filter_innd: Add sha256/sha512 for Cancel-Lock/Key.

[usenet/INN.git] / filter / cleanfeed.local

# vim: set tabstop=4 shiftwidth=4 expandtab syntax=perl:

use MIME::Base64();
use Digest::SHA();

#
# local_filter_cancel
#
sub local_filter_cancel {
   unless($hdr{Control} =~ m/^cancel\s+(<[^>]+>)/i) {
      return "Cancel with broken target ID";
   }
   return verify_cancel(\%hdr, $1, 'Cancel');
}

sub local_filter_after_emp {
   if (exists( $hdr{'Supersedes'} )) {
      #return verify_cancel(\%hdr, $hdr{'Supersedes'}, 'Supersedes');
      # verify_cancel is called, but not returned, so the
      # posting is unconditionally accepted
      # verify_cancel calls INN:cancel() if verification suceeds
      verify_cancel(\%hdr, $hdr{'Supersedes'}, 'Supersedes');
   }

   return undef;
}

sub verify_cancel($$$) {
   my $r_hdr = shift || die;
   my $target = shift;
   my $descr = shift;

   my $headers = INN::head($target) || return "$descr of non-existing ID $target";

   my %headers;
   for my $line(split(/\s*\n/, $headers))    {
      if ($line =~ m/^([[:alnum:]-]+):\s+(.*)/) {
         $headers{$1} = $2;
         $lastkey = $1;
      } elsif ($line =~ m/^\s+(.*)/ and defined($lastkey)) {
         $headers{$lastkey} .= ' ' . $1;
      }
   }
   my $lock = $headers{'Cancel-Lock'};

   if (defined($lock)) {
      my $key = $r_hdr->{'Cancel-Key'} || return "$descr of $target without Cancel-Key";
      #return verify_cancel_key($key, $lock, ' target=' . $target);
      return verify_cancel_key($key, $lock, $target);
   } else {
    # -thh
    # no cancel-lock: go ahead and cancel anyway!
    INN::cancel($target);
   }

   return undef;
}

sub verify_cancel_key($$$) {
   my $cancel_key = shift;
   my $cancel_lock = shift;
   my $msg = shift;

   $msg = '' unless(defined($msg));
   # -thh
   my $target = $msg;
   $msg = ' target=' . $msg;

   my %lock;
   for my $l(split(/\s+/, $cancel_lock))   {
      next unless($l =~ m/^(sha512|sha256|sha1|md5):(\S+)/);
      $lock{$2} = $1;
   }

   for my $k(split(/\s+/, $cancel_key))    {
      unless($k =~ m/^(sha512|sha256|sha1|md5):(\S+)/) { 
        INN::syslog('notice', "Invalid Cancel-Key syntax '$k'.$msg");
        next;
      }

      my $key;
      if ($1 eq 'sha512') {
        $key = Digest::SHA::sha512($2);
      } elsif ($1 eq 'sha256') {
         $key = Digest::SHA::sha256($2);
      } elsif($1 eq 'sha1') {
         $key = Digest::SHA::sha1($2);
      } elsif ($1 eq 'md5') {
         $key = Digest::MD5::md5($2);
      }
      $key = MIME::Base64::encode_base64($key, '');

      if (exists($lock{$key})) { 
         # INN::syslog('notice', "Valid Cancel-Key $key found.$msg");
         # -thh
         # article is canceled now
         INN::cancel($target) if ($target);
         return undef;
      }
   }

   INN::syslog('notice',
      "No Cancel-Key[$cancel_key] matches Cancel-Lock[$cancel_lock]$msg"
   );
   return "No Cancel-Key matches Cancel-Lock.$msg";
}

1;