move all code into /trunk

2008-12-14 19:12:48 +00:00 · 2008-12-14 19:12:48 +00:00 · 2aac3e1e88
commit 2aac3e1e88
42 changed files with 6888 additions and 0 deletions
--- a/7
+++ b/7
@ -0,0 +1,7 @@
+Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+  Main coder
+
+Veit Wahlich <cru@zodia.de>
+  .spec file rewrite
+  patch for rejection if peer's ip doesn't resolve to a hostname
+  patch for stats transmission exactly every 60 minutes
--- a/335
+++ b/335
@ -0,0 +1,335 @@
+ChangeLog
+---------
+
+2007-07-20 20:03 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* 1.6 release
+
+* Bugs:
+
+* Fixed a DoS-causing, remotely explitable bug in Proxy.cpp. This bug only affects version 1.3 to
+1.5, both inclusive. If you are using either 1.3, 1.4 or 1.5 UPDATE NOW.
+Thanks to Veit Wahlich for finding and reporting the bug and for submitting
+a preeliminar patch.
+
+* While looking for similar vulnerabilities in the code, found a small
+incorrection, although it doesn't have security implications.
+
+
+2007-07-19 12:57 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* 1.5 release
+
+* Enhancements:
+
+* Allow permanently rejecting mails with dnsbl or spf errors. To use configure
+return_temp_error_on_reject as false (default). To keep the old behaviour,
+configure the above option as true.
+
+* File logger can now be configured to only open the file sporadically to
+write its buffer. This allows for external log rotators on platforms that
+can't rename an open file (i.e. windows). The option is called
+keep_file_locked. To use the new behaviour, configure as false, to keep the
+old one configure as true.
+
+* Implemented win32 service support. To enable, configure with
+--enable-win32-service. The windows build on the website are already compiled
+with this option. To install the service execute:
+
+c:\hermes> hermes -install
+
+To uninstall:
+
+c:\hermes> hermes -uninstall
+
+To start:
+
+c:\hermes> net start hermes
+
+To stop:
+
+c:\hermes> net stop hermes
+
+Of course, you can also use the service manager to start and stop the service.
+Using the service code there's a big warning everyone should read:
+
+The config file MUST be named "hermes.ini" and be located on the same
+directory as "hermes.exe". Also, since hermes is started from another
+directory, you have to specify the full path to the database:
+
+database_file = "c:\hermes\greydatabase.db"
+
+
+
+* Fixes:
+
+* Fix SPF requests to be synchronized. I haven't seen a single failure from
+this, but this is the right way.
+
+* Removed an stale debug statement. It could be noticed when starting hermes
+that the list of dns white/black lists was printed on the standard output.
+
+* dns_{white,black}list_percentage now defaults to 100. Setting it to 0 makes
+no sense and makes all your emails to be considered white/black listed.
+
+* Fixed spec file to include the AUTHORS file.
+
+* The value of spf_query now defaults to true when compiled with SPF support.
+
+* Applied patch by Veit Wahlich that fixes stats submission to be each 60
+minutes exactly. Previously it would send the stats on intervals of
+approximattely 60 minutes.
+
+* Whitelisting IPs is now partial like blacklisting. For example, whitelisting
+192.168.0 will whitelist 192.168.0.* (192.168.0.0/24)
+
+* Small fixes to the building system.
+
+
+2007-06-14 20:23 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* 1.4 release
+
+* Enhancements:
+
+* SPF: if you enable query_spf, everytime someone gets through greylisting,
+they will be checked for spf compliance. If they either FAIL or SOFTFAIL, they
+will be rejected.
+
+* Specify your hostname on the config file (option hostname). If it's empty,
+it gets filled by gethostname() (as before)
+
+* DNS Whitelisting: similar to DNS Blacklisting, but the other way around.
+
+* DNS Whitelisting and DNS Blacklisting both support querying more than one
+server at a time. It means that you don't have to rely 100% on a dns list, but
+can use more than one. To control how many of the list need to list a server,
+use dns_{black,white}list_percentage option on config file.
+
+* If you define now whitelisted_disables_everything, whitelisted host will not
+be forced to go through throttling and banner delaying (or anything else).
+
+* Blacklisting is now partial. That means that if you blacklist 192.168.0. you
+are actually blacklisting 192.168.0.* (192.168.0.0/24 if you prefer)
+
+* Added the	throttling_time option that controls how much we sleep between
+lines when throttling a connection.
+
+* Changed logging format. Should be clearer now, although there are still some
+things I'd like to change.
+
+* We are also logging now also when someone gets their connection dropped
+because of throttling or data-before-banner (or black/whitelisting, spf, etc. ).
+It should help to get a better feeling of how much spam we are stopping with 
+these techniques.
+
+* We now can reject emails if peer doesn't have an inverse resolution (patch
+by Veit Wahlich) or if the inverse resolution doesn't match the helo string.
+Both of these features should be used with extreme care, and are disabled by
+default. You shouldn't use them if you don't know what you are doing.
+
+
+* Fixes:
+
+* FileLogger.cpp: file logging now flushes its buffer after a few lines (15).
+This should update the log on file more often.
+
+* Configfile.tmpl: when compiling on windows, all default values should be
+valid
+
+* Fixed a bug when closing the filelogger file (most people noticed that
+hermes crashed when closing when using file logger).
+
+* Changed the X-Anti-Spam-Proxy header to be more clear.
+
+* Fixed all typos with wether to whether
+
+* Fixed a minor RFC-strict error when defining the non-existing extension
+
+* Timezone _should_ be correct now on windows. If it isn't, write to the
+mailing list with an example and why you think it's incorrect.
+
+* Fixed configure.in. If you specify now --disable-openssl it will disable
+openssl even if you have it installed
+
+* Updated the .spec file (thanks again to Veit Wahlich's patch)
+
+* Added AUTHORS file and also added lot's of docs to the windows release.
+
+2007-05-18 20:11 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* 1.3 release
+
+* added the add_headers option, will add the rfc-required "Received" headers
+should give a better idea of where emails are coming/going
+
+* also added date to logging when it is done to a file
+
+* fixed filelogger, should now use file_logger_file config option
+
+* windows version can now resolve addresses, so rbl works and also you can now
+use fancy names like "localhost" instead of ugly ips like "127.0.0.1"
+
+* updated rpm, hopefully everything should be ok now
+
+2007-05-13 18:21 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* 1.2 release
+
+* added rbl checking. Simply define rbl_domain in configfile
+
+2007-04-20 12:04 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Added an option to configure the initial delay of the SMTP banner
+
+2007-04-19 20:28 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Bugfix 1.1 release
+
+* Implemented the bind_to config option. Defining bind_to in the configfile
+will force hermes to only bind to one ip.
+
+* Fixed a small bug when closing hermes with clean_db=false (it would segfault
+previously)
+
+* Added more documentation and updated http://www.hermes-project.com
+
+2007-04-16 19:48 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Initial 1.0 release
+
+2007-04-09 20:27 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* *.{h,cpp}: add GPL license to all source files. also added gpl.txt with the
+full license text on /docs
+
+* Makefile.am: configure automake more correctly (not a lot, probably still
+very wrong)
+
+* TODO: cleaned up a bit
+
+2007-04-09 18:57 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* *.{h,cpp}: Ifdef'd all output to terminal. From now on if you want all that
+output, define REALLY_VERBOSE_DEBUG on config.h (once it is generated)
+
+* generate_config.pl: generate also a default config file from the information
+on Configfile.tmpl
+
+2007-03-18 19:16 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* *Logger.{h,cpp}: Implement logging as a base class with different subclasses
+depending on a configure option. Also added option to Configfile.tmpl to
+configure the filename for FileLogger.
+This change will allow us to port hermes more easily to other platforms,
+specially non-unix(i.e. win32), but also will help if we don't have a logger
+installed or if it's not compatible with the common interface (I'm using
+metalog, btw).
+
+2007-03-18 17:06 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* *: change all instances of spit to hermes to reflect project's new name
+
+2007-03-09 18:19 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Database.*: modified cleanDB, now the method counts the number of spams we
+have blocked since the last time we cleaned
+
+* spit.cpp: if we have configured it, send the number of spams blocked to a
+server to keep the statistics
+
+* Configfile.tmpl: added options to configure the previous changes.
+submit_stats (bool) submit_stats_username (string) and submit_stats_password
+(string)
+
+2007-02-14 18:20 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* *.*: change all calls to Exception constructor to send also the file name and line
+number
+
+2007-02-12 19:03 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Socket.*: new option setTimeout, sets the timeout for receive/send operations, should
+help with the sockets getting blocked on recv() or send()
+
+* Exception.*: new constructor accepts a filename and line number. The idea is to migrate
+all calls to Exception to this new constructor so that errors get printed with their source
+filename and line number to make debugging easier.
+
+2007-02-10 17:25 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Configfile.*: changed Configfile.{cpp,h} to be generated from Configfile.tmpl and
+Configfile.{cpp,h}.in . It should be MUCH easier to add new config options
+from now on. As a proof, adding options for the time to greylist and the
+initial delay were a breeze compared to before.
+
+* spit.cpp: instead of sending the data for thread_main in a pointer, send a
+pointer to a stack and just pop the last element added.
+
+2006-11-12 21:22 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* updated changelog to use gnu coding standards
+
+* autotoolize spit
+* Makefile.am
+* configure.in
+* Config.h: rename class to Configfile
+
+2006-10-22 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Socket.cpp: now creates the ssl context and loads certificates on the first socket
+creation, so we now use less memory per-thread, AND we also load the certs
+BEFORE chrooting, so now private_key and certificate DON'T need to be
+(and are NOT recomended) INSIDE the chroot, which is a cool security feature.
+
+2006-10-21 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* SQL.cpp: Changed SQL class so that every query is made through doQuery, that
+controls that everything works the right way.
+
+* Exception.cpp: When an Exception ocurrs, we notify it by email, either through smtp
+or through sendmail
+
+2006-10-15 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Config.cpp: Fixed Config.cpp::validateConfig to take into account chrooting
+
+* Socket.cpp: Fixed Socketp.cpp::close, we were sometimes closing fds twice
+
+* main.cpp: if you send SIGINT or SIGTERM once you close gracefully, if you do
+it twice, you forcefully stop the program, for when a socket is waiting to timeout,
+and you can't restart the proxy in-between
+
+2006-10-12 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Config.cpp: Overhauled Config class
+
+* main.cpp: fixed chrooting, now only /etc/resolv.conf is needed
+
+2006-10-08 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* Socket.cpp: ssl is now fully working
+decimal time for waiting in Socket::canRead
+
+* SQL.cpp: whitelisting based on hostname of peer added.
+
+* Logger.cpp: implements a logger for unix
+
+* preeliminary port to solaris 10
+
+2006-09-24 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* LOTS of bugfixes, some change in semantics and a bit of heavy-work
+testing. Should be MUCH more stable now.
+
+2006-09-18 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* main.cpp (main): Made threads detached to allow them to free resources
+
+2006-09-17 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+
+* main.cpp (main): Create a thread to clean the database each hour
+Threads now clean themselves up when finishing
+
+2006-09-16 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+* Initial import to svn
--- a/Makefile.am
+++ b/Makefile.am
@ -0,0 +1,3 @@
+EXTRA_DIST = scripts/generate_config.pl ChangeLog TODO
+
+SUBDIRS = src docs dists
--- a/21
+++ b/21
@ -0,0 +1,21 @@
+TODO:
+-----
+
+check ipv6 support, although I don't have any machine configured with ipv6..., but work is required anyway
+
+windows Service
+windowsishms
+
+create documentation!!!!!!
+add to documentation a note about the importance of correctly whitelisting peer hostname(you need a DOT before the name, so for example bongmail.com doesn't match against .gmail.com)
+
+check return value from some functions
+document some functions
+
+check segfaults when receiving 1000+ threads
+
+inet_ntoa/ntoa_inet are static!!!
+
+reduce memory consumption per-thread
+profile program
+run through valgrind
--- a/3
+++ b/3
@ -0,0 +1,3 @@
+#!/bin/bash
+
+aclocal && autoconf && autoheader && automake --add-missing
--- a/configure.in
+++ b/configure.in
@ -0,0 +1,134 @@
+dnl Process this file with autoconf to produce a configure script.
+
+AC_PREREQ(2.57)
+
+AC_INIT([hermes], [1.7], [juanjo@gutierrezdequevedo.com])
+
+dnl AC_CONFIG_AUX_DIR=([./config])
+
+AM_CONFIG_HEADER([config.h])
+
+AM_INIT_AUTOMAKE([1.7.8 foreign])
+
+AC_PROG_CXX
+AC_PROG_INSTALL
+
+dnl
+dnl check libraries and functions
+dnl
+
+AC_CHECK_FUNCS(getaddrinfo gai_strerror)
+PKG_CHECK_MODULES(SQLite3, sqlite3, [], AC_MSG_ERROR("sqlite3 is required"))
+PKG_CHECK_MODULES(OpenSSL, openssl, have_ssl=yes, have_ssl=no)
+AC_CHECK_LIB(spf2,SPF_server_new, have_spf=yes, have_spf=no)
+
+dnl
+dnl end of libraries and functions
+dnl
+
+dnl
+dnl check parameters
+dnl
+
+AC_ARG_WITH(logger-module,
+  [  --with-logger-module=module          Module to log errors with. module is one of unix, file or null. default=unix],
+  [loggermodule=$withval],
+  [loggermodule=unix]
+)
+
+if test "$loggermodule" = unix; then
+  AC_DEFINE(LOGGER_CLASS,UnixLogger)
+fi
+if test "$loggermodule" = file; then
+  AC_DEFINE(LOGGER_CLASS,FileLogger)
+fi
+if test "$loggermodule" = null; then
+  AC_DEFINE(LOGGER_CLASS,NullLogger,[Define what logger we are using])
+fi
+
+AC_ARG_ENABLE(openssl,
+[  --enable-openssl               Enable OpenSSL support ],
+[
+  if test x$enableval = xyes; then
+    if test x$have_ssl = xno; then
+      AC_MSG_ERROR("OpenSSL support requested but not detected")
+    fi
+    have_ssl=yes
+  else
+    have_ssl=no
+  fi
+]
+)
+
+AC_ARG_ENABLE(spf,
+[  --enable-spf                   Enable SPF support ],
+[
+  if test x$enableval = xyes; then
+    if test x$have_spf = xno; then
+      AC_MSG_ERROR("SPF support requested but not detected")
+    fi
+    have_spf=yes
+  else
+    have_spf=no
+  fi
+]
+)
+
+win32_service=no
+AC_ARG_ENABLE(win32-service,
+[  --enable-win32-service         Enable win32 service support ],
+[
+  if test x$enableval = xyes; then
+    win32_service=yes
+  fi
+]
+)
+dnl
+dnl end of parameters check
+dnl
+
+dnl
+dnl config.h variables
+dnl
+
+if test x$have_ssl = xyes; then
+  AC_DEFINE(HAVE_SSL,1,[Defined if using openssl for SSL support])
+fi
+if test x$have_spf = xyes; then
+  AC_DEFINE(HAVE_SPF,1,[Defined if system has libspf2])
+fi
+if test x$win32_service = xyes; then
+  AC_DEFINE(WIN32_SERVICE,1,[Defined if we want to compile win32 service support])
+fi
+
+dnl
+dnl end of config.h variables
+dnl
+
+dnl
+dnl conditionals for makefiles
+dnl
+
+AM_CONDITIONAL(HAVE_SPF, test "$have_spf" = yes)
+AM_CONDITIONAL(LOGGER_UNIX, test "$loggermodule" = unix)
+AM_CONDITIONAL(LOGGER_NULL, test "$loggermodule" = null)
+AM_CONDITIONAL(LOGGER_FILE, test "$loggermodule" = file)
+AM_CONDITIONAL(WIN32_SERVICE, test "$win32_service" = yes)
+
+dnl
+dnl end of conditionals for makefiles
+dnl
+
+
+AC_CONFIG_FILES([Makefile src/Makefile docs/Makefile dists/Makefile dists/hermes.spec])
+AC_OUTPUT
+
+echo
+echo
+echo "Configuration for $PACKAGE_STRING"
+echo
+echo "    SSL:      $have_ssl"
+echo "    SPF:      $have_spf"
+echo "    Logger:   $loggermodule"
+echo "    Win32:    $win32_service"
+echo
--- a/dists/Makefile.am
+++ b/dists/Makefile.am
@ -0,0 +1,2 @@
+doc_DATA = hermesrc.example
+EXTRA_DIST = fc_init hermes.spec hermes.spec.in
--- a/dists/fc_init
+++ b/dists/fc_init
@ -0,0 +1,62 @@
+#!/bin/bash
+# Startup script for hermes
+#
+# chkconfig: 3 95 05
+# description: hermes
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+prog=hermes
+configfile=/etc/hermes/hermesrc
+
+start() {
+  echo -n $"Starting $prog: "
+  daemon --check=$prog /usr/bin/hermes $configfile
+  RETVAL=$?
+  echo
+}
+
+stop() {
+  echo -n $"Stopping $prog: "
+  killproc $prog
+  RETVAL=$?
+  echo
+}
+
+safestop() {
+  echo -n $"Stopping $prog(will process pending connections):"
+  killproc $prog -INT
+  rm /var/run/$prog.pid
+  RETVAL=$?
+  echo
+}
+
+case "$1" in
+  start)
+    start
+    ;;
+
+  stop)
+    stop
+    ;;
+
+  restart)
+    safestop
+    sleep 2
+    start
+    ;;
+  condrestart)
+    if test "x`pidfileofproc $prog`" != x; then
+    stop
+    start
+    fi
+    ;;
+
+  *)
+    echo $"Usage: $0 {start|stop|restart|condrestart}"
+    exit 1
+
+esac
+
+exit $RETVAL
--- a/dists/hermes.spec.in
+++ b/dists/hermes.spec.in
@ -0,0 +1,77 @@
+Summary:        An anti-spam SMTP proxy
+Name:           @PACKAGE@
+Version:        @VERSION@
+Release:        0
+License:        GPL
+Group:          System Environment/Daemons
+Packager:       Veit Wahlich <cru@zodia.de>
+URL:            http://www.hermes-project.com/
+Source0:        http://www.hermes-project.com/files/%{name}-%{version}.tar.bz2
+Buildroot:      %{_tmppath}/%{name}-%{version}-%{release}-root
+
+%description
+hermes is a generic, lightweight, portable and fast anti-spam smtp proxy.
+Supports greylisting, dns blacklisting/whitelisting, protocol throttling, banner delaying, spf and some
+other tricks to reject most spam before it even enters your system.
+
+%prep
+%setup -q
+
+%build
+%configure --docdir=%{_datadir}/doc/%{name}-%{version}
+%__make %{?_smp_mflags}
+
+%install
+%__rm -rf %{buildroot}
+%__make DESTDIR=%{buildroot} install
+%__mkdir_p %{buildroot}%{_sysconfdir}/rc.d/init.d
+%__mkdir_p %{buildroot}%{_sysconfdir}/hermes
+%__mkdir_p %{buildroot}%{_localstatedir}/hermes
+%__install -m 0755 dists/fc_init %{buildroot}%{_sysconfdir}/rc.d/init.d/hermes
+%__install -m 0600 dists/hermesrc.example %{buildroot}%{_sysconfdir}/hermes/hermesrc
+
+%clean
+%__rm -rf %{buildroot}
+
+%post
+/sbin/chkconfig --add hermes
+
+%preun
+if [ $1 = 0 ]; then	# execute this only if we are NOT doing an upgrade
+    %{_sysconfdir}/rc.d/init.d/hermes stop >/dev/null 2>&1
+    /sbin/chkconfig --del hermes
+fi
+exit 0
+
+%files
+%defattr(-, root, root, 0755)
+%doc ChangeLog TODO AUTHORS dists/hermesrc.example docs/hermes-options.html docs/installing-hermes.txt docs/gpl.txt
+%{_bindir}/hermes
+%{_sysconfdir}/rc.d/init.d/hermes
+%config %{_sysconfdir}/hermes/hermesrc
+%dir %attr(0700,nobody,nobody) %{_localstatedir}/hermes
+
+%changelog
+* Thu Jun 14 2007 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com> 1.4
+- removed patches, they are now on upstream
+
+* Fri May 25 2007 Veit Wahlich <cru@zodia.de> 1.3-2
+- added patch fix_whether (documentation fixes)
+- added patch add_rejectnoresolve (reject on no DNS reverse resolution feature)
+- changed RPM group to system daemon standard
+
+* Sat May 19 2007 Veit Wahlich <cru@zodia.de> 1.3-1
+- Made /etc/hermes/hermesrc readonly as it may contain passwords
+- Fixed ownership and permissions of /var/hermes to match configuration default
+- Silenced setup macro output as required by some distributions
+- Fixed docdir to a LSB compliant location, will be replaced by rpmbuild
+- Packaged extra documentation
+- Removed hermes-options.html.in from docs
+- Use directory macros for files section
+- Further specfile cleanups and macro usage
+
+* Tue May 15 2007 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+- Fixed rpm to create /var/hermes
+
+* Fri Apr 11 2007 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+- Initial release
--- a/docs/Doxyfile
+++ b/docs/Doxyfile
--- a/docs/Makefile.am
+++ b/docs/Makefile.am
@ -0,0 +1,6 @@
+EXTRA_DIST = Doxyfile gpl.txt installing-hermes.txt hermes-options.html hermes-options.html.in
+
+doc_DATA = gpl.txt installing-hermes.txt hermes-options.html hermes-options.html.in
+
+docs:
+	doxygen
--- a/docs/gpl.txt
+++ b/docs/gpl.txt
@ -0,0 +1,339 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
--- a/docs/hermes-options.html.in
+++ b/docs/hermes-options.html.in
@ -0,0 +1,8 @@
+<div class="hermesoption">
+  <a name="%name%"><h3>%name%</h3></a>
+  <div class="type">Type: %type%</div>
+  <div class="default">Default value: %default%</div>
+  <div class="explanation">
+    %explanation%
+  </div>
+</div>
--- a/docs/installing-hermes.txt
+++ b/docs/installing-hermes.txt
@ -0,0 +1,180 @@
+Installing hermes
+
+NOTE: this file has been generated from the source file
+http://www.hermes-project.com/pages/installing-hermes
+
+To install and configure a fully working hermes, you have to follow these
+steps:
+
+* Install_hermes
+* Configure_hermes
+* Change_your_current_SMTP_server_to_another_port
+
+
+Install hermes
+=================
+
+If you are going to install from source, you first need to have sqlite3
+installed with it's corresponding development package (usually sqlite3-devel or
+sqlite3-dev). If you want to install hermes with SSL support, you also need
+openssl with it's development headers (usually openssl-devel or openssl-dev).
+
+- From source
+
+If you have downloaded a .tar.gz or .tar.bz2 file, the procedure is as follows:
+
+  # tar xvfj hermes-1.0.tar.bz2 # extract file
+  # cd hermes-1.0 # change to the directory
+  # ./configure # execute configure
+  # make # compile
+  # make install # install
+
+- From a source RPM
+
+If you have downloaded a source rpm (.src.rpm) you have to compile it before
+installing. To do so, you need the rpmbuild program.
+
+  # rpmbuild --rebuild hermes-1.0.src.rpm
+
+After compiling, you should have a binary rpm on /usr/src/rpm/RPMS/i386 (or /
+usr/src/redhat/RPMS/i386, depending on your distribution). With this file,
+proceed to install the rpm.
+
+- From a binary RPM
+
+If you have downloaded a binary rpm (.rpm), installing should be pretty
+straightforward:
+
+  # rpm -ihv hermes-1.0.rpm
+
+Configure hermes
+===================
+
+This document will show you how to configure hermes in the most common way, but
+if you want to read the full help for the hermes options, go to the full
+reference_of_hermes_options.
+
+- Config file
+
+The first thing you need is a configuration file. There should be an example
+file on /usr/local/share/doc/hermes or /usr/share/doc/hermes called
+hermesrc.example. Copy this file to /etc/hermes/ (create the directory first if
+needed)
+
+  # mkdir /etc/hermes
+  # cp /usr/share/doc/hermes/hermesrc.example /etc/hermes/hermesrc
+
+Then edit the file, and let's start changing it:
+
+  # vi /etc/hermes/hermesrc
+
+- Editing the config
+
+In this section we will be creating a new file from scratch with only the
+minimum required to get hermes working.
+First, let's specify the user and group to drop privileges to:
+
+  user = nobody
+  group = nobody
+
+Now let's configure where the greylisting database is saved (defaults to /var/
+hermes/greylisting.db).
+
+  database_file = /var/hermes/greylisting.db
+
+The only thing left is to specify the host and port with our real SMTP server:
+
+  server_host = localhost
+  server_port = 2525
+
+After that, save the file and quit, and make sure that the database_file
+directory exists and that it is owned by the user and group we specified
+earlier
+
+  # mkdir /var/hermes
+  # chown nobody:nobody /var/hermes
+
+If you have compiled hermes with SSL support, you have to configure the
+certificate file and the private key
+
+  private_key_file = /etc/hermes/hermes.key
+  certificate_file = /etc/hermes/hermes.cert
+
+Now we have to generate the key file and the certificate. To do this we will
+use the openssl tool "openssl"
+
+  # openssl genrsa 1024 > /etc/hermes/hermes.key
+  Generating RSA private key, 1024 bit long modulus
+  ...................................................++++++
+  .......++++++
+  e is 65537 (0x10001)
+  # openssl req -new -x509 -nodes -sha1 -days 365 -key /etc/hermes/hermes.key > /etc/hermes/hermes.cert
+  (at this point, openssl will ask lots of questions about your contact
+  information, organization, and the like. Once it's over, the certificate will
+  be generated)
+
+Our resulting file looks like this:
+
+  user = nobody
+  group = nobody
+  database_file = /var/hermes/greylisting.db
+  server_host = localhost
+  server_port = 2525
+  private_key_file = /etc/hermes/hermes.key
+  certificate_file = /etc/hermes/hermes.cert
+
+Change your server's port
+============================
+
+Changing the port of your SMTP server is a very different proccess depending on
+your SMTP software, although they basically involve editing a file to change
+the port number from 25 (default) to another port number. This document will
+show you how to change the port number from 25 to 2525, which is hermes'
+default. If your server's software is not listed here, try to search for
+"<software-name> change default port" (i.e. "sendmail change default port") in
+your favourite search engine.
+
+- Sendmail
+
+To change sendmail port, edit your sendmail.mc file (usually on /etc/mail) and
+edit the line that says:
+
+  DAEMON_OPTIONS(`Port=smtp, Name=MTA')
+
+and change the Port from smtp to 2525
+
+  DAEMON_OPTIONS(`Port=2525, Name=MTA')
+
+After that type make to rebuild sendmail.cf
+
+  # make
+
+And restart sendmail.
+Of course, you can always edit the sendmail.cf directly, but if you know how/
+what to change, then you don't need this help.
+
+- Postfix
+
+If you are using postfix, edit /etc/postfix/master.cf and change the line that
+reads
+
+  smtp inet n - n - - smtpd
+
+to read
+
+  2525 inet n - n - - smtpd
+
+After that, restart postfix.
+
+- Qmail
+
+The easiest way to configure qmail's listening port is to edit /etc/services
+and change the line that says
+
+  smtp 25/tcp mail
+
+to
+
+  smtp 2525/tcp mail
+
+and restart qmail.
--- a/scripts/generate_config.pl
+++ b/scripts/generate_config.pl
@ -0,0 +1,123 @@
+#!/usr/bin/perl -w
+
+# this small script generates the Configfile class from the
+# Configfile.cpp.in and Configfile.h.in. this way when we want
+# to add a new option to the config file, we just have to put it
+# on Configfile.tmpl and automagically it will appear on our code
+# It will also generate an example hermesrc from the same info.
+# 2007-04-17 Now it also generates an html document for our webpage
+
+my $hvar="";
+my $cppvar1="",$cppvar2="",$cppvar3="",$conf_example="",$htmlvar="";
+
+open HTMLIN, "<../docs/hermes-options.html.in";
+$htmltempl=join("",<HTMLIN>);
+close HTMLIN;
+
+while(<>)
+{
+  chomp;
+  if(! /^#/ && ! /^\t*$/ && ! /^\*/)
+  {
+    s/^\s+//;s/\s+$//;
+    @_=split ",";
+    my $camelcased=&camel_case($_[1]);
+    my $type=$_[0];
+    $type="list<string>" if($type =~ /list/);
+    $hvar1.="$type $_[1];\n";
+    $hvar2.="$type& get$camelcased();\n";
+    if($type =~ /list/)
+    {
+      $cppvar1.="$_[1]=Configfile::parseAsList($_[2]);\n";
+    }
+    else
+    {
+      $cppvar1.="$_[1]=$_[2];\n";
+    }
+    $cppvar2.="PARSE_".uc($_[0])."(\"$_[1]\",$_[1])\n";
+    $cppvar3.="GET_VAR(get$camelcased,$_[1],$type&)\n";
+    $conf_example.="$_[1] = $_[2]\n\n";
+    my $htmltemp=$htmltempl;
+    $htmltemp =~ s/%type%/$_[0]/;
+    $htmltemp =~ s/%name%/$_[1]/g;
+    $htmltemp =~ s/%default%/$_[2]/;
+    $htmltemp =~ s/%explanation%/$htmlexpl/;
+    $htmlexpl="";
+    $htmlvar.=$htmltemp;
+  }
+  else
+  {
+    if(/^\*clean\*$/) # clean restarts our htmlexpl contents
+    {
+      $htmlexpl="";
+    }
+    else
+    {
+      if(/^\*/)
+      {
+        s/^\*$//;
+        s/^\*/#/;
+        $conf_example.="$_\n";
+        chomp;
+        s/^#//;
+        s/>/&gt;/;
+        $htmlexpl.="$_\n";
+      }
+    }
+  }
+}
+
+chomp $cppvar1;
+chomp $cppvar2;
+chomp $cppvar3;
+chomp $hvar1;
+chomp $hvar2;
+chomp $conf_example;
+
+open CPPIN, "<Configfile.cpp.in";
+$cppstr=join("",<CPPIN>);
+close CPPIN;
+open CPPOUT, ">Configfile.cpp";
+$cppstr =~ s/%templ_default_values%/$cppvar1/;
+$cppstr =~ s/%templ_parsevars%/$cppvar2/;
+$cppstr =~ s/%templ_getmethods%/$cppvar3/;
+print CPPOUT $cppstr;
+close CPPOUT;
+
+open HIN, "<Configfile.h.in";
+$hstr=join("",<HIN>);
+close HIN;
+open HOUT, ">Configfile.h";
+$hstr =~ s/%templ_privateattribs%/$hvar1/;
+$hstr =~ s/%templ_publicmethods%/$hvar2/;
+print HOUT $hstr;
+close HOUT;
+
+open RCEX, ">../dists/hermesrc.example";
+print RCEX $conf_example;
+close RCEX;
+
+open HTML, ">../docs/hermes-options.html";
+print HTML $htmlvar;
+close HTML;
+
+sub camel_case()
+{
+  my $str=shift;
+  my $outstr="";
+
+  for($i=0;$i<length($str);$i++)
+  {
+    my $letter=substr($str,$i,1);
+    if($letter eq "_")
+    {
+      $i++;
+      $outstr.=uc(substr($str,$i,1));
+    }
+    else
+    {
+      $outstr.=$letter;
+    }
+  }
+  return ucfirst($outstr);
+}
--- a/src/Configfile.cpp.in
+++ b/src/Configfile.cpp.in
@ -0,0 +1,172 @@
+/**
+ * hermes antispam proxy
+ * Copyright (C) 2006, 2007 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * @author Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+ */
+#include "Configfile.h"
+
+/**
+ * default config
+ *
+ */
+Configfile::Configfile()
+{
+%templ_default_values%
+}
+
+void Configfile::parse(string file)
+{
+  ifstream f;
+  char line[255];
+  int equalpos;
+
+  f.open(file.c_str(),ios::in);
+  while(!f.eof())
+  {
+    f.getline(line,255);
+    string l=Utils::trim(line);
+    if('#'!=l[0]&&l!=""&&l.find("="))
+    {
+      equalpos=l.find("=");
+      string option=Utils::trim(l.substr(0,equalpos));
+      string value=Utils::trim(l.substr(equalpos+1));
+      #ifdef REALLY_VERBOSE_DEBUG
+        cout << l << endl;
+        cout << option << "->" << value << endl;
+      #endif //REALLY_VERBOSE_DEBUG
+      //this is a bit of a hack, but simplifies a lot this function
+      #define PARSE_INT(x,y) if(x==option) y=Configfile::parseAsInt(value); else
+      #define PARSE_BOOL(x,y) if(x==option) y=Configfile::parseAsBool(value); else
+      #define PARSE_STRING(x,y) if(x==option) y=Configfile::parseAsString(value); else
+      #define PARSE_LIST(x,y) if(x==option) y=Configfile::parseAsList(value); else
+
+      %templ_parsevars%
+      {
+        throw Exception("Option \""+option+"\" with value \""+value+"\" is not recognized",__FILE__,__LINE__);
+      }
+      #undef PARSE_INT
+      #undef PARSE_BOOL
+      #undef PARSE_STRING
+      #undef PARSE_LIST
+    }
+  }
+  #ifndef WIN32
+    uid=Utils::usertouid(user);
+    gid=Utils::grouptogid(group);
+  #endif //WIN32
+  f.close();
+}
+
+//again, this is a BIG HACK, but it simplifies code a lot
+#define GET_VAR(x,y,z) z Configfile::x(){ return y;}
+
+GET_VAR(getUid,uid,int)
+GET_VAR(getGid,gid,int)
+%templ_getmethods%
+
+#undef GET_VAR
+
+void Configfile::validateConfig()
+{
+  #ifndef WIN32
+    //check if we are root if we want to bind to a port lower than 1024
+    if(getuid()!=0&&listening_port<1024)
+      throw Exception(_("You can't bind to a port lower than 1024 without being root"),__FILE__,__LINE__);
+  #endif //WIN32
+
+  #ifdef HAVE_SSL
+    //check if ssl is usable
+    if(!Utils::file_exists(certificate_file))
+      throw Exception("Certificate file "+certificate_file+" doesn't exist.\nTo generate a certificate look in hermesrc.example, there is an example there.",__FILE__,__LINE__);
+
+    if(!Utils::file_exists(private_key_file))
+      throw Exception("Private key file "+private_key_file+" doesn't exist.\nTo generate a private key look in hermesrc.example, there is an example there.",__FILE__,__LINE__);
+  #endif //HAVE_SSL
+
+  #ifndef WIN32
+  //check if chroot dir exist //TODO: check that files needed in chroot exist
+  //for now only /etc/resolv.conf, but we're working on it :-D
+  if(""!=chroot&&!Utils::dir_exists(chroot))
+    throw Exception("Directory "+chroot+" doesn't exist, can't chroot to it.",__FILE__,__LINE__);
+  #endif //WIN32
+
+  //check if we have submit_stats on but no user and password
+  if(getSubmitStats()&&(""==getSubmitStatsUsername()||""==getSubmitStatsPassword()))
+    throw Exception("You have configured hermes to send stats, but have not configured a username or password.\n"
+      "If you don't have one, go to http://www.hermes-project.com and register there",__FILE__,__LINE__);
+
+  #ifndef HAVE_SSL
+  //check if we have activated submit_stats_ssl not having ssl activated
+  if(getSubmitStatsSsl())
+    throw Exception("You have configured stats submission through SSL, but hermes was compiled without SSL support",__FILE__,__LINE__);
+  #endif //HAVE_SSL
+  
+}
+
+string Configfile::parseAsString(string str)
+{
+  //remove "" round the string
+  if('"'==str[0])
+    str=str.substr(1);
+  if('"'==str[str.length()-1])
+    str=str.substr(0,str.length()-1);
+
+  return str;
+}
+
+bool Configfile::parseAsBool(string str)
+{
+  if("yes"==str||"on"==str||"1"==str||"true"==str)
+    return true;
+  else
+    return false;
+}
+
+long int Configfile::parseAsInt(string str)
+{
+  long int value;
+
+  errno=0; //to know why we do this, read NOTES on strtol(3)
+  value=strtol(str.c_str(),NULL,10);
+  if(errno)
+    throw Exception("Error parsing as int ("+Utils::errnotostrerror(errno)+")",__FILE__,__LINE__);
+
+  return value;
+}
+
+list<string> Configfile::parseAsList(string str)
+{
+  list<string> tmpList;
+  string::size_type startpos=0,endpos=0,len;
+  string tmpstr;
+
+  str=Configfile::parseAsString(str); //remove quotes around string
+
+  len=str.length();
+  while(startpos<len&&string::npos!=endpos)
+  {
+    endpos=str.find(',',startpos);
+    if(string::npos==endpos)
+      tmpstr=str.substr(startpos);
+    else
+      tmpstr=str.substr(startpos,endpos-startpos);
+    tmpList.push_back(Utils::trim(tmpstr));
+    startpos=endpos+1;
+  }
+
+  return tmpList;
+}
--- a/src/Configfile.h.in
+++ b/src/Configfile.h.in
@ -0,0 +1,52 @@
+/**
+ * hermes antispam proxy
+ * Copyright (C) 2006, 2007 Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * @author Juan José Gutiérrez de Quevedo <juanjo@gutierrezdequevedo.com>
+ */
+#ifndef CONFIGFILE_H
+#define CONFIGFILE_H
+
+#include "hermes.h"
+#include <list>
+#include <string>
+#include <iostream>
+#include <fstream>
+
+#include "Utils.h"
+
+using namespace std;
+
+class Configfile
+{
+  private:
+    static string parseAsString(string);
+    static bool parseAsBool(string);
+    static long parseAsInt(string);
+    static list<string> parseAsList(string);
+    int uid;
+    int gid;
+    %templ_privateattribs%
+  public:
+    Configfile();
+    void parse(string);
+    void validateConfig();
+    int getUid();
+    int getGid();
+    %templ_publicmethods%
+};
+
+#endif //CONFIGFILE_H
--- a/src/Configfile.tmpl
+++ b/src/Configfile.tmpl
@ -0,0 +1,253 @@
+#include "../config.h"
+
+* comments MUST begin with a #.
+*
+* boolean options recognise (true, 1, on, yes) as true
+* and anything else as false
+*
+* string literals can be surrounded by the " character,
+* but everything else CANNOT be
+*
+
+*clean*
+#ifndef WIN32
+
+* whether to fork to the background. initscripts require 
+* this to be true most of the time.
+bool,background,true
+
+* chroot to this directory on startup.
+* this path is ABSOLUTE, it WON'T work with a relative path,
+* because we are chrooting to the dir BEFORE chrooting, as a
+* security measure.
+* to disable chrooting, use an empty string (default).
+string,chroot,""
+
+* drop privileges once running? recomended.
+bool,drop_privileges,true
+
+* user to drop privileges to.
+string,user,"nobody"
+
+* group to drop privileges to.
+string,group,"nobody"
+
+* write a pid file with the pid of the main hermes server.
+* if you set background=true above, this will write the pid 
+* of the forked hermes, not the original.
+string,pid_file,"/var/run/hermes.pid"
+#endif //WIN32
+
+* the port where hermes will listen for new connection.
+* if you are going to use a port lower than 1024 (almost always,
+* smtp is 25, smtps is 465 and delivery is 587), then you need
+* to run as root (you can drop privileges) or with setUID active.
+int,listening_port,25
+
+* the ip to bind to. if you leave it empty (default), then it 
+* listens on all available ips
+string,bind_to,""
+
+* the host of the real smtp server.
+* if your server is qmail and you have the AUTH patch,
+* DON'T use localhost, use the external IP instead.
+string,server_host,"localhost"
+
+* the port for the real smtp server.
+int,server_port,2525
+
+* database file to use.
+* if you are chrooting, the path is relative to the chroot:
+*  real filepath = chroot + database_file
+#ifdef WIN32
+string,database_file,"greylisting.db"
+#else
+string,database_file,"/var/hermes/greylisting.db"
+#endif //WIN32
+
+* whether to use greylisting.
+* greylisting will slightly delay your emails (configurable, see below)
+* to stop most spam. is the most efective technique in use by hermes.
+bool,greylist,true
+
+* whether to throttle connection.
+* it will force some spammers (the more impatient ones) to drop the connection
+* and leave you alone.
+bool,throttle,true
+
+* throttling time
+* this is the time (in seconds) that hermes will wait between each sent line.
+* don't set this too high (more than 3), as that will drop MANY connections
+int,throttling_time,1
+
+* whether we should check if there is data before we send the SMTP banner.
+* if there is data the email is almost certainly spam.
+bool,allow_data_before_banner,false
+
+* dns blacklist domain list to check.
+* if this is empty (default) hermes will not check anything, effectively disabling
+* dns blacklisting.
+* recommended value is "zen.spamhaus.org"
+list,dns_blacklist_domains,""
+
+* percentage of domains that have to blacklist an ip before considering it blacklisted.
+* for example if you need a domain to be listed in only half of the blacklists to be considered
+* as listed, just define dns_blacklist_percentage as 50 (50%)
+int,dns_blacklist_percentage,100
+
+* dns whitelist domain to check.
+* if this is empty (default) hermes will not check anything, effectively disabling
+* dns whitelisting.
+* this lists should only list hosts that have a history of NOT sending spam.
+* recommended value is "list.dnswl.org"
+list,dns_whitelist_domains,""
+
+* percentage of domains that have to whitelist an ip before considering it whitelisted.
+* for example if you need a domain to be listed in only half of the whitelists to be considered
+* as listed, just define dns_whitelist_percentage as 50 (50%).
+int,dns_whitelist_percentage,100
+
+* time to delay the initial SMTP banner
+int,banner_delay_time,5
+
+#ifdef REALLY_VERBOSE_DEBUG
+* email to notify exceptions to.
+* CAVEAT: the code that does this is VERY BUGGY and VERY VERBOSE, don't use unless you
+* are a developer looking for a bug.
+string,notify_to,""
+#endif //REALLY_VERBOSE_DEBUG
+
+* greylisting options.
+*
+*clean*
+