated by the configure
    script and some autotools. Remove the obsolete entry for Makefile.inc.
  • Adapt the github actions workflow and the reflex.conf to the changed
    configure script.
• Separate the variable UDBFILE in the Makefile into UDBFILE and UDBPATH
  and use the UDBPATH in more places, to make it possible to install the
  database to another location, by overriding the variable when calling
  make (thanks to @oleludwig).
• Separated the DESTDIR variable in the Makefile into DESTDIR (empty by
  default and only included in the Makefile, not in configure) and prefix
  (/usr/local by default and overridable when calling configure or make),
  (thanks to @oleludwig)
• Combine CFLAGS and BUILDFLAGS into CFLAGS in the Makefile.
• Do not change the permissions for files and directories with chmod
  anymore. Pass for example "-m 0700" to the install command if special
  permissions are needed or leave it out if the defaults from
  @INSTALL_PROGRAM@ and @INSTALL_DATA@ are enough. This makes it possible
  to change the behavior by overriding the variables for INSTALL_PROGRAM
  and INSTALL_DATA (thanks to @oleludwig).
• Do not change the owner and group of the created files and directories
  in the make install target. This change makes it possible to run
  "make install" without root rights by setting the DESTDIR to a path
  owned by the user (thanks to @oleludwig).
• New make target to create the init.d_script by replacing the daemon-path
  with a variable from autoconf (thanks to @oleludwig).
• Remove the getver.sh script. The make target print_version uses
  variables from autoconf instead (thanks to @oleludwig).
• Use "-n" instead of "-g" as the flag for the sort command in the Make
  target count because it is standardized and results in the same sorting
  (thanks to @oleludwig).
• Also update the manpages when calling "make upgrade" (thx @oleludwig).
• Refactor make targets lex.yy.o and config.tab.o to avoid build failures
  when lex.yy.c got deleted and avoid unnecessary recompilations (thanks
  to @oleludwig).
• Add extensive tests for wendzelnntpd and wendzelnntpadm covering all
  supported NNTP commands and all commands of wendzelnntpadm (thanks to
  @oleludwig)
• Execute the tests on some Linux and BSD distributions and on
  different architectures (thanks to @oleludwig).
• Improve the detection of root privileges in the script
  create_certificate (thanks to @oleludwig).
• Switch license of the file wendzelnntpd.SlackBuild to GPLv3
• Migrate the source code of the documentation from latex to markdown.
  Generate the HTML version of the documentation with mkdocs and make it
  available under https://cdpxe.github.io/WendzelNNTPd/. Generate the PDF
  version of the documentation with pandoc and make it available under
  https://cdpxe.github.io/WendzelNNTPd/docs.pdf. (thanks to @oleludwig)
• Move wendzelnntpd.conf into the subdirectory wendzelnntpd together
  with the SSL certificates, so the new default location for
  wendzelnntpd.conf is /usr/local/etc/wendzelnntpd/wendzelnntpd.conf.
• Add systemd service unit for wendzelnntpd (thanks to @oleludwig)
• Change installation paths for usenet.db_struct and mysql_db_struct.sql
  from /usr/local/share/docs to /usr/local/share/wendzelnntpd
• Add man pages for create_certificate and wendzelnntpd.conf (thanks to
  @oleludwig)
• MySQL is also supported on BSD systems (thanks to @oleludwig)

v2.1.3

2.1.3-stable "Friedrichroda" : 17-Apr-2021:

As usual, every new release gets named after a nice travel location.
This time it is Friedrichroda, Germany.

FIXES:

• Do not exit on SIG_PIPE (broken pipe) *** security fix (DoS) ***.
  This would be exploitable easily by "echo | telnet hostname port"!
  This fix requires support for the send() flag MSG_NOSIGNAL. Seems
  to be present in *BSD and Linux (at least).
• Modified regex checks during POST command:
  • Prevent postings to Newsgroups: ,,,
  • Prevent sender '@'
  • Prevent \r\n\t in subjects
  • Unified structure of regex tests with macros
• Minor fix in documentation for ACL management.

ADDED FEATURES:

• Created the manpages wendzelnntpd(8) and wendzelnntpadm(8).
• The make target "install" now installs manpages, too.

MISC:

• Listen on ::1 per default, too (in addition to 127.0.0.1).
• Slackware build script does not require make install anymore,
  which makes the whole process much cleaner. Also, this is quicker.
• Added additional meta-data for https://slackbuilds.org compatibility (beta).
• Applied several adjustments and improvements from SBo's repository.
• Improved some comments in the code.

v2.1.2

2.1.2-current "Sydney/Waverton" : 29-Mar-2021
ADDED_FEATURES:

• Slackware package for amd64 was added (beta!)
• Added support for parameters -h and -v now to check for the version.
• init (rc.d) script is now patched to desired DESTDIR in configure.
  FIXES:
• Incorrect path for database files from create_code_pkg.sh was used
  in the last tarball (support for this script now dropped; see MISC).
  MISC:
• Improved wording/fixed some typos.
• Dropped create_code_pkg.sh because of path inconsistency; we now
  use github for this job.

v2.1.1

This is just a tiny improvement of the documentation of v.2.1.0. No actual changes were made in the code. This release is named Crows Nest, after one of my favorite parts of Sydney during the years when I was a regular visitor of NSW.

2.1.1-stable "Sydney/Crows Nest" : 05-Jan-2021

MISC:

• Updated documentation to better reflect the new 2.1 sub-version.
• Tiny adjustments of provided text files.
• Removed "OSE (Open Source Edition)" string as there is (nor ever
  was!) a non-free edition of this software.

v2.1.0

2.1.0-alpha "Sydney (Post-NYE Release 2021)" : 04-Jan-2021

FIXES:

• Improved error handling in database.c:
  • Removed a memory leak and unclosed file handles in case of errors
• Improved error handling in db_sqlite3.c:
  • Explicitly use zero body length if length of body is zero
    (should not be possible but this makes the code safer).

ADDED_FEATURES:

• Finally, passwords are saved using a hash function (SHA2, 256 bits).
  The hashed string is a concatenation of a configurable system-wide
  salt, the username and the password. This is not a perfect solution
  since it would be better to have unique salts per user (currently
  the "unique salt" is just the username), but it is at least a start.

MISC:

• Improved documentation, thanks to @deavmi
• Default max size for postings is now 20 MBytes in config file.
• Tiny improvements of coding style

WendzelNNTPd-2.0.9 (Christmas Release 2017)

Please note that this is a minor clean-up release. No upgrades are necessary.

2.0.9-stable "Bergen, Christmas Releae 2017" : 18-Dec-2017
 FIXES:
 - 'configure' script did not check whether the `install' tool is
   present. The tool's presence is now also checked.
 MISC:
 - Old RFC 850 mentions YY (two-digit) yearly format. However, INNd
   uses YYYY (four-digit) yearly format. WendzelNNTPd now does the
   same.
 - Tiny code cleanup (removed two doubled prototype definitions).
 - Ran WendzelNNTPd with lib efence, just to see whether memory leaks
   would be detected. Executed (hopefully) all possible NNTP commands.
   No memory leaks were revealed. However, tested only Sqlite3 setup,
   not MySQL.

WendzelNNTPd-2.0.8

This new minor release is basically just an improvement for those who are new to WendzelNNTPd. The documentation was improved and the code now compiles a bit easier under FreeBSD. No bugs were discovered or fixed and an update from v.2.0.7 is not necessary.

2.0.8-stable "Oslo" : 31-Jan-2017
 ADDED_FEATURES:
 - *BSD support: Add comment how to install WendzelNNTPd under FreeBSD
   and other BSD derivates in documentation and also adjust the Makefile
   accordingly since group "root" is called "wheel" there. Now use 0:0
   instead of root:root in install/upgrade targets of the Makefile.
 MISC:
 - Slight improvement of the documentation (how to start/stop/restart
   the service and how to install the startup script) and in the expla-
   nation of the default config file (wendzelnntpd.conf).
 - Slight improvement of help output and comments in configure script
   and Makefile.
- Tiny code e-mail address clean-up

WendzelNNTPd v2.0.7

This new release fixes a problem with the XHDR command that led to problems with some Usenet clients (e.g. claws-mail). Additional tiny improvements were made to improve the error reporting.

No security fixes were applied but it is recommended to upgrade from all v2.0.x releases to v2.0.7 in order to prevent NNTP protocol problems with clients using XHDR.

As usual: Enjoy the new release!

WendzelNNTPd v2.0.6

This is the release of WendzelNNTPd-2.0.6. This release integrates a new feature to configure the max. allowed size of postings plus several tiny cleanups and improvements (especially in the documentation).

This release contains no security updates or bug fixes. If you run v2.0.5, no update will be required.

As usual: Have a lot of fun with this server!

WendzelNNTPd v2.0.5

This is the release of WendzelNNTPd-2.0.5, which was shifted from SourceForge (after many years!) to GitHub now. Have a lot of fun with this server!