#!/usr/bin/perl
 
 use strict;
 use warnings;
 
 use Getopt::Long qw(:config gnu_getopt);
 
 sub wwarn {
 	my $w = shift;

 	warn "WARNING: $w\n";
 }
 
 sub tosconf {
 	my ($cfg, $v) = @_;
 	if($v) {
 		my $sep = $v=~/ / ? '"' : '';
 		$v = "\n$cfg $sep$v$sep";
 	}
 	return $v;

 }
 
 my $notify = 0;
 my $black = 0;
 my $report = 0;
 my $debug = 0;
 my $sign = 0;
 my $broad = 0;
 my $forge = 0;
 my $sanity = 1;
 my $blackhole = 0;
 my $quarantine = 0;
 my $rate = 0;
 my $monitor = 0;
 my $oninfected = 'Reject';
 my $onfail = 'Defer';
 my @localnets = ();

 my $whitelist = '';

 my $config = '';
 my $chroot = '';
 my $pidfile = '';
 my $addheader = 1;
 my $tcpclamds = '';
 my $localclamd;
 
 GetOptions (
 	"from|a:s" => \$notify,
 	"bounce|b" => \$notify,
 	"headers|H" => \$notify,
 	"postmaster|p=s" => \$notify,
 	"postmaster-only|P" => \$notify,
 	"template-file|t=s" => \$notify,
 	"template-headers|1=s" => \$notify,
 	"quiet|q" => sub { $notify = 0 },
 	"dont-blacklist|K=s" => \$black,
 	"blacklist-time|k=i" => \$black,
 	"report-phish|r=s" => \$report,
 	"report-phish-false-positives|R=s" => \$report,
 	"debug-level|x=i" => \$debug,
 	"debug|D" => \$debug,
 	"sign|S" => \$sign,
 	"signature-file|F=s" => \$sign,

 	"broadcast|B=s" => \$broad,

 	"detect-forged-local-address|L" => \$forge,
 	"dont-sanitise|z" => sub { $sanity = 0 },
 	"black-hole-mode|2" => \$blackhole,
 	"quarantine|Q=s" => \$quarantine,
 	"quarantine-dir|U" => \$quarantine,
 	"max-children|m=i" => \$rate,
 	"dont-wait|w" => \$rate,
 	"timeout|T=i" => \$rate,
 	"freshclam-monitor|M=i" => \$monitor,
 	"external|e" => sub { },
 	"no-check-cf" => sub { },
 	"sendmail-cf|0=s" => sub { },
 	"advisory|A" => sub { $oninfected='Accept'; },
 	"noreject|N" => sub { $oninfected='Blackhole'; },
 	"dont-scan-on-error|d" => sub { $onfail = 'Accept'; },
 	"ignore|I=s" => \@localnets,
 	"local|l" => sub { @localnets = (); },
 	"force-scan|f" => sub { @localnets = (); },
 	"whitelist-file|W=s" => \$whitelist,
 	"config-file|c=s" => \$config,
 	"chroot|C=s" => \$chroot,
 	"pidfile|i=s" => \$pidfile,
 	"noxheader|n" => sub { $addheader = 0},
 	"outgoing|o" => sub { push(@localnets, 'localhost'); },
 	"server|s=s" => \$tcpclamds,
 ) or die "huh?!";
 
 my %clamds = ();
 foreach (split(/:/, $tcpclamds)) {
 	$clamds{"tcp:$_:3310"}++;
 }
 

 my $user = '';
 my $supgrp = '';
 my $syslog = '';
 my $facility = '';
 my $tempdir = '';
 my $maxsize = '';
 

 if ($config) {
 	my $port = 0;
 	my $ip = '';
 	my $lsock = '';
 	open CFG, "<$chroot/$config" or die "failed to open clamd config file $config";
 	while (<CFG>) {
 		chomp;
 		$port = $1 if /^TCPSocket\s+(.*)$/;
 		$ip = $1 if /^TCPAddr\s+(.*)$/;
 		$lsock = $1 if /^LocalSocket\s+(.*)$/;

 		$user = $1 if /^User\s+(.*)$/;
 		$supgrp = $1 if /^AllowSupplementaryGroups\s+(.*)$/;
 		$syslog = $1 if /^LogSyslog\s+(.*)$/;
 		$facility = $1 if /^LogFacility\s+(.*)$/;
 		$tempdir = $1 if /^TemporaryDirectory\s+(.*)$/;
 		$maxsize = $1 if /^MaxFileSize\s+(.*)$/;

 	}
 	close(CFG);
 	if ($lsock) {
 		$clamds{"unix:$lsock"}++;
 	} elsif ($port) {
 		if($ip) {
 			$clamds{"tcp:$ip:$port"}++;
 		} else {
 			$clamds{"tcp:localhost:$port"}++;
 		}
 	}
 }
 

 die "FAIL: No socket provided" unless $ARGV[0];

 die "FAIL: Unable to determine clamd socket\n" unless scalar keys %clamds;
 
 wwarn "Notifications and bounces are no longer supported.
 As a result the following command line options cannot be converted into new config options:
  --from (-a)
  --bounce (-b)
  --headers (-H)
  --postmaster (-p)
  --postmaster-only (-P)
  --template-file (-t)
  --template-headers (-1)
 " if $notify;
 
 wwarn "Temporary blacklisting of ip addresses is no longer supported.
 As a result the following command line options cannot be converted into new config options:
  --dont-blacklist (-K)
  --blacklist-time (-k)
 " if $black;
 
 wwarn "Phising reports are no longer supported.
 As a result the following command line options cannot be converted into new config options:
  --report-phish (-r)
  --report-phish-false-positives (-R)
 " if $report; 
 
 wwarn "The options --debug (-D) and --debug-level (-x) are no longer supported.
 Please set LogVerbose to yes instead
 " if $debug;
 
 wwarn "Message scan signatures are no longer supported.
 As a result the following command line options cannot be converted into new config options:
  --sign (-S)
  --signature-file (-F)
 " if $sign;
 
 wwarn "Broadcasting is no longer supported\n" if $broad;
 
 wwarn "Forgery detection is no longer supported\n" if $forge;
 
 wwarn "Please be aware that email addresses are no longer checked for weird characters like '|' and ';'\n" if $sanity;
 
 wwarn "Blackhole mode is no longer available\nIf you have a lot users aliased to /dev/null you may want to whitelist them instead\n" if $blackhole;
 
 wwarn "Quarantine now achieved via native milter support\nPlease read more about it in the example config file\n" if $quarantine;
 
 wwarn "Rate limiting in the milter is no longer supported.
 As a result the following command line options cannot be converted into new config options:
  --max-children (-m)
  --dont-wait (-w)
  --timeout (-T)
 Please make use of the native Sendmail / Postfix rate limiting facilities
 " if $rate;
 
 wwarn "The option --freshclam-monitor (-M) only made sense in internal mode\nPlease configure freshclam to notify clamd about updates instead\n" if $monitor;
 

 wwarn "Your whitelist file path has been preserved, however please be aware that its syntax is changed\nInstead of a full email address you are now allowed to use regexes. See the example clamav-milter.conf file for more info.\n" if $whitelist;
 

 wwarn "Here is the auto generated config file. Please review:\n";
 
 my $mysock = tosconf('MilterSocket', $ARGV[0]);
 $chroot = tosconf('Chroot', $chroot);
 $pidfile = tosconf('PidFile', $pidfile);
 $oninfected = tosconf('OnInfected', $oninfected);
 $onfail = tosconf('OnFail', $onfail);
 $whitelist = tosconf('Whitelist', $whitelist);
 $addheader = $addheader ? "\nAddHeader Yes" : '';

 $user = tosconf('User', $user);
 $supgrp = $supgrp ? "\nAllowSupplementaryGroups Yes" : '';
 if ($syslog =~ /yes/i) {
 	$syslog = "LogSyslog yes";
 	$facility = tosconf('LogFacility', $facility);
 } else {
 	$syslog = '';
 	$facility = '';
 }
 $tempdir = tosconf('TemporaryDirectory', $tempdir);
 $maxsize = tosconf('MaxFileSize', $maxsize);

 
 print <<BLOCK1;
 ##
 ## Example config file for clamav-milter
 ## (automatically generated by make-clamav-milter-conf.pl)
 ##
 
 # Comment or remove the line below.
 Example
 
 
 ##
 ## Main options
 ##
 
 # Define the interface through which we communicate with sendmail
 # This option is mandatory! Possible formats are:
 # [[unix|local]:]/path/to/file - to specify a unix domain socket
 # inet:port@[hostname|ip-address] - to specify an ipv4 socket
 # inet6:port@[hostname|ip-address] - to specify an ipv6 socket
 #
 # Default: no default
 #MilterSocket /tmp/clamav-milter.socket
 #MilterSocket inet:7357$mysock
 
 # Remove stale socket after unclean shutdown.
 #
 # Default: yes
 #FixStaleSocket yes
 
 # Run as another user (clamav-milter must be started by root for this option to work)
 #
 # Default: unset (don't drop privileges)

 #User clamav$user

 
 # Initialize supplementary group access (clamd must be started by root).
 #
 # Default: no

 #AllowSupplementaryGroups no$supgrp

 
 # Waiting for data from clamd will timeout after this time (seconds).
 # Value of 0 disables the timeout.
 #
 # Default: 120
 #ReadTimeout 300
 
 # Don't fork into background.
 #
 # Default: no

 #Foreground yes

 
 # Chroot to the specified directory.
 # Chrooting is performed just after reading the config file and before dropping privileges.
 #
 # Default: unset (don't chroot)
 #Chroot /newroot$chroot
 
 # This option allows you to save a process identifier of the listening
 # daemon (main thread).
 #
 # Default: disabled
 #PidFile /var/run/clamd.pid$pidfile
 
 # Optional path to the global temporary directory.
 # Default: system specific (usually /tmp or /var/tmp).
 #

 #TemporaryDirectory /var/tmp$tempdir

 
 ##
 ## Clamd options
 ##
 
 # Define the clamd socket to connect to for scanning.
 # If not set (the default), clamav-milter uses internal mode.
 # This option is mandatory! Syntax:
 # ClamdSocket unix:path
 # ClamdSocket tcp:host:port
 # The first syntax specifies a local unix socket (needs an bsolute path) e.g.:
 #     ClamdSocket unix:/var/run/clamd/clamd.socket
 # The second syntax specifies a tcp local or remote tcp socket: the
 # host can be a hostname or an ip address; the ":port" field is only required
 # for IPv6 addresses, otherwise it defaults to 3310
 #     ClamdSocket tcp:192.168.0.1
 #
 # This option can be repeated several times with different sockets or even
 # with the same socket: clamd servers will be selected in a round-robin fashion.
 #
 # Default: no default
 #ClamdSocket tcp:scanner.mydomain:7357
 BLOCK1
 
 print "ClamdSocket \"$_\"\n" foreach (keys %clamds);
 print <<BLOCK2;
 
 
 ##
 ## Exclusions
 ##
 
 # Messages originating from these hosts/networks will not be scanned
 # This option takes a host(name)/mask pair in CIRD notation and can be
 # repeated several times. If "/mask" is omitted, a host is assumed.
 # To specify a locally orignated, non-smtp, email use the keyword "local"
 #
 # Default: unset (scan everything regardless of the origin)
 #LocalNet local
 #LocalNet 192.168.0.0/24
 #LocalNet 1111:2222:3333::/48
 
 # This option specifies a file which contains a list of POSIX regular
 # expressions. Addresses (sent to or from - see below) matching these regexes
 # will not be scanned.  Optionally each line can start with the string "From:"
 # or "To:" (note: no whitespace after the colon) indicating if it is, 
 # respectively, the sender or recipient that is to be whitelisted.
 # If the field is missing, "To:" is assumed.
 # Lines starting with #, : or ! are ignored.
 #
 # Default unset (no exclusion applied)
 #Whitelist /etc/whitelisted_addresses$whitelist
 
 
 ##
 ## Actions
 ##
 
 # The following group of options controls the delievery process under
 # different circumstances.
 # The following actions are available:
 # - Accept
 #   The message is accepted for delievery
 # - Reject
 #   Immediately refuse delievery (a 5xx error is returned to the peer)
 # - Defer
 #   Return a temporary failure message (4xx) to the peer
 # - Blackhole (not available for OnFail)
 #   Like accept but the message is sent to oblivion
 # - Quarantine (not available for OnFail)
 #   Like accept but message is quarantined instead of being deilievered
 #   In sendmail the quarantine queue can be examined via mailq -qQ
 #   For Postfix this causes the message to be accepted but placed on hold
 # 
 # Action to be performed on clean messages (mostly useful for testing)
 # Default Accept
 #OnClean Accept
 
 # Action to be performed on infected messages
 # Default: Quarantine
 #OnInfected Quarantine$oninfected
 
 # Action to be performed on error conditions (this includes failure to
 # allocate data structures, no scanners available, network timeouts,
 # unknown scanner replies and the like)
 # Default Defer
 #OnFail Defer$onfail
 
 # If this option is set to Yes, an "X-Virus-Scanned" and an "X-Virus-Status"
 # headers will be attached to each processed message, possibly replacing
 # existing headers. 
 # Default: No
 #AddHeader Yes$addheader
 
 
 ##
 ## Logging options
 ##
 
 # Uncomment this option to enable logging.
 # LogFile must be writable for the user running daemon.
 # A full path is required.
 #
 # Default: disabled
 #LogFile /tmp/clamav-milter.log
 
 # By default the log file is locked for writing - the lock protects against
 # running clamav-milter multiple times.
 # This option disables log file locking.
 #
 # Default: no
 #LogFileUnlock yes
 
 # Maximum size of the log file.
 # Value of 0 disables the limit.
 # You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
 # and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
 # in bytes just don't use modifiers.
 #
 # Default: 1M
 #LogFileMaxSize 2M
 
 # Log time with each message.
 #
 # Default: no
 #LogTime yes
 
 # Use system logger (can work together with LogFile).
 #
 # Default: no

 #LogSyslog yes$syslog

 
 # Specify the type of syslog messages - please refer to 'man syslog'
 # for facility names.
 #
 # Default: LOG_LOCAL6

 #LogFacility LOG_MAIL$facility

 
 # Enable verbose logging.
 #
 # Default: no
 #LogVerbose yes
 
 
 ##
 ## Limits
 ##
 
 # Messages larger than this value won't be scanned.
 # Default: 25M

 #MaxFileSize 150M$maxsize

 BLOCK2