X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/93a6fce2ebf117f490d7ee11f066f75280d32386..14de8063d82edc5bf003ed50abdea55ac542679b:/src/src/malware.c

diff --git a/src/src/malware.c b/src/src/malware.c
index 9e71afc9b..d7be4edbb 100644
--- a/src/src/malware.c
+++ b/src/src/malware.c
@@ -2,8 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003-2014 */
-/* License: GPL */
+/* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
+ * License: GPL
+ * Copyright (c) The Exim Maintainers 2016
+ */
 
 /* Code for calling virus (malware) scanners. Called from acl.c. */
 
@@ -11,7 +13,7 @@
 #ifdef WITH_CONTENT_SCAN
 
 typedef enum {M_FPROTD, M_DRWEB, M_AVES, M_FSEC, M_KAVD, M_CMDL,
-		M_SOPHIE, M_CLAMD, M_SOCK, M_MKSD, M_AVAST} scanner_t;
+		M_SOPHIE, M_CLAMD, M_SOCK, M_MKSD, M_AVAST, M_FPROT6D} scanner_t;
 typedef enum {MC_NONE, MC_TCP, MC_UNIX, MC_STRM} contype_t;
 static struct scan
 {
@@ -32,6 +34,7 @@ static struct scan
   { M_SOCK,	US"sock",	US"/tmp/malware.sock",		      MC_STRM },
   { M_MKSD,	US"mksd",	NULL,				      MC_NONE },
   { M_AVAST,	US"avast",	US"/var/run/avast/scan.sock",	      MC_STRM },
+  { M_FPROT6D,	US"f-prot6d",	US"localhost 10200",		      MC_TCP },
   { -1,		NULL,		NULL, MC_NONE }		/* end-marker */
 };
 
@@ -82,6 +85,11 @@ static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d\\.\\d\\t\\d\\
 static const pcre * ava_re_clean = NULL;
 static const pcre * ava_re_virus = NULL;
 
+static const uschar * fprot6d_re_error_str = US "^\\d+\\s<(.+?)>$";
+static const uschar * fprot6d_re_virus_str = US "^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
+static const pcre * fprot6d_re_error = NULL;
+static const pcre * fprot6d_re_virus = NULL;
+
 
 
 /******************************************************************************/
@@ -106,7 +114,7 @@ BOOL malware_ok = FALSE;
 the scan directory normally for that case, but look into rigging up the
 needed header variables if not already set on the command-line? */
 extern int spool_mbox_ok;
-extern uschar spooled_message_id[17];
+extern uschar spooled_message_id[MESSAGE_ID_LENGTH+1];
 
 
 
@@ -118,16 +126,18 @@ return DEFER;
 }
 
 static int
-m_errlog_defer(struct scan * scanent, const uschar * str)
+m_errlog_defer(struct scan * scanent, const uschar * hostport,
+  const uschar * str)
 {
-return malware_errlog_defer(string_sprintf("%s: %s", scanent->name, str));
+return malware_errlog_defer(string_sprintf("%s %s : %s",
+  scanent->name, hostport ? hostport : CUS"", str));
 }
 static int
-m_errlog_defer_3(struct scan * scanent, const uschar * str,
-	int fd_to_close)
+m_errlog_defer_3(struct scan * scanent, const uschar * hostport,
+  const uschar * str, int fd_to_close)
 {
 (void) close(fd_to_close);
-return m_errlog_defer(scanent, str);
+return m_errlog_defer(scanent, hostport, str);
 }
 
 /*************************************************/
@@ -192,7 +202,11 @@ const pcre * cre = NULL;
 if (!(list_ele = string_nextinlist(list, sep, NULL, 0)))
   *errstr = US listerr;
 else
+  {
+  DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "RE: ",
+    string_printing(list_ele));
   cre = m_pcre_compile(CUS list_ele, errstr);
+  }
 return cre;
 }
 
@@ -227,13 +241,13 @@ while ((rcv = read(fd, p, 1)) > 0)
   }
 if (!ok)
   {
-  DEBUG(D_acl) debug_printf("Malware scan: read %s (%s)\n",
+  DEBUG(D_acl) debug_printf_indent("Malware scan: read %s (%s)\n",
 		rcv==0 ? "EOF" : "error", strerror(errno));
   return rcv==0 ? -1 : -2;
   }
 *p = '\0';
 
-DEBUG(D_acl) debug_printf("Malware scan: read '%s'\n", buffer);
+DEBUG(D_acl) debug_printf_indent("Malware scan: read '%s'\n", buffer);
 return p - buffer;
 }
 
@@ -327,7 +341,7 @@ switch (*line)
   case 'A': /* ERR */
     if ((p = strchr (line, '\n')) != NULL)
       *p = '\0';
-    return m_errlog_defer(scanent,
+    return m_errlog_defer(scanent, NULL,
       string_sprintf("scanner failed: %s", line));
 
   default: /* VIR */
@@ -345,7 +359,7 @@ switch (*line)
 	return OK;
 	}
       }
-    return m_errlog_defer(scanent,
+    return m_errlog_defer(scanent, NULL,
       string_sprintf("malformed reply received: %s", line));
   }
 }
@@ -403,16 +417,16 @@ is via malware(), or there's malware_in_file() used for testing/debugging.
 
 Arguments:
   malware_re    match condition for "malware="
-  eml_filename  the file holding the email to be scanned
+  scan_filename  the file holding the email to be scanned, if we're faking
+		this up for the -bmalware test, else NULL
   timeout	if nonzero, non-default timeoutl
-  faking        whether or not we're faking this up for the -bmalware test
 
 Returns:        Exim message processing code (OK, FAIL, DEFER, ...)
                 where true means malware was found (condition applies)
 */
 static int
-malware_internal(const uschar * malware_re, const uschar * eml_filename,
-  int timeout, BOOL faking)
+malware_internal(const uschar * malware_re, const uschar * scan_filename,
+  int timeout)
 {
 int sep = 0;
 const uschar *av_scanner_work = av_scanner;
@@ -425,21 +439,24 @@ struct scan * scanent;
 const uschar * scanner_options;
 int sock = -1;
 time_t tmo;
+uschar * eml_filename, * eml_dir;
+
+if (!malware_re)
+  return FAIL;		/* empty means "don't match anything" */
 
-/* make sure the eml mbox file is spooled up */
-if (!(mbox_file = spool_mbox(&mbox_size, faking ? eml_filename : NULL)))
+/* Ensure the eml mbox file is spooled up */
+
+if (!(mbox_file = spool_mbox(&mbox_size, scan_filename, &eml_filename)))
   return malware_errlog_defer(US"error while creating mbox spool file");
 
-/* none of our current scanners need the mbox
-   file as a stream, so we can close it right away */
-(void)fclose(mbox_file);
+/* None of our current scanners need the mbox file as a stream (they use
+the name), so we can close it right away.  Get the directory too. */
 
-if (!malware_re)
-  return FAIL;		/* empty means "don't match anything" */
+(void) fclose(mbox_file);
+eml_dir = string_copyn(eml_filename, Ustrrchr(eml_filename, '/') - eml_filename);
 
 /* parse 1st option */
-  if ( (strcmpic(malware_re, US"false") == 0) ||
-     (Ustrcmp(malware_re,"0") == 0) )
+if (strcmpic(malware_re, US"false") == 0  ||  Ustrcmp(malware_re,"0") == 0)
   return FAIL;		/* explicitly no matching */
 
 /* special cases (match anything except empty) */
@@ -459,9 +476,6 @@ if (  strcmpic(malware_re,US"true") == 0
 else if (!(re = m_pcre_compile(malware_re, &errstr)))
   return malware_errlog_defer(errstr);
 
-/* Reset sep that is set by previous string_nextinlist() call */
-sep = 0;
-
 /* if av_scanner starts with a dollar, expand it first */
 if (*av_scanner == '$')
   {
@@ -471,7 +485,7 @@ if (*av_scanner == '$')
 	 expand_string_message));
 
   DEBUG(D_acl)
-    debug_printf("Expanded av_scanner global: %s\n", av_scanner_work);
+    debug_printf_indent("Expanded av_scanner global: %s\n", av_scanner_work);
   /* disable result caching in this case */
   malware_name = NULL;
   malware_ok = FALSE;
@@ -493,22 +507,26 @@ if (!malware_ok)
 	scanner_name));
     if (strcmpic(scanner_name, US scanent->name) != 0)
       continue;
+    DEBUG(D_acl) debug_printf_indent("Malware scan:  %s tmo=%s\n",
+      scanner_name, readconf_printtime(timeout));
+
     if (!(scanner_options = string_nextinlist(&av_scanner_work, &sep, NULL, 0)))
       scanner_options = scanent->options_default;
     if (scanent->conn == MC_NONE)
       break;
+
+    DEBUG(D_acl) debug_printf_indent("%15s%10s%s\n", "", "socket: ", scanner_options);
     switch(scanent->conn)
     {
-    case MC_TCP:  sock = ip_tcpsocket(scanner_options, &errstr, 5);	  break;
-    case MC_UNIX: sock = ip_unixsocket(scanner_options, &errstr);	  break;
+    case MC_TCP:  sock = ip_tcpsocket(scanner_options, &errstr, 5);	break;
+    case MC_UNIX: sock = ip_unixsocket(scanner_options, &errstr);	break;
     case MC_STRM: sock = ip_streamsocket(scanner_options, &errstr, 5);  break;
     default: /* compiler quietening */ break;
     }
     if (sock < 0)
-      return m_errlog_defer(scanent, errstr);
+      return m_errlog_defer(scanent, CUS callout_address, errstr);
     break;
   }
-  DEBUG(D_acl) debug_printf("Malware scan: %s tmo %s\n", scanner_name, readconf_printtime(timeout));
 
   switch (scanent->scancode)
     {
@@ -531,12 +549,12 @@ if (!malware_ok)
 	par_count++;
 	}
       scanrequest = string_sprintf("%s HTTP/1.0\r\n\r\n", scanrequest);
-      DEBUG(D_acl) debug_printf("Malware scan: issuing %s: %s\n",
+      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
 	scanner_name, scanrequest);
 
       /* send scan request */
       if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       while ((len = recv_line(sock, buf, sizeof(buf), tmo)) >= 0)
 	if (len > 0)
@@ -585,16 +603,17 @@ if (!malware_ok)
 	{
 	/* calc file size */
 	if ((drweb_fd = open(CCS eml_filename, O_RDONLY)) == -1)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't open spool file %s: %s",
 	      eml_filename, strerror(errno)),
 	    sock);
 
 	if ((fsize = lseek(drweb_fd, 0, SEEK_END)) == -1)
 	  {
-	  int err = errno;
+	  int err;
+badseek:  err = errno;
 	  (void)close(drweb_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't seek spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
@@ -603,15 +622,16 @@ if (!malware_ok)
 	if ((off_t)fsize_uint != fsize)
 	  {
 	  (void)close(drweb_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("seeking spool file %s, size overflow",
 	      eml_filename),
 	    sock);
 	  }
 	drweb_slen = htonl(fsize);
-	lseek(drweb_fd, 0, SEEK_SET);
+	if (lseek(drweb_fd, 0, SEEK_SET) < 0)
+	  goto badseek;
 
-	DEBUG(D_acl) debug_printf("Malware scan: issuing %s remote scan [%s]\n",
+	DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s remote scan [%s]\n",
 	    scanner_name, scanner_options);
 
 	/* send scan request */
@@ -621,15 +641,15 @@ if (!malware_ok)
 	    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0))
 	  {
 	  (void)close(drweb_fd);
-	  return m_errlog_defer_3(scanent, string_sprintf(
+	  return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
 	    "unable to send commands to socket (%s)", scanner_options),
 	    sock);
 	  }
 
-	if (!(drweb_fbuf = (uschar *) malloc (fsize_uint)))
+	if (!(drweb_fbuf = US malloc(fsize_uint)))
 	  {
 	  (void)close(drweb_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("unable to allocate memory %u for file (%s)",
 	      fsize_uint, eml_filename),
 	    sock);
@@ -640,7 +660,7 @@ if (!malware_ok)
 	  int err = errno;
 	  (void)close(drweb_fd);
 	  free(drweb_fbuf);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't read spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
@@ -651,17 +671,16 @@ if (!malware_ok)
 	if (send(sock, drweb_fbuf, fsize, 0) < 0)
 	  {
 	  free(drweb_fbuf);
-	  return m_errlog_defer_3(scanent, string_sprintf(
+	  return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
 	    "unable to send file body to socket (%s)", scanner_options),
 	    sock);
 	  }
-	(void)close(drweb_fd);
 	}
       else
 	{
 	drweb_slen = htonl(Ustrlen(eml_filename));
 
-	DEBUG(D_acl) debug_printf("Malware scan: issuing %s local scan [%s]\n",
+	DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s local scan [%s]\n",
 	    scanner_name, scanner_options);
 
 	/* send scan request */
@@ -670,19 +689,19 @@ if (!malware_ok)
 	    (send(sock, &drweb_slen, sizeof(drweb_slen), 0) < 0) ||
 	    (send(sock, eml_filename, Ustrlen(eml_filename), 0) < 0) ||
 	    (send(sock, &drweb_fin, sizeof(drweb_fin), 0) < 0))
-	  return m_errlog_defer_3(scanent, string_sprintf(
+	  return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
 	    "unable to send commands to socket (%s)", scanner_options),
 	    sock);
 	}
 
       /* wait for result */
       if (!recv_len(sock, &drweb_rc, sizeof(drweb_rc), tmo))
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 		    US"unable to read return code", sock);
       drweb_rc = ntohl(drweb_rc);
 
       if (!recv_len(sock, &drweb_vnum, sizeof(drweb_vnum), tmo))
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 			    US"unable to read the number of viruses", sock);
       drweb_vnum = ntohl(drweb_vnum);
 
@@ -704,14 +723,14 @@ if (!malware_ok)
 	  int size = 0, off = 0, ovector[10*3];
 	  /* read the size of report */
 	  if (!recv_len(sock, &drweb_slen, sizeof(drweb_slen), tmo))
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, CUS callout_address,
 			      US"cannot read report size", sock);
 	  drweb_slen = ntohl(drweb_slen);
 	  tmpbuf = store_get(drweb_slen);
 
 	  /* read report body */
 	  if (!recv_len(sock, tmpbuf, drweb_slen, tmo))
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, CUS callout_address,
 			      US"cannot read report string", sock);
 	  tmpbuf[drweb_slen] = '\0';
 
@@ -749,7 +768,7 @@ if (!malware_ok)
 	 * DERR_CRC_ERROR, DERR_READSOCKET, DERR_WRITE_ERR
 	 * and others are ignored */
 	if (drweb_s)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("drweb daemon retcode 0x%x (%s)", drweb_rc, drweb_s),
 	    sock);
 
@@ -769,7 +788,7 @@ if (!malware_ok)
       recv_line(sock, buf, sizeof(buf), tmo);
 
       if (buf[0] != '2')		/* aveserver is having problems */
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unavailable (Responded: %s).",
 			  ((buf[0] != 0) ? buf : (uschar *)"nothing") ),
 	  sock);
@@ -779,10 +798,10 @@ if (!malware_ok)
 						eml_filename);
 
       /* and send it */
-      DEBUG(D_acl) debug_printf("Malware scan: issuing %s %s\n",
+      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s %s\n",
 	scanner_name, buf);
       if (m_sock_send(sock, buf, Ustrlen(buf), &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       malware_name = NULL;
       result = 0;
@@ -793,7 +812,7 @@ if (!malware_ok)
 	  break;
 	if (buf[0] == '5')		/* aveserver is having problems */
 	  {
-	  result = m_errlog_defer(scanent,
+	  result = m_errlog_defer(scanent, CUS callout_address,
 	     string_sprintf("unable to scan file %s (Responded: %s).",
 			     eml_filename, buf));
 	  break;
@@ -807,14 +826,14 @@ if (!malware_ok)
 	}
 
       if (m_sock_send(sock, US"quit\r\n", 6, &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       /* read aveserver's greeting and see if it is ready (2xx greeting) */
       buf[0] = 0;
       recv_line(sock, buf, sizeof(buf), tmo);
 
       if (buf[0] != '2')		/* aveserver is having problems */
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unable to quit dialogue (Responded: %s).",
 			((buf[0] != 0) ? buf : (uschar *)"nothing") ),
 	  sock);
@@ -839,7 +858,7 @@ if (!malware_ok)
 
       malware_name = NULL;
 
-      DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan [%s]\n",
+      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
 	  scanner_name, scanner_options);
       /* pass options */
       memset(av_buffer, 0, sizeof(av_buffer));
@@ -847,12 +866,12 @@ if (!malware_ok)
 	{
 
 	if (m_sock_send(sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0)
-	  return m_errlog_defer(scanent, errstr);
+	  return m_errlog_defer(scanent, CUS callout_address, errstr);
 
 	bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
 	if (bread > 0) av_buffer[bread]='\0';
 	if (bread < 0)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("unable to read answer %d (%s)", i, strerror(errno)),
 	    sock);
 	for (j = 0; j < bread; j++)
@@ -864,7 +883,7 @@ if (!malware_ok)
       file_name = string_sprintf("SCAN\t%s\n", eml_filename);
 
       if (m_sock_send(sock, file_name, Ustrlen(file_name), &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       /* set up match */
       /* todo also SUSPICION\t */
@@ -879,14 +898,14 @@ if (!malware_ok)
 
 	for (;;)
 	  {
-	  errno = ETIME;
+	  errno = ETIMEDOUT;
 	  i =  av_buffer+sizeof(av_buffer)-p;
 	  if ((bread= ip_recv(sock, p, i-1, tmo-time(NULL))) < 0)
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, CUS callout_address,
 	      string_sprintf("unable to read result (%s)", strerror(errno)),
 	      sock);
 
-	  for (p[bread] = '\0'; q = Ustrchr(p, '\n'); p = q+1)
+	  for (p[bread] = '\0'; (q = Ustrchr(p, '\n')); p = q+1)
 	    {
 	    *q = '\0';
 
@@ -916,7 +935,8 @@ if (!malware_ok)
       uschar tmpbuf[1024];
       uschar * scanrequest;
       int kav_rc;
-      unsigned long kav_reportlen, bread;
+      unsigned long kav_reportlen;
+      int bread;
       const pcre *kav_re;
       uschar *p;
 
@@ -934,16 +954,16 @@ if (!malware_ok)
       if (p)
 	*p = '\0';
 
-      DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan [%s]\n",
+      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
 	  scanner_name, scanner_options);
 
       /* send scan request */
       if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest)+1, &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       /* wait for result */
       if (!recv_len(sock, tmpbuf, 2, tmo))
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 			    US"unable to read 2 bytes from socket.", sock);
 
       /* get errorcode from one nibble */
@@ -951,18 +971,18 @@ if (!malware_ok)
       switch(kav_rc)
       {
       case 5: case 6: /* improper kavdaemon configuration */
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 		US"please reconfigure kavdaemon to NOT disinfect or remove infected files.",
 		sock);
       case 1:
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 		US"reported 'scanning not completed' (code 1).", sock);
       case 7:
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 		US"reported 'kavdaemon damaged' (code 7).", sock);
       }
 
-      /* code 8 is not handled, since it is ambigous. It appears mostly on
+      /* code 8 is not handled, since it is ambiguous. It appears mostly on
       bounces where part of a file has been cut off */
 
       /* "virus found" return codes (2-4) */
@@ -980,7 +1000,7 @@ if (!malware_ok)
 	  {
 	  /* read report size */
 	  if (!recv_len(sock, &kav_reportlen, 4, tmo))
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, CUS callout_address,
 		  US"cannot read report size", sock);
 
 	  /* it's possible that avp returns av_buffer[1] == 1 but the
@@ -999,7 +1019,9 @@ if (!malware_ok)
 	      kav_re = kav_re_inf;
 	      }
 
-	    /* read report, linewise */
+	    /* read report, linewise.  Using size from stream to read amount of data
+	    from same stream is safe enough. */
+	    /* coverity[tainted_data] */
 	    while (kav_reportlen > 0)
 	      {
 	      if ((bread = recv_line(sock, tmpbuf, sizeof(tmpbuf), tmo)) < 0)
@@ -1037,19 +1059,19 @@ if (!malware_ok)
       uschar *p;
 
       if (!cmdline_scanner)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, NULL, errstr);
 
       /* find scanner output trigger */
       cmdline_trigger_re = m_pcre_nextinlist(&av_scanner_work, &sep,
 				"missing trigger specification", &errstr);
       if (!cmdline_trigger_re)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, NULL, errstr);
 
       /* find scanner name regex */
       cmdline_regex_re = m_pcre_nextinlist(&av_scanner_work, &sep,
 			  "missing virus name regex specification", &errstr);
       if (!cmdline_regex_re)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, NULL, errstr);
 
       /* prepare scanner call; despite the naming, file_name holds a directory
       name which is documented as the value given to %s. */
@@ -1063,7 +1085,7 @@ if (!malware_ok)
       /* redirect STDERR too */
       commandline = string_sprintf("%s 2>&1", commandline);
 
-      DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan [%s]\n",
+      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
 	      scanner_name, commandline);
 
       /* store exims signal handlers */
@@ -1074,20 +1096,19 @@ if (!malware_ok)
 	{
 	int err = errno;
 	signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, NULL,
 	  string_sprintf("call (%s) failed: %s.", commandline, strerror(err)));
 	}
       scanner_fd = fileno(scanner_out);
 
-      file_name = string_sprintf("%s/scan/%s/%s_scanner_output",
-				spool_directory, message_id, message_id);
+      file_name = string_sprintf("%s/%s_scanner_output", eml_dir, message_id);
 
       if (!(scanner_record = modefopen(file_name, "wb", SPOOL_MODE)))
 	{
 	int err = errno;
 	(void) pclose(scanner_out);
 	signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
-	return m_errlog_defer(scanent, string_sprintf(
+	return m_errlog_defer(scanent, NULL, string_sprintf(
 	    "opening scanner output file (%s) failed: %s.",
 	    file_name, strerror(err)));
 	}
@@ -1103,7 +1124,7 @@ if (!malware_ok)
 	    break;
 	  (void) pclose(scanner_out);
 	  signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
-	  return m_errlog_defer(scanent, string_sprintf(
+	  return m_errlog_defer(scanent, NULL, string_sprintf(
 	      "unable to read from scanner (%s): %s",
 	      commandline, strerror(err)));
 	  }
@@ -1113,7 +1134,7 @@ if (!malware_ok)
 	  /* short write */
 	  (void) pclose(scanner_out);
 	  signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
-	  return m_errlog_defer(scanent, string_sprintf(
+	  return m_errlog_defer(scanent, NULL, string_sprintf(
 	    "short write on scanner output file (%s).", file_name));
 	  }
 	putc('\n', scanner_record);
@@ -1128,7 +1149,7 @@ if (!malware_ok)
       sep = pclose(scanner_out);
       signal(SIGCHLD,eximsigchld); signal(SIGPIPE,eximsigpipe);
       if (sep != 0)
-	  return m_errlog_defer(scanent,
+	  return m_errlog_defer(scanent, NULL, 
 	      sep == -1
 	      ? string_sprintf("running scanner failed: %s", strerror(sep))
 	      : string_sprintf("scanner returned error code: %d", sep));
@@ -1166,20 +1187,20 @@ if (!malware_ok)
       if ((p = Ustrrchr(file_name, '/')))
 	*p = '\0';
 
-      DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan [%s]\n",
+      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan [%s]\n",
 	  scanner_name, scanner_options);
 
       if (  write(sock, file_name, Ustrlen(file_name)) < 0
 	 || write(sock, "\n", 1) != 1
 	 )
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unable to write to UNIX socket (%s)", scanner_options),
 	  sock);
 
       /* wait for result */
       memset(av_buffer, 0, sizeof(av_buffer));
       if ((bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL))) <= 0)
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unable to read from UNIX socket (%s)", scanner_options),
 	  sock);
 
@@ -1191,7 +1212,8 @@ if (!malware_ok)
 	malware_name = string_copy(&av_buffer[2]);
       }
       else if (!strncmp(CS av_buffer, "-1", 2))
-	return m_errlog_defer_3(scanent, US"scanner reported error", sock);
+	return m_errlog_defer_3(scanent, CUS callout_address,
+		US"scanner reported error", sock);
       else /* all ok, no virus */
 	malware_name = NULL;
 
@@ -1212,7 +1234,7 @@ if (!malware_ok)
 * WITH_OLD_CLAMAV_STREAM is defined.
 * See Exim bug 926 for details.  */
 
-      uschar *p, *vname, *result_tag, *response_end;
+      uschar *p, *vname, *result_tag;
       int bread=0;
       uschar * file_name;
       uschar av_buffer[1024];
@@ -1253,7 +1275,7 @@ if (!malware_ok)
 
 	/* parse options */
 	if (clamd_option(cd, sublist, &subsep) != OK)
-	  return m_errlog_defer(scanent,
+	  return m_errlog_defer(scanent, NULL,
 	    string_sprintf("bad option '%s'", scanner_options));
 	cv[0] = cd;
 	}
@@ -1285,13 +1307,13 @@ if (!malware_ok)
 	  sublist = scanner_options;
 	  if (!(cd->hostspec = string_nextinlist(&sublist, &subsep, NULL, 0)))
 	    {
-	    (void) m_errlog_defer(scanent,
+	    (void) m_errlog_defer(scanent, NULL, 
 		      string_sprintf("missing address: '%s'", scanner_options));
 	    continue;
 	    }
 	  if (!(s = string_nextinlist(&sublist, &subsep, NULL, 0)))
 	    {
-	    (void) m_errlog_defer(scanent,
+	    (void) m_errlog_defer(scanent, NULL, 
 		      string_sprintf("missing port: '%s'", scanner_options));
 	    continue;
 	    }
@@ -1300,16 +1322,13 @@ if (!malware_ok)
 	  /* parse options */
 	  /*XXX should these options be common over scanner types? */
 	  if (clamd_option(cd, sublist, &subsep) != OK)
-	    {
-	    return m_errlog_defer(scanent,
+	    return m_errlog_defer(scanent, NULL,
 	      string_sprintf("bad option '%s'", scanner_options));
-	    continue;
-	    }
 
 	  cv[num_servers++] = cd;
 	  if (num_servers >= MAX_CLAMD_SERVERS)
 	    {
-	    (void) m_errlog_defer(scanent,
+	    (void) m_errlog_defer(scanent, NULL,
 		  US"More than " MAX_CLAMD_SERVERS_S " clamd servers "
 		  "specified; only using the first " MAX_CLAMD_SERVERS_S );
 	    break;
@@ -1319,14 +1338,14 @@ if (!malware_ok)
 
 	/* check if we have at least one server */
 	if (!num_servers)
-	  return m_errlog_defer(scanent,
+	  return m_errlog_defer(scanent, NULL,
 	    US"no useable server addresses in malware configuration option.");
 	}
 
       /* See the discussion of response formats below to see why we really
       don't like colons in filenames when passing filenames to ClamAV. */
       if (use_scan_command && Ustrchr(eml_filename, ':'))
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, NULL,
 	  string_sprintf("local/SCAN mode incompatible with" \
 	    " : in path to email filename [%s]", eml_filename));
 
@@ -1342,7 +1361,7 @@ if (!malware_ok)
 	  int i = random_number( num_servers );
 	  clamd_address * cd = cv[i];
 
-	  DEBUG(D_acl) debug_printf("trying server name %s, port %u\n",
+	  DEBUG(D_acl) debug_printf_indent("trying server name %s, port %u\n",
 			 cd->hostspec, cd->tcp_port);
 
 	  /* Lookup the host. This is to ensure that we connect to the same IP
@@ -1362,8 +1381,7 @@ if (!malware_ok)
 	  if (sock >= 0)
 	    break;
 
-	  log_write(0, LOG_MAIN, "malware acl condition: %s: %s",
-	    scanent->name, errstr);
+	  (void) m_errlog_defer(scanent, CUS callout_address, errstr);
 
 	  /* Remove the server from the list. XXX We should free the memory */
 	  num_servers--;
@@ -1372,7 +1390,7 @@ if (!malware_ok)
 	  }
 
 	if (num_servers == 0)
-	  return m_errlog_defer(scanent, US"all servers failed");
+	  return m_errlog_defer(scanent, NULL, US"all servers failed");
 	}
       else
 	for (;;)
@@ -1383,7 +1401,7 @@ if (!malware_ok)
 	    break;
 	    }
 	  if (cv[0]->retry <= 0)
-	    return m_errlog_defer(scanent, errstr);
+	    return m_errlog_defer(scanent, CUS callout_address, errstr);
 	  while (cv[0]->retry > 0) cv[0]->retry = sleep(cv[0]->retry);
 	  }
 
@@ -1399,39 +1417,41 @@ if (!malware_ok)
 	 * that port on a second connection; then in the scan-method-neutral
 	 * part, read the response back on the original connection. */
 
-	DEBUG(D_acl) debug_printf(
+	DEBUG(D_acl) debug_printf_indent(
 	    "Malware scan: issuing %s old-style remote scan (PORT)\n",
 	    scanner_name);
 
 	/* Pass the string to ClamAV (7 = "STREAM\n") */
 	if (m_sock_send(sock, US"STREAM\n", 7, &errstr) < 0)
-	  return m_errlog_defer(scanent, errstr);
+	  return m_errlog_defer(scanent, CUS callout_address, errstr);
 
 	memset(av_buffer2, 0, sizeof(av_buffer2));
 	bread = ip_recv(sock, av_buffer2, sizeof(av_buffer2), tmo-time(NULL));
 
 	if (bread < 0)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("unable to read PORT from socket (%s)",
 		strerror(errno)),
 	    sock);
 
 	if (bread == sizeof(av_buffer2))
-	  return m_errlog_defer_3(scanent, "buffer too small", sock);
+	  return m_errlog_defer_3(scanent, CUS callout_address,
+		  "buffer too small", sock);
 
 	if (!(*av_buffer2))
-	  return m_errlog_defer_3(scanent, "ClamAV returned null", sock);
+	  return m_errlog_defer_3(scanent, CUS callout_address,
+		  "ClamAV returned null", sock);
 
 	av_buffer2[bread] = '\0';
 	if( sscanf(CS av_buffer2, "PORT %u\n", &port) != 1 )
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("Expected port information from clamd, got '%s'",
 	      av_buffer2),
 	    sock);
 
 	sockData = m_tcpsocket(connhost.address, port, NULL, &errstr);
 	if (sockData < 0)
-	  return m_errlog_defer_3(scanent, errstr, sock);
+	  return m_errlog_defer_3(scanent, CUS callout_address, errstr, sock);
 
 # define CLOSE_SOCKDATA (void)close(sockData)
 #else /* WITH_OLD_CLAMAV_STREAM not defined */
@@ -1439,13 +1459,13 @@ if (!malware_ok)
 	chunks, <n> a 4-byte number (network order), terminated by a zero-length
 	chunk. */
 
-	DEBUG(D_acl) debug_printf(
+	DEBUG(D_acl) debug_printf_indent(
 	    "Malware scan: issuing %s new-style remote scan (zINSTREAM)\n",
 	    scanner_name);
 
 	/* Pass the string to ClamAV (10 = "zINSTREAM\0") */
 	if (send(sock, "zINSTREAM", 10, 0) < 0)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS hostname,
 	    string_sprintf("unable to send zINSTREAM to socket (%s)",
 	      strerror(errno)),
 	    sock);
@@ -1458,16 +1478,17 @@ if (!malware_ok)
 	  {
 	  int err = errno;
 	  CLOSE_SOCKDATA;
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't open spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
 	  }
 	if ((fsize = lseek(clam_fd, 0, SEEK_END)) < 0)
 	  {
-	  int err = errno;
+	  int err;
+b_seek:   err = errno;
 	  CLOSE_SOCKDATA; (void)close(clam_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't seek spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
@@ -1476,17 +1497,18 @@ if (!malware_ok)
 	if ((off_t)fsize_uint != fsize)
 	  {
 	  CLOSE_SOCKDATA; (void)close(clam_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("seeking spool file %s, size overflow",
 	      eml_filename),
 	    sock);
 	  }
-	lseek(clam_fd, 0, SEEK_SET);
+	if (lseek(clam_fd, 0, SEEK_SET) < 0)
+	  goto b_seek;
 
-	if (!(clamav_fbuf = (uschar *) malloc (fsize_uint)))
+	if (!(clamav_fbuf = US malloc(fsize_uint)))
 	  {
 	  CLOSE_SOCKDATA; (void)close(clam_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("unable to allocate memory %u for file (%s)",
 	      fsize_uint, eml_filename),
 	    sock);
@@ -1496,7 +1518,7 @@ if (!malware_ok)
 	  {
 	  int err = errno;
 	  free(clamav_fbuf); CLOSE_SOCKDATA; (void)close(clam_fd);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("can't read spool file %s: %s",
 	      eml_filename, strerror(err)),
 	    sock);
@@ -1508,7 +1530,7 @@ if (!malware_ok)
 	if (send(sockData, clamav_fbuf, fsize_uint, 0) < 0)
 	  {
 	  free(clamav_fbuf); CLOSE_SOCKDATA;
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("unable to send file body to socket (%s:%u)",
 	      hostname, port),
 	    sock);
@@ -1521,7 +1543,7 @@ if (!malware_ok)
 	    (send(sock, &send_final_zeroblock, sizeof(send_final_zeroblock), 0) < 0))
 	  {
 	  free(clamav_fbuf);
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, NULL,
 	    string_sprintf("unable to send file body to socket (%s)", hostname),
 	    sock);
 	  }
@@ -1550,12 +1572,12 @@ if (!malware_ok)
 	/* Pass the string to ClamAV (7 = "SCAN \n" + \0) */
 	file_name = string_sprintf("SCAN %s\n", eml_filename);
 
-	DEBUG(D_acl) debug_printf(
+	DEBUG(D_acl) debug_printf_indent(
 	    "Malware scan: issuing %s local-path scan [%s]\n",
 	    scanner_name, scanner_options);
 
 	if (send(sock, file_name, Ustrlen(file_name), 0) < 0)
-	  return m_errlog_defer_3(scanent,
+	  return m_errlog_defer_3(scanent, CUS callout_address,
 	    string_sprintf("unable to write to socket (%s)", strerror(errno)),
 	    sock);
 
@@ -1572,12 +1594,13 @@ if (!malware_ok)
       sock = -1;
 
       if (bread <= 0)
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, CUS callout_address,
 	  string_sprintf("unable to read from socket (%s)",
 	  errno == 0 ? "EOF" : strerror(errno)));
 
       if (bread == sizeof(av_buffer))
-	return m_errlog_defer(scanent, US"buffer too small");
+	return m_errlog_defer(scanent, CUS callout_address,
+		US"buffer too small");
       /* We're now assured of a NULL at the end of av_buffer */
 
       /* Check the result. ClamAV returns one of two result formats.
@@ -1601,7 +1624,8 @@ if (!malware_ok)
       passing a filename to clamd). */
 
       if (!(*av_buffer))
-	return m_errlog_defer(scanent, US"ClamAV returned null");
+	return m_errlog_defer(scanent, CUS callout_address,
+		US"ClamAV returned null");
 
       /* strip newline at the end (won't be present for zINSTREAM)
       (also any trailing whitespace, which shouldn't exist, but we depend upon
@@ -1609,16 +1633,15 @@ if (!malware_ok)
       p = av_buffer + Ustrlen(av_buffer) - 1;
       if (*p == '\n') *p = '\0';
 
-      DEBUG(D_acl) debug_printf("Malware response: %s\n", av_buffer);
+      DEBUG(D_acl) debug_printf_indent("Malware response: %s\n", av_buffer);
 
       while (isspace(*--p) && (p > av_buffer))
 	*p = '\0';
       if (*p) ++p;
-      response_end = p;
 
       /* colon in returned output? */
-      if((p = Ustrchr(av_buffer,':')) == NULL)
-	return m_errlog_defer(scanent, string_sprintf(
+      if(!(p = Ustrchr(av_buffer,':')))
+	return m_errlog_defer(scanent, CUS callout_address, string_sprintf(
 		  "ClamAV returned malformed result (missing colon): %s",
 		  av_buffer));
 
@@ -1647,22 +1670,22 @@ if (!malware_ok)
 	    *p = '\0';
 	  }
 	malware_name = string_copy(vname);
-	DEBUG(D_acl) debug_printf("Malware found, name \"%s\"\n", malware_name);
+	DEBUG(D_acl) debug_printf_indent("Malware found, name \"%s\"\n", malware_name);
 
 	}
       else if (Ustrcmp(result_tag, "ERROR") == 0)
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, CUS callout_address,
 	  string_sprintf("ClamAV returned: %s", av_buffer));
 
       else if (Ustrcmp(result_tag, "OK") == 0)
 	{
 	/* Everything should be OK */
 	malware_name = NULL;
-	DEBUG(D_acl) debug_printf("Malware not found\n");
+	DEBUG(D_acl) debug_printf_indent("Malware not found\n");
 
 	}
       else
-	return m_errlog_defer(scanent,
+	return m_errlog_defer(scanent, CUS callout_address,
 	  string_sprintf("unparseable response from ClamAV: {%s}", av_buffer));
 
       break;
@@ -1683,57 +1706,66 @@ if (!malware_ok)
       const pcre *sockline_name_re;
 
       /* find scanner command line */
-      if ((sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
-					  NULL, 0)))
+      if (  (sockline_scanner = string_nextinlist(&av_scanner_work, &sep,
+					  NULL, 0))
+	 && *sockline_scanner
+	 )
       {	/* check for no expansions apart from one %s */
 	uschar * s = Ustrchr(sockline_scanner, '%');
 	if (s++)
 	  if ((*s != 's' && *s != '%') || Ustrchr(s+1, '%'))
-	    return m_errlog_defer_3(scanent,
+	    return m_errlog_defer_3(scanent, NULL,
 				  US"unsafe sock scanner call spec", sock);
       }
       else
 	sockline_scanner = sockline_scanner_default;
+      DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "cmdline: ",
+	string_printing(sockline_scanner));
 
       /* find scanner output trigger */
       sockline_trig_re = m_pcre_nextinlist(&av_scanner_work, &sep,
 				"missing trigger specification", &errstr);
       if (!sockline_trig_re)
-	return m_errlog_defer_3(scanent, errstr, sock);
+	return m_errlog_defer_3(scanent, NULL, errstr, sock);
 
       /* find virus name regex */
       sockline_name_re = m_pcre_nextinlist(&av_scanner_work, &sep,
 			  "missing virus name regex specification", &errstr);
       if (!sockline_name_re)
-	return m_errlog_defer_3(scanent, errstr, sock);
+	return m_errlog_defer_3(scanent, NULL, errstr, sock);
 
       /* prepare scanner call - security depends on expansions check above */
-      commandline = string_sprintf("%s/scan/%s/%s.eml", spool_directory, message_id, message_id);
-      commandline = string_sprintf( CS sockline_scanner, CS commandline);
-
+      commandline = string_sprintf( CS sockline_scanner, CS eml_filename);
+      DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "expanded: ",
+	string_printing(commandline));
 
       /* Pass the command string to the socket */
       if (m_sock_send(sock, commandline, Ustrlen(commandline), &errstr) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       /* Read the result */
       bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
 
       if (bread <= 0)
-	return m_errlog_defer_3(scanent,
+	return m_errlog_defer_3(scanent, CUS callout_address,
 	  string_sprintf("unable to read from socket (%s)", strerror(errno)),
 	  sock);
 
       if (bread == sizeof(av_buffer))
-	return m_errlog_defer_3(scanent, US"buffer too small", sock);
+	return m_errlog_defer_3(scanent, CUS callout_address,
+		US"buffer too small", sock);
       av_buffer[bread] = '\0';
       linebuffer = string_copy(av_buffer);
+      DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "answer: ",
+	string_printing(linebuffer));
 
       /* try trigger match */
       if (regex_match_and_setup(sockline_trig_re, linebuffer, 0, -1))
 	{
 	if (!(malware_name = m_pcre_exec(sockline_name_re, av_buffer)))
 	  malware_name = US "unknown";
+	DEBUG(D_acl) debug_printf_indent("%15s%10s'%s'\n", "", "name: ",
+	  string_printing(malware_name));
 	}
       else /* no virus found */
 	malware_name = NULL;
@@ -1754,16 +1786,16 @@ if (!malware_ok)
 	   || mksd_maxproc < 1
 	   || mksd_maxproc > 32
 	   )
-	  return m_errlog_defer(scanent,
+	  return m_errlog_defer(scanent, CUS callout_address,
 	    string_sprintf("invalid option '%s'", scanner_options));
 	}
 
       if((sock = ip_unixsocket(US "/var/run/mksd/socket", &errstr)) < 0)
-	return m_errlog_defer(scanent, errstr);
+	return m_errlog_defer(scanent, CUS callout_address, errstr);
 
       malware_name = NULL;
 
-      DEBUG(D_acl) debug_printf("Malware scan: issuing %s scan\n", scanner_name);
+      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s scan\n", scanner_name);
 
       if ((retval = mksd_scan_packed(scanent, sock, eml_filename, tmo)) != OK)
 	{
@@ -1803,9 +1835,9 @@ if (!malware_ok)
 	  )
 	{
 	int slen = Ustrlen(buf);
-	if (slen >= 1) 
+	if (slen >= 1)
 	  {
-	  DEBUG(D_acl) debug_printf("got from avast: %s\n", buf);
+	  DEBUG(D_acl) debug_printf_indent("got from avast: %s\n", buf);
 	  switch (avast_stage)
 	    {
 	    case AVA_HELO:
@@ -1831,8 +1863,7 @@ if (!malware_ok)
 		}
 	      else
 		{
-		scanrequest = string_sprintf("SCAN %s/scan/%s\n",
-		    spool_directory, message_id);
+		scanrequest = string_sprintf("SCAN %s\n", eml_dir);
 		avast_stage = AVA_RSP;		/* just sent command */
 		}
 
@@ -1841,7 +1872,7 @@ if (!malware_ok)
 	      if (send(sock, scanrequest, len, 0) < 0)
 		{
 		scanrequest[len-1] = '\0';
-		return m_errlog_defer_3(scanent, string_sprintf(
+		return m_errlog_defer_3(scanent, CUS callout_address, string_sprintf(
 		      "unable to send request '%s' to socket (%s): %s",
 		      scanrequest, scanner_options, strerror(errno)), sock);
 		}
@@ -1859,18 +1890,19 @@ if (!malware_ok)
 	      if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
 		{ /* remove backslash in front of [whitespace|backslash] */
 		uschar * p, * p0;
-		for (p = malware_name; *p; ++p) 
+		for (p = malware_name; *p; ++p)
 		  if (*p == '\\' && (isspace(p[1]) || p[1] == '\\'))
 		    for (p0 = p; *p0; ++p0) *p0 = p0[1];
-		
+
 		avast_stage = AVA_DONE;
 		goto endloop;
 		}
 
-	      if (Ustrncmp(buf, "200 SCAN OK", 11) == 0) 
+	      if (Ustrncmp(buf, "200 SCAN OK", 11) == 0)
 		{ /* we're done finally */
 		if (send(sock, "QUIT\n", 5, 0) < 0) /* courtesy */
-		  return m_errlog_defer_3(scanent, string_sprintf(
+		  return m_errlog_defer_3(scanent, CUS callout_address,
+			  string_sprintf(
 			      "unable to send quit request to socket (%s): %s",
 			      scanner_options, strerror(errno)),
 			      sock);
@@ -1881,6 +1913,9 @@ if (!malware_ok)
 
 	      /* here for any unexpected response from the scanner */
 	      goto endloop;
+
+	    case AVA_DONE:	log_write(0, LOG_PANIC, "%s:%d:%s: should not happen",
+			    __FILE__, __LINE__, __FUNCTION__);
 	    }
 	  }
 	}
@@ -1888,9 +1923,9 @@ if (!malware_ok)
 
       switch(avast_stage)
 	{
-	case AVA_HELO:	
+	case AVA_HELO:
 	case AVA_OPT:
-	case AVA_RSP:	return m_errlog_defer_3(scanent,
+	case AVA_RSP:	return m_errlog_defer_3(scanent, CUS callout_address,
 			    nread >= 0
 			    ? string_sprintf(
 				"invalid response from scanner: '%s'", buf)
@@ -1900,8 +1935,53 @@ if (!malware_ok)
 			  sock);
 	default:	break;
 	}
+      break;
       }
+
+    case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
+      {
+      int bread;
+      uschar * e;
+      uschar * linebuffer;
+      uschar * scanrequest;
+      uschar av_buffer[1024];
+
+      if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
+        || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
+        return malware_errlog_defer(errstr);
+
+      scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
+      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
+        scanner_name, scanrequest);
+
+      if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0)
+        return m_errlog_defer(scanent, CUS callout_address, errstr);
+
+      bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
+
+      if (bread <= 0)
+        return m_errlog_defer_3(scanent, CUS callout_address,
+          string_sprintf("unable to read from socket (%s)", strerror(errno)),
+          sock);
+
+      if (bread == sizeof(av_buffer))
+        return m_errlog_defer_3(scanent, CUS callout_address,
+          US"buffer too small", sock);
+
+      av_buffer[bread] = '\0';
+      linebuffer = string_copy(av_buffer);
+
+      m_sock_send(sock, US"QUIT\n", 5, 0);
+
+      if ((e = m_pcre_exec(fprot6d_re_error, linebuffer)))
+        return m_errlog_defer_3(scanent, CUS callout_address,
+          string_sprintf("scanner reported error (%s)", e), sock);
+
+      if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer)))
+        malware_name = NULL;
+
       break;
+      }  /* f-prot6d */
   }	/* scanner type switch */
 
   if (sock >= 0)
@@ -1912,7 +1992,7 @@ if (!malware_ok)
 /* match virus name against pattern (caseless ------->----------v) */
 if (malware_name && regex_match_and_setup(re, malware_name, 0, -1))
   {
-  DEBUG(D_acl) debug_printf(
+  DEBUG(D_acl) debug_printf_indent(
       "Matched regex to malware [%s] [%s]\n", malware_re, malware_name);
   return OK;
   }
@@ -1938,15 +2018,10 @@ Returns:      Exim message processing code (OK, FAIL, DEFER, ...)
 int
 malware(const uschar * malware_re, int timeout)
 {
-  uschar * scan_filename;
-  int ret;
-
-  scan_filename = string_sprintf("%s/scan/%s/%s.eml",
-		    spool_directory, message_id, message_id);
-  ret = malware_internal(malware_re, scan_filename, timeout, FALSE);
-  if (ret == DEFER) av_failed = TRUE;
+int ret = malware_internal(malware_re, NULL, timeout);
 
-  return ret;
+if (ret == DEFER) av_failed = TRUE;
+return ret;
 }
 
 
@@ -1968,32 +2043,35 @@ Returns:        Exim message processing code (OK, FAIL, DEFER, ...)
 int
 malware_in_file(uschar *eml_filename)
 {
-  uschar message_id_buf[64];
-  int ret;
-
-  /* spool_mbox() assumes various parameters exist, when creating
-  the relevant directory and the email within */
-  (void) string_format(message_id_buf, sizeof(message_id_buf),
-      "dummy-%d", vaguely_random_number(INT_MAX));
-  message_id = message_id_buf;
-  sender_address = US"malware-sender@example.net";
-  return_path = US"";
-  recipients_list = NULL;
-  receive_add_recipient(US"malware-victim@example.net", -1);
-  enable_dollar_recipients = TRUE;
-
-  ret = malware_internal(US"*", eml_filename, 0,  TRUE);
-
-  Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
-  spool_mbox_ok = 1;
-  /* don't set no_mbox_unspool; at present, there's no way for it to become
-  set, but if that changes, then it should apply to these tests too */
-  unspool_mbox();
-
-  /* silence static analysis tools */
-  message_id = NULL;
-
-  return ret;
+uschar message_id_buf[64];
+int ret;
+
+/* spool_mbox() assumes various parameters exist, when creating
+the relevant directory and the email within */
+
+(void) string_format(message_id_buf, sizeof(message_id_buf),
+    "dummy-%d", vaguely_random_number(INT_MAX));
+message_id = message_id_buf;
+sender_address = US"malware-sender@example.net";
+return_path = US"";
+recipients_list = NULL;
+receive_add_recipient(US"malware-victim@example.net", -1);
+enable_dollar_recipients = TRUE;
+
+ret = malware_internal(US"*", eml_filename, 0);
+
+Ustrncpy(spooled_message_id, message_id, sizeof(spooled_message_id));
+spool_mbox_ok = 1;
+
+/* don't set no_mbox_unspool; at present, there's no way for it to become
+set, but if that changes, then it should apply to these tests too */
+
+unspool_mbox();
+
+/* silence static analysis tools */
+message_id = NULL;
+
+return ret;
 }
 
 
@@ -2014,6 +2092,10 @@ if (!ava_re_clean)
   ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
 if (!ava_re_virus)
   ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
+if (!fprot6d_re_error)
+  fprot6d_re_error = regex_must_compile(fprot6d_re_error_str, FALSE, TRUE);
+if (!fprot6d_re_virus)
+  fprot6d_re_virus = regex_must_compile(fprot6d_re_virus_str, FALSE, TRUE);
 }
 
 #endif /*WITH_CONTENT_SCAN*/