--- work/exim-4.20/src/malware.c.orig	Tue Jul 22 12:20:22 2003
+++ work/exim-4.20/src/malware.c	Tue Jul 22 12:10:10 2003
@@ -17,6 +17,9 @@
 #define SHUT_WR 1
 #endif
 
+#define DRWEBD_SCAN_CMD 	0x0001
+#define DRWEBD_RETURN_VIRUSES	0x0001
+
 uschar malware_name_buffer[256];
 int malware_ok = 0;
 
@@ -92,10 +95,255 @@
       return DEFER;
     };
     
+	/* "drweb" scanner type ----------------------------------------------- */
+	/* v0.1 - added support for tcp sockets					*/
+	/* v0.0 - initial release -- support for unix sockets			*/
+	if (strcmpic(scanner_name,US"drweb") == 0) {
+		uschar *drweb_options;
+		uschar drweb_options_buffer[1024];
+		uschar drweb_options_default[] = "/usr/local/drweb/run/drwebd.sock";
+		struct sockaddr_un server;
+		int sock, port, result, ovector[30];
+		unsigned int fsize;
+		uschar tmpbuf[1024], *drweb_fbuf;
+		uschar scanrequest[1024];
+		uschar drweb_match_string[128];
+		int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
+		    drweb_vnum, drweb_slen, drweb_fin = 0x0000;
+		unsigned long bread;
+		uschar hostname[256];
+		struct hostent *he;
+		struct in_addr in;
+		pcre *drweb_re;
+    
+		if ((drweb_options = string_nextinlist(&av_scanner_work, &sep,
+			drweb_options_buffer, sizeof(drweb_options_buffer))) == NULL) {
+			/* no options supplied, use default options */
+			drweb_options = drweb_options_default;
+		};
+
+		if (*drweb_options != '/') {
+    
+			/* extract host and port part */
+			if( sscanf(CS drweb_options, "%s %u", hostname, &port) != 2 ) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: invalid socket '%s'", drweb_options);
+				return DEFER;
+    			}
+    
+			/* Lookup the host */
+			if((he = gethostbyname(CS hostname)) == 0) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: failed to lookup host '%s'", hostname);
+				return DEFER;
+			}
     
+			in = *(struct in_addr *) he->h_addr_list[0];
+    
+			/* Open the drwebd TCP socket */
+			if ( (sock = ip_socket(SOCK_STREAM, AF_INET)) < 0) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to acquire socket (%s)",
+					strerror(errno));
+				return DEFER;
+			}
+    
+			if (ip_connect(sock, AF_INET, (uschar*)inet_ntoa(in), port, 5) < 0) {
+				close(sock); 
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: connection to %s, port %u failed (%s)",
+					inet_ntoa(in), port, strerror(errno));
+				return DEFER;
+			}
+
+			/* prepare variables */
+			drweb_cmd = htonl(DRWEBD_SCAN_CMD);
+			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES);
+			snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", 
+				    spool_directory, message_id, message_id);
+
+			/* calc file size */
+			drweb_fd = open(scanrequest, O_RDONLY);
+			if (drweb_fd == -1) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+            				"malware acl condition: drweb: can't open spool file %s: %s", 
+					scanrequest, strerror(errno));
+				return DEFER; 
+			}
+			fsize = lseek(drweb_fd, 0, SEEK_END);
+			if (fsize == -1) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+            				"malware acl condition: drweb: can't seek spool file %s: %s", 
+					scanrequest, strerror(errno));
+				return DEFER; 
+			}
+			drweb_slen = htonl(fsize);
+			lseek(drweb_fd, 0, SEEK_SET);
+
+			/* send scan request */
+			if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) || 
+			    (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
+			    (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
+			    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0)) {
+				close(sock); 
+				close(drweb_fd);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
+				return DEFER;
+			}
+
+			drweb_fbuf = (uschar *) malloc (fsize);
+			if (!drweb_fbuf) {
+				close(sock);
+				close(drweb_fd);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to allocate memory %u for file (%s)", 
+					fsize, scanrequest);
+				return DEFER;
+			}
+
+			result = read (drweb_fd, drweb_fbuf, fsize);
+			if (result == -1) {
+				close(sock);
+				close(drweb_fd);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+            				"malware acl condition: drweb: can't read spool file %s: %s",
+					scanrequest, strerror(errno));
+				return DEFER; 
+			}
+			
+			/* send file body to socket */
+			if (send(sock, drweb_fbuf, fsize, 0) < 0) {
+				close(sock);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to send file body to socket (%s)", drweb_options);
+				return DEFER;
+			}
+			close(drweb_fd);
+			free(drweb_fbuf);
+		}
+    		else {
+			/* open the drwebd UNIX socket */
+			sock = socket(AF_UNIX, SOCK_STREAM, 0);
+			if (sock < 0) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+            				"malware acl condition: drweb: can't open UNIX socket");
+				return DEFER; 
+			}
+			server.sun_family = AF_UNIX;
+			Ustrcpy(server.sun_path, drweb_options);
+			if (connect(sock, (struct sockaddr *) &server, sizeof(struct sockaddr_un)) < 0) {
+				close(sock);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to connect to socket (%s). errno=%d", drweb_options, errno);
+				return DEFER;
+			}
+      
+			/* prepare variables */
+			drweb_cmd = htonl(DRWEBD_SCAN_CMD);
+			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES);
+			snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
+			drweb_slen = htonl(Ustrlen(scanrequest));
+
+			/* send scan request */
+			if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) || 
+			    (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
+			    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
+			    (send(sock, scanrequest, Ustrlen(scanrequest), 0) < 0) ||
+			    (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0)) {
+				close(sock);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
+				return DEFER;
+			}
+		}
+
+		/* wait for result */
+		if ((bread = recv(sock, &drweb_rc, sizeof(drweb_rc), 0) != sizeof(drweb_rc))) {
+			close(sock);
+			log_write(0, LOG_MAIN|LOG_PANIC,
+				"malware acl condition: drweb: unable to read return code");
+			return DEFER;
+		}
+		drweb_rc = ntohl(drweb_rc);
+    
+		if ((bread = recv(sock, &drweb_vnum, sizeof(drweb_vnum), 0) != sizeof(drweb_vnum))) {
+			close(sock);
+			log_write(0, LOG_MAIN|LOG_PANIC,
+				"malware acl condition: drweb: unable to read the number of viruses");
+			return DEFER;
+		}
+		drweb_vnum = ntohl(drweb_vnum);
+		
+		/* "virus(es) found" if virus number is > 0 */
+		if (drweb_vnum)
+		{
+			int i;
+			uschar pre_malware_nb[256];
+			
+			malware_name = malware_name_buffer;
+			
+			/* setup default virus name */
+			Ustrcpy(malware_name_buffer,"unknown");
+			
+			/* read and concatenate virus names into one string */
+			for (i=0;i<drweb_vnum;i++)
+			{
+				/* read the size of report */
+				if ((bread = recv(sock, &drweb_slen, sizeof(drweb_slen), 0) != sizeof(drweb_slen))) {
+					close(sock);
+					log_write(0, LOG_MAIN|LOG_PANIC,
+						"malware acl condition: drweb: cannot read report size");
+					return DEFER;
+				};
+				drweb_slen = ntohl(drweb_slen);
+			
+				/* read report body */
+				if ((bread = recv(sock, tmpbuf, drweb_slen, 0)) != drweb_slen) {
+					close(sock);
+					log_write(0, LOG_MAIN|LOG_PANIC,
+						"malware acl condition: drweb: cannot read report string");
+					return DEFER;
+				};
+				tmpbuf[drweb_slen] = '\0';
+
+				/* set up match regex, depends on retcode */
+				Ustrcpy(drweb_match_string, "infected\\swith\\s*(.+?)$");
+
+				drweb_re = pcre_compile( CS drweb_match_string,
+                        		PCRE_COPT,
+                                	(const char **)&rerror,
+                                	&roffset,
+                                	NULL );
+            
+				/* try matcher on the line, grab substring */
+				result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0, ovector, 30);
+				if (result >= 2) {
+					pcre_copy_substring(CS tmpbuf, ovector, result, 1, CS pre_malware_nb, 255);
+				}
+				/* the first name we just copy to malware_name */
+				if (i==0)
+					Ustrcpy(CS malware_name_buffer, CS pre_malware_nb);
+				else {
+					/* concatenate each new virus name to previous */
+					int slen = Ustrlen(malware_name_buffer);
+					if (slen < (slen+Ustrlen(pre_malware_nb))) {
+						Ustrcat(malware_name_buffer, "/");
+						Ustrcat(malware_name_buffer, pre_malware_nb);
+					}
+				}
+			}
+		}
+		else {
+			/* no virus found */
+			malware_name = NULL;
+		};
+		close(sock);
+	}
+	/* ----------------------------------------------------------------------- */
     
     /* "kavdaemon" scanner type ------------------------------------------------ */
-    if (strcmpic(scanner_name,US"kavdaemon") == 0) {
+    else if (strcmpic(scanner_name,US"kavdaemon") == 0) {
       uschar *kav_options;
       uschar kav_options_buffer[1024];
       uschar kav_options_default[] = "/var/run/AvpCtl";