@@ -31,8 +31,14 @@ clamav_milter_SOURCES = \

     $(top_srcdir)/shared/getopt.h \

     $(top_srcdir)/shared/misc.c \

     $(top_srcdir)/shared/misc.h \

-    $(top_srcdir)/shared/network.c \

-    $(top_srcdir)/shared/network.h \

+    $(top_srcdir)/shared/options.c \

+    $(top_srcdir)/shared/options.h \

+    connpool.c \

+    connpool.h \

+    netcode.c \

+    netcode.h \

+    clamfi.c \

+    clamfi.h \

     clamav-milter.c

 man_MANS = $(top_builddir)/docs/man/clamav-milter.8

@@ -76,14 +76,18 @@ am__clamav_milter_SOURCES_DIST = $(top_srcdir)/shared/cfgparser.c \

 	$(top_srcdir)/shared/cfgparser.h $(top_srcdir)/shared/output.c \

 	$(top_srcdir)/shared/output.h $(top_srcdir)/shared/getopt.c \

 	$(top_srcdir)/shared/getopt.h $(top_srcdir)/shared/misc.c \

-	$(top_srcdir)/shared/misc.h $(top_srcdir)/shared/network.c \

-	$(top_srcdir)/shared/network.h clamav-milter.c

+	$(top_srcdir)/shared/misc.h $(top_srcdir)/shared/options.c \

+	$(top_srcdir)/shared/options.h connpool.c connpool.h netcode.c \

+	netcode.h clamfi.c clamfi.h clamav-milter.c

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@am_clamav_milter_OBJECTS =  \

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	cfgparser.$(OBJEXT) \

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	output.$(OBJEXT) \

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	getopt.$(OBJEXT) \

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	misc.$(OBJEXT) \

-@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	network.$(OBJEXT) \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	options.$(OBJEXT) \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	connpool.$(OBJEXT) \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	netcode.$(OBJEXT) \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	clamfi.$(OBJEXT) \

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@	clamav-milter.$(OBJEXT)

 clamav_milter_OBJECTS = $(am_clamav_milter_OBJECTS)

 clamav_milter_LDADD = $(LDADD)

@@ -273,8 +277,14 @@ top_srcdir = @top_srcdir@

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    $(top_srcdir)/shared/getopt.h \

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    $(top_srcdir)/shared/misc.c \

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    $(top_srcdir)/shared/misc.h \

-@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    $(top_srcdir)/shared/network.c \

-@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    $(top_srcdir)/shared/network.h \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    $(top_srcdir)/shared/options.c \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    $(top_srcdir)/shared/options.h \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    connpool.c \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    connpool.h \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    netcode.c \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    netcode.h \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    clamfi.c \

+@BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    clamfi.h \

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@    clamav-milter.c

 @BUILD_CLAMD_TRUE@@HAVE_MILTER_TRUE@man_MANS = $(top_builddir)/docs/man/clamav-milter.8

@@ -370,9 +380,12 @@ distclean-compile:

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/cfgparser.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/clamav-milter.Po@am__quote@

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/clamfi.Po@am__quote@

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/connpool.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/getopt.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/misc.Po@am__quote@

-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/network.Po@am__quote@

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/netcode.Po@am__quote@

+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/options.Po@am__quote@

 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/output.Po@am__quote@

 .c.o:

@@ -452,19 +465,19 @@ misc.obj: $(top_srcdir)/shared/misc.c

 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@

 @am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o misc.obj `if test -f '$(top_srcdir)/shared/misc.c'; then $(CYGPATH_W) '$(top_srcdir)/shared/misc.c'; else $(CYGPATH_W) '$(srcdir)/$(top_srcdir)/shared/misc.c'; fi`

-network.o: $(top_srcdir)/shared/network.c

-@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT network.o -MD -MP -MF $(DEPDIR)/network.Tpo -c -o network.o `test -f '$(top_srcdir)/shared/network.c' || echo '$(srcdir)/'`$(top_srcdir)/shared/network.c

-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/network.Tpo $(DEPDIR)/network.Po

-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$(top_srcdir)/shared/network.c' object='network.o' libtool=no @AMDEPBACKSLASH@

+options.o: $(top_srcdir)/shared/options.c

+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT options.o -MD -MP -MF $(DEPDIR)/options.Tpo -c -o options.o `test -f '$(top_srcdir)/shared/options.c' || echo '$(srcdir)/'`$(top_srcdir)/shared/options.c

+@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/options.Tpo $(DEPDIR)/options.Po

+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$(top_srcdir)/shared/options.c' object='options.o' libtool=no @AMDEPBACKSLASH@

 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@

-@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o network.o `test -f '$(top_srcdir)/shared/network.c' || echo '$(srcdir)/'`$(top_srcdir)/shared/network.c

+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o options.o `test -f '$(top_srcdir)/shared/options.c' || echo '$(srcdir)/'`$(top_srcdir)/shared/options.c

-network.obj: $(top_srcdir)/shared/network.c

-@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT network.obj -MD -MP -MF $(DEPDIR)/network.Tpo -c -o network.obj `if test -f '$(top_srcdir)/shared/network.c'; then $(CYGPATH_W) '$(top_srcdir)/shared/network.c'; else $(CYGPATH_W) '$(srcdir)/$(top_srcdir)/shared/network.c'; fi`

-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/network.Tpo $(DEPDIR)/network.Po

-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$(top_srcdir)/shared/network.c' object='network.obj' libtool=no @AMDEPBACKSLASH@

+options.obj: $(top_srcdir)/shared/options.c

+@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT options.obj -MD -MP -MF $(DEPDIR)/options.Tpo -c -o options.obj `if test -f '$(top_srcdir)/shared/options.c'; then $(CYGPATH_W) '$(top_srcdir)/shared/options.c'; else $(CYGPATH_W) '$(srcdir)/$(top_srcdir)/shared/options.c'; fi`

+@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/options.Tpo $(DEPDIR)/options.Po

+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$(top_srcdir)/shared/options.c' object='options.obj' libtool=no @AMDEPBACKSLASH@

 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@

-@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o network.obj `if test -f '$(top_srcdir)/shared/network.c'; then $(CYGPATH_W) '$(top_srcdir)/shared/network.c'; else $(CYGPATH_W) '$(srcdir)/$(top_srcdir)/shared/network.c'; fi`

+@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o options.obj `if test -f '$(top_srcdir)/shared/options.c'; then $(CYGPATH_W) '$(top_srcdir)/shared/options.c'; else $(CYGPATH_W) '$(srcdir)/$(top_srcdir)/shared/options.c'; fi`

 mostlyclean-libtool:

 	-rm -f *.lo

@@ -1,13 +1,11 @@

 /*

- * clamav-milter.c

- *	.../clamav-milter/clamav-milter.c

+ *  Copyright (C)2008 Sourcefire, Inc.

  *

- *  Copyright (C) 2003-2007 Nigel Horne <njh@bandsman.co.uk>

+ *  Author: aCaB <acab@clamav.net>

  *

  *  This program is free software; you can redistribute it and/or modify

- *  it under the terms of the GNU General Public License as published by

- *  the Free Software Foundation; either version 2 of the License, or

- *  (at your option) any later version.

+ *  it under the terms of the GNU General Public License version 2 as

+ *  published by the Free Software Foundation.

  *

  *  This program is distributed in the hope that it will be useful,

  *  but WITHOUT ANY WARRANTY; without even the implied warranty of

@@ -18,7022 +16,249 @@

  *  along with this program; if not, write to the Free Software

  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

  *  MA 02110-1301, USA.

- *

- * Install into /usr/local/sbin/clamav-milter

- * See http://www.elandsys.com/resources/sendmail/libmilter/overview.html

- *

- * For installation instructions see the file INSTALL that came with this file

- *

- * NOTE: first character of strings to logg():

- *	! Error

- *	^ Warning

- *	* Verbose

- *	# Info, but not logged in foreground

- *	Default Info

  */

-static	char	const	rcsid[] = "$Id: clamav-milter.c,v 1.312 2007/02/12 22:24:21 njh Exp $";

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

 #endif

-#include "cfgparser.h"

-#include "target.h"

-#include "str.h"

-#include "../libclamav/others.h"

-#include "output.h"

-#include "clamav.h"

-#include "table.h"

-#include "network.h"

-#include "misc.h"

-

 #include <stdio.h>

-#include <sysexits.h>

-#ifdef	HAVE_SYS_STAT_H

-#include <sys/stat.h>

-#endif

-#if	HAVE_STDLIB_H

-#include <stdlib.h>

-#endif

-#if	HAVE_MEMORY_H

-#include <memory.h>

-#endif

-#if	HAVE_STRING_H

-#include <string.h>

-#endif

-#ifdef HAVE_STRINGS_H

-#include <strings.h>

-#endif

-#include <sys/wait.h>

-#include <assert.h>

-#include <sys/socket.h>

-#include <netinet/in.h>

-#include <net/if.h>

-#include <arpa/inet.h>

-#include <sys/un.h>

-#include <stdarg.h>

-#include <errno.h>

-#if	HAVE_LIBMILTER_MFAPI_H

-#include <libmilter/mfapi.h>

-#endif

-#include <pthread.h>

-#include <sys/time.h>

-#include <sys/resource.h>

-#include <signal.h>

-#include <fcntl.h>

+#include <sys/types.h>

+#include <unistd.h>

 #include <pwd.h>

 #include <grp.h>

-#if	HAVE_SYS_PARAM_H

-#include <sys/param.h>

-#endif

-#if	HAVE_RESOLV_H

-#include <arpa/nameser.h>	/* for HEADER */

-#include <resolv.h>

-#endif

-#ifdef	HAVE_UNISTD_H

-#include <unistd.h>

-#endif

-#include <ctype.h>

-

-#if HAVE_MMAP

-#if HAVE_SYS_MMAN_H

-#include <sys/mman.h>

-#else /* HAVE_SYS_MMAN_H */

-#undef HAVE_MMAP

-#endif

-#endif

-

-#define NONBLOCK_SELECT_MAX_FAILURES	3

-#define NONBLOCK_MAX_ATTEMPTS	10

-#define	CONNECT_TIMEOUT	5	/* Allow 5 seconds to connect */

-

-#ifdef	C_LINUX

-#include <sys/sendfile.h>	/* FIXME: use sendfile on BSD not Linux */

-#include <libintl.h>

-#include <locale.h>

-

-#define	gettext_noop(s)	s

-#define	_(s)	gettext(s)

-#define	N_(s)	gettext_noop(s)

-

-#else

-

-#define	_(s)	s

-#define	N_(s)	s

-

-#endif

-

-#ifdef	USE_SYSLOG

+#include <string.h>

 #include <syslog.h>

-#endif

-

-#ifdef	WITH_TCPWRAP

-#if	HAVE_TCPD_H

-#include <tcpd.h>

-#endif

-

-int	allow_severity = LOG_DEBUG;

-int	deny_severity = LOG_NOTICE;

-#endif

-

-#ifdef	CL_DEBUG

-static	char	console[] = "/dev/console";

-#endif

-

-#if defined(CL_DEBUG) && defined(C_LINUX)

-#include <sys/resource.h>

-#endif

-

-#define _GNU_SOURCE

-#include <getopt.h>

-

-#ifndef	SENDMAIL_BIN

-#define	SENDMAIL_BIN	"/usr/lib/sendmail"

-#endif

-

-#ifndef HAVE_IN_PORT_T

-typedef	unsigned short	in_port_t;

-#endif

-

-#ifndef	HAVE_IN_ADDR_T

-typedef	unsigned int	in_addr_t;

-#endif

-

-#ifndef	INET6_ADDRSTRLEN

-#ifdef	AF_INET6

-#define	INET6_ADDRSTRLEN	40

-#else

-#define	INET6_ADDRSTRLEN	16

-#endif

-#endif

-

-#ifndef	EX_CONFIG	/* HP-UX */

-#define	EX_CONFIG	78

-#endif

-

-#define	VERSION_LENGTH	128

-#define	DEFAULT_TIMEOUT	120

-

-#define	NTRIES	5	/* How many times we try to connect to a clamd */

-

-/*#define	SESSION*/

-		/* Keep one command connexion open to clamd, otherwise a new

-		 * command connexion is created for each new email

-		 *

-		 * FIXME: When SESSIONS are open, freshclam can hang when

-		 *	notfying clamd of an update. This is most likely to be a

-		 *	problem with the implementation of SESSIONS on clamd.

-		 *	The problem seems worst on BSD.

-		 *

-		 * Note that clamd is buggy and can hang or even crash if you

-		 *	send SESSION command so be aware

-		 */

-

-/*

- * TODO: optional: xmessage on console when virus stopped (SNMP would be real nice!)

- *	Having said that, with LogSysLog you can (on Linux) configure the system

- *	to get messages on the system console, see syslog.conf(5), also you

- *	can use wall(1) in the VirusEvent entry in clamd.conf

- * TODO: Decide action (bounce, discard, reject etc.) based on the virus

- *	found. Those with faked addresses, such as SCO.A want discarding,

- *	others could be bounced properly.

- * TODO: Encrypt mails sent to clamd to stop sniffers. Sending by UNIX domain

- *	sockets is better

- * TODO: Load balancing, allow local machine to talk via UNIX domain socket.

- * TODO: allow each To: line in the whitelist file to specify a quarantine email

- *	address

- * TODO: optionally use zlib to compress data sent to remote hosts

- * TODO: Finish IPv6 support (serverIPs array and SPF are IPv4 only)

- * TODO: Check domainkeys as well as SPF for phish false positives

- */

-

-struct header_node_t {

-	char	*header;

-	struct	header_node_t *next;

-};

-

-struct header_list_struct {

-	struct	header_node_t *first;

-	struct	header_node_t *last;

-};

-

-typedef struct header_list_struct *header_list_t;

-

-/*

- * Local addresses are those not scanned if --local is not set

- * 127.0.0.0 is not in this table since that's goverend by --outgoing

- * Andy Fiddaman <clam@fiddaman.net> added 169.254.0.0/16

- *	(Microsoft default DHCP)

- * TODO: compare this with RFC1918/RFC3330

- */

-#define PACKADDR(a, b, c, d) (((uint32_t)(a) << 24) | ((b) << 16) | ((c) << 8) | (d))

-#define MAKEMASK(bits)	((uint32_t)(0xffffffff << (32 - bits)))

-

-static struct cidr_net {	/* don't make this const because of -I flag */

-	uint32_t	base;

-	uint32_t	mask;

-} localNets[] = {

-	/*{ PACKADDR(127,   0,   0,   0), MAKEMASK(8) },	*   127.0.0.0/8 */

-	{ PACKADDR(192, 168,   0,   0), MAKEMASK(16) },	/* 192.168.0.0/16 - RFC3330 */

-	/*{ PACKADDR(192, 18,   0,   0), MAKEMASK(15) },	* 192.18.0.0/15 - RFC2544 */

-	/*{ PACKADDR(192, 0,   2,   0), MAKEMASK(24) },	* 192.0.2.0/24 - RFC3330 */

-	{ PACKADDR( 10,   0,   0,   0), MAKEMASK(8) },	/*    10.0.0.0/8 */

-	{ PACKADDR(172,  16,   0,   0), MAKEMASK(12) },	/*  172.16.0.0/12 */

-	{ PACKADDR(169, 254,   0,   0), MAKEMASK(16) },	/* 169.254.0.0/16 */

-	{ 0, 0 },	/* space to put eight more via -I addr */

-	{ 0, 0 },

-	{ 0, 0 },

-	{ 0, 0 },

-	{ 0, 0 },

-	{ 0, 0 },

-	{ 0, 0 },

-	{ 0, 0 },

-	{ 0, 0 }

-};

-#define IFLAG_MAX 8

-

-#ifdef	AF_INET6

-typedef struct cidr_net6 {

-	struct in6_addr	base;

-	int preflen;

-} cidr_net6;

-static	cidr_net6	localNets6[IFLAG_MAX];

-static	int	localNets6_cnt;

-#endif

+#include <time.h>

+#include <libmilter/mfapi.h>

-/*

- * Each libmilter thread has one of these

- */

-struct	privdata {

-	char	*from;	/* Who sent the message */

-	char	*subject;	/* Original subject */

-	char	*sender;	/* Secretary - often used in mailing lists */

-	char	**to;	/* Who is the message going to */

-	char	ip[INET6_ADDRSTRLEN];	/* IP address of the other end */

-	int	numTo;	/* Number of people the message is going to */

-#ifndef	SESSION

-	int	cmdSocket;	/*

-				 * Socket to send/get commands e.g. PORT for

-				 * dataSocket

-				 */

-#endif

-	int	dataSocket;	/* Socket to send data to clamd */

-	char	*filename;	/* Where to store the message in quarantine */

-	u_char	*body;		/* body of the message if Sflag is set */

-	size_t	bodyLen;	/* number of bytes in body */

-	header_list_t headers;	/* Message headers */

-	long	numBytes;	/* Number of bytes sent so far */

-	char	*received;	/* keep track of received from */

-	const	char	*rejectCode;	/* 550 or 554? */

-	unsigned	int	discard:1;	/*

-				 * looks like the remote end is playing ping

-				 * pong with us

-				 */

-#ifdef	HAVE_RESOLV_H

-	unsigned	int	spf_ok:1;

-#endif

-	int	statusCount;	/* number of X-Virus-Status headers */

-	int	serverNumber;	/* Index into serverIPs */

-};

+#include "clamav.h"

-#ifdef	SESSION

-static	int		createSession(unsigned int s);

-#else

-static	int		pingServer(int serverNumber);

-static	void		*try_server(void *var);

-static	int		active_servers(int *active);

-struct	try_server_struct {

-	int	sock;

-	int	rc;

-	struct	sockaddr_in *server;

-	int	server_index;

+#include "shared/options.h"

+#include "shared/output.h"

+#include "shared/cfgparser.h"

+#include "shared/misc.h"

+

+#include "connpool.h"

+#include "netcode.h"

+#include "clamfi.h"

+

+

+struct smfiDesc descr = {

+    "ClamAV", 		/* filter name */

+    SMFI_VERSION,	/* milter version */

+    SMFIF_ADDHDRS|SMFIF_ADDRCPT, /* flags */

+    NULL,		/* connection info filter */

+    NULL,		/* SMTP HELO command filter */

+    NULL,		/* envelope sender filter */

+    NULL,		/* envelope recipient filter */

+    NULL,		/* header filter */

+    NULL,		/* end of header */

+    clamfi_body,	/* body block */

+    clamfi_eom,		/* end of message */

+    NULL,		/* message aborted */

+    NULL,		/* connection cleanup */

+    NULL,		/* any unrecognized or unimplemented command filter */

+    NULL,		/* SMTP DATA command filter */

+    NULL		/* negotiation callback */

 };

-#endif

-static	int		findServer(void);

-static	sfsistat	clamfi_connect(SMFICTX *ctx, char *hostname, _SOCK_ADDR *hostaddr);

-#ifdef	CL_DEBUG

-static	sfsistat	clamfi_helo(SMFICTX *ctx, char *helostring);

-#endif

-static	sfsistat	clamfi_envfrom(SMFICTX *ctx, char **argv);

-static	sfsistat	clamfi_envrcpt(SMFICTX *ctx, char **argv);

-static	sfsistat	clamfi_header(SMFICTX *ctx, char *headerf, char *headerv);

-static	sfsistat	clamfi_eoh(SMFICTX *ctx);

-static	sfsistat	clamfi_body(SMFICTX *ctx, u_char *bodyp, size_t len);

-static	sfsistat	clamfi_eom(SMFICTX *ctx);

-static	sfsistat	clamfi_abort(SMFICTX *ctx);

-static	sfsistat	clamfi_close(SMFICTX *ctx);

-static	void		clamfi_cleanup(SMFICTX *ctx);

-static	void		clamfi_free(struct privdata *privdata, int keep);

-#ifdef __GNUC__

-static	int		clamfi_send(struct privdata *privdata, size_t len, const char *format, ...) __attribute__((format(printf, 3,4)));

-#else

-static	int		clamfi_send(struct privdata *privdata, size_t len, const char *format, ...);

-#endif

-static	long		clamd_recv(int sock, char *buf, size_t len);

-static	off_t		updateSigFile(void);

-static	header_list_t	header_list_new(void);

-static	void	header_list_free(header_list_t list);

-static	void	header_list_add(header_list_t list, const char *headerf, const char *headerv);

-static	void	header_list_print(header_list_t list, FILE *fp);

-static	int	connect2clamd(struct privdata *privdata);

-static	int	sendToFrom(struct privdata *privdata);

-static	int	checkClamd(int log_result);

-static	int	sendtemplate(SMFICTX *ctx, const char *filename, FILE *sendmail, const char *virusname);

-static	int	qfile(struct privdata *privdata, const char *sendmailId, const char *virusname);

-static	int	move(const char *oldfile, const char *newfile);

-static	void	setsubject(SMFICTX *ctx, const char *virusname);

-/*static	int	clamfi_gethostbyname(const char *hostname, struct hostent *hp, char *buf, size_t len);*/

-static	int	add_local_ip(char *address);

-static	int	isLocalAddr(in_addr_t addr);

-static	int	isLocal(const char *addr);

-static	void	clamdIsDown(void);

-static	void	*watchdog(void *a);

-static	int	check_and_reload_database(void);

-static	void	timeoutBlacklist(char *ip_address, int time_of_blacklist, void *v);

-static	void	quit(void);

-static	void	broadcast(const char *mess);

-static	int	loadDatabase(void);

-static	int	increment_connexions(void);

-static	void	decrement_connexions(void);

-static	void	dump_blacklist(char *key, int value, void *v);

-static	int	nonblock_connect(int sock, const struct sockaddr_in *sin, const char *hostname);

-static	int	connect_error(int sock, const char *hostname);

-

-#ifdef	SESSION

-static	pthread_mutex_t	version_mutex = PTHREAD_MUTEX_INITIALIZER;

-static	char	**clamav_versions;	/* max_children elements in the array */

-#define	clamav_version	(clamav_versions[0])

-#else

-static	char	clamav_version[VERSION_LENGTH + 1];

-#endif

-static	int	fflag = 0;	/* force a scan, whatever */

-static	int	oflag = 0;	/* scan messages from our machine? */

-static	int	lflag = 0;	/* scan messages from our site? */

-static	int	Iflag = 0;	/* Added an IP addr to localNets? */

-static	const	char	*progname;	/* our name - usually clamav-milter */

-

-/* Variables for --external */

-static	int	external = 0;	/* scan messages ourself or use clamd? */

-static	pthread_mutex_t	engine_mutex = PTHREAD_MUTEX_INITIALIZER;

-struct  cl_engine *engine = NULL;

-uint64_t maxscansize;

-uint64_t maxfilesize;

-uint32_t maxreclevel;

-uint32_t maxfiles;

-

-static	struct	cl_stat	dbstat;

-static	int	options = CL_SCAN_STDOPT;

-

-#ifdef	BOUNCE

-static	int	bflag = 0;	/*

-				 * send a failure (bounce) message to the

-				 * sender. This probably isn't a good idea

-				 * since most reply addresses will be fake

-				 *

-				 * TODO: Perhaps we can have an option to

-				 * bounce outgoing mail, but not incoming?

-				 */

-#endif

-static	const	char	*iface;	/*

-				 * Broadcast a message when a virus is found,

-				 * this allows remote network management

-				 */

-static	int	broadcastSock = -1;

-static	int	pflag = 0;	/*

-				 * Send a warning to the postmaster only,

-				 * this means user's won't be told when someone

-				 * sent them a virus

-				 */

-static	int	qflag = 0;	/*

-				 * Send no warnings when a virus is found,

-				 * this means that the only log of viruses

-				 * found is the syslog, so it's best to

-				 * enable LogSyslog in clamd.conf

-				 */

-static	int	Sflag = 0;	/*

-				 * Add a signature to each message that

-				 * has been scanned

-				 */

-static	const	char	*sigFilename;	/*

-				 * File where the scanned message signature

-				 * can be found

-				 */

-static	char	*quarantine;	/*

-				 * If a virus is found in an email redirect

-				 * it to this account

-				 */

-static	char	*quarantine_dir; /*

-				 * Path to store messages before scanning.

-				 * Infected ones will be left there.

-				 */

-static	int	nflag = 0;	/*

-				 * Don't add X-Virus-Scanned to header. Patch

-				 * from Dirk Meyer <dirk.meyer@dinoex.sub.org>

-				 */

-static	int	rejectmail = 1;	/*

-				 * Send a 550 rejection when a virus is

-				 * found

-				 */

-static	int	hflag = 0;	/*

-				 * Include original message headers in

-				 * report

-				 */

-static	int	cl_error = SMFIS_TEMPFAIL; /*

-				 * If an error occurs, return

-				 * this status. Allows messages

-				 * to be passed through

-				 * unscanned in the event of

-				 * an error. Patch from

-				 * Joe Talbott <josepht@cstone.net>

-				 */

-static	int	readTimeout = DEFAULT_TIMEOUT; /*

-				 * number of seconds to wait for clamd to

-				 * respond, see ReadTimeout in clamd.conf

-				 */

-static	long	streamMaxLength = -1;	/* StreamMaxLength from clamd.conf */

-static	int	logok = 0;	/*

-				 * Add clean items to the log file

-				 */

-static	const char	*signature = N_("-- \nScanned by ClamAv - http://www.clamav.net\n");

-static	time_t	signatureStamp;

-static	char	*templateFile;	/* e-mail to be sent when virus detected */

-static	char	*templateHeaders;	/* headers to be added to the above */

-static	const char	*tmpdir;

-

-#ifdef	CL_DEBUG

-static	int	debug_level = 0;

-#endif

-

-static	pthread_mutex_t	n_children_mutex = PTHREAD_MUTEX_INITIALIZER;

-static	pthread_cond_t	n_children_cond = PTHREAD_COND_INITIALIZER;

-static	int	n_children = 0;

-static	int	max_children = 0;

-static	unsigned	int	freshclam_monitor = 10;	/*

-							 * how often, in

-							 * seconds, to scan for

-							 * database updates

-							 */

-static	int	child_timeout = 300;	/* number of seconds to wait for

-					 * a child to die. Set to 0 to

-					 * wait forever

-					 */

-static	int	dont_wait = 0;	/*

-				 * If 1 send retry later to the remote end

-				 * if max_chilren is exceeded, otherwise we

-				 * wait for the number to go down

-				 */

-static	int	dont_sanitise = 0; /*

-				 * Don't check for ";" and "|" chars in 

-				 * email addresses.

-				 */

-static	int	advisory = 0;	/*

-				 * Run clamav-milter in advisory mode - viruses

-				 * are flagged rather than deleted. Incompatible

-				 * with quarantine options

-				 */

-static	int	detect_forged_local_address;	/*

-				 * for incoming only mail servers, drop emails

-				 * claiming to be from us that must be false

-				 * Requires that -o, -l or -f are NOT given

-				 */

-static	const	char	*pidFile;

-static	struct	cfgstruct	*copt;

-static	const	char	*localSocket;	/* milter->clamd comms */

-static	in_port_t	tcpSocket;	/* milter->clamd comms */

-static	char	*port = NULL;	/* sendmail->milter comms */

-

-static	const	char	*serverHostNames = "127.0.0.1";

-#if	HAVE_IN_ADDR_T

-static	in_addr_t	*serverIPs;	/* IPv4 only, in network byte order */

-#else

-static	long	*serverIPs;	/* IPv4 only, in network byte order */

-#endif

-static	int	numServers;	/* number of elements in serverIPs array */

-#ifndef	SESSION

-#define	RETRY_SECS	300	/* How often to retry a server that's down */

-static	time_t	*last_failed_pings;	/* For servers that are down. NB: not mutexed */

-#endif

-static	char	*rootdir;	/* for chroot */

-

-#ifdef	SESSION

-static	struct	session {

-	int	sock;	/* fd */

-	enum	{ CMDSOCKET_FREE, CMDSOCKET_INUSE, CMDSOCKET_DOWN }	status;

-} *sessions;	/* max_children elements in the array */

-static	pthread_mutex_t sstatus_mutex = PTHREAD_MUTEX_INITIALIZER;

-#endif	/*SESSION*/

-

-static	pthread_cond_t	watchdog_cond = PTHREAD_COND_INITIALIZER;

-

-#ifndef	SHUT_RD

-#define	SHUT_RD		0

-#endif

-#ifndef	SHUT_WR

-#define	SHUT_WR		1

-#endif

-

-static	const	char	*postmaster = "postmaster";

-static	const	char	*from = "MAILER-DAEMON";

-static	int	quitting;

-static	int	reload;	/* reload database when SIGUSR2 is received */

-static	const	char	*report;	/* Report Phishing to this address */

-static	const	char	*report_fps;	/* Report Phish FPs to this address */

-

-static	const	char	*whitelistFile;	/*

-					 * file containing destination email

-					 * addresses that we don't scan

-					 */

-static	const	char	*sendmailCF;	/* location of sendmail.cf to verify */

-static		int	checkCF = 1;

-static	const	char	*pidfile;

-static	int	black_hole_mode; /*

-				 * Since sendmail calls its milters before it

-				 * looks in /etc/aliases we can spend time

-				 * looking for malware that's going to be

-				 * thrown away even if the message is clean.

-				 * Enable this to not scan these messages.

-				 * Sadly, because these days sendmail -bv

-				 * only works as root, you can't use this with

-				 * the User directive, which some won't like

-				 * which also may contain the real target name

-				 *

-				 * smfi_getsymval(ctx, "{rcpt_addr}") only

-				 * handles virtuser, it doesn't also deref

-				 * the alias table, so it isn't any help

-				 */

-

-static	table_t	*blacklist;	/* never freed */

-static	int	blacklist_time;	/* How long to blacklist an IP */

-static	pthread_mutex_t	blacklist_mutex = PTHREAD_MUTEX_INITIALIZER;

-

-#ifdef	CL_DEBUG

-#if __GLIBC__ == 2 && __GLIBC_MINOR__ >= 1

-#define HAVE_BACKTRACE

-#endif

-#endif

-

-static	void	sigsegv(int sig);

-static	void	sigusr1(int sig);

-static	void	sigusr2(int sig);

-

-#ifdef HAVE_BACKTRACE

-#include <execinfo.h>

-

-static	void	print_trace(void);

-

-#define	BACKTRACE_SIZE	200

-

-#endif

-

-static	int	verifyIncomingSocketName(const char *sockName);

-static	int	isWhitelisted(const char *emailaddress, int to);

-static	int	isBlacklisted(const char *ip_address);

-static	table_t	*mx(const char *host, table_t *t);

-static	sfsistat	black_hole(const struct privdata *privdata);

-static	int	useful_header(const char *cmd);

-

-extern	short	logg_foreground;

-

-#ifdef HAVE_RESOLV_H

-static	table_t	*resolve(const char *host, table_t *t);

-static	int	spf(struct privdata *privdata, table_t *prevhosts);

-static	void	spf_ip(char *ip, int zero, void *v);

-

-pthread_mutex_t	res_pool_mutex = PTHREAD_MUTEX_INITIALIZER;

-

-#ifdef HAVE_LRESOLV_R

-res_state res_pool;

-uint8_t *res_pool_state;

-pthread_cond_t res_pool_cond = PTHREAD_COND_INITIALIZER;

-

-static int safe_res_query(const char *d, int c, int t, u_char *a, int l) {

-	int i = -1, ret;

-

-	pthread_mutex_lock(&res_pool_mutex);

-	while(i==-1) {

-		int j;

-		for(j=0; j<max_children+1; j++) {

-			if(!res_pool_state[j]) continue;

-			i = j;

-			break;

-		}

-		if(i!=-1) break;

-		pthread_cond_wait(&res_pool_cond, &res_pool_mutex);

-	}

-	res_pool_state[i]=0;

-	pthread_mutex_unlock(&res_pool_mutex);

-

-	ret = res_nquery(&res_pool[i], d, c, t, a, l);

-  

-	pthread_mutex_lock(&res_pool_mutex);

-	res_pool_state[i]=1;

-	pthread_cond_signal(&res_pool_cond);

-	pthread_mutex_unlock(&res_pool_mutex);

-	return ret;

-}

-

-#else /* !HAVE_LRESOLV_R - non thread safe resolver (old bsd's) */

-

-static int safe_res_query(const char *d, int c, int t, u_char *a, int l) {

-	int ret;

-	pthread_mutex_lock(&res_pool_mutex);

-	ret = res_query(d, c, t, a, l);

-	pthread_mutex_unlock(&res_pool_mutex);

-	return ret;

-}

-

-#endif /* HAVE_LRESOLV_R */

-

-#endif /* HAVE_RESOLV_H */

-

-static void

-help(void)

-{

-	printf("\n\tclamav-milter version %s\n", get_version());

-	puts("\tCopyright (C) 2007 Nigel Horne <njh@clamav.net>\n");

-

-	puts(_("\t--advisory\t\t-A\tFlag viruses rather than deleting them."));

-	puts(_("\t--blacklist-time=SECS\t-k\tTime (in seconds) to blacklist an IP."));

-	puts(_("\t--black-hole-mode\t\tDon't scan messages aliased to /dev/null."));

-#ifdef	BOUNCE

-	puts(_("\t--bounce\t\t-b\tSend a failure message to the sender."));

-#endif

-	puts(_("\t--broadcast\t\t-B [IFACE]\tBroadcast to a network manager when a virus is found."));

-	puts(_("\t--chroot=DIR\t\t-C DIR\tChroot to dir when starting."));

-	puts(_("\t--config-file=FILE\t-c FILE\tRead configuration from FILE."));

-	puts(_("\t--debug\t\t\t-D\tPrint debug messages."));

-	puts(_("\t--detect-forged-local-address\t-L\tReject mails that claim to be from us."));

-	puts(_("\t--dont-blacklist\t-K\tDon't blacklist a given IP."));

-	puts(_("\t--dont-scan-on-error\t-d\tPass e-mails through unscanned if a system error occurs."));

-	puts(_("\t--dont-wait\t\t\tAsk remote end to resend if max-children exceeded."));

-	puts(_("\t--dont-sanitise\t\t\tAllow semicolon and pipe characters in email addresses."));

-	puts(_("\t--external\t\t-e\tUse an external scanner (usually clamd)."));

-	puts(_("\t--freshclam-monitor=SECS\t-M SECS\tHow often to check for database update."));

-	puts(_("\t--from=EMAIL\t\t-a EMAIL\tError messages come from here."));

-	puts(_("\t--force-scan\t\t-f\tForce scan all messages (overrides (-o and -l)."));

-	puts(_("\t--help\t\t\t-h\tThis message."));

-	puts(_("\t--headers\t\t-H\tInclude original message headers in the report."));

-	puts(_("\t--ignore IPaddr\t\t-I IPaddr\tAdd IPaddr to LAN IP list (see --local)."));

-	puts(_("\t--local\t\t\t-l\tScan messages sent from machines on our LAN."));

-	puts(_("\t--max-childen\t\t-m\tMaximum number of concurrent scans."));

-	puts(_("\t--outgoing\t\t-o\tScan outgoing messages from this machine."));

-	puts(_("\t--noreject\t\t-N\tDon't reject viruses, silently throw them away."));

-	puts(_("\t--noxheader\t\t-n\tSuppress X-Virus-Scanned/X-Virus-Status headers."));

-	puts(_("\t--pidfile=FILE\t\t-i FILE\tLocation of pidfile."));

-	puts(_("\t--postmaster\t\t-p EMAIL\tPostmaster address [default=postmaster]."));

-	puts(_("\t--postmaster-only\t-P\tSend notifications only to the postmaster."));

-	puts(_("\t--quiet\t\t\t-q\tDon't send e-mail notifications of interceptions."));

-	puts(_("\t--quarantine=USER\t-Q EMAIL\tQuarantine e-mail account."));

-	puts(_("\t--report-phish=EMAIL\t-r EMAIL\tReport phish to this email address."));

-	puts(_("\t--report-phish-false-positives=EMAIL\t-R EMAIL\tReport phish false positves to this email address."));

-	puts(_("\t--quarantine-dir=DIR\t-U DIR\tDirectory to store infected emails."));

-	puts(_("\t--server=SERVER\t\t-s SERVER\tHostname/IP address of server(s) running clamd (when using TCPsocket)."));

-	puts(_("\t--sendmail-cf=FILE\t\tLocation of the sendmail.cf file to verify"));

-	puts(_("\t--no-check-cf\t\tSkip verification of sendmail.cf"));

-	puts(_("\t--sign\t\t\t-S\tAdd a hard-coded signature to each scanned message."));

-	puts(_("\t--signature-file=FILE\t-F FILE\tLocation of signature file."));

-	puts(_("\t--template-file=FILE\t-t FILE\tLocation of e-mail template file."));

-	puts(_("\t--template-headers=FILE\t\tLocation of e-mail headers for template file."));

-	puts(_("\t--timeout=SECS\t\t-T SECS\tTimeout waiting to childen to die."));

-	puts(_("\t--whitelist-file=FILE\t-W FILE\tLocation of the file of whitelisted addresses"));

-	puts(_("\t--version\t\t-V\tPrint the version number of this software."));

-#ifdef	CL_DEBUG

-	puts(_("\t--debug-level=n\t\t-x n\tSets the debug level to 'n'."));

-#endif

-	puts(_("\nFor more information type \"man clamav-milter\"."));

-	puts(_("For bug reports, please refer to http://www.clamav.net/bugs"));

-}

-

-extern char *optarg;

-int

-main(int argc, char **argv)

-{

-	int i, Bflag = 0, server = 0;

-	char *cfgfile = NULL;

-	const char *wont_blacklist = NULL;

-	const struct cfgstruct *cpt;

-	char version[VERSION_LENGTH + 1];

-	pthread_t tid;

-	struct rlimit rlim;

-#ifdef	CL_DEBUG

-	int consolefd;

-#endif

-

-	/*

-	 * The SMFI_VERSION checks are for Sendmail 8.14, which I don't have

-	 * yet, so I can't verify them

-	 * Patch from Andy Fiddaman <clam@fiddaman.net>

-	 */