* [PATCH net 0/2] tipc: fix the mtu update in link mtu negotiation
@ 2023-04-29 22:40 Xin Long
2023-04-29 22:40 ` [PATCH net 1/2] tipc: add tipc_bearer_min_mtu to calculate min mtu Xin Long
2023-04-29 22:40 ` [PATCH net 2/2] tipc: do not update mtu if msg_max is too small Xin Long
0 siblings, 2 replies; 6+ messages in thread
From: Xin Long @ 2023-04-29 22:40 UTC (permalink / raw)
To: network dev, tipc-discussion
Cc: davem, kuba, Eric Dumazet, Paolo Abeni, Jon Maloy
This patchset fixes a crash caused by a too small MTU carried in the
activate msg. Note that as such malicious packet does not exist in
the normal env, and the fix won't break any application.
The 1st patch introduces a function to calculate the minimum MTU for
the bearer, and the 2nd patch fixes the crash with this function.
Xin Long (2):
tipc: add tipc_bearer_min_mtu to calculate min mtu
tipc: do not update mtu if msg_max is too small
net/tipc/bearer.c | 13 +++++++++++++
net/tipc/bearer.h | 3 +++
net/tipc/link.c | 7 ++++---
net/tipc/udp_media.c | 5 +++--
4 files changed, 23 insertions(+), 5 deletions(-)
--
2.39.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net 1/2] tipc: add tipc_bearer_min_mtu to calculate min mtu
2023-04-29 22:40 [PATCH net 0/2] tipc: fix the mtu update in link mtu negotiation Xin Long
@ 2023-04-29 22:40 ` Xin Long
2023-05-01 5:21 ` [tipc-discussion] " Tung Quang Nguyen
2023-04-29 22:40 ` [PATCH net 2/2] tipc: do not update mtu if msg_max is too small Xin Long
1 sibling, 1 reply; 6+ messages in thread
From: Xin Long @ 2023-04-29 22:40 UTC (permalink / raw)
To: network dev, tipc-discussion
Cc: davem, kuba, Eric Dumazet, Paolo Abeni, Jon Maloy
As different media may requires different min mtu, and even the
same media with different net family requires different min mtu,
add tipc_bearer_min_mtu() to calculate min mtu accordingly.
This API will be used to check the new mtu when doing the link
mtu negotiation in the next patch.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
net/tipc/bearer.c | 13 +++++++++++++
net/tipc/bearer.h | 3 +++
net/tipc/udp_media.c | 5 +++--
3 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 35cac7733fd3..c5d2e8c45f88 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -541,6 +541,19 @@ int tipc_bearer_mtu(struct net *net, u32 bearer_id)
return mtu;
}
+int tipc_bearer_min_mtu(struct net *net, u32 bearer_id)
+{
+ int mtu = TIPC_MIN_BEARER_MTU;
+ struct tipc_bearer *b;
+
+ rcu_read_lock();
+ b = rcu_dereference(tipc_net(net)->bearer_list[bearer_id]);
+ if (b)
+ mtu += b->encap_hlen;
+ rcu_read_unlock();
+ return mtu;
+}
+
/* tipc_bearer_xmit_skb - sends buffer to destination over bearer
*/
void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 490ad6e5f7a3..bd0cc5c287ef 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -146,6 +146,7 @@ struct tipc_media {
* @identity: array index of this bearer within TIPC bearer array
* @disc: ptr to link setup request
* @net_plane: network plane ('A' through 'H') currently associated with bearer
+ * @encap_hlen: encap headers length
* @up: bearer up flag (bit 0)
* @refcnt: tipc_bearer reference counter
*
@@ -170,6 +171,7 @@ struct tipc_bearer {
u32 identity;
struct tipc_discoverer *disc;
char net_plane;
+ u16 encap_hlen;
unsigned long up;
refcount_t refcnt;
};
@@ -232,6 +234,7 @@ int tipc_bearer_setup(void);
void tipc_bearer_cleanup(void);
void tipc_bearer_stop(struct net *net);
int tipc_bearer_mtu(struct net *net, u32 bearer_id);
+int tipc_bearer_min_mtu(struct net *net, u32 bearer_id);
bool tipc_bearer_bcast_support(struct net *net, u32 bearer_id);
void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
struct sk_buff *skb,
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index c2bb818704c8..0a85244fd618 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -738,8 +738,8 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
udp_conf.local_ip.s_addr = local.ipv4.s_addr;
udp_conf.use_udp_checksums = false;
ub->ifindex = dev->ifindex;
- if (tipc_mtu_bad(dev, sizeof(struct iphdr) +
- sizeof(struct udphdr))) {
+ b->encap_hlen = sizeof(struct iphdr) + sizeof(struct udphdr);
+ if (tipc_mtu_bad(dev, b->encap_hlen)) {
err = -EINVAL;
goto err;
}
@@ -760,6 +760,7 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
else
udp_conf.local_ip6 = local.ipv6;
ub->ifindex = dev->ifindex;
+ b->encap_hlen = sizeof(struct ipv6hdr) + sizeof(struct udphdr);
b->mtu = 1280;
#endif
} else {
--
2.39.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH net 2/2] tipc: do not update mtu if msg_max is too small
2023-04-29 22:40 [PATCH net 0/2] tipc: fix the mtu update in link mtu negotiation Xin Long
2023-04-29 22:40 ` [PATCH net 1/2] tipc: add tipc_bearer_min_mtu to calculate min mtu Xin Long
@ 2023-04-29 22:40 ` Xin Long
2023-05-01 5:22 ` Tung Quang Nguyen
1 sibling, 1 reply; 6+ messages in thread
From: Xin Long @ 2023-04-29 22:40 UTC (permalink / raw)
To: network dev, tipc-discussion
Cc: davem, kuba, Eric Dumazet, Paolo Abeni, Jon Maloy
When doing link mtu negotiation, a malicious peer may send Activate msg
with a very small mtu, e.g. 4 in Shuang's testing, without checking for
the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then
n->links[bearer_id].mtu is set to 4294967228, which is a overflow of
'4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss().
With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning:
tipc: Too large msg, purging xmit list 1 5 0 40 4!
tipc: Too large msg, purging xmit list 1 15 0 60 4!
And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in
named_distribute(), and when purging it in tipc_link_xmit(), a crash
was even caused:
general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI
CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19
RIP: 0010:kfree_skb_list_reason+0x7e/0x1f0
Call Trace:
<IRQ>
skb_release_data+0xf9/0x1d0
kfree_skb_reason+0x40/0x100
tipc_link_xmit+0x57a/0x740 [tipc]
tipc_node_xmit+0x16c/0x5c0 [tipc]
tipc_named_node_up+0x27f/0x2c0 [tipc]
tipc_node_write_unlock+0x149/0x170 [tipc]
tipc_rcv+0x608/0x740 [tipc]
tipc_udp_recv+0xdc/0x1f0 [tipc]
udp_queue_rcv_one_skb+0x33e/0x620
udp_unicast_rcv_skb.isra.72+0x75/0x90
__udp4_lib_rcv+0x56d/0xc20
ip_protocol_deliver_rcu+0x100/0x2d0
This patch fixes it by checking the new mtu against tipc_bearer_min_mtu(),
and not updating mtu if it is too small.
Fixes: ed193ece2649 ("tipc: simplify link mtu negotiation")
Reported-by: Shuang Li <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
net/tipc/link.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/tipc/link.c b/net/tipc/link.c
index b3ce24823f50..a9e46c58b28a 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2200,7 +2200,7 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
struct tipc_msg *hdr = buf_msg(skb);
struct tipc_gap_ack_blks *ga = NULL;
bool reply = msg_probe(hdr), retransmitted = false;
- u32 dlen = msg_data_sz(hdr), glen = 0;
+ u32 dlen = msg_data_sz(hdr), glen = 0, msg_max;
u16 peers_snd_nxt = msg_next_sent(hdr);
u16 peers_tol = msg_link_tolerance(hdr);
u16 peers_prio = msg_linkprio(hdr);
@@ -2283,8 +2283,9 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
l->peer_session = msg_session(hdr);
l->in_session = true;
l->peer_bearer_id = msg_bearer_id(hdr);
- if (l->mtu > msg_max_pkt(hdr))
- l->mtu = msg_max_pkt(hdr);
+ msg_max = msg_max_pkt(hdr);
+ if (msg_max >= tipc_bearer_min_mtu(l->net, l->bearer_id) && l->mtu > msg_max)
+ l->mtu = msg_max;
break;
case STATE_MSG:
--
2.39.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* RE: [tipc-discussion] [PATCH net 1/2] tipc: add tipc_bearer_min_mtu to calculate min mtu
2023-04-29 22:40 ` [PATCH net 1/2] tipc: add tipc_bearer_min_mtu to calculate min mtu Xin Long
@ 2023-05-01 5:21 ` Tung Quang Nguyen
[not found] ` <CADvbK_cbgUh4XN2C+xQuM6PKSXEW2LLyE0E2QtePeTce6NdP-g@mail.gmail.com>
0 siblings, 1 reply; 6+ messages in thread
From: Tung Quang Nguyen @ 2023-05-01 5:21 UTC (permalink / raw)
To: Xin Long, network dev, tipc-discussion@lists.sourceforge.net
Cc: kuba@kernel.org, Eric Dumazet, Paolo Abeni, davem@davemloft.net
>-----Original Message-----
>From: Xin Long <lucien.xin@gmail.com>
>Sent: Sunday, April 30, 2023 5:41 AM
>To: network dev <netdev@vger.kernel.org>; tipc-discussion@lists.sourceforge.net
>Cc: kuba@kernel.org; Eric Dumazet <edumazet@google.com>; Paolo Abeni <pabeni@redhat.com>; davem@davemloft.net
>Subject: [tipc-discussion] [PATCH net 1/2] tipc: add tipc_bearer_min_mtu to calculate min mtu
>
>As different media may requires different min mtu, and even the
>same media with different net family requires different min mtu,
>add tipc_bearer_min_mtu() to calculate min mtu accordingly.
>
>This API will be used to check the new mtu when doing the link
>mtu negotiation in the next patch.
>
>Signed-off-by: Xin Long <lucien.xin@gmail.com>
>---
> net/tipc/bearer.c | 13 +++++++++++++
> net/tipc/bearer.h | 3 +++
> net/tipc/udp_media.c | 5 +++--
> 3 files changed, 19 insertions(+), 2 deletions(-)
>
>diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
>index 35cac7733fd3..c5d2e8c45f88 100644
>--- a/net/tipc/bearer.c
>+++ b/net/tipc/bearer.c
>@@ -541,6 +541,19 @@ int tipc_bearer_mtu(struct net *net, u32 bearer_id)
> return mtu;
> }
>
>+int tipc_bearer_min_mtu(struct net *net, u32 bearer_id)
>+{
>+ int mtu = TIPC_MIN_BEARER_MTU;
>+ struct tipc_bearer *b;
>+
>+ rcu_read_lock();
>+ b = rcu_dereference(tipc_net(net)->bearer_list[bearer_id]);
>+ if (b)
>+ mtu += b->encap_hlen;
>+ rcu_read_unlock();
>+ return mtu;
>+}
>+
> /* tipc_bearer_xmit_skb - sends buffer to destination over bearer
> */
> void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
>diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
>index 490ad6e5f7a3..bd0cc5c287ef 100644
>--- a/net/tipc/bearer.h
>+++ b/net/tipc/bearer.h
>@@ -146,6 +146,7 @@ struct tipc_media {
> * @identity: array index of this bearer within TIPC bearer array
> * @disc: ptr to link setup request
> * @net_plane: network plane ('A' through 'H') currently associated with bearer
>+ * @encap_hlen: encap headers length
> * @up: bearer up flag (bit 0)
> * @refcnt: tipc_bearer reference counter
> *
>@@ -170,6 +171,7 @@ struct tipc_bearer {
> u32 identity;
> struct tipc_discoverer *disc;
> char net_plane;
>+ u16 encap_hlen;
> unsigned long up;
> refcount_t refcnt;
> };
>@@ -232,6 +234,7 @@ int tipc_bearer_setup(void);
> void tipc_bearer_cleanup(void);
> void tipc_bearer_stop(struct net *net);
> int tipc_bearer_mtu(struct net *net, u32 bearer_id);
>+int tipc_bearer_min_mtu(struct net *net, u32 bearer_id);
> bool tipc_bearer_bcast_support(struct net *net, u32 bearer_id);
> void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
> struct sk_buff *skb,
>diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
>index c2bb818704c8..0a85244fd618 100644
>--- a/net/tipc/udp_media.c
>+++ b/net/tipc/udp_media.c
>@@ -738,8 +738,8 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
> udp_conf.local_ip.s_addr = local.ipv4.s_addr;
> udp_conf.use_udp_checksums = false;
> ub->ifindex = dev->ifindex;
>- if (tipc_mtu_bad(dev, sizeof(struct iphdr) +
>- sizeof(struct udphdr))) {
>+ b->encap_hlen = sizeof(struct iphdr) + sizeof(struct udphdr);
>+ if (tipc_mtu_bad(dev, b->encap_hlen)) {
> err = -EINVAL;
> goto err;
> }
>@@ -760,6 +760,7 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
> else
> udp_conf.local_ip6 = local.ipv6;
> ub->ifindex = dev->ifindex;
>+ b->encap_hlen = sizeof(struct ipv6hdr) + sizeof(struct udphdr);
tipc_mtu_bad() needs to be called here to check for the minimum required MTU like the way ipv4 UDP bearer does.
> b->mtu = 1280;
> #endif
> } else {
>--
>2.39.1
>
>
>
>_______________________________________________
>tipc-discussion mailing list
>tipc-discussion@lists.sourceforge.net
>https://lists.sourceforge.net/lists/listinfo/tipc-discussion
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [PATCH net 2/2] tipc: do not update mtu if msg_max is too small
2023-04-29 22:40 ` [PATCH net 2/2] tipc: do not update mtu if msg_max is too small Xin Long
@ 2023-05-01 5:22 ` Tung Quang Nguyen
0 siblings, 0 replies; 6+ messages in thread
From: Tung Quang Nguyen @ 2023-05-01 5:22 UTC (permalink / raw)
To: Xin Long, network dev, tipc-discussion@lists.sourceforge.net
Cc: davem@davemloft.net, kuba@kernel.org, Eric Dumazet, Paolo Abeni,
Jon Maloy
>-----Original Message-----
>From: Xin Long <lucien.xin@gmail.com>
>Sent: Sunday, April 30, 2023 5:41 AM
>To: network dev <netdev@vger.kernel.org>; tipc-discussion@lists.sourceforge.net
>Cc: davem@davemloft.net; kuba@kernel.org; Eric Dumazet <edumazet@google.com>; Paolo Abeni <pabeni@redhat.com>; Jon Maloy
><jmaloy@redhat.com>
>Subject: [PATCH net 2/2] tipc: do not update mtu if msg_max is too small
>
>When doing link mtu negotiation, a malicious peer may send Activate msg
>with a very small mtu, e.g. 4 in Shuang's testing, without checking for
>the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then
>n->links[bearer_id].mtu is set to 4294967228, which is a overflow of
>'4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss().
>
>With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning:
>
> tipc: Too large msg, purging xmit list 1 5 0 40 4!
> tipc: Too large msg, purging xmit list 1 15 0 60 4!
>
>And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in
>named_distribute(), and when purging it in tipc_link_xmit(), a crash
>was even caused:
>
> general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI
> CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19
> RIP: 0010:kfree_skb_list_reason+0x7e/0x1f0
> Call Trace:
> <IRQ>
> skb_release_data+0xf9/0x1d0
> kfree_skb_reason+0x40/0x100
> tipc_link_xmit+0x57a/0x740 [tipc]
> tipc_node_xmit+0x16c/0x5c0 [tipc]
> tipc_named_node_up+0x27f/0x2c0 [tipc]
> tipc_node_write_unlock+0x149/0x170 [tipc]
> tipc_rcv+0x608/0x740 [tipc]
> tipc_udp_recv+0xdc/0x1f0 [tipc]
> udp_queue_rcv_one_skb+0x33e/0x620
> udp_unicast_rcv_skb.isra.72+0x75/0x90
> __udp4_lib_rcv+0x56d/0xc20
> ip_protocol_deliver_rcu+0x100/0x2d0
>
>This patch fixes it by checking the new mtu against tipc_bearer_min_mtu(),
>and not updating mtu if it is too small.
>
>Fixes: ed193ece2649 ("tipc: simplify link mtu negotiation")
>Reported-by: Shuang Li <shuali@redhat.com>
>Signed-off-by: Xin Long <lucien.xin@gmail.com>
>---
> net/tipc/link.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
>diff --git a/net/tipc/link.c b/net/tipc/link.c
>index b3ce24823f50..a9e46c58b28a 100644
>--- a/net/tipc/link.c
>+++ b/net/tipc/link.c
>@@ -2200,7 +2200,7 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
> struct tipc_msg *hdr = buf_msg(skb);
> struct tipc_gap_ack_blks *ga = NULL;
> bool reply = msg_probe(hdr), retransmitted = false;
>- u32 dlen = msg_data_sz(hdr), glen = 0;
>+ u32 dlen = msg_data_sz(hdr), glen = 0, msg_max;
> u16 peers_snd_nxt = msg_next_sent(hdr);
> u16 peers_tol = msg_link_tolerance(hdr);
> u16 peers_prio = msg_linkprio(hdr);
>@@ -2283,8 +2283,9 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
> l->peer_session = msg_session(hdr);
> l->in_session = true;
> l->peer_bearer_id = msg_bearer_id(hdr);
>- if (l->mtu > msg_max_pkt(hdr))
>- l->mtu = msg_max_pkt(hdr);
>+ msg_max = msg_max_pkt(hdr);
>+ if (msg_max >= tipc_bearer_min_mtu(l->net, l->bearer_id) && l->mtu > msg_max)
>+ l->mtu = msg_max;
If this link receives a malicious ACTIVATE_MSG from a peer, this message should be dropped. It is better if the check " msg_max < tipc_bearer_min_mtu()" is put at the beginning of this ACTIVATE_MSG handling and we break immediately.
> break;
>
> case STATE_MSG:
>--
>2.39.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [tipc-discussion] [PATCH net 1/2] tipc: add tipc_bearer_min_mtu to calculate min mtu
[not found] ` <CADvbK_cbgUh4XN2C+xQuM6PKSXEW2LLyE0E2QtePeTce6NdP-g@mail.gmail.com>
@ 2023-05-01 20:18 ` Xin Long
0 siblings, 0 replies; 6+ messages in thread
From: Xin Long @ 2023-05-01 20:18 UTC (permalink / raw)
To: Tung Quang Nguyen
Cc: network dev, tipc-discussion@lists.sourceforge.net,
kuba@kernel.org, Eric Dumazet, Paolo Abeni, davem@davemloft.net
On Mon, May 1, 2023 at 11:35 AM Xin Long <lucien.xin@gmail.com> wrote:
> On Mon, May 1, 2023 at 1:21 AM Tung Quang Nguyen <tung.q.nguyen@dektech.com.au> wrote:
>> >@@ -760,6 +760,7 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
>> > else
>> > udp_conf.local_ip6 = local.ipv6;
>> > ub->ifindex = dev->ifindex;
>> >+ b->encap_hlen = sizeof(struct ipv6hdr) + sizeof(struct udphdr);
>> tipc_mtu_bad() needs to be called here to check for the minimum required MTU like the way ipv4 UDP bearer does.
>
> Agree, especially after commit 5a6f6f579178 ("tipc: set ub->ifindex for local ipv6 address"), we have the dev there.
After taking a second look, I think we should delete the tipc_mtu_bad()
call for ipv4 UDP bearer, as b->mtu is no longer using dev->mtu since:
commit a4dfa72d0acd ("tipc: set default MTU for UDP media")
The issue described in commit 3de81b758853 ("tipc: check minimum bearer MTU")
no longer exists in UDP bearer.
Besides, dev->mtu can still be changed to a too small mtu after the UDP
bearer is created even with the tipc_mtu_bad() check in tipc_udp_enable().
Note that NETDEV_CHANGEMTU event processing in tipc_l2_device_event()
doesn't really work for UDP bearer.
I will leave this patch as it is in my v2 post, and create another patch
for net-next to delete the unnecessary tipc_mtu_bad() check in UDP bearer.
Agree?
Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-05-01 20:18 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-04-29 22:40 [PATCH net 0/2] tipc: fix the mtu update in link mtu negotiation Xin Long
2023-04-29 22:40 ` [PATCH net 1/2] tipc: add tipc_bearer_min_mtu to calculate min mtu Xin Long
2023-05-01 5:21 ` [tipc-discussion] " Tung Quang Nguyen
[not found] ` <CADvbK_cbgUh4XN2C+xQuM6PKSXEW2LLyE0E2QtePeTce6NdP-g@mail.gmail.com>
2023-05-01 20:18 ` Xin Long
2023-04-29 22:40 ` [PATCH net 2/2] tipc: do not update mtu if msg_max is too small Xin Long
2023-05-01 5:22 ` Tung Quang Nguyen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).