X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/8523533c08c018ac4b750b0e0fab6cfe611e8a49..f7b639017a889d802b26b61df6b3f1ac46c6f4f0:/src/src/malware.c

diff --git a/src/src/malware.c b/src/src/malware.c
index 916480197..82111557c 100644
--- a/src/src/malware.c
+++ b/src/src/malware.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/malware.c,v 1.2 2004/12/16 15:11:47 tom Exp $ */
+/* $Cambridge: exim/src/src/malware.c,v 1.3 2004/12/17 14:52:44 ph10 Exp $ */
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
@@ -48,7 +48,7 @@ int malware(uschar **listptr) {
   uschar *malware_regex;
   uschar malware_regex_buffer[64];
   uschar malware_regex_default[] = ".+";
-  unsigned long long mbox_size;
+  unsigned long mbox_size;
   FILE *mbox_file;
   int roffset;
   const pcre *re;
@@ -127,258 +127,257 @@ int malware(uschar **listptr) {
       return DEFER;
     };
     
-  	/* "drweb" scanner type ----------------------------------------------- */
-  	/* v0.1 - added support for tcp sockets					*/
-  	/* v0.0 - initial release -- support for unix sockets			*/
-  	if (strcmpic(scanner_name,US"drweb") == 0) {
-  		uschar *drweb_options;
-  		uschar drweb_options_buffer[1024];
-  		uschar drweb_options_default[] = "/usr/local/drweb/run/drwebd.sock";
-  		struct sockaddr_un server;
-  		int sock, port, result, ovector[30];
-  		unsigned int fsize;
-  		uschar tmpbuf[1024], *drweb_fbuf;
-  		uschar scanrequest[1024];
-  		uschar drweb_match_string[128];
-  		int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
-  		    drweb_vnum, drweb_slen, drweb_fin = 0x0000;
-  		unsigned long bread;
-  		uschar hostname[256];
-  		struct hostent *he;
-  		struct in_addr in;
-  		pcre *drweb_re;
+	/* "drweb" scanner type ----------------------------------------------- */
+	/* v0.1 - added support for tcp sockets					*/
+	/* v0.0 - initial release -- support for unix sockets			*/
+	if (strcmpic(scanner_name,US"drweb") == 0) {
+		uschar *drweb_options;
+		uschar drweb_options_buffer[1024];
+		uschar drweb_options_default[] = "/usr/local/drweb/run/drwebd.sock";
+		struct sockaddr_un server;
+		int sock, result, ovector[30];
+		unsigned int port, fsize;
+		uschar tmpbuf[1024], *drweb_fbuf;
+		uschar scanrequest[1024];
+		uschar drweb_match_string[128];
+		int drweb_rc, drweb_cmd, drweb_flags = 0x0000, drweb_fd,
+		    drweb_vnum, drweb_slen, drweb_fin = 0x0000;
+		unsigned long bread;
+		uschar hostname[256];
+		struct hostent *he;
+		struct in_addr in;
+		pcre *drweb_re;
       
-  		if ((drweb_options = string_nextinlist(&av_scanner_work, &sep,
-  			drweb_options_buffer, sizeof(drweb_options_buffer))) == NULL) {
-  			/* no options supplied, use default options */
-  			drweb_options = drweb_options_default;
-  		};
+		if ((drweb_options = string_nextinlist(&av_scanner_work, &sep,
+			drweb_options_buffer, sizeof(drweb_options_buffer))) == NULL) {
+			/* no options supplied, use default options */
+			drweb_options = drweb_options_default;
+		};
   
-  		if (*drweb_options != '/') {
+		if (*drweb_options != '/') {
       
-  			/* extract host and port part */
-  			if( sscanf(CS drweb_options, "%s %u", hostname, &port) != 2 ) {
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-  					"malware acl condition: drweb: invalid socket '%s'", drweb_options);
-  				return DEFER;
-      			}
+			/* extract host and port part */
+			if( sscanf(CS drweb_options, "%s %u", hostname, &port) != 2 ) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: invalid socket '%s'", drweb_options);
+				return DEFER;
+			}
       
-  			/* Lookup the host */
-  			if((he = gethostbyname(CS hostname)) == 0) {
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-  					"malware acl condition: drweb: failed to lookup host '%s'", hostname);
-  				return DEFER;
-  			}
+			/* Lookup the host */
+			if((he = gethostbyname(CS hostname)) == 0) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: failed to lookup host '%s'", hostname);
+				return DEFER;
+			}
       
-  			in = *(struct in_addr *) he->h_addr_list[0];
+			in = *(struct in_addr *) he->h_addr_list[0];
       
-  			/* Open the drwebd TCP socket */
-  			if ( (sock = ip_socket(SOCK_STREAM, AF_INET)) < 0) {
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-  					"malware acl condition: drweb: unable to acquire socket (%s)",
-  					strerror(errno));
-  				return DEFER;
-  			}
+			/* Open the drwebd TCP socket */
+			if ( (sock = ip_socket(SOCK_STREAM, AF_INET)) < 0) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to acquire socket (%s)",
+					strerror(errno));
+				return DEFER;
+			}
       
-  			if (ip_connect(sock, AF_INET, (uschar*)inet_ntoa(in), port, 5) < 0) {
-  				close(sock); 
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-  					"malware acl condition: drweb: connection to %s, port %u failed (%s)",
-  					inet_ntoa(in), port, strerror(errno));
-  				return DEFER;
-  			}
+			if (ip_connect(sock, AF_INET, (uschar*)inet_ntoa(in), port, 5) < 0) {
+				close(sock); 
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: connection to %s, port %u failed (%s)",
+					inet_ntoa(in), port, strerror(errno));
+				return DEFER;
+			}
   
-  			/* prepare variables */
-  			drweb_cmd = htonl(DRWEBD_SCAN_CMD);
-  			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
-  			snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", 
-  				    spool_directory, message_id, message_id);
+			/* prepare variables */
+			drweb_cmd = htonl(DRWEBD_SCAN_CMD);
+			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
+			snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", 
+				    spool_directory, message_id, message_id);
   
-  			/* calc file size */
-  			drweb_fd = open(CS scanrequest, O_RDONLY);
-  			if (drweb_fd == -1) {
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-              				"malware acl condition: drweb: can't open spool file %s: %s", 
-  					scanrequest, strerror(errno));
-  				return DEFER; 
-  			}
-  			fsize = lseek(drweb_fd, 0, SEEK_END);
-  			if (fsize == -1) {
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-              				"malware acl condition: drweb: can't seek spool file %s: %s", 
-  					scanrequest, strerror(errno));
-  				return DEFER; 
-  			}
-  			drweb_slen = htonl(fsize);
-  			lseek(drweb_fd, 0, SEEK_SET);
+			/* calc file size */
+			drweb_fd = open(CS scanrequest, O_RDONLY);
+			if (drweb_fd == -1) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: can't open spool file %s: %s", 
+					scanrequest, strerror(errno));
+				return DEFER; 
+			}
+			fsize = lseek(drweb_fd, 0, SEEK_END);
+			if (fsize == -1) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: can't seek spool file %s: %s", 
+					scanrequest, strerror(errno));
+				return DEFER; 
+			}
+			drweb_slen = htonl(fsize);
+			lseek(drweb_fd, 0, SEEK_SET);
   
-  			/* send scan request */
-  			if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) || 
-  			    (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
-  			    (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
-  			    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0)) {
-  				close(sock); 
-  				close(drweb_fd);
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-  					"malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
-  				return DEFER;
-  			}
+			/* send scan request */
+			if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) || 
+			    (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
+			    (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0) ||
+			    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0)) {
+				close(sock); 
+				close(drweb_fd);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
+				return DEFER;
+			}
   
-  			drweb_fbuf = (uschar *) malloc (fsize);
-  			if (!drweb_fbuf) {
-  				close(sock);
-  				close(drweb_fd);
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-  					"malware acl condition: drweb: unable to allocate memory %u for file (%s)", 
-  					fsize, scanrequest);
-  				return DEFER;
-  			}
+			drweb_fbuf = (uschar *) malloc (fsize);
+			if (!drweb_fbuf) {
+				close(sock);
+				close(drweb_fd);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to allocate memory %u for file (%s)", 
+					fsize, scanrequest);
+				return DEFER;
+			}
   
-  			result = read (drweb_fd, drweb_fbuf, fsize);
-  			if (result == -1) {
-  				close(sock);
-  				close(drweb_fd);
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-              				"malware acl condition: drweb: can't read spool file %s: %s",
-  					scanrequest, strerror(errno));
-  				return DEFER; 
-  			}
-  			
-  			/* send file body to socket */
-  			if (send(sock, drweb_fbuf, fsize, 0) < 0) {
-  				close(sock);
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-  					"malware acl condition: drweb: unable to send file body to socket (%s)", drweb_options);
-  				return DEFER;
-  			}
-  			close(drweb_fd);
-  			free(drweb_fbuf);
-  		}
-      		else {
-  			/* open the drwebd UNIX socket */
-  			sock = socket(AF_UNIX, SOCK_STREAM, 0);
-  			if (sock < 0) {
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-              				"malware acl condition: drweb: can't open UNIX socket");
-  				return DEFER; 
-  			}
-  			server.sun_family = AF_UNIX;
-  			Ustrcpy(server.sun_path, drweb_options);
-  			if (connect(sock, (struct sockaddr *) &server, sizeof(struct sockaddr_un)) < 0) {
-  				close(sock);
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-  					"malware acl condition: drweb: unable to connect to socket (%s). errno=%d", drweb_options, errno);
-  				return DEFER;
-  			}
+			result = read (drweb_fd, drweb_fbuf, fsize);
+			if (result == -1) {
+				close(sock);
+				close(drweb_fd);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: can't read spool file %s: %s",
+					scanrequest, strerror(errno));
+				return DEFER; 
+			}
+			
+			/* send file body to socket */
+			if (send(sock, drweb_fbuf, fsize, 0) < 0) {
+				close(sock);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to send file body to socket (%s)", drweb_options);
+				return DEFER;
+			}
+			close(drweb_fd);
+			free(drweb_fbuf);
+		}
+		else {
+			/* open the drwebd UNIX socket */
+			sock = socket(AF_UNIX, SOCK_STREAM, 0);
+			if (sock < 0) {
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: can't open UNIX socket");
+				return DEFER; 
+			}
+			server.sun_family = AF_UNIX;
+			Ustrcpy(server.sun_path, drweb_options);
+			if (connect(sock, (struct sockaddr *) &server, sizeof(struct sockaddr_un)) < 0) {
+				close(sock);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to connect to socket (%s). errno=%d", drweb_options, errno);
+				return DEFER;
+			}
         
-  			/* prepare variables */
-  			drweb_cmd = htonl(DRWEBD_SCAN_CMD);
-  			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
-  			snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
-  			drweb_slen = htonl(Ustrlen(scanrequest));
+			/* prepare variables */
+			drweb_cmd = htonl(DRWEBD_SCAN_CMD);
+			drweb_flags = htonl(DRWEBD_RETURN_VIRUSES | DRWEBD_IS_MAIL);
+			snprintf(CS scanrequest, 1024,CS"%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
+			drweb_slen = htonl(Ustrlen(scanrequest));
   
-  			/* send scan request */
-  			if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) || 
-  			    (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
-  			    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
-  			    (send(sock, scanrequest, Ustrlen(scanrequest), 0) < 0) ||
-  			    (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0)) {
-  				close(sock);
-  				log_write(0, LOG_MAIN|LOG_PANIC,
-  					"malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
-  				return DEFER;
-  			}
-  		}
+			/* send scan request */
+			if ((send(sock, &drweb_cmd, sizeof(drweb_cmd), 0) < 0) || 
+			    (send(sock, &drweb_flags, sizeof(drweb_flags), 0) < 0) ||
+			    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
+			    (send(sock, scanrequest, Ustrlen(scanrequest), 0) < 0) ||
+			    (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0)) {
+				close(sock);
+				log_write(0, LOG_MAIN|LOG_PANIC,
+					"malware acl condition: drweb: unable to send commands to socket (%s)", drweb_options);
+				return DEFER;
+			}
+		}
   
-  		/* wait for result */
-  		if ((bread = recv(sock, &drweb_rc, sizeof(drweb_rc), 0) != sizeof(drweb_rc))) {
-  			close(sock);
-  			log_write(0, LOG_MAIN|LOG_PANIC,
-  				"malware acl condition: drweb: unable to read return code");
-  			return DEFER;
-  		}
-  		drweb_rc = ntohl(drweb_rc);
+		/* wait for result */
+		if ((bread = recv(sock, &drweb_rc, sizeof(drweb_rc), 0) != sizeof(drweb_rc))) {
+			close(sock);
+			log_write(0, LOG_MAIN|LOG_PANIC,
+				"malware acl condition: drweb: unable to read return code");
+			return DEFER;
+		}
+		drweb_rc = ntohl(drweb_rc);
       
-  		if ((bread = recv(sock, &drweb_vnum, sizeof(drweb_vnum), 0) != sizeof(drweb_vnum))) {
-  			close(sock);
-  			log_write(0, LOG_MAIN|LOG_PANIC,
-  				"malware acl condition: drweb: unable to read the number of viruses");
-  			return DEFER;
-  		}
-  		drweb_vnum = ntohl(drweb_vnum);
-  		
-  		/* "virus(es) found" if virus number is > 0 */
-  		if (drweb_vnum)
-  		{
-  			int i;
-  			uschar pre_malware_nb[256];
-  			
-  			malware_name = malware_name_buffer;
-  			
-  			/* setup default virus name */
-  			Ustrcpy(malware_name_buffer,"unknown");
-  			
-  			/* read and concatenate virus names into one string */
-  			for (i=0;i<drweb_vnum;i++)
-  			{
-  				/* read the size of report */
-  				if ((bread = recv(sock, &drweb_slen, sizeof(drweb_slen), 0) != sizeof(drweb_slen))) {
-  					close(sock);
-  					log_write(0, LOG_MAIN|LOG_PANIC,
-  						"malware acl condition: drweb: cannot read report size");
-  					return DEFER;
-  				};
-  				drweb_slen = ntohl(drweb_slen);
-  			
-  				/* read report body */
-  				if ((bread = recv(sock, tmpbuf, drweb_slen, 0)) != drweb_slen) {
-  					close(sock);
-  					log_write(0, LOG_MAIN|LOG_PANIC,
-  						"malware acl condition: drweb: cannot read report string");
-  					return DEFER;
-  				};
-  				tmpbuf[drweb_slen] = '\0';
+		if ((bread = recv(sock, &drweb_vnum, sizeof(drweb_vnum), 0) != sizeof(drweb_vnum))) {
+			close(sock);
+			log_write(0, LOG_MAIN|LOG_PANIC,
+				"malware acl condition: drweb: unable to read the number of viruses");
+			return DEFER;
+		}
+		drweb_vnum = ntohl(drweb_vnum);
+		
+		/* "virus(es) found" if virus number is > 0 */
+		if (drweb_vnum)
+		{
+			int i;
+			uschar pre_malware_nb[256];
+			
+			malware_name = malware_name_buffer;
+			
+			/* setup default virus name */
+			Ustrcpy(malware_name_buffer,"unknown");
+			
+			/* read and concatenate virus names into one string */
+			for (i=0;i<drweb_vnum;i++)
+			{
+				/* read the size of report */
+				if ((bread = recv(sock, &drweb_slen, sizeof(drweb_slen), 0) != sizeof(drweb_slen))) {
+					close(sock);
+					log_write(0, LOG_MAIN|LOG_PANIC,
+						"malware acl condition: drweb: cannot read report size");
+					return DEFER;
+				};
+				drweb_slen = ntohl(drweb_slen);
+			
+				/* read report body */
+				if ((bread = recv(sock, tmpbuf, drweb_slen, 0)) != drweb_slen) {
+					close(sock);
+					log_write(0, LOG_MAIN|LOG_PANIC,
+						"malware acl condition: drweb: cannot read report string");
+					return DEFER;
+				};
+				tmpbuf[drweb_slen] = '\0';
   
-  				/* set up match regex, depends on retcode */
-  				Ustrcpy(drweb_match_string, "infected\\swith\\s*(.+?)$");
+				/* set up match regex, depends on retcode */
+				Ustrcpy(drweb_match_string, "infected\\swith\\s*(.+?)$");
   
-  				drweb_re = pcre_compile( CS drweb_match_string,
-                          		PCRE_COPT,
-                                  	(const char **)&rerror,
-                                  	&roffset,
-                                  	NULL );
+				drweb_re = pcre_compile( CS drweb_match_string,
+					PCRE_COPT,
+					(const char **)&rerror,
+					&roffset,
+					NULL );
               
-  				/* try matcher on the line, grab substring */
-  				result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0, ovector, 30);
-  				if (result >= 2) {
-  					pcre_copy_substring(CS tmpbuf, ovector, result, 1, CS pre_malware_nb, 255);
-  				}
-  				/* the first name we just copy to malware_name */
-  				if (i==0)
-  					Ustrcpy(CS malware_name_buffer, CS pre_malware_nb);
-  				else {
-  					/* concatenate each new virus name to previous */
-  					int slen = Ustrlen(malware_name_buffer);
-  					if (slen < (slen+Ustrlen(pre_malware_nb))) {
-  						Ustrcat(malware_name_buffer, "/");
-  						Ustrcat(malware_name_buffer, pre_malware_nb);
-  					}
-  				}
-  			}
-  		}
-  		else {
-  			/* no virus found */
-  			malware_name = NULL;
-  		};
-  		close(sock);
-  	}
-  	/* ----------------------------------------------------------------------- */
+				/* try matcher on the line, grab substring */
+				result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0, ovector, 30);
+				if (result >= 2) {
+					pcre_copy_substring(CS tmpbuf, ovector, result, 1, CS pre_malware_nb, 255);
+				}
+				/* the first name we just copy to malware_name */
+				if (i==0)
+					Ustrcpy(CS malware_name_buffer, CS pre_malware_nb);
+				else {
+					/* concatenate each new virus name to previous */
+					int slen = Ustrlen(malware_name_buffer);
+					if (slen < (slen+Ustrlen(pre_malware_nb))) {
+						Ustrcat(malware_name_buffer, "/");
+						Ustrcat(malware_name_buffer, pre_malware_nb);
+					}
+				}
+			}
+		}
+		else {
+			/* no virus found */
+			malware_name = NULL;
+		};
+		close(sock);
+	}
+	/* ----------------------------------------------------------------------- */
     else if (strcmpic(scanner_name,US"aveserver") == 0) {
       uschar *kav_options;
       uschar kav_options_buffer[1024];
       uschar kav_options_default[] = "/var/run/aveserver";
       uschar buf[32768];
-      uschar *p;
       struct sockaddr_un server;
       int sock;
     
@@ -452,7 +451,10 @@ int malware(uschar **listptr) {
       uschar file_name[1024];
       uschar av_buffer[1024];
       pcre *fs_inf;
-      static uschar *cmdoptions[] = { "CONFIGURE\tARCHIVE\t1\n","CONFIGURE\tTIMEOUT\t0\n","CONFIGURE\tMAXARCH\t5\n","CONFIGURE\tMIME\t1\n" };
+      static uschar *cmdoptions[] = { US"CONFIGURE\tARCHIVE\t1\n",
+                                      US"CONFIGURE\tTIMEOUT\t0\n",
+                                      US"CONFIGURE\tMAXARCH\t5\n",
+                                      US"CONFIGURE\tMIME\t1\n" };
       
       malware_name = NULL;
       if ((fsecure_options = string_nextinlist(&av_scanner_work, &sep,
@@ -947,7 +949,8 @@ int malware(uschar **listptr) {
       uschar clamd_options_default[] = "/tmp/clamd";
       uschar *p,*vname;
       struct sockaddr_un server;
-      int sock,port,bread=0;
+      int sock,bread=0;
+      unsigned int port; 
       uschar file_name[1024];
       uschar av_buffer[1024];
       uschar hostname[256];
@@ -1058,7 +1061,7 @@ int malware(uschar **listptr) {
       /* Check the result. ClamAV Returns
          infected: -> "<filename>: <virusname> FOUND"
          not-infected: -> "<filename>: OK"
-	        error: -> "<filename>: <errcode> ERROR */
+		error: -> "<filename>: <errcode> ERROR */
          
       if (!(*av_buffer)) {
         log_write(0, LOG_MAIN|LOG_PANIC,
@@ -1123,7 +1126,7 @@ int malware(uschar **listptr) {
                                             sizeof(mksd_options_buffer))) != NULL) {
         mksd_maxproc = (int) strtol(CS mksd_options, &mksd_options_end, 10);
 	      if ((*mksd_options == '\0') || (*mksd_options_end != '\0') ||
-	          (mksd_maxproc < 1) || (mksd_maxproc > 32)) {
+		  (mksd_maxproc < 1) || (mksd_maxproc > 32)) {
           log_write(0, LOG_MAIN|LOG_PANIC,
                     "malware acl condition: mksd: invalid option '%s'", mksd_options);
           return DEFER;