/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Description:  Module contains supporting functions used by functions
 * defined in vs_svc.c. It also contains some internal(static) functions.
 */

#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <time.h>
#include <fcntl.h>
#include <syslog.h>
#include <ctype.h>
#include <strings.h>
#include <string.h>
#include <limits.h>
#include <pthread.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/debug.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#include "vs_incl.h"
#include "vs_icap.h"

/*  prototypes of local functions  */
static int  vs_icap_option_request(vs_scan_ctx_t *);
static int  vs_icap_send_option_req(vs_scan_ctx_t *);
static int  vs_icap_read_option_resp(vs_scan_ctx_t *);

static int  vs_icap_respmod_request(vs_scan_ctx_t *);
static int  vs_icap_may_preview(vs_scan_ctx_t *);
static char *vs_icap_find_ext(char *);
static int  vs_icap_send_preview(vs_scan_ctx_t *);
static int  vs_icap_send_respmod_hdr(vs_scan_ctx_t *, int);
static int  vs_icap_create_respmod_hdr(vs_scan_ctx_t *, int);
static int  vs_icap_uri_encode(char *, int, char *);
static int  vs_icap_uri_illegal_char(char);

static int  vs_icap_read_respmod_resp(vs_scan_ctx_t *);
static int  vs_icap_read_resp_code(vs_scan_ctx_t *);
static int  vs_icap_read_hdr(vs_scan_ctx_t *, vs_hdr_t *, int);

static int  vs_icap_set_scan_result(vs_scan_ctx_t *);
static int  vs_icap_read_encap_hdr(vs_scan_ctx_t *);
static void vs_icap_read_encap_data(vs_scan_ctx_t *);
static int  vs_icap_create_repair_file(vs_scan_ctx_t *);
static int  vs_icap_read_resp_body(vs_scan_ctx_t *);
static int  vs_icap_read_body_chunk(vs_scan_ctx_t *);

static int  vs_icap_send_chunk(vs_scan_ctx_t *, int);
static int  vs_icap_send_termination(vs_scan_ctx_t *);
static int  vs_icap_readline(vs_scan_ctx_t *, char *, int);

static int  vs_icap_write(int, char *, int);
static int  vs_icap_read(int, char *, int);

/* process options and respmod headers */
static void vs_icap_parse_hdrs(char, char *, char **, char **);
static int  vs_icap_opt_value(vs_scan_ctx_t *, int, char *);
static int  vs_icap_opt_ext(vs_scan_ctx_t *, int, char *);
static int  vs_icap_resp_violations(vs_scan_ctx_t *, int, char *);
static int  vs_icap_resp_violation_rec(vs_scan_ctx_t *, int);
static int  vs_icap_resp_infection(vs_scan_ctx_t *, int, char *);
static int  vs_icap_resp_virus_id(vs_scan_ctx_t *, int, char *);
static int  vs_icap_resp_encap(vs_scan_ctx_t *, int, char *);
static int  vs_icap_resp_istag(vs_scan_ctx_t *, int, char *);
static void vs_icap_istag_to_scanstamp(char *, vs_scanstamp_t);

/* Utility functions for handling OPTIONS data: vs_options_t */
static void vs_icap_free_options(vs_options_t *);
static void vs_icap_copy_options(vs_options_t *, vs_options_t *);
static void vs_icap_update_options(vs_scan_ctx_t *);
static int vs_icap_compare_se(int, char *, int);

static iovec_t *vs_icap_make_strvec(char *, const char *);
static iovec_t *vs_icap_copy_strvec(iovec_t *);
static int  vs_icap_check_ext(char *, iovec_t *);
static void vs_icap_trimspace(char *);

/* icap response message */
static char *vs_icap_resp_str(int);

/*
 * local variables
 */

/* option headers  - and handler functions */
vs_hdr_t option_hdrs[] = {
        { VS_OPT_SERVICE,       "Service",              vs_icap_opt_value},
        { VS_OPT_ISTAG,         "ISTag",                vs_icap_opt_value},
        { VS_OPT_METHODS,       "Methods",              vs_icap_opt_value},
        { VS_OPT_ALLOW,         "Allow",                vs_icap_opt_value},
        { VS_OPT_PREVIEW,       "Preview",              vs_icap_opt_value},
        { VS_OPT_XFER_PREVIEW,  "Transfer-Preview",     vs_icap_opt_ext},
        { VS_OPT_XFER_COMPLETE, "Transfer-Complete",    vs_icap_opt_ext},
        { VS_OPT_MAX_CONNECTIONS, "Max-Connections",    vs_icap_opt_value},
        { VS_OPT_TTL,           "Options-TTL",          vs_icap_opt_value},
        { VS_OPT_X_DEF_INFO,    "X-Definition-Info",    vs_icap_opt_value}
};


/* resp hdrs  - and handler functions */
vs_hdr_t resp_hdrs[] = {
        { VS_RESP_ENCAPSULATED, "Encapsulated", vs_icap_resp_encap},
        { VS_RESP_ISTAG,        "ISTag",        vs_icap_resp_istag},
        { VS_RESP_X_VIRUS_ID,   "X-Virus-ID",   vs_icap_resp_virus_id},
        { VS_RESP_X_INFECTION,  "X-Infection-Found",    vs_icap_resp_infection},
        { VS_RESP_X_VIOLATIONS, "X-Violations-Found",   vs_icap_resp_violations}
};

/* ICAP response code to string mappings */
vs_resp_msg_t icap_resp[] = {
        { VS_RESP_CONTINUE,             "Continue"},
        { VS_RESP_OK,                   "OK"},
        { VS_RESP_CREATED,              "Virus Detected and Repaired"},
        { VS_RESP_NO_CONT_NEEDED,       "No Content Necessary"},
        { VS_RESP_BAD_REQ,              "Bad Request"},
        { VS_RESP_FORBIDDEN,            "File Infected and not repaired"},
        { VS_RESP_NOT_FOUND,            "URI not found"},
        { VS_RESP_NOT_ALLOWED,          "Method not allowed"},
        { VS_RESP_TIMEOUT,              "Request timedout"},
        { VS_RESP_INTERNAL_ERR,         "Internal server error"},
        { VS_RESP_NOT_IMPL,             "Method not implemented"},
        { VS_RESP_SERV_UNAVAIL,         "Service unavailable/overloaded"},
        { VS_RESP_ICAP_VER_UNSUPP,      "ICAP version not supported"},
        { VS_RESP_SCAN_ERR,             "Error scanning file"},
        { VS_RESP_NO_LICENSE,           "No AV License"},
        { VS_RESP_RES_UNAVAIL,          "Resource unavailable"},
        { VS_RESP_UNKNOWN,              "Unknown Error"},
};

static const char *EXT_SEPARATOR =  ",";
static vs_options_t vs_options[VS_SE_MAX];
static pthread_mutex_t vs_opt_mutex = PTHREAD_MUTEX_INITIALIZER;

/*
 * vs_icap_init
 * initialization performed when daemon is loaded
 */
void
vs_icap_init()
{

        (void) pthread_mutex_lock(&vs_opt_mutex);
        (void) memset(vs_options, 0, sizeof (vs_options_t));
        (void) pthread_mutex_unlock(&vs_opt_mutex);
}


/*
 * vs_icap_fini
 * cleanup  performed when daemon is unloaded
 */
void
vs_icap_fini()
{
        int i;

        (void) pthread_mutex_lock(&vs_opt_mutex);

        for (i = 0; i < VS_SE_MAX; i++)
                vs_icap_free_options(&vs_options[i]);

        (void) pthread_mutex_unlock(&vs_opt_mutex);
}


/*
 * vs_icap_config
 *
 * When a new VSCAN configuration is specified, this will be
 * called per scan engine. If the scan engine host or port has
 * changed delete the vs_options entry for that scan engine.
 */
void
vs_icap_config(int idx, char *host, int port)
{
        (void) pthread_mutex_lock(&vs_opt_mutex);
        if (vs_icap_compare_se(idx, host, port) != 0) {
                vs_icap_free_options(&vs_options[idx]);
                (void) strlcpy(vs_options[idx].vso_host, host,
                    sizeof (vs_options[idx].vso_host));
                vs_options[idx].vso_port = port;
        }
        (void) pthread_mutex_unlock(&vs_opt_mutex);
}


/*
 * vs_icap_scan_file
 *
 * Create a context (vs_scan_ctx_t) for the scan operation and initialize
 * its options info. If the scan engine connection's IP or port is different
 * from that held in vs_options the vs_options info is old and should
 * be deleted (vs_icap_free_options). Otherwise, copy the vs_options info
 * into the context.
 * file name, size and decsriptor are also copied into the context
 *
 * Handle the ICAP protocol communication with the external Scan Engine to
 * perform the scan
 *  - send an OPTIONS request if necessary
 *  - send RESPMOD scan request
 *  - process the response and save any cleaned data to file
 *
 * Returns: result->vsr_rc
 */
int
vs_icap_scan_file(vs_eng_ctx_t *eng, char *devname, char *fname,
    uint64_t fsize, int flags, vs_result_t *result)
{
        vs_scan_ctx_t ctx;
        int fd;

        fd = open(devname, O_RDONLY);

        /* retry once on ENOENT as /dev link may not be created yet */
        if ((fd == -1) && (errno == ENOENT)) {
                (void) sleep(1);
                fd = open(devname, O_RDONLY);
        }

        if (fd == -1) {
                syslog(LOG_ERR, "Failed to open device %s - %s",
                    devname, strerror(errno));
                result->vsr_rc = VS_RESULT_ERROR;
                return (result->vsr_rc);
        }

        /* initialize context */
        (void) memset(&ctx, 0, sizeof (vs_scan_ctx_t));
        ctx.vsc_idx = eng->vse_eidx;
        (void) strlcpy(ctx.vsc_host, eng->vse_host, sizeof (ctx.vsc_host));
        ctx.vsc_port = eng->vse_port;
        ctx.vsc_sockfd = eng->vse_sockfd;
        ctx.vsc_fd = fd;
        ctx.vsc_fname = fname;
        ctx.vsc_fsize = fsize;
        ctx.vsc_flags = flags;
        ctx.vsc_result = result;

        /* Hooks for future saving of repaired data, not yet in use */
        ctx.vsc_flags |= VS_NO_REPAIR;
        ctx.vsc_repair = 0;
        ctx.vsc_repair_fname = NULL;
        ctx.vsc_repair_fd = -1;

        /* take a copy of vs_options[idx] if they match the SE specified */
        (void) pthread_mutex_lock(&vs_opt_mutex);
        if (vs_icap_compare_se(ctx.vsc_idx, ctx.vsc_host, ctx.vsc_port) == 0) {
                vs_icap_copy_options(&ctx.vsc_options,
                    &vs_options[ctx.vsc_idx]);
        }

        (void) pthread_mutex_unlock(&vs_opt_mutex);

        /*
         * default the result to scan engine error.
         * Any non scan-engine errors will reset it to VS_RESULT_ERROR
         */
        result->vsr_rc = VS_RESULT_SE_ERROR;

        /* do the scan */
        if (vs_icap_option_request(&ctx) == 0)
                (void) vs_icap_respmod_request(&ctx);

        (void) close(fd);
        vs_icap_free_options(&ctx.vsc_options);
        return (result->vsr_rc);
}


/* ********************************************************************* */
/*                      Local Function definitions                       */
/* ********************************************************************* */

/*
 * vs_icap_option_request
 *
 * Send ICAP options message and await/process the response.
 *
 * The ICAP options request needs to be sent when a connection
 * is first made with the scan engine. Unless the scan engine
 * determines that the options will never expire (which we save
 * as optione_req_time == -1) the request should be resent after
 * the expiry time specified by the icap server.
 *
 * Returns: 0 - success
 *         -1 - error
 */
static int
vs_icap_option_request(vs_scan_ctx_t *ctx)
{
        if (ctx->vsc_options.vso_req_time != -1 &&
            ((time(0) - ctx->vsc_options.vso_req_time) >
            ctx->vsc_options.vso_ttl)) {

                if (vs_icap_send_option_req(ctx) < 0)
                        return (-1);

                if (vs_icap_read_option_resp(ctx) < 0)
                        return (-1);

                vs_icap_update_options(ctx);
        }

        return (0);
}


/*
 * vs_icap_send_option_req
 *
 * Send an OPTIONS request to the scan engine
 * The Symantec ICAP server REQUIRES the resource name (VS_SERVICE_NAME)
 * after the IP address, otherwise it closes the connection.
 *
 * Returns: 0 - success
 *         -1 - error
 */
static int
vs_icap_send_option_req(vs_scan_ctx_t *ctx)
{
        char my_host_name[MAXHOSTNAMELEN];
        int  bufsp = VS_BUF_SZ;
        char *buf0 = ctx->vsc_info.vsi_send_buf;
        char *bufp = buf0;
        int  tlen;

        if (gethostname(my_host_name, sizeof (my_host_name)) != 0) {
                /* non SE error */
                ctx->vsc_result->vsr_rc = VS_RESULT_ERROR;
                return (-1);
        }

        (void) memset(ctx->vsc_info.vsi_send_buf, 0,
            sizeof (ctx->vsc_info.vsi_send_buf));

        tlen = snprintf(bufp, bufsp, "OPTIONS icap://%s:%d/%s %s\r\n",
            ctx->vsc_host, ctx->vsc_port, VS_SERVICE_NAME, VS_ICAP_VER);
        bufp += tlen;
        bufsp -= tlen;

        tlen = snprintf(bufp, bufsp, "Host: %s\r\n\r\n", my_host_name);
        bufp += tlen;

        if (vs_icap_write(ctx->vsc_sockfd, buf0, (bufp - buf0)) < 0)
                return (-1);

        return (0);
}


/*
 * vs_icap_read_option_resp
 *
 * Returns: 0 - success
 *         -1 - error
 */
static int
vs_icap_read_option_resp(vs_scan_ctx_t *ctx)
{
        if (vs_icap_read_resp_code(ctx) < 0)
                return (-1);

        if (ctx->vsc_info.vsi_icap_rc != VS_RESP_OK) {
                syslog(LOG_ERR, "ICAP protocol error "
                    "- unexpected option response: %s",
                    vs_icap_resp_str(ctx->vsc_info.vsi_icap_rc));
                return (-1);
        }

        if (vs_icap_read_hdr(ctx, option_hdrs, VS_OPT_HDR_MAX) != 0)
                return (-1);

        if ((ctx->vsc_options.vso_scanstamp[0] == 0) ||
            (ctx->vsc_options.vso_respmod == 0) ||
            (ctx->vsc_options.vso_req_time == 0)) {
                syslog(LOG_ERR, "ICAP protocol error "
                    "- missing or invalid option response hdrs");
                return (-1);
        }

        return (0);
}


/*
 * vs_icap_respmod_request
 *
 * Send respmod request and receive and process ICAP response.
 * Preview:
 *   ICAP allows for an optional "preview" request.  In the option negotiation,
 *   the server may ask for a list of types to be previewed, or to be sent
 *   complete (no preview).
 *   This is advisory. It is ok to skip the preview step, as done when the file
 *   is smaller than the preview_len.
 * Process Response:
 * - read and parse the RESPMOD response headers
 * - populate the result structure
 * - read any encapsulated response headers
 * - read any encapsulated response body and, if it represents cleaned
 *   file data, overwrite the file with it
 *
 * Returns: 0 - success
 *         -1 - error
 */
static int
vs_icap_respmod_request(vs_scan_ctx_t *ctx)
{
        int rv;
        int bytes_sent, send_len;
        uint64_t resid = ctx->vsc_fsize;

        if (vs_icap_may_preview(ctx)) {

                if ((rv = vs_icap_send_preview(ctx)) < 0)
                        return (-1);

                if (vs_icap_read_respmod_resp(ctx) < 0)
                        return (-1);

                if (ctx->vsc_info.vsi_icap_rc != VS_RESP_CONTINUE)
                        return (0);

                bytes_sent = rv;

                /* If > block (VS_BUF_SZ) remains, re-align to block boundary */
                if ((ctx->vsc_fsize - (uint64_t)bytes_sent) > VS_BUF_SZ) {
                        send_len = VS_BUF_SZ - bytes_sent;
                        if ((rv = vs_icap_send_chunk(ctx, send_len)) < 0)
                                return (-1);
                        bytes_sent += rv;
                }

                resid -= (uint64_t)bytes_sent;

        } else {

                if (vs_icap_send_respmod_hdr(ctx, 0) < 0)
                        return (-1);
        }

        /* Send the remainder of the file...  */
        while (resid) {
                send_len = (resid > VS_BUF_SZ) ? VS_BUF_SZ : resid;

                if ((rv = vs_icap_send_chunk(ctx, send_len)) < 0)
                        return (-1);

                if (rv == 0)
                        break;

                resid  -= (uint64_t)rv;
        }

        if (vs_icap_send_termination(ctx) < 0)
                return (-1);

        /* sending of ICAP request complete */
        if (vs_icap_read_respmod_resp(ctx) < 0)
                return (-1);

        return (0);
}


/*
 *      vs_icap_may_preview
 *
 *      Returns: 1  - preview
 *               0 - don't preview
 */
static int
vs_icap_may_preview(vs_scan_ctx_t *ctx)
{
        int  in_list = 0;
        char *ext;
        vs_options_t *opts = &ctx->vsc_options;

        if (opts->vso_xfer_how == VS_PREVIEW_NONE)
                return (0);

        /* if the file is smaller than the preview size, don't preview */
        if (ctx->vsc_fsize < (uint64_t)ctx->vsc_options.vso_preview_len)
                return (0);

        switch (opts->vso_xfer_how) {
        case VS_PREVIEW_ALL:
                return (1);
        case VS_PREVIEW_EXCEPT:
                /* Preview everything except types in xfer_complete */
                if ((ext = vs_icap_find_ext(ctx->vsc_fname)) != 0)
                        in_list = vs_icap_check_ext(ext,
                            opts->vso_xfer_complete);
                return ((in_list) ? 0 : 1);
        case VS_PREVIEW_LIST:
                /* Preview only types in the the xfer_preview list  */
                if ((ext = vs_icap_find_ext(ctx->vsc_fname)) != 0)
                        in_list = vs_icap_check_ext(ext,
                            opts->vso_xfer_preview);
                return ((in_list) ? 1 : 0);
        }

        return (1);
}


/*
 * vs_icap_find_ext
 *
 * Returns: ptr to file's extension in fname
 *          0 if no extension
 */
static char *
vs_icap_find_ext(char *fname)
{
        char *last_comp, *ext_str = 0;

        if ((last_comp = strrchr(fname, '/')) != 0) {
                last_comp++;
        } else {
                last_comp = fname;
        }

        /* Get file extension */
        if ((ext_str = strrchr(last_comp, '.')) != 0) {
                ext_str++;
                if (strlen(ext_str) == 0)
                        ext_str = 0;
        }

        return (ext_str);
}


/*
 * vs_icap_send_preview
 *
 * Returns:  bytes sent (preview + alignment)
 *           -1 - error
 */
static int
vs_icap_send_preview(vs_scan_ctx_t *ctx)
{
        int preview_len = ctx->vsc_options.vso_preview_len;
        int bytes_sent;

        /* Send a RESPMOD request with "preview" mode.  */
        if (vs_icap_send_respmod_hdr(ctx, 'P') < 0)
                return (-1);

        if ((bytes_sent = vs_icap_send_chunk(ctx, preview_len)) < 0)
                return (-1);

        if (bytes_sent < preview_len)
                return (-1);

        if (vs_icap_send_termination(ctx) < 0)
                return (-1);

        return (bytes_sent);
}


/*
 * vs_icap_send_respmod_hdr
 *
 * Create and send the RESPMOD request headers to the scan engine.
 *
 * Returns: 0 success
 *        < 0 error
 */
static int
vs_icap_send_respmod_hdr(vs_scan_ctx_t *ctx, int ispreview)
{
        int len;

        if ((len = vs_icap_create_respmod_hdr(ctx, ispreview)) == -1) {
                /* non SE error */
                ctx->vsc_result->vsr_rc = VS_RESULT_ERROR;
                return (-1);
        }

        /* send the headers */
        if (vs_icap_write(ctx->vsc_sockfd,
            ctx->vsc_info.vsi_send_buf, len) < 0) {
                return (-1);
        }

        return (0);
}


/*
 * vs_icap_create_respmod_hdr
 *
 * Create the RESPMOD request headers.
 * - RESPMOD, Host, Allow, [Preview], Encapsulated, encapsulated request hdr,
 *   encapsulated response hdr
 * Encapsulated data is sent separately subsequent to vs_icap_send_respmod_hdr,
 * via calls to vs_icap_send_chunk.
 *
 * The Symantec ICAP server REQUIRES the resource name (VS_SERVICE_NAME)
 * after the IP address, otherwise it closes the connection.
 *
 * Returns: -1 error
 *           length of headers data
 */
static int
vs_icap_create_respmod_hdr(vs_scan_ctx_t *ctx, int ispreview)
{
        char my_host_name[MAXHOSTNAMELEN];
        int  hbufsp = VS_BUF_SZ;
        char *hbuf0  = ctx->vsc_info.vsi_send_buf;
        char *hbufp  = hbuf0;
        char *encap_hdr, *encap_off0, *req_hdr, *res_hdr, *res_body;
        int preview_len = ctx->vsc_options.vso_preview_len;
        int  tlen;

        if (gethostname(my_host_name, sizeof (my_host_name)) != 0) {
                /* non SE error */
                ctx->vsc_result->vsr_rc = VS_RESULT_ERROR;
                return (-1);
        }

        (void) memset(hbufp, 0, hbufsp);

        /* First the ICAP "request" part. (at offset 0) */
        tlen = snprintf(hbufp, hbufsp, "RESPMOD icap://%s:%d/%s %s\r\n",
            ctx->vsc_host, ctx->vsc_port, VS_SERVICE_NAME, VS_ICAP_VER);
        if (tlen >= hbufsp)
                return (-1);
        hbufp += tlen; hbufsp -= tlen;

        tlen = snprintf(hbufp, hbufsp, "Host: %s\r\n", my_host_name);
        if (tlen >= hbufsp)
                return (-1);
        hbufp += tlen; hbufsp -= tlen;

        tlen = snprintf(hbufp, hbufsp, "Allow: 204\r\n");
        if (tlen >= hbufsp)
                return (-1);
        hbufp += tlen; hbufsp -= tlen;

        if (ispreview) {
                tlen = snprintf(hbufp, hbufsp, "Preview: %d\r\n", preview_len);
                if (tlen >= hbufsp)
                        return (-1);
                hbufp += tlen; hbufsp -= tlen;
        }

        /* Reserve space to later insert encapsulation offsets, & blank line */
        encap_hdr = hbufp;
        tlen = snprintf(hbufp, hbufsp, "%*.*s\r\n\r\n",
            VS_ENCAP_SZ, VS_ENCAP_SZ, "");
        if (tlen >= hbufsp)
                return (-1);
        hbufp += tlen; hbufsp -= tlen;

        /* "offset zero" for the encapsulated parts that follow */
        encap_off0 = hbufp;

        /* Encapsulated request header (req_hdr) & blank line */
        req_hdr = hbufp;
        tlen = snprintf(hbufp, hbufsp, "GET http://%s", my_host_name);
        if (tlen >= hbufsp)
                return (-1);
        hbufp += tlen; hbufsp -= tlen;

        tlen = vs_icap_uri_encode(hbufp, hbufsp, ctx->vsc_fname);
        if (tlen < 0)
                return (-1);
        hbufp += tlen; hbufsp -= tlen;

        tlen = snprintf(hbufp, hbufsp, " HTTP/1.1\r\n\r\n");
        if (tlen >= hbufsp)
                return (-1);
        hbufp += tlen; hbufsp -= tlen;

        /* Encapsulated response header (res_hdr) & blank line */
        res_hdr = hbufp;
        tlen = snprintf(hbufp, hbufsp, "HTTP/1.1 200 OK\r\n");
        if (tlen >= hbufsp)
                return (-1);
        hbufp += tlen; hbufsp -= tlen;

        tlen = snprintf(hbufp, hbufsp, "Transfer-Encoding: chunked\r\n\r\n");
        if (tlen >= hbufsp)
                return (-1);
        hbufp += tlen; hbufsp -= tlen;

        /* response body section - res-body ("chunked data") */
        res_body = hbufp;

        /* Insert offsets in encap_hdr */
        tlen = snprintf(encap_hdr, VS_ENCAP_SZ, "Encapsulated: "
            "req-hdr=%d, res-hdr=%d, res-body=%d",
            req_hdr - encap_off0, res_hdr - encap_off0, res_body - encap_off0);
        /* undo the null from snprintf */
        encap_hdr[tlen] = ' ';

        /* return length */
        return (hbufp - hbuf0);
}


/*
 * vs_icap_read_respmod_resp
 *
 * Used for both preview and final RESMOD response
 */
static int
vs_icap_read_respmod_resp(vs_scan_ctx_t *ctx)
{
        if (vs_icap_read_resp_code(ctx) < 0)
                return (-1);

        if (vs_icap_read_hdr(ctx, resp_hdrs, VS_RESP_HDR_MAX) < 0)
                return (-1);

        if (ctx->vsc_info.vsi_icap_rc == VS_RESP_CONTINUE) {
                /* A VS_RESP_CONTINUE should not have encapsulated data */
                if ((ctx->vsc_info.vsi_res_hdr) ||
                    (ctx->vsc_info.vsi_res_body)) {
                        syslog(LOG_ERR, "ICAP protocol error -"
                            "- encapsulated data in Continue response");
                        return (-1);
                }
        } else {
                if (vs_icap_set_scan_result(ctx) < 0)
                        return (-1);

                if (ctx->vsc_info.vsi_res_hdr) {
                        if (vs_icap_read_encap_hdr(ctx) < 0)
                                return (-1);
                }

                if (ctx->vsc_info.vsi_res_body)
                        vs_icap_read_encap_data(ctx);
                else if (ctx->vsc_result->vsr_rc == VS_RESULT_CLEANED)
                        ctx->vsc_result->vsr_rc = VS_RESULT_FORBIDDEN;
        }

        return (0);
}


/*
 * vs_icap_read_resp_code
 *
 * Get the response code from the icap response messages
 */
static int
vs_icap_read_resp_code(vs_scan_ctx_t *ctx)
{
        char *buf = ctx->vsc_info.vsi_recv_buf;
        int  retval;

        /* Break on error or non-blank line. */
        for (;;) {
                (void) memset(buf, '\0', VS_BUF_SZ);

                if ((retval = vs_icap_readline(ctx, buf, VS_BUF_SZ)) < 0)
                        return (-1);

                if (retval && buf[0]) {
                        if (MATCH(buf, VS_ICAP_VER)) {
                                (void) sscanf(buf+8, "%d",
                                    &ctx->vsc_info.vsi_icap_rc);
                                return (0);
                        }

                        syslog(LOG_ERR, "ICAP protocol error -"
                            "- expected ICAP/1.0, received %s", buf);

                        return (-1);
                }
        }
}


/*
 * vs_icap_read_hdr
 *
 * Reads all response headers.
 * As each line is read it is parsed and passed to the appropriate handler.
 *
 * Returns: 0 - success
 *         -1 - error
 */
static int
vs_icap_read_hdr(vs_scan_ctx_t *ctx, vs_hdr_t hdrs[], int num_hdrs)
{
        char *buf = ctx->vsc_info.vsi_recv_buf;
        int  i, retval;
        char *name, *val;

        /* Break on error or blank line. */
        for (;;) {
                (void) memset(buf, '\0', VS_BUF_SZ);

                if ((retval = vs_icap_readline(ctx, buf, VS_BUF_SZ)) < 0)
                        return (-1);

                /* Empty line (CR/LF) normal break */
                if ((retval == 0) || (!buf[0]))
                        break;

                vs_icap_parse_hdrs(':', buf, &name, &val);

                for (i = 0; i < num_hdrs; i++) {
                        if (strcmp(name, hdrs[i].vsh_name) == 0) {
                                hdrs[i].vsh_func(ctx, hdrs[i].vsh_id, val);
                                break;
                        }
                }
        }

        return ((retval >= 0) ? 0 : -1);
}


/*
 * vs_icap_set_scan_result
 *
 * Sets the vs_result_t vsr_rc from the icap_resp_code and
 * any violation information in vs_result_t
 *
 * Returns: 0 - success
 *         -1 - error
 */
static int
vs_icap_set_scan_result(vs_scan_ctx_t *ctx)
{
        int i;
        vs_result_t *result = ctx->vsc_result;

        (void) strlcpy(result->vsr_scanstamp,
            ctx->vsc_options.vso_scanstamp, sizeof (vs_scanstamp_t));

        switch (ctx->vsc_info.vsi_icap_rc) {
        case VS_RESP_NO_CONT_NEEDED:
                result->vsr_rc = VS_RESULT_CLEAN;
                break;

        case VS_RESP_OK:
                /* if we have no violations , that means all ok */
                if (result->vsr_nviolations == 0) {
                        result->vsr_rc = VS_RESULT_CLEAN;
                        break;
                }

                /* Any infections not repaired? */
                result->vsr_rc = VS_RESULT_CLEANED;
                for (i = 0; i < result->vsr_nviolations; i++) {
                        if (result->vsr_vrec[i].vr_res !=
                            VS_RES_FILE_REPAIRED) {
                                result->vsr_rc = VS_RESULT_FORBIDDEN;
                                break;
                        }
                }
                break;

        case VS_RESP_CREATED :
                /* file is repaired */
                result->vsr_rc = VS_RESULT_CLEANED;
                break;

        case VS_RESP_FORBIDDEN:
                /* file is infected and could not be repaired */
                result->vsr_rc = VS_RESULT_FORBIDDEN;
                break;

        default:
                syslog(LOG_ERR, "ICAP protocol error "
                    "- unsupported scan result: %s",
                    vs_icap_resp_str(ctx->vsc_info.vsi_icap_rc));
                return (-1);
        }

        return (0);
}


/*
 * vs_icap_read_encap_hdr
 *
 * Read the encapsulated response header to determine the length of
 * encapsulated data and, in some cases, to detect the infected state
 * of the file.
 *
 * Use of http response code:
 * Trend IWSS does not return virus information in the RESPMOD response
 * headers unless the OPTIONAL "include X_Infection_Found" checkbox is
 * checked and "disable_infected_url_block=yes" is set in intscan.ini.
 * Thus if we haven't already detected the infected/cleaned status
 * (ie if vsr_rc == VS_RESULT_CLEAN) we attempt to detect the
 * infected/cleaned state of a file from a combination of the ICAP and
 * http resp codes.
 * Here are the response code values that Trend IWSS returns:
 *  - clean:      icap resp = VS_RESP_NO_CONT_NEEDED
 *  - quarantine: icap resp = VS_RESP_OK, http resp = VS_RESP_FORBIDDEN
 *  - cleaned:    icap resp = VS_RESP_OK, http resp = VS_RESP_OK
 * For all other vendors' scan engines (so far) the infected/cleaned
 * state of the file has already been detected from the RESPMOD
 * response headers.
 */
static int
vs_icap_read_encap_hdr(vs_scan_ctx_t *ctx)
{
        char *buf = ctx->vsc_info.vsi_recv_buf;
        char *name, *value;
        int  retval;

        /* Break on error or blank line. */
        for (;;) {
                if ((retval = vs_icap_readline(ctx, buf, VS_BUF_SZ)) < 0)
                        return (-1);

                /* Empty line (CR/LF) normal break */
                if ((retval == 0) || (!buf[0]))
                        break;

                if (MATCH(buf, "HTTP/1.1")) {
                        (void) sscanf(buf + 8, "%d",
                            &ctx->vsc_info.vsi_http_rc);
                        ctx->vsc_info.vsi_html_content = B_TRUE;

                        /* if not yet detected infection, interpret http_rc */
                        if (ctx->vsc_result->vsr_rc == VS_RESULT_CLEAN) {
                                if ((ctx->vsc_info.vsi_icap_rc == VS_RESP_OK) &&
                                    (ctx->vsc_info.vsi_http_rc == VS_RESP_OK)) {
                                        ctx->vsc_result->vsr_rc =
                                            VS_RESULT_CLEANED;
                                } else {
                                        ctx->vsc_result->vsr_rc =
                                            VS_RESULT_FORBIDDEN;
                                }
                        }
                } else {
                        vs_icap_parse_hdrs(':', buf, &name, &value);
                        if (name && (MATCH(name, "Content-Length"))) {
                                (void) sscanf(value, "%d",
                                    &ctx->vsc_info.vsi_content_len);
                        }
                }
        }

        return (0);
}


/*
 * vs_icap_read_encap_data
 *
 * Read the encapsulated response data.
 *
 * If the response data represents cleaned file data (for an infected file)
 * and VS_NO_REPAIR is not set, open repair file to save the reponse body
 * data in. Set the repair flag in the scan context. The repair flag is used
 * during the processing of the response data. If the flag is set then the
 * data is written to file. If any error occurs which invalidates the repaired
 * data file the repair flag gets reset to 0, and the data will be discarded.
 *
 * The result is reset to VS_RESULT_FORBIDDEN until all of the cleaned data
 * has been successfully received and processed. It is then reset to
 * VS_RESULT_CLEANED.
 *
 * If the data doesn't represent cleaned file data, or we cannot (or don't
 * want to) write the cleaned data to file, the data is discarded (repair flag
 * in ctx == 0).
 */
static void
vs_icap_read_encap_data(vs_scan_ctx_t *ctx)
{
        if (ctx->vsc_result->vsr_rc == VS_RESULT_CLEANED) {
                ctx->vsc_result->vsr_rc = VS_RESULT_FORBIDDEN;

                if (!(ctx->vsc_flags & VS_NO_REPAIR)) {
                        if (vs_icap_create_repair_file(ctx) == 0)
                                ctx->vsc_repair = B_TRUE;
                }
        }

        /*
         * vs_icap_read_resp_body handles errors internally;
         * resets ctx->vsc_repair
         */
        (void) vs_icap_read_resp_body(ctx);

        if (ctx->vsc_repair_fd != -1) {
                (void) close(ctx->vsc_repair_fd);

                if (ctx->vsc_repair) {
                        /* repair file contains the cleaned data */
                        ctx->vsc_result->vsr_rc = VS_RESULT_CLEANED;
                } else {
                        /* error occured processing data. Remove repair file */
                        (void) unlink(ctx->vsc_repair_fname);
                }
        }
}


/*
 * vs_icap_create_repair_file
 *
 * Create and open a file to save cleaned data in.
 */
static int
vs_icap_create_repair_file(vs_scan_ctx_t *ctx)
{
        if (ctx->vsc_repair_fname == NULL)
                return (-1);

        if ((ctx->vsc_repair_fd = open(ctx->vsc_repair_fname,
            O_RDWR | O_CREAT | O_EXCL | O_TRUNC, 0644)) == -1) {
                return (-1);
        }

        return (0);
}


/*
 * vs_icap_read_resp_body
 *
 * Repeatedly call vs_icap_read_body_chunk until it returns:
 *    0 indicating that there's no more data to read or
 *   -1 indicating a read error -> reset ctx->vsc_repair 0
 *
 * Returns: 0 success
 *         -1 error
 */
static int
vs_icap_read_resp_body(vs_scan_ctx_t *ctx)
{
        int retval;

        while ((retval = vs_icap_read_body_chunk(ctx)) > 0)
                ;

        if (retval < 0)
                ctx->vsc_repair = B_FALSE;

        return (retval);
}


/*
 * vs_icap_read_body_chunk
 *
 * Read the chunk size, then read the chunk of data and write the
 * data to file repair_fd (or discard it).
 * If the data cannot be successfully written to file, set repair
 * flag in ctx to 0, and discard all subsequent data.
 *
 * Returns: chunk size
 *          -1 on error
 */
static int
vs_icap_read_body_chunk(vs_scan_ctx_t *ctx)
{
        char *lbuf = ctx->vsc_info.vsi_recv_buf;
        unsigned int chunk_size, resid;
        int rsize;

        /* Read and parse the chunk size. */
        if ((vs_icap_readline(ctx, lbuf, VS_BUF_SZ) < 0) ||
            (!sscanf(lbuf, "%x", &chunk_size))) {
                return (-1);
        }

        /* Read and save/discard chunk */
        resid = chunk_size;
        while (resid) {
                rsize = (resid < VS_BUF_SZ) ? resid : VS_BUF_SZ;

                if ((rsize = vs_icap_read(ctx->vsc_sockfd, lbuf, rsize)) <= 0)
                        return (-1);

                if (ctx->vsc_repair) {
                        if (vs_icap_write(ctx->vsc_repair_fd, lbuf, rsize) < 0)
                                ctx->vsc_repair = B_FALSE;
                }

                resid -= rsize;
        }

        /* Eat one CR/LF after the data */
        if (vs_icap_readline(ctx, lbuf, VS_BUF_SZ) < 0)
                return (-1);

        if (lbuf[0]) {
                syslog(LOG_ERR, "ICAP protocol error - expected blank line");
                return (-1);
        }

        return (chunk_size);
}


/* *********************************************************************** */
/*                      Utility read, write functions                      */
/* *********************************************************************** */

/*
 * vs_icap_write
 *
 * Return: 0 if all data successfully written
 *        -1 otherwise
 */
static int
vs_icap_write(int fd, char *buf, int buflen)
{
        char *ptr = buf;
        int resid = buflen;
        int bytes_sent = 0;

        while (resid > 0) {
                errno = 0;
                bytes_sent = write(fd, ptr, resid);
                if (bytes_sent < 0) {
                        if (errno == EINTR)
                                continue;
                        else
                                return (-1);
                }
                resid -= bytes_sent;
                ptr += bytes_sent;
        }

        return (0);
}


/*
 * vs_icap_read
 *
 * Returns: bytes_read (== len unless EOF hit before len bytes read)
 *          -1 error
 */
static int
vs_icap_read(int fd, char *buf, int len)
{
        char *ptr = buf;
        int resid = len;
        int bytes_read = 0;

        while (resid > 0) {
                errno = 0;
                bytes_read = read(fd, ptr, resid);
                if (bytes_read < 0) {
                        if (errno == EINTR)
                                continue;
                        else
                                return (-1);
                }
                resid -= bytes_read;
                ptr += bytes_read;
        }

        return (len - resid);
}


/*
 * vs_icap_send_chunk
 *
 * Send a "chunk" of file data, containing:
 * - Length (in hex) CR/NL
 * - [optiona data]
 * - CR/NL
 *
 * Returns: data length sent (not including encapsulation)
 *          -1 - error
 */
static int
vs_icap_send_chunk(vs_scan_ctx_t *ctx, int chunk_len)
{
        char *hdr = ctx->vsc_info.vsi_send_hdr;
        char *dbuf = ctx->vsc_info.vsi_send_buf;
        char *tail;
        char head[VS_HDR_SZ + 1];
        int nread = 0, hlen, tlen = 2;

        if (chunk_len > VS_BUF_SZ)
                chunk_len = VS_BUF_SZ;

        /* Read the data. */
        if ((nread = vs_icap_read(ctx->vsc_fd, dbuf, chunk_len)) < 0)
                return (-1);

        if (nread > 0) {
                /* wrap data in a header and trailer */
                hlen = snprintf(head, sizeof (head), "%x\r\n", nread);
                hdr += (VS_HDR_SZ - hlen);
                (void) memcpy(hdr, head, hlen);
                tail = dbuf + nread;
                tail[0] = '\r';
                tail[1] = '\n';

                if (vs_icap_write(ctx->vsc_sockfd, hdr,
                    hlen + nread + tlen) < 0) {
                        return (-1);
                }
        }

        return (nread);
}


/*
 * vs_icap_send_termination
 *
 * Send 0 length termination to scan engine: "0\r\n\r\n"
 *
 * Returns: 0 - success
 *         -1 - error
 */
static int
vs_icap_send_termination(vs_scan_ctx_t *ctx)
{
        if (vs_icap_write(ctx->vsc_sockfd, VS_TERMINATION,
            strlen(VS_TERMINATION)) < 0) {
                return (-1);
        }

        return (0);
}


/*
 * vs_icap_readline
 *
 * Read a line of response data from the socket. \n indicates end of line.
 *
 *  Returns: bytes read
 *          -1 - error
 */
static int
vs_icap_readline(vs_scan_ctx_t *ctx, char *buf, int buflen)
{
        char c;
        int i, retval;

        i = 0;
        for (;;) {
                errno = 0;
                retval = recv(ctx->vsc_sockfd, &c, 1, 0);

                if (retval < 0 && errno == EINTR)
                        continue;

                if (retval <= 0) {
                        if (vscand_get_state() != VS_STATE_SHUTDOWN) {
                                syslog(LOG_ERR, "Error receiving data from "
                                    "Scan Engine: %s", strerror(errno));
                        }
                        return (-1);
                }

                buf[i++] = c;
                if (c == '\n')
                        break;

                if (i >= (buflen - 2))
                        return (-1);
        }

        buf[i] = '\0';

        /* remove preceding and trailing whitespace */
        vs_icap_trimspace(buf);

        return (i);
}


/* ************************************************************************ */
/*                              HEADER processing                           */
/* ************************************************************************ */

/*
 * vs_icap_parse_hdrs
 *
 * parse an icap hdr line to find name and value
 */
static void
vs_icap_parse_hdrs(char delimiter, char *line, char **name, char **val)
{
        char *q = line;
        int line_len;

        /* strip any spaces */
        while (*q == ' ')
                q++;

        *name = q;
        *val = 0;

        /* Empty line is normal termination */
        if ((line_len = strlen(line)) == 0)
                return;

        if ((q = strchr(line, delimiter)) != 0) {
                *q++ = '\0';
        } else {
                q = line + line_len;
        }

        /* value part follows spaces */
        while (*q == ' ')
                q++;

        *val = q;
}


/*
 * vs_icap_resp_violations
 */
/*ARGSUSED*/
static int
vs_icap_resp_violations(vs_scan_ctx_t *ctx, int hdr_id, char *line)
{
        int i, rv, vcnt;

        (void) sscanf(line, "%d", &vcnt);

        ctx->vsc_result->vsr_nviolations =
            (vcnt > VS_MAX_VIOLATIONS) ? VS_MAX_VIOLATIONS : vcnt;

        ctx->vsc_info.vsi_threat_hdr = VS_RESP_X_VIOLATIONS;

        for (i = 0; i < vcnt; i++) {
                if ((rv = vs_icap_resp_violation_rec(ctx, i)) < 0)
                        return (rv);

        }

        return (1);
}


/*
 * vs_icap_resp_violation_rec
 *
 * take all violation data (up to VS_MAX_VIOLATIONS) and save it
 * in violation_info.
 * each violation has 4 lines of info: doc name, virus name,
 * virus id and resolution
 */
static int
vs_icap_resp_violation_rec(vs_scan_ctx_t *ctx, int vr_idx)
{
        int vline;
        int retval = 0;
        char *buf = ctx->vsc_info.vsi_recv_buf;
        vs_vrec_t *vr;

        if (vr_idx < VS_MAX_VIOLATIONS) {
                vr = &ctx->vsc_result->vsr_vrec[vr_idx];
        } else {
                vr = 0;
        }

        for (vline = 0; vline < VS_VIOLATION_LINES; vline++) {
                if ((retval = vs_icap_readline(ctx, buf, VS_BUF_SZ)) < 0)
                        return (-1);

                /* empty line? */
                if ((retval == 0) || (!buf[0]))
                        break;

                if (vr) {
                        switch (vline) {
                        case 0: /* doc name */
                                break;
                        case 1: /* Threat Description */
                                (void) strlcpy(vr->vr_desc, buf,
                                    VS_DESCRIPTION_MAX);
                                break;
                        case 2: /* Problem ID */
                                (void) sscanf(buf, "%d", &vr->vr_id);
                                break;
                        case 3: /* Resolution */
                                (void) sscanf(buf, "%d", &vr->vr_res);
                                break;
                        }
                }
        }

        return (1);
}


/*
 * vs_icap_opt_value
 * given an icap options hdr string, process value
 */
static int
vs_icap_opt_value(vs_scan_ctx_t *ctx, int hdr_id, char *line)
{
        int x;
        long val;
        char *end;

        switch (hdr_id) {
        case VS_OPT_PREVIEW:
                (void) sscanf(line, "%d", &x);
                if (x < VS_MIN_PREVIEW_LEN)
                        x = VS_MIN_PREVIEW_LEN;
                if (x > VS_BUF_SZ)
                        x = VS_BUF_SZ;
                ctx->vsc_options.vso_preview_len = x;
                break;

        case VS_OPT_TTL:
                if (*line == 0) {
                        ctx->vsc_options.vso_req_time = -1;
                        break;
                }

                val = strtol(line, &end, 10);
                if ((end != (line + strlen(line))) || (val < 0))
                        break;

                ctx->vsc_options.vso_ttl = val;
                ctx->vsc_options.vso_req_time = time(0);
                break;

        case VS_OPT_ALLOW:
                (void) sscanf(line, "%d", &ctx->vsc_options.vso_allow);
                break;

        case VS_OPT_SERVICE:
                (void) strlcpy(ctx->vsc_options.vso_service, line,
                    VS_SERVICE_SZ);
                break;

        case VS_OPT_X_DEF_INFO:
                (void) strlcpy(ctx->vsc_options.vso_defninfo, line,
                    VS_DEFN_SZ);
                break;

        case VS_OPT_METHODS:
                if (strstr(line, "RESPMOD") != NULL)
                        ctx->vsc_options.vso_respmod = 1;
                break;

        case VS_OPT_ISTAG:
                vs_icap_istag_to_scanstamp(line,
                    ctx->vsc_options.vso_scanstamp);
                break;

        default:
                break;

        }

        return (1);
}


/*
 * vs_icap_resp_istag
 *
 * Called to handle ISTAG when received in RESPMOD response.
 *  - populate result->vsr_scanstamp from istag
 *  - update the scanstamp in vs_options and log the update.
 */
/*ARGSUSED*/
static int
vs_icap_resp_istag(vs_scan_ctx_t *ctx, int hdr_id, char *line)
{
        vs_icap_istag_to_scanstamp(line, ctx->vsc_result->vsr_scanstamp);

        /* update the scanstamp in vs_options */
        (void) pthread_mutex_lock(&vs_opt_mutex);
        if (vs_icap_compare_se(ctx->vsc_idx,
            ctx->vsc_host, ctx->vsc_port) == 0) {
                if (strcmp(vs_options[ctx->vsc_idx].vso_scanstamp,
                    ctx->vsc_result->vsr_scanstamp) != 0) {
                        (void) strlcpy(vs_options[ctx->vsc_idx].vso_scanstamp,
                            ctx->vsc_result->vsr_scanstamp,
                            sizeof (vs_scanstamp_t));
                }
        }
        (void) pthread_mutex_unlock(&vs_opt_mutex);

        return (1);
}


/*
 * vs_icap_istag_to_scanstamp
 *
 * Copies istag into scanstamp, stripping leading and trailing
 * quotes '"' from istag. If the istag is invalid (too long)
 * scanstamp will be left unchanged.
 *
 * vs_scanstamp_t is defined to be large enough to hold the
 * istag plus a null terminator.
 */
static void
vs_icap_istag_to_scanstamp(char *istag, vs_scanstamp_t scanstamp)
{
        char *p = istag;
        int len;

        /* eliminate preceding '"' */
        if (p[0] == '"')
                ++p;

        /* eliminate trailing '"' */
        len = strlen(p);
        if (p[len - 1] == '"')
                --len;

        if (len < sizeof (vs_scanstamp_t))
                (void) strlcpy(scanstamp, p, len + 1);
}


/*
 * vs_icap_opt_ext
 *
 * read the transfer preview / transfer complete headers to
 * determine which file types can be previewed
 */
static int
vs_icap_opt_ext(vs_scan_ctx_t *ctx, int hdr_id, char *line)
{
        vs_options_t *opt = &ctx->vsc_options;

        switch (hdr_id) {
        case VS_OPT_XFER_PREVIEW:
                if (opt->vso_xfer_preview) {
                        free(opt->vso_xfer_preview);
                        opt->vso_xfer_preview = 0;
                }
                if (strstr(line, "*")) {
                        opt->vso_xfer_how = VS_PREVIEW_ALL;
                } else {
                        opt->vso_xfer_preview = vs_icap_make_strvec
                            (line, EXT_SEPARATOR);
                        opt->vso_xfer_how = VS_PREVIEW_LIST;
                }
                break;

        case VS_OPT_XFER_COMPLETE :
                if (opt->vso_xfer_complete) {
                        free(opt->vso_xfer_complete);
                        opt->vso_xfer_complete = 0;
                }
                if (strstr(line, "*")) {
                        opt->vso_xfer_how = VS_PREVIEW_NONE;
                } else {
                        opt->vso_xfer_complete = vs_icap_make_strvec
                            (line, EXT_SEPARATOR);
                        opt->vso_xfer_how = VS_PREVIEW_EXCEPT;
                }
                break;
        default:
                break;
        }

        return (1);
}


/*
 * vs_icap_resp_infection
 *
 * read the type, resolution and threat description for each
 * reported violation and save in ctx->vsc_result
 */
/*ARGSUSED*/
static int
vs_icap_resp_infection(vs_scan_ctx_t *ctx, int hdr_id, char *line)
{
        char *name, *val;
        int i, got = 0;
        int type = 0, res = 0;
        char *desc = 0;
        vs_vrec_t *vr = 0;

        for (i = 0; i < VS_INFECTION_FIELDS; i++) {
                vs_icap_parse_hdrs('=', line, &name, &val);

                switch (i) {
                case 0:
                        if (MATCH(name, "Type")) {
                                (void) sscanf(val, "%d", &type);
                                got++;
                        }
                        break;
                case 1:
                        if (MATCH(name, "Resolution")) {
                                (void) sscanf(val, "%d", &res);
                                got++;
                        }
                        break;
                case 2:
                        if (MATCH(name, "Threat")) {
                                desc = val;
                                got++;
                        }
                        break;
                default :
                        break;
                }

                if ((line = strstr(val, ";")))
                        line++;
        }

        if (got != VS_INFECTION_FIELDS)
                return (0);

        /*
         * We may have info from an X-Violations-Found record, (which provides
         * more complete information). If so, don't destroy what we have.
         */
        if ((ctx->vsc_result->vsr_nviolations == 0) ||
            (ctx->vsc_info.vsi_threat_hdr < VS_RESP_X_INFECTION)) {
                vr = &ctx->vsc_result->vsr_vrec[0];
                vr->vr_id = type;
                vr->vr_res = res;
                (void) strlcpy(vr->vr_desc, desc, VS_DESCRIPTION_MAX);
                ctx->vsc_result->vsr_nviolations = 1;

                ctx->vsc_info.vsi_threat_hdr = VS_RESP_X_INFECTION;
        }

        return (1);
}


/*
 * vs_icap_resp_virus_id
 *
 * X-Virus-ID is defined as being a shorter alternative to X-Infection-Found.
 * If we already have virus information, from either X-Infection-Found or
 * X-Violations-Found, it will be more complete, so don't overwrite it with
 * the info from X-Virus-ID.
 */
/*ARGSUSED*/
static int
vs_icap_resp_virus_id(vs_scan_ctx_t *ctx, int hdr_id, char *line)
{
        vs_vrec_t *vr = 0;

        if (ctx->vsc_result->vsr_nviolations == 0) {
                vr = &ctx->vsc_result->vsr_vrec[0];
                vr->vr_id = 0;
                vr->vr_res = 0;
                (void) strlcpy(vr->vr_desc, line, VS_DESCRIPTION_MAX);
                ctx->vsc_result->vsr_nviolations = 1;

                ctx->vsc_info.vsi_threat_hdr = VS_RESP_X_VIRUS_ID;
        }

        return (1);
}


/*
 * vs_icap_resp_encap
 *
 * get the encapsulated header info
 */
/*ARGSUSED*/
static int
vs_icap_resp_encap(vs_scan_ctx_t *ctx, int hdr_id, char *line)
{
        if (strstr(line, "res-hdr"))
                ctx->vsc_info.vsi_res_hdr = B_TRUE;

        if (strstr(line, "res-body"))
                ctx->vsc_info.vsi_res_body = B_TRUE;

        return (1);
}


/*
 * Utility functions for handling OPTIONS data: vs_options_t
 */

/*
 * vs_icap_compare_scanstamp
 * compare scanstamp with that stored for engine idx
 *
 * Returns: 0 - if equal
 */
int
vs_icap_compare_scanstamp(int idx, vs_scanstamp_t scanstamp)
{
        int rc;

        if (!scanstamp || scanstamp[0] == '\0')
                return (-1);

        (void) pthread_mutex_lock(&vs_opt_mutex);
        rc = strcmp(scanstamp, vs_options[idx].vso_scanstamp);
        (void) pthread_mutex_unlock(&vs_opt_mutex);

        return (rc);
}


/*
 * vs_icap_compare_se
 * compare host and port with that stored for engine idx
 *
 * Returns: 0 - if equal
 */
static int
vs_icap_compare_se(int idx, char *host, int port)
{
        if (vs_options[idx].vso_port != port)
                return (-1);

        if (strcmp(vs_options[idx].vso_host, host) != 0)
                return (-1);

        return (0);
}


/*
 * vs_icap_free_options
 *
 * Free dynamic parts of vs_options_t: xfer_preview, xfer_complete
 */
static void
vs_icap_free_options(vs_options_t *options)
{
        if (options->vso_xfer_preview)
                free(options->vso_xfer_preview);

        if (options->vso_xfer_complete)
                free(options->vso_xfer_complete);

        (void) memset(options, 0, sizeof (vs_options_t));
}


/*
 * vs_icap_copy_options
 */
void
vs_icap_copy_options(vs_options_t *to_opt, vs_options_t *from_opt)
{
        *to_opt = *from_opt;

        if (from_opt->vso_xfer_preview) {
                to_opt->vso_xfer_preview =
                    vs_icap_copy_strvec(from_opt->vso_xfer_preview);
        }

        if (from_opt->vso_xfer_complete) {
                to_opt->vso_xfer_complete =
                    vs_icap_copy_strvec(from_opt->vso_xfer_complete);
        }
}


/*
 * vs_icap_update_options
 */
static void
vs_icap_update_options(vs_scan_ctx_t *ctx)
{
        int idx = ctx->vsc_idx;

        (void) pthread_mutex_lock(&vs_opt_mutex);

        if (vs_icap_compare_se(idx, ctx->vsc_host, ctx->vsc_port) == 0) {
                vs_icap_free_options(&vs_options[idx]);
                vs_icap_copy_options(&vs_options[idx], &ctx->vsc_options);
        }

        (void) pthread_mutex_unlock(&vs_opt_mutex);
}


/*
 * vs_icap_make_strvec
 *
 * Populate a iovec_t from line, where line is a string of 'sep'
 * separated fields. Within the copy of line in the iovec_t each
 * field will be null terminated with leading & trailing whitespace
 * removed. This allows for fast searching.
 *
 * The iovec_t itself and the data it points to are allocated
 * as a single chunk.
 */
static iovec_t *
vs_icap_make_strvec(char *line, const char *sep)
{
        iovec_t *vec;
        char *tmp, *ctx;
        int datalen, len;

        datalen = strlen(line) + 1;
        len = sizeof (iovec_t) + datalen;

        if ((vec = (iovec_t *)calloc(1, len)) == 0)
                return (0);

        vec->iov_len = len;
        vec->iov_base = (char *)vec + sizeof (iovec_t);
        (void) strlcpy(vec->iov_base, line, datalen);

        /* tokenize data for easier searching */
        for (tmp = strtok_r(vec->iov_base, sep, &ctx); tmp;
            tmp = strtok_r(0, sep, &ctx)) {
        }

        return (vec);
}


/*
 * vs_icap_copy_strvec
 *
 * allocate and copy strvec
 */
static iovec_t *
vs_icap_copy_strvec(iovec_t *from_vec)
{
        iovec_t *to_vec;

        if ((to_vec = (iovec_t *)calloc(1, from_vec->iov_len)) == 0)
                return (0);

        bcopy(from_vec, to_vec, from_vec->iov_len);
        to_vec->iov_base = (char *)to_vec + sizeof (iovec_t);

        return (to_vec);
}


/*
 * vs_icap_check_ext
 *
 * Returns: 1 - if ext in strvec
 *          0 - otherwise
 */
static int
vs_icap_check_ext(char *ext, iovec_t *vec)
{
        char *p, *end = (char *)vec + vec->iov_len;

        for (p = vec->iov_base;  p < end; p += strlen(p) + 1) {
                if (MATCH(ext, p))
                        return (1);
        }

        return (0);
}


/*
 * vs_icap_resp_str
 */
static char *
vs_icap_resp_str(int rc)
{
        vs_resp_msg_t *p = icap_resp;

        if (rc < 0)
                rc = -rc;

        while (p->vsm_rc != VS_RESP_UNKNOWN) {
                if (p->vsm_rc == rc)
                        break;
                p++;
        }

        return (p->vsm_msg);
}


/*
 * vs_icap_trimspace
 *
 * Trims whitespace from both the beginning and end of a string. This
 * function alters the string buffer in-place.
 *
 * Whitespaces found at the beginning of the string are eliminated by
 * moving forward the start of the string at the first non-whitespace
 * character.
 * Whitespace found at the end of the string are overwritten with nulls.
 *
 */
static void
vs_icap_trimspace(char *buf)
{
        char *p = buf;
        char *q = buf;

        if (buf == 0)
                return;

        while (*p && isspace(*p))
                ++p;

        while ((*q = *p++) != 0)
        ++q;

        if (q != buf) {
                while ((--q, isspace(*q)) != 0)
                        *q = '\0';
        }
}


/*
 * vs_icap_uri_encode
 *
 * Encode uri data (eg filename) in accordance with RFC 2396
 * 'Illegal' characters should be replaced with %hh, where hh is
 * the hex value of the character. For example a space would be
 * replaced with %20.
 * Filenames are all already UTF-8 encoded. Any UTF-8 octects that
 * are 'illegal' characters will be encoded as described above.
 *
 * Paramaters: data - string to be encoded (NULL terminated)
 *             buf  - output buffer (NULL terminated)
 *             size - size of output buffer
 *
 * Returns: strlen of encoded data on success
 *                      -1 size on error (contents of buf undefined)
 */
static int
vs_icap_uri_encode(char *buf, int size, char *data)
{
        unsigned char *iptr;
        char *optr = buf;
        int len = strlen(data);

        /* modify the data */
        for (iptr = (unsigned char *)data; *iptr; iptr++) {
                if (vs_icap_uri_illegal_char(*iptr)) {
                        if ((len += 2) >= size)
                                return (-1);
                        (void) sprintf(optr, "%%%0x", *iptr);
                        optr += 3;
                } else {
                        if (len >= size)
                                return (-1);
                        *optr++ = *iptr;
                }
        }

        *optr = '\0';
        return (len);
}


/*
 * vs_icap_uri_illegal_char
 *
 * The following us-ascii characters (UTF-8 octets) are 'illegal':
 * < > # % " { } | \ ^ [ ] ` space, 0x01 -> 0x1F & 0x7F
 * All non us-ascii UTF-8 octets ( >= 0x80) are illegal.
 *
 * Returns: 1 if character is not allowed in a URI
 *          0 otherwise
 */
static int
vs_icap_uri_illegal_char(char c)
{
        static const char *uri_illegal_chars = "<>#%\" {}|\\^[]`";

        /* us-ascii non printable characters or non us-ascii */
        if ((c <= 0x1F) || (c >= 0x7F))
                return (1);

        /* us-ascii dis-allowed characters */
        if (strchr(uri_illegal_chars, c))
                return (1);

        return (0);

}