    
/*
 * -------------------------------------------------------------
 *
 *   Mail filters configuration file description
 *
 * -------------------------------------------------------------
 */

    Configuration file is an ordinary text file with the following rules:

[Section 1 name]
Parameter1 = volume
.....
ParameterN = volume

.....

[Section X name]
Parameter1 = volume
.....
ParameterY = volume

The parameters will be described in the following way:

---
parameter_name = parameter_type (default_value or 'absent')

parameter description
---

All the parameters may be of the following four types:
- string parameters (STRING), and here paths, names, actions etc. go,
- numeric ones (COUNT), these are signless numbers from 0 to 2^31 - 1,
- Boolean ones (BOOL), these variables may have such values as:
     yes, on, true - to enable,
     no, off, false - to disable the option set by this parameter,
  any of the adduced variants possible, letter case is not taken into account.

Now let's stop at the options that may be specified. 


    In the [DaemonCommunication] section the parameters regarding the
filer-daemon interaction are described.

Address = STRING (absent)

Similar to previous version command line option: -d -u -n -p 
This parameter specifies daemon transport address to which the filter will
give out scanning jobs. The string must correspond to the following :

   TYPE:TRANSPORT_ADDRESS

   Admissible the following types:
   inet - TCP sockets used, than TRANSPORT_ADDRESS has the following :
           PORT@HOST_NAME
         HOST_NAME may be either direct IP address, or host domain name.
         Example:
           Address = inet:3000@localhost
   local - local UNIX sockets used, than TRANSPORT_ADDRESS 
         is a mere path to the socket file.
         Example:
           Address = local:/var/run/drwebd.skt
   pid - shows that the real address must be read from the daemons pid file.
         Example:
           Address = pid:/var/run/drwebd.pid

Cache = BOOL (on)

Similar to previous version command line option: -v 
This option may be used only if TCP sockets are utilized to provide the
connection with the daemon. If it is enabled (yes, on, true) and the daemon
host address is a domain name, than its IP will be requested only once (at
the filer start) and this very IP will be used in future; if the option is
disabled, IP will get ascertained at every request (which is quite a
slow-speed operation).

Timeout = COUNT (0)

Similar to previous version command line option: -t 
This option specifies the timeout (in seconds) value for the whole handling 
session of an message. If the daemon failed to give answer within the
timeout period, than the action specified by ProcessingErrors option is
undertaken (see below). 0 value corresponds to infinite timeout.

    
    In the [SendmailCommunication] section the parameters regarding
filter-Sendmail interaction are described.

Address = STRING (absent)

Similar to previous version command line option: -m -i -s 
The parameter specifies the address at which the filter will be waiting for
Sendmail requests. The  is similar to that described above, the only
exception is that pid type cannot be used.

Examples of different configurations:
   1) sendmail, drweb-smf & daemon installed at one and the same host
   and are using Unix sockets:
   * in drweb32.ini
     SocketMode = Unix
     SocketFile = /path/to/daemon.socket
   * in sendmail.mc there will be:
     MAIL_FILTER(`drweb-filter', `S=local:/path/to/drweb-smf.socket, F=T, T=C:5m;S:15m;R:15m;E:1h')
   * in drweb_smf.conf there will be:
     [DaemonCommunication]
     Address = local:/path/to/daemon.socket
     [SendmailCommunication]
     Address = local:/path/to/drweb-smf.socket
           
   2) sendmail, drweb-smf & daemon installed at one and the same host
   and are using TCP sockets:
   * in drweb32.ini
     SocketMode = TCP
     DaemonPort = 3000
     Interfaces = localhost
   * in sendmail.mc there will be:
     MAIL_FILTER(`drweb-filter', `S=inet:3001@localhost, F=T, T=C:5m;S:15m;R:15m;E:1h')
   * in drweb_smf.conf there will be:
     [DaemonCommunication]
     Address = inet:3000@localhost
     [SendmailCommunication]
     Address = S=inet:3001@localhost
                      
   3) sendmail installed at host_A, drweb-smf at host_B, daemon at host_C,
   although most frequent are particular cases when host_A == host_B
   (sendmail & drweb-smf at one host, daemon at another) or host_B == host_C
   (sendmail at one host, drweb-smf & daemon at another):

   * in drweb32.ini there will be:
     SocketMode = TCP
     DaemonPort = 3000
     Interfaces = "host_C"
   * in sendmail.mc there will be:
     MAIL_FILTER(`drweb-filter', `S=inet:3001@host_B, F=T, T=C:5m;S:15m;R:15m;E:1h')
   * in drweb_smf.conf there will be:
     [DaemonCommunication]
     Address = inet:3000@host_C
     [SendmailCommunication]
     Address = inet:3001@host_B

           
    In the [Scanning] section the scanning process parameters are described.

HeuristicAnalysis = BOOL (on)

Similar to previous version command line option: -ha 
Enable/disable heuristic analyser to detect unknown viruses, although it
makes possible false alarms.

IncludeReport = BOOL (yes)

Similar to previous version command line option: -r 
Enable/disable including DrWeb daemon report to notifications.
Obsolete: VirusReport in [Actions]

ReportMaxSize = COUNT (4096)

Max size of report that be created if IncludeReport is set to "yes".
You can specify 0 if you do not want restrict size, but it is bad idea - 
report can grow to some megabytes for mailbombs

LocalScan = BOOL (yes)

Similar to previous version command line option: -l 
Enable/disable "local scanning" mode. In the "local scanning" mode the
filter does not transmit to the daemon the file itself (as it is in general
mode) but only reports to the daemon the location of the file (containing
the message). This mode is notable for high performance, although it
requires accurate setting of the rights to the directories.

SpamFilter = BOOL (off)

Similar to previous version command line option: -hs 
Enable/disable message header analyser. The analyser uses the rules written
in regular expressions in the daemons configuration file (drweb32.ini).
See documentation on the daemon. This option is available only starting
from the daemon v4.27.

Spool = STRING (absent)

Similar to previous version command line option: -f 
Path to the directory where temporary files will be created for checking.

FilterAccount = STRING (absent)

Similar to previous version command line option: -o 
Name of the user whose account will be used for filter operating. 

DenyOnOne = BOOL (no)

The parameter specifies how the filter should react to the "blocked" mail
masks. If the option is enabled the message will be gated through, if at
least one of the mail addresses (the senders or one of the recipients)
falls under the "blocked" mask. If it is disabled than the letter will not
be delivered without checking unless all the mail addresses in the letter
(the senders and all the recipients) fall under the "blocked" masks.

DenyList = STRING (absent)

Path to the file containing the "blocked" masks; if it is not specified
there are no such.

 
   In the [Actions] section the actions the filter undertakes in different
cases are described.

Infected = STRING (reject)

The action taken if an "infected" object is found in the message body -
i.e. a known virus. Possible actions: reject - deny the delivery and
remove, quarantine - deny the delivery and store the message itself in the
"quarantine".
 
Suspicious = STRING (reject)

The action taken if a "suspicious" object is found in the message body -
possibly a new virus. Possible actions: pass - gate the message through,
reject - deny the delivery, quarantine - deny the delivery and store the 
message itself in the "quarantine".

SpamFilterAlert = STRING (pass)

Similar to previous version command line option: -z -hs 
The action taken if the message fell under the inhibitory actions of the
message header analyser. Possible actions: pass - gate the message through, 
reject - deny the delivery, discard - acknowledge the delivery and remove 
the message (the black hole effect).

EmptyFrom = STRING (continue)

Similar to previous version command line option: -z 
The action taken if the letter has blank sender <>. Possible actions:
pass - gate the message through, reject - deny the delivery, discard -
acknowledge the delivery and remove the message (the black hole effect).

SkipObject = STRING (reject)

Similar to previous version command line option: -k 
The action taken if an object which cannot be checked by the antivirus
daemon is found in the message (e.g., a passworded archive). Possible
actions: pass - gate the message through, reject - deny the delivery,
quarantine - move message to quarantine and reject it.

MailbombObject = STRING (reject)

Similar to previous version command line option: -j 
The action taken against an object found in the message which cannot be
checked by the antivirus daemon because its compression rate (or the
embedded file) exceeds the maximum compression rate specified in the
daemons configuration file (see MaxCompressionRatio and
MaxFileSizeToExtract). Possible actions: pass - gate the message through,
reject - deny the delivery, quarantine - move message to quarantine and 
reject it.

ScanningErrors = STRING (reject)

Similar to previous version command line option: -y 
The action taken if any errors occurred during the message processing by
the daemon (e.g. memory shortage or no rights to access the file).
Possible actions: pass - gate the message through, reject - deny the
delivery, tempfail - temporary delay the message and retry later - the time
of the delay depends on the mail system settings, quarantine - move message 
to quarantine and reject it.

ProcessingErrors = STRING (reject)

Similar to previous version command line option: -b 
The action taken if any errors occurred during the message processing by
the filter (e.g. memory shortage or could not stablish connection with the
daemon). Possible actions: pass - gate the message through, reject - deny
the delivery, tempfail - temporary delay the message and retry later - the
time of the delay depends on the mail system settings.

AdminMail = STRING (absent)

Similar to previous version command line option: -g 
Specifies the mail address to which the notification signed for
administrator will be sent.

FilterMail = STRING (absent)

The address that will be indicated as notification senders one.

Quarantine = STRING (absent)

Similar to previous version command line option: -a 
Path to the "quarantine" - the directory where the infected messages will
be stored.
  
   
   In the [NotificationOptions] section the notification parameters are
described.

FastNotify = BOOL (no)

The option allows to use quick-dispatch mechanism - the notification
messages, unlike in the general mode, do not undergo checking by the
daemon. But the use of this mode may make it possible to dispatch letters
for checking also for unauthorised persons. For them it is enough either to
guess the secret signature generated at every start (with the use of md5),
or - if they have access to the system with too detailed logging
(Milter.LogLevel above 6) spy the signature in the system log files.

NotifyHashSalt = STRING (absent)

The line used as one of the components when generating the secret signature.
 
    
    In the [VirusNotifications] section regulations of notifying about a
detected virus are described.

SenderNotify = BOOL (yes)
AdminNotify = BOOL (yes)
RcptsNotify = BOOL (yes)

To inform or not to inform the sender, the administrator and the recipients
correspondingly that a virus has been found in the message.

SenderTemplate = STRING (absent)
AdminTemplate = STRING (absent)
RcptsTemplate = STRING (absent)

Paths to the templates of the correspondent notifications.

Assigning the parameters of the same name for the sections
[SkipNotifications], [MailbombNotifications] and [ErrorNotifications] is
similar, the only exception being the event they regard.

 
    In the [Logging] section the parameters of outputting the information
on filter operating are described.

Level = STRING (Quiet)

Similar to previous version command line option: -w -q 
Set the detalization level of the output information. Currently available next 
values: Quiet, Errors, Alerts, Info, Verbose, Debug. Operational information 
will be output with SyslogPriority priority and SyslogFacility facility.

SyslogFacility = STRING (Mail)

Logging type if syslogd system service is used. Available values: Daemon, Mail, 
Local0 .. Local7

SyslogPriority = STRING (Info)

Logging priority if syslogd system service is used. Available values: Debug, 
Info, Notice, Alert.

    
    In the [Submitter] section the mail system itself is described.

MailSystem = STRING (Sendmail)

Mail system name, must containt name of your MTA. See value in bracket.

Submitter = STRING (absent)

Path to sendmail with the standard interface:
{mailprog} -i -bm -f {sender} -- {rcpts} < {mail.msg}
 