Draft specification for future X-Trace header

Russ Allbery rra at stanford.edu
Wed Jul 12 05:26:55 UTC 2000


James Ralston <qralston+ml.inn-workers at andrew.cmu.edu> writes:

> The main reason I want to see this is because I want to be able to
> squash any supplied Date: header of submitted articles and have nnrpd
> generate the Date: header itself.

Don't do that the way you describe it; you'll cause loops.  We've seen it
happen numerous times, and it's been discussed on news.software.nntp to
death.  It's not theoretical; sooner or later, you'll get someone who
sucks down articles and then feeds them to your server via POST just long
enough after they were posted that they've dropped out of your history.

USEFOR has, under "Procedure to be followed by Injecting Agents":

   2. It MUST reject any article whose Date header is more than 24 hours
      into the past or into the future (cf. 5.1).

and:

   8. The injecting agent MAY add other headers not already provided by
      the poster, but SHOULD NOT alter, delete or reorder any headers
      already present in the article (except for headers intended for
      tracing purposes). The injecting agent MUST NOT alter the body of
      the article in any way.

If you drop the Date header without checking it, you're violating a MUST.
If you check the Date header first and reject the message if it's too old,
that's probably safe even if you still drop it and generate your own
(hence you're only violating a SHOULD), but it's still not considered good
behavior.

> I run NTP on my news servers, so I trust any Date: headers they generate
> to be fairly accurate.  In contrast, most of our newsreader clients are
> Windows boxes, and their clocks are all over the place, often off by
> days, weeks, or even months.

If you reject their posts, they might fix their clocks.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>



More information about the inn-workers mailing list