Feature macros, show-supported and build-time selection for malware interfaces

111 files changed, 1895 insertions, 2184 deletions

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 86c02412e..31f3c5d95 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -47,6 +47,10 @@ JH/07 Bug 2214: Fix SMTP responses resulting from non-accept result of MIME ACL.
       Previously a spurious "250 OK id=" response was appended to the proper
       failure response.
 
+JH/08 The "support for" informational output now, which built with Content
+      Scanning support, has a line for the malware scanner interfaces compiled
+      in.  Interface can be individually included or not at build time.
+
 
 Exim version 4.90
 -----------------
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index df7055a36..590343f82 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -15,6 +15,8 @@ Version 4.91
  2. DANE is now supported under GnuTLS version 3.0.0 or later (adding to the
     previous OpenSSL implementation, but still Experimental).
 
+ 3. Feature macros for the compiled-in set of malware scanner interfaces.
+
 
 Version 4.90
 ------------
diff --git a/src/OS/Makefile-Base b/src/OS/Makefile-Base
index 6aab029ad..230ab1bce 100644
--- a/src/OS/Makefile-Base
+++ b/src/OS/Makefile-Base
@@ -135,7 +135,7 @@ OBJ_MACRO = macro_predef.o \
 	macro-manualroute.o macro-queryprogram.o macro-redirect.o \
 	macro-auth-spa.o macro-cram_md5.o macro-cyrus_sasl.o macro-dovecot.o macro-gsasl_exim.o \
 	macro-heimdal_gssapi.o macro-plaintext.o macro-spa.o macro-tls.o\
-	macro-dkim.o
+	macro-dkim.o macro-malware.o
 
 $(OBJ_MACRO):	$(MACRO_HSRC)
 
@@ -226,6 +226,9 @@ macro-tls.o:		auths/tls.c
 macro-dkim.o:		dkim.c
 	@echo "$(CC) -DMACRO_PREDEF dkim.c"
 	$(FE)$(CC) -c $(CFLAGS) -DMACRO_PREDEF $(INCLUDE) -o $@ dkim.c
+macro-malware.o:	malware.c
+	@echo "$(CC) -DMACRO_PREDEF malware.c"
+	$(FE)$(CC) -c $(CFLAGS) -DMACRO_PREDEF $(INCLUDE) -o $@ malware.c
 
 macro_predef: $(OBJ_MACRO)
 	@echo "$(LNCC) -o $@"
diff --git a/src/src/EDITME b/src/src/EDITME
index 35585d6bb..39c1cdbcc 100644
--- a/src/src/EDITME
+++ b/src/src/EDITME
@@ -398,6 +398,23 @@ EXIM_MONITOR=eximon.bin
 
 # WITH_CONTENT_SCAN=yes
 
+# If you have content scanning you may wish to only include some of the scanner
+# interfaces.  Uncomment any of these lines to remove that code.
+
+# DISABLE_MAL_FFROTD=yes
+# DISABLE_MAL_FFROT6D=yes
+# DISABLE_MAL_DRWEB=yes
+# DISABLE_MAL_AVE=yes
+# DISABLE_MAL_FSECURE=yes
+# DISABLE_MAL_KAV=yes
+# DISABLE_MAL_SOPHIE=yes
+# DISABLE_MAL_CLAM=yes
+# DISABLE_MAL_MKS=yes
+# DISABLE_MAL_AVAST=yes
+# DISABLE_MAL_SOCK=yes
+# DISABLE_MAL_CMDLINE=yes
+
+
 #------------------------------------------------------------------------------
 # If you're using ClamAV and are backporting fixes to an old version, instead
 # of staying current (which is the more usual approach) then you may need to
diff --git a/src/src/config.h.defaults b/src/src/config.h.defaults
index 4750523dc..08dc446f6 100644
--- a/src/src/config.h.defaults
+++ b/src/src/config.h.defaults
@@ -3,6 +3,7 @@
 *************************************************/
 
 /* Copyright (c) University of Cambridge 1995 - 2017 */
+/* Copyright (c) The Exim Maintainers 2018 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* The default settings for Exim configuration variables. A #define without
@@ -173,6 +174,18 @@ Do not put spaces between # and the 'define'.
 #define WHITELIST_D_MACROS
 
 #define WITH_CONTENT_SCAN
+#define DISABLE_MAL_FFROTD
+#define DISABLE_MAL_FFROT6D
+#define DISABLE_MAL_DRWEB
+#define DISABLE_MAL_AVE
+#define DISABLE_MAL_FSECURE
+#define DISABLE_MAL_KAV
+#define DISABLE_MAL_SOPHIE
+#define DISABLE_MAL_CLAM
+#define DISABLE_MAL_MKS
+#define DISABLE_MAL_AVAST
+#define DISABLE_MAL_SOCK
+#define DISABLE_MAL_CMDLINE
 #define WITH_OLD_CLAMAV_STREAM
 
 /* EXPERIMENTAL features */
diff --git a/src/src/exim.c b/src/src/exim.c
index 8bd145635..2189bc051 100644
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -801,11 +801,11 @@ fprintf(f, "Support for:");
   fprintf(f, " TCPwrappers");
 #endif
 #ifdef SUPPORT_TLS
-  #ifdef USE_GNUTLS
+# ifdef USE_GNUTLS
   fprintf(f, " GnuTLS");
-  #else
+# else
   fprintf(f, " OpenSSL");
-  #endif
+# endif
 #endif
 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
   fprintf(f, " translate_ip_address");
@@ -934,6 +934,10 @@ auth_show_supported(f);
 route_show_supported(f);
 transport_show_supported(f);
 
+#ifdef WITH_CONTENT_SCAN
+malware_show_supported(f);
+#endif
+
 if (fixed_never_users[0] > 0)
   {
   int i;
diff --git a/src/src/functions.h b/src/src/functions.h
index b9a0cbc7c..1e8698b78 100644
--- a/src/src/functions.h
+++ b/src/src/functions.h
@@ -263,6 +263,7 @@ extern void    mainlog_close(void);
 extern int     malware(const uschar *, int);
 extern int     malware_in_file(uschar *);
 extern void    malware_init(void);
+extern void    malware_show_supported(FILE *);
 #endif
 extern int     match_address_list(const uschar *, BOOL, BOOL, const uschar **,
                  unsigned int *, int, int, const uschar **);
diff --git a/src/src/macro_predef.c b/src/src/macro_predef.c
index d13248ce4..08028bf5b 100644
--- a/src/src/macro_predef.c
+++ b/src/src/macro_predef.c
@@ -43,6 +43,7 @@ builtin_macro_create_var(name, US"y");
 }
 
 
+/* restricted snprintf */
 void
 spf(uschar * buf, int len, const uschar * fmt, ...)
 {
@@ -261,6 +262,10 @@ due to conflicts with other common macros. */
   builtin_macro_create(US"_HAVE_TRANSPORT_APPEND_MBX");
 # endif
 #endif
+
+#ifdef WITH_CONTENT_SCAN
+features_malware();
+#endif
 }
 
 
diff --git a/src/src/macro_predef.h b/src/src/macro_predef.h
index 00d9537ca..bfa201068 100644
--- a/src/src/macro_predef.h
+++ b/src/src/macro_predef.h
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) Jeremy Harris 2017 */
+/* Copyright (c) Jeremy Harris 2017 - 2018 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Global functions */
@@ -12,6 +12,7 @@ extern void builtin_macro_create(const uschar *);
 extern void builtin_macro_create_var(const uschar *, const uschar *);
 extern void options_from_list(optionlist *, unsigned, const uschar *, uschar *);
 
+extern void features_malware(void);
 extern void options_main(void);
 extern void options_routers(void);
 extern void options_transports(void);
diff --git a/src/src/malware.c b/src/src/malware.c
index 7ae8200ae..fa1a7aaba 100644
--- a/src/src/malware.c
+++ b/src/src/malware.c
@@ -4,13 +4,13 @@
 
 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2003 - 2015
  * License: GPL
- * Copyright (c) The Exim Maintainers 2017
+ * Copyright (c) The Exim Maintainers 2017 - 2018
  */
 
 /* Code for calling virus (malware) scanners. Called from acl.c. */
 
 #include "exim.h"
-#ifdef WITH_CONTENT_SCAN
+#ifdef WITH_CONTENT_SCAN	/* entire file */
 
 typedef enum {M_FPROTD, M_DRWEB, M_AVES, M_FSEC, M_KAVD, M_CMDL,
 		M_SOPHIE, M_CLAMD, M_SOCK, M_MKSD, M_AVAST, M_FPROT6D} scanner_t;
@@ -23,72 +23,130 @@ static struct scan
   contype_t	conn;
 } m_scans[] =
 {
+#ifndef DISABLE_MAL_FFROTD
   { M_FPROTD,	US"f-protd",	US"localhost 10200-10204",	      MC_TCP },
+#endif
+#ifndef DISABLE_MAL_FFROT6D
+  { M_FPROT6D,	US"f-prot6d",	US"localhost 10200",		      MC_TCP },
+#endif
+#ifndef DISABLE_MAL_DRWEB
   { M_DRWEB,	US"drweb",	US"/usr/local/drweb/run/drwebd.sock", MC_STRM },
+#endif
+#ifndef DISABLE_MAL_AVE
   { M_AVES,	US"aveserver",	US"/var/run/aveserver",		      MC_UNIX },
+#endif
+#ifndef DISABLE_MAL_FSECURE
   { M_FSEC,	US"fsecure",	US"/var/run/.fsav",		      MC_UNIX },
+#endif
+#ifndef DISABLE_MAL_KAV
   { M_KAVD,	US"kavdaemon",	US"/var/run/AvpCtl",		      MC_UNIX },
-  { M_CMDL,	US"cmdline",	NULL,				      MC_NONE },
+#endif
+#ifndef DISABLE_MAL_SOPHIE
   { M_SOPHIE,	US"sophie",	US"/var/run/sophie",		      MC_UNIX },
+#endif
+#ifndef DISABLE_MAL_CLAM
   { M_CLAMD,	US"clamd",	US"/tmp/clamd",			      MC_NONE },
-  { M_SOCK,	US"sock",	US"/tmp/malware.sock",		      MC_STRM },
+#endif
+#ifndef DISABLE_MAL_MKS
   { M_MKSD,	US"mksd",	NULL,				      MC_NONE },
+#endif
+#ifndef DISABLE_MAL_AVAST
   { M_AVAST,	US"avast",	US"/var/run/avast/scan.sock",	      MC_STRM },
-  { M_FPROT6D,	US"f-prot6d",	US"localhost 10200",		      MC_TCP },
+#endif
+#ifndef DISABLE_MAL_SOCK
+  { M_SOCK,	US"sock",	US"/tmp/malware.sock",		      MC_STRM },
+#endif
+#ifndef DISABLE_MAL_CMDLINE
+  { M_CMDL,	US"cmdline",	NULL,				      MC_NONE },
+#endif
   { -1,		NULL,		NULL, MC_NONE }		/* end-marker */
 };
 
+/******************************************************************************/
+# ifdef MACRO_PREDEF		/* build solely to predefine macros */
+
+#  include "macro_predef.h"
+
+void
+features_malware(void)
+{
+struct scan * sc;
+uschar * s, * t;
+uschar buf[64];
+
+spf(buf, sizeof(buf), US"_HAVE_MALWARE_");
+
+for (sc = m_scans; sc->scancode != -1; sc++)
+  {
+  for(s = sc->name, t = buf+14; *s; s++) if (*s != '-') *t++ = toupper(*s);
+  *t = '\0';
+  builtin_macro_create(buf);
+  }
+}
+
+/******************************************************************************/
+# else	/*!MACRO_PREDEF, main build*/
+
+
+#define MALWARE_TIMEOUT 120	/* default timeout, seconds */
+
+static const uschar * malware_regex_default = US ".+";
+static const pcre * malware_default_re = NULL;
+
+
+
+#ifndef DISABLE_MAL_CLAM
 /* The maximum number of clamd servers that are supported in the configuration */
-#define MAX_CLAMD_SERVERS 32
-#define MAX_CLAMD_SERVERS_S "32"
+# define MAX_CLAMD_SERVERS 32
+# define MAX_CLAMD_SERVERS_S "32"
 
 typedef struct clamd_address {
   uschar * hostspec;
   unsigned tcp_port;
   unsigned retry;
 } clamd_address;
-
-#ifndef nelements
-# define nelements(arr) (sizeof(arr) / sizeof(arr[0]))
 #endif
 
 
-#define MALWARE_TIMEOUT 120	/* default timeout, seconds */
-
-
-#define DRWEBD_SCAN_CMD             (1)     /* scan file, buffer or diskfile */
-#define DRWEBD_RETURN_VIRUSES       (1<<0)   /* ask daemon return to us viruses names from report */
-#define DRWEBD_IS_MAIL              (1<<19)  /* say to daemon that format is "archive MAIL" */
+#ifndef DISABLE_MAL_DRWEB
+# define DRWEBD_SCAN_CMD             (1)     /* scan file, buffer or diskfile */
+# define DRWEBD_RETURN_VIRUSES       (1<<0)   /* ask daemon return to us viruses names from report */
+# define DRWEBD_IS_MAIL              (1<<19)  /* say to daemon that format is "archive MAIL" */
 
-#define DERR_READ_ERR               (1<<0)   /* read error */
-#define DERR_NOMEMORY               (1<<2)   /* no memory */
-#define DERR_TIMEOUT                (1<<9)   /* scan timeout has run out */
-#define DERR_BAD_CALL               (1<<15)  /* wrong command */
-
-
-static const uschar * malware_regex_default = US ".+";
-static const pcre * malware_default_re = NULL;
+# define DERR_READ_ERR               (1<<0)   /* read error */
+# define DERR_NOMEMORY               (1<<2)   /* no memory */
+# define DERR_TIMEOUT                (1<<9)   /* scan timeout has run out */
+# define DERR_BAD_CALL               (1<<15)  /* wrong command */
 
 static const uschar * drweb_re_str = US "infected\\swith\\s*(.+?)$";
 static const pcre * drweb_re = NULL;
+#endif
 
+#ifndef DISABLE_MAL_FSECURE
 static const uschar * fsec_re_str = US "\\S{0,5}INFECTED\\t[^\\t]*\\t([^\\t]+)\\t\\S*$";
 static const pcre * fsec_re = NULL;
+#endif
 
+#ifndef DISABLE_MAL_KAV
 static const uschar * kav_re_sus_str = US "suspicion:\\s*(.+?)\\s*$";
 static const uschar * kav_re_inf_str = US "infected:\\s*(.+?)\\s*$";
 static const pcre * kav_re_sus = NULL;
 static const pcre * kav_re_inf = NULL;
+#endif
 
+#ifndef DISABLE_MAL_AVAST
 static const uschar * ava_re_clean_str = US "(?!\\\\)\\t\\[\\+\\]";
 static const uschar * ava_re_virus_str = US "(?!\\\\)\\t\\[L\\]\\d\\.\\d\\t\\d\\s(.*)";
 static const pcre * ava_re_clean = NULL;
 static const pcre * ava_re_virus = NULL;
+#endif
 
+#ifndef DISABLE_MAL_FFROT6D
 static const uschar * fprot6d_re_error_str = US "^\\d+\\s<(.+?)>$";
 static const uschar * fprot6d_re_virus_str = US "^\\d+\\s<infected:\\s+(.+?)>\\s+.+$";
 static const pcre * fprot6d_re_error = NULL;
 static const pcre * fprot6d_re_virus = NULL;
+#endif
 
 
 
@@ -142,6 +200,7 @@ return m_errlog_defer(scanent, hostport, str);
 
 /*************************************************/
 
+#ifndef DISABLE_MAL_CLAM
 /* Only used by the Clamav code, which is working from a list of servers and
 uses the returned in_addr to get a second connection to the same system.
 */
@@ -152,6 +211,7 @@ m_tcpsocket(const uschar * hostname, unsigned int port,
 return ip_connectedsocket(SOCK_STREAM, hostname, port, port, 5,
 			  host, errstr, fastopen_blob);
 }
+#endif
 
 static int
 m_sock_send(int sock, uschar * buf, int cnt, uschar ** errstr)
@@ -186,7 +246,7 @@ m_pcre_exec(const pcre * cre, uschar * text)
 {
 int ovector[10*3];
 int i = pcre_exec(cre, NULL, CS text, Ustrlen(text), 0, 0,
-	      ovector, nelements(ovector));
+	      ovector, nelem(ovector));
 uschar * substr = NULL;
 if (i >= 2)				/* Got it */
   pcre_get_substring(CS text, ovector, i, 1, (const char **) &substr);
@@ -263,9 +323,10 @@ return fd_ready(sock, tmo-time(NULL))
 
 
 
+#ifndef DISABLE_MAL_MKS
 /* ============= private routines for the "mksd" scanner type ============== */
 
-#include <sys/uio.h>
+# include <sys/uio.h>
 
 static inline int
 mksd_writev (int sock, struct iovec * iov, int iovcnt)
@@ -388,8 +449,10 @@ if (mksd_read_lines (sock, av_buffer, sizeof (av_buffer), tmo) < 0)
 
 return mksd_parse_line (scanent, CS av_buffer);
 }
+#endif	/* MKSD */
 
 
+#ifndef DISABLE_MAL_CLAM
 static int
 clamd_option(clamd_address * cd, const uschar * optstr, int * subsep)
 {
@@ -408,6 +471,9 @@ while ((s = string_nextinlist(&optstr, subsep, NULL, 0)))
     return FAIL;
 return OK;
 }
+#endif
+
+
 
 /*************************************************
 *          Scan content for malware              *
@@ -531,6 +597,7 @@ if (!malware_ok)
 
   switch (scanent->scancode)
     {
+#ifndef DISABLE_MAL_FFROTD
     case M_FPROTD: /* "f-protd" scanner type -------------------------------- */
       {
       uschar *fp_scan_option;
@@ -584,7 +651,56 @@ if (!malware_ok)
 	}
       break;
       }	/* f-protd */
+#endif
+
+#ifndef DISABLE_MAL_FFROT6D
+    case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
+      {
+      int bread;
+      uschar * e;
+      uschar * linebuffer;
+      uschar * scanrequest;
+      uschar av_buffer[1024];
+
+      if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
+        || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
+        return malware_errlog_defer(errstr);
+
+      scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
+      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
+        scanner_name, scanrequest);
+
+      if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0)
+        return m_errlog_defer(scanent, CUS callout_address, errstr);
+
+      bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
+
+      if (bread <= 0)
+        return m_errlog_defer_3(scanent, CUS callout_address,
+          string_sprintf("unable to read from socket (%s)", strerror(errno)),
+          sock);
+
+      if (bread == sizeof(av_buffer))
+        return m_errlog_defer_3(scanent, CUS callout_address,
+          US"buffer too small", sock);
+
+      av_buffer[bread] = '\0';
+      linebuffer = string_copy(av_buffer);
+
+      m_sock_send(sock, US"QUIT\n", 5, 0);
+
+      if ((e = m_pcre_exec(fprot6d_re_error, linebuffer)))
+        return m_errlog_defer_3(scanent, CUS callout_address,
+          string_sprintf("scanner reported error (%s)", e), sock);
 
+      if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer)))
+        malware_name = NULL;
+
+      break;
+      }  /* f-prot6d */
+#endif
+
+#ifndef DISABLE_MAL_DRWEB
     case M_DRWEB: /* "drweb" scanner type ----------------------------------- */
   /* v0.1 - added support for tcp sockets          */
   /* v0.0 - initial release -- support for unix sockets      */
@@ -739,7 +855,7 @@ badseek:  err = errno;
 
 	  /* try matcher on the line, grab substring */
 	  result = pcre_exec(drweb_re, NULL, CS tmpbuf, Ustrlen(tmpbuf), 0, 0,
-				  ovector, nelements(ovector));
+				  ovector, nelem(ovector));
 	  if (result >= 2)
 	    {
 	    const char * pre_malware_nb;
@@ -780,7 +896,9 @@ badseek:  err = errno;
 	}
       break;
       }	/* drweb */
+#endif
 
+#ifndef DISABLE_MAL_AVE
     case M_AVES: /* "aveserver" scanner type -------------------------------- */
       {
       uschar buf[32768];
@@ -848,7 +966,9 @@ badseek:  err = errno;
 	}
       break;
       }	/* aveserver */
+#endif
 
+#ifndef DISABLE_MAL_FSECURE
     case M_FSEC: /* "fsecure" scanner type ---------------------------------- */
       {
       int i, j, bread = 0;
@@ -865,7 +985,7 @@ badseek:  err = errno;
 	  scanner_name, scanner_options);
       /* pass options */
       memset(av_buffer, 0, sizeof(av_buffer));
-      for (i = 0; i != nelements(cmdopt); i++)
+      for (i = 0; i != nelem(cmdopt); i++)
 	{
 
 	if (m_sock_send(sock, cmdopt[i], Ustrlen(cmdopt[i]), &errstr) < 0)
@@ -931,7 +1051,9 @@ badseek:  err = errno;
       fsec_found:
 	break;
       }	/* fsecure */
+#endif
 
+#ifndef DISABLE_MAL_KAV
     case M_KAVD: /* "kavdaemon" scanner type -------------------------------- */
       {
       time_t t;
@@ -1043,7 +1165,9 @@ badseek:  err = errno;
 
       break;
       }
+#endif
 
+#ifndef DISABLE_MAL_CMDLINE
     case M_CMDL: /* "cmdline" scanner type ---------------------------------- */
       {
       const uschar *cmdline_scanner = scanner_options;
@@ -1177,7 +1301,9 @@ badseek:  err = errno;
 	malware_name = NULL;
       break;
       }	/* cmdline */
+#endif
 
+#ifndef DISABLE_MAL_SOPHIE
     case M_SOPHIE: /* "sophie" scanner type --------------------------------- */
       {
       int bread = 0;
@@ -1222,7 +1348,9 @@ badseek:  err = errno;
 
       break;
       }
+#endif
 
+#ifndef DISABLE_MAL_CLAM
     case M_CLAMD: /* "clamd" scanner type ----------------------------------- */
       {
 /* This code was originally contributed by David Saez */
@@ -1709,7 +1837,9 @@ b_seek:   err = errno;
 
       break;
       } /* clamd */
+#endif
 
+#ifndef DISABLE_MAL_SOCK
     case M_SOCK: /* "sock" scanner type ------------------------------------- */
     /* This code was derived by Martin Poole from the clamd code contributed
        by David Saez and the cmdline code
@@ -1790,7 +1920,9 @@ b_seek:   err = errno;
 	malware_name = NULL;
       break;
       }
+#endif
 
+#ifndef DISABLE_MAL_MKS
     case M_MKSD: /* "mksd" scanner type ------------------------------------- */
       {
       char *mksd_options_end;
@@ -1823,7 +1955,9 @@ b_seek:   err = errno;
 	}
       break;
       }
+#endif
 
+#ifndef DISABLE_MAL_AVAST
     case M_AVAST: /* "avast" scanner type ----------------------------------- */
       {
       int ovector[1*3];
@@ -1903,7 +2037,7 @@ b_seek:   err = errno;
 		break;  /* ignore the "210 SCAN DATA" message */
 
 	      if (pcre_exec(ava_re_clean, NULL, CS buf, slen,
-		    0, 0, ovector, nelements(ovector)) > 0)
+		    0, 0, ovector, nelem(ovector)) > 0)
 		break;
 
 	      if ((malware_name = m_pcre_exec(ava_re_virus, buf)))
@@ -1956,51 +2090,7 @@ b_seek:   err = errno;
 	}
       break;
       }
-
-    case M_FPROT6D: /* "f-prot6d" scanner type ----------------------------------- */
-      {
-      int bread;
-      uschar * e;
-      uschar * linebuffer;
-      uschar * scanrequest;
-      uschar av_buffer[1024];
-
-      if ((!fprot6d_re_virus && !(fprot6d_re_virus = m_pcre_compile(fprot6d_re_virus_str, &errstr)))
-        || (!fprot6d_re_error && !(fprot6d_re_error = m_pcre_compile(fprot6d_re_error_str, &errstr))))
-        return malware_errlog_defer(errstr);
-
-      scanrequest = string_sprintf("SCAN FILE %s\n", eml_filename);
-      DEBUG(D_acl) debug_printf_indent("Malware scan: issuing %s: %s\n",
-        scanner_name, scanrequest);
-
-      if (m_sock_send(sock, scanrequest, Ustrlen(scanrequest), &errstr) < 0)
-        return m_errlog_defer(scanent, CUS callout_address, errstr);
-
-      bread = ip_recv(sock, av_buffer, sizeof(av_buffer), tmo-time(NULL));
-
-      if (bread <= 0)
-        return m_errlog_defer_3(scanent, CUS callout_address,
-          string_sprintf("unable to read from socket (%s)", strerror(errno)),
-          sock);
-
-      if (bread == sizeof(av_buffer))
-        return m_errlog_defer_3(scanent, CUS callout_address,
-          US"buffer too small", sock);
-
-      av_buffer[bread] = '\0';
-      linebuffer = string_copy(av_buffer);
-
-      m_sock_send(sock, US"QUIT\n", 5, 0);
-
-      if ((e = m_pcre_exec(fprot6d_re_error, linebuffer)))
-        return m_errlog_defer_3(scanent, CUS callout_address,
-          string_sprintf("scanner reported error (%s)", e), sock);
-
-      if (!(malware_name = m_pcre_exec(fprot6d_re_virus, linebuffer)))
-        malware_name = NULL;
-
-      break;
-      }  /* f-prot6d */
+#endif
   }	/* scanner type switch */
 
   if (sock >= 0)
@@ -2099,24 +2189,47 @@ malware_init(void)
 {
 if (!malware_default_re)
   malware_default_re = regex_must_compile(malware_regex_default, FALSE, TRUE);
+
+#ifndef DISABLE_MAL_DRWEB
 if (!drweb_re)
   drweb_re = regex_must_compile(drweb_re_str, FALSE, TRUE);
+#endif
+#ifndef DISABLE_MAL_FSECURE
 if (!fsec_re)
   fsec_re = regex_must_compile(fsec_re_str, FALSE, TRUE);
+#endif
+#ifndef DISABLE_MAL_KAV
 if (!kav_re_sus)
   kav_re_sus = regex_must_compile(kav_re_sus_str, FALSE, TRUE);
 if (!kav_re_inf)
   kav_re_inf = regex_must_compile(kav_re_inf_str, FALSE, TRUE);
+#endif
+#ifndef DISABLE_MAL_AVA
 if (!ava_re_clean)
   ava_re_clean = regex_must_compile(ava_re_clean_str, FALSE, TRUE);
 if (!ava_re_virus)
   ava_re_virus = regex_must_compile(ava_re_virus_str, FALSE, TRUE);
+#endif
+#ifndef DISABLE_MAL_FPROT6D
 if (!fprot6d_re_error)
   fprot6d_re_error = regex_must_compile(fprot6d_re_error_str, FALSE, TRUE);
 if (!fprot6d_re_virus)
   fprot6d_re_virus = regex_must_compile(fprot6d_re_virus_str, FALSE, TRUE);
+#endif
+}
+
+
+void
+malware_show_supported(FILE * f)
+{
+struct scan * sc;
+fprintf(f, "Malware:");
+for (sc = m_scans; sc->scancode != -1; sc++) fprintf(f, " %s", sc->name);
+fprintf(f, "\n");
 }
 
+
+# endif	/*!MACRO_PREDEF*/
 #endif /*WITH_CONTENT_SCAN*/
 /*
  * vi: aw ai sw=2
diff --git a/test/aux-fixed/4007.script b/test/aux-fixed/4008.script
index e391a2bb2..e391a2bb2 100755
--- a/test/aux-fixed/4007.script
+++ b/test/aux-fixed/4008.script
diff --git a/test/confs/4001 b/test/confs/4001
index 85e68a587..334ca0cae 100644
--- a/test/confs/4001
+++ b/test/confs/4001
@@ -1,29 +1,53 @@
-# Exim test configuration 4001
-# Content-scan: f-protd interface
+# Exim test configuration 4001:  ACL regex=
 
 .include DIR/aux-var/std_conf_prefix
 
 primary_hostname = myhost.test.ex
+rfc1413_query_timeout = 0s
 
-av_scanner = f-protd : localhost4 PORT_S
 
 # ----- Main settings -----
 
-acl_smtp_rcpt = accept
-acl_smtp_data = c_data
+acl_smtp_rcpt = check_rcpt
+acl_smtp_data = check_data
+acl_not_smtp  = check_data
+
+
+# ----- ACL -----
 
 begin acl
 
-c_data:
-  accept !malware = * OPT
-  deny	 logwrite = $callout_address malware_name $malware_name
+check_rcpt:
+  accept
+
+check_data:
+  warn     regex   = \N(THIS\s((\w+)\s)?REGEX)\N
+           message = X-Regex: Regex matched <$regex1> <$regex3>
+
+  warn     condition = ${if !eq{$h_fakereject:}{}}
+           control   = fakereject
+
+  warn     condition = ${if !eq{$h_fakedefer:}{}}
+           control   = fakedefer
+
+  accept
 
 # ----- Routers -----
 
 begin routers
 
-r:
-  driver = redirect
-  data = :blackhole:
+r1:
+  driver = accept
+  transport = t1
+
+# ----- Transports -----
+
+begin transports
+
+t1:
+  driver = appendfile
+  file = DIR/test-mail/$local_part
+  user = CALLER
+
 
 # End
diff --git a/test/confs/4002 b/test/confs/4002
index dde49c3b2..043a1eccb 100644
--- a/test/confs/4002
+++ b/test/confs/4002
@@ -1,12 +1,17 @@
 # Exim test configuration 4002
-# Content-scan: aveserver interface
+# Content-scan: spamassassin interface
+
+OPT= 127.0.0.1 7833
 
 .include DIR/aux-var/std_conf_prefix
 
 log_selector = +subject
 primary_hostname = myhost.test.ex
 
-av_scanner = aveserver : DIR/eximdir/aveserver_sock
+# we need to set the sender
+trusted_users = CALLER
+
+spamd_address = OPT
 
 # ----- Main settings -----
 
@@ -16,8 +21,11 @@ acl_smtp_data = c_data
 begin acl
 
 c_data:
-  accept !malware = * OPT
-  deny	 logwrite = malware_name $malware_name
+  warn
+    spam = nobody
+  warn
+    log_message = $callout_address $spam_action $spam_report
+  accept
 
 # ----- Routers -----
 
diff --git a/test/confs/4003 b/test/confs/4003
index fbcf3021c..1d00cc695 100644
--- a/test/confs/4003
+++ b/test/confs/4003
@@ -1,12 +1,12 @@
-# Exim test configuration 4002
-# Content-scan: fsecure interface
+# Exim test configuration 4003
+# Content-scan: rspamd interface
 
 .include DIR/aux-var/std_conf_prefix
 
 log_selector = +subject
 primary_hostname = myhost.test.ex
 
-av_scanner = fsecure : DIR/eximdir/fsec_sock
+spamd_address = 127.0.0.1 11333 variant=rspamd
 
 # ----- Main settings -----
 
@@ -16,8 +16,11 @@ acl_smtp_data = c_data
 begin acl
 
 c_data:
-  accept !malware = <; * OPT
-  deny	 logwrite = malware_name $malware_name
+  warn
+    spam = nobody
+  warn
+    log_message = $spam_action $spam_report
+  accept
 
 # ----- Routers -----
 
diff --git a/test/confs/4006 b/test/confs/4006
index 3efca602c..4c7059fdf 100644
--- a/test/confs/4006
+++ b/test/confs/4006
@@ -1,12 +1,16 @@
 # Exim test configuration 4006
-# Content-scan: avast interface
+# Content-scan: clamav interface
+
+OPT=
+CONTROL=
 
 .include DIR/aux-var/std_conf_prefix
 
 log_selector = +subject
 primary_hostname = myhost.test.ex
 
-av_scanner = avast : DIR/eximdir/avast_sock : OPTION
+#XXX we need an additional test for tcp-connected clamd
+av_scanner = clamd : DIR/eximdir/clam_sock CONTROL
 
 # ----- Main settings -----
 
@@ -16,7 +20,7 @@ acl_smtp_data = c_data
 begin acl
 
 c_data:
-  accept !malware = * INSERT
+  accept !malware = * OPT
   deny	 logwrite = malware_name $malware_name
 
 # ----- Routers -----
diff --git a/test/confs/4007 b/test/confs/4007
index 55bfcfafb..0b082b684 100644
--- a/test/confs/4007
+++ b/test/confs/4007
@@ -1,12 +1,12 @@
 # Exim test configuration 4007
-# Content-scan: cmsline interface
+# Content-scan: avast interface
 
 .include DIR/aux-var/std_conf_prefix
 
 log_selector = +subject
 primary_hostname = myhost.test.ex
 
-av_scanner = cmdline : DIR/aux-fixed/TESTNUM.script -o OPT %s : found in file : ^(\S*)
+av_scanner = avast : DIR/eximdir/avast_sock : OPTION
 
 # ----- Main settings -----
 
diff --git a/test/confs/4008 b/test/confs/4008
index a3bb87f73..1ec1b85fe 100644
--- a/test/confs/4008
+++ b/test/confs/4008
@@ -1,12 +1,12 @@
 # Exim test configuration 4008
-# Content-scan: rspamd interface
+# Content-scan: cmsline interface
 
 .include DIR/aux-var/std_conf_prefix
 
 log_selector = +subject
 primary_hostname = myhost.test.ex
 
-spamd_address = 127.0.0.1 11333 variant=rspamd
+av_scanner = cmdline : DIR/aux-fixed/TESTNUM.script -o OPT %s : found in file : ^(\S*)
 
 # ----- Main settings -----
 
@@ -16,11 +16,8 @@ acl_smtp_data = c_data
 begin acl
 
 c_data:
-  warn
-    spam = nobody
-  warn
-    log_message = $spam_action $spam_report
-  accept
+  accept !malware = * INSERT
+  deny	 logwrite = malware_name $malware_name
 
 # ----- Routers -----
 
diff --git a/test/confs/4009 b/test/confs/4009
index dd21a2183..f8e832070 100644
--- a/test/confs/4009
+++ b/test/confs/4009
@@ -1,17 +1,12 @@
 # Exim test configuration 4009
-# Content-scan: spamassassin interface
-
-OPT= 127.0.0.1 7833
+# Content-scan: sophie interface
 
 .include DIR/aux-var/std_conf_prefix
 
 log_selector = +subject
 primary_hostname = myhost.test.ex
 
-# we need to set the sender
-trusted_users = CALLER
-
-spamd_address = OPT
+av_scanner = sophie : DIR/eximdir/sophie_sock
 
 # ----- Main settings -----
 
@@ -21,11 +16,8 @@ acl_smtp_data = c_data
 begin acl
 
 c_data:
-  warn
-    spam = nobody
-  warn
-    log_message = $callout_address $spam_action $spam_report
-  accept
+  accept !malware = * OPT
+  deny	 logwrite = malware_name $malware_name
 
 # ----- Routers -----
 
diff --git a/test/confs/4010 b/test/confs/4010
index f01baf3cf..d7998dc49 100644
--- a/test/confs/4010
+++ b/test/confs/4010
@@ -1,53 +1,30 @@
-# Exim test configuration 0568:  ACL regex=
+# Exim test configuration 4010
+# Content-scan: fsecure interface
 
 .include DIR/aux-var/std_conf_prefix
 
+log_selector = +subject
 primary_hostname = myhost.test.ex
-rfc1413_query_timeout = 0s
 
+av_scanner = fsecure : DIR/eximdir/fsec_sock
 
 # ----- Main settings -----
 
-acl_smtp_rcpt = check_rcpt
-acl_smtp_data = check_data
-acl_not_smtp  = check_data
-
-
-# ----- ACL -----
+acl_smtp_rcpt = accept
+acl_smtp_data = c_data
 
 begin acl
 
-check_rcpt:
-  accept
-
-check_data:
-  warn     regex   = \N(THIS\s((\w+)\s)?REGEX)\N
-           message = X-Regex: Regex matched <$regex1> <$regex3>
-
-  warn     condition = ${if !eq{$h_fakereject:}{}}
-           control   = fakereject
-
-  warn     condition = ${if !eq{$h_fakedefer:}{}}
-           control   = fakedefer
-
-  accept
+c_data:
+  accept !malware = <; * OPT
+  deny	 logwrite = malware_name $malware_name
 
 # ----- Routers -----
 
 begin routers
 
-r1:
-  driver = accept
-  transport = t1
-
-# ----- Transports -----
-
-begin transports
-
-t1:
-  driver = appendfile
-  file = DIR/test-mail/$local_part
-  user = CALLER
-
+r:
+  driver = redirect
+  data = :blackhole:
 
 # End
diff --git a/test/confs/4011 b/test/confs/4011
index 7be64dc6d..96f5460b9 100644
--- a/test/confs/4011
+++ b/test/confs/4011
@@ -1,11 +1,12 @@
 # Exim test configuration 4011
-# Content-scan: f-prot6d interface
+# Content-scan: aveserver interface
 
 .include DIR/aux-var/std_conf_prefix
 
+log_selector = +subject
 primary_hostname = myhost.test.ex
 
-av_scanner = f-prot6d : localhost4 PORT_S
+av_scanner = aveserver : DIR/eximdir/aveserver_sock
 
 # ----- Main settings -----
 
@@ -16,7 +17,7 @@ begin acl
 
 c_data:
   accept !malware = * OPT
-  deny	 logwrite = $callout_address malware_name $malware_name
+  deny	 logwrite = malware_name $malware_name
 
 # ----- Routers -----
 
diff --git a/test/confs/4012 b/test/confs/4012
index 9afd4a07c..d0152c507 100644
--- a/test/confs/4012
+++ b/test/confs/4012
@@ -1,11 +1,11 @@
 # Exim test configuration 4012
-# Content-scan: sock interface
+# Content-scan: f-protd interface
 
 .include DIR/aux-var/std_conf_prefix
 
 primary_hostname = myhost.test.ex
 
-av_scanner = sock : 127.0.0.1 PORT_S : : BAD : NAME:: (\w+)
+av_scanner = f-protd : localhost4 PORT_S
 
 # ----- Main settings -----
 
diff --git a/test/confs/4004 b/test/confs/4013
index 9bc22ce2e..f45082827 100644
--- a/test/confs/4004
+++ b/test/confs/4013
@@ -1,12 +1,11 @@
-# Exim test configuration 4002
-# Content-scan: sophie interface
+# Exim test configuration 4013
+# Content-scan: f-prot6d interface
 
 .include DIR/aux-var/std_conf_prefix
 
-log_selector = +subject
 primary_hostname = myhost.test.ex
 
-av_scanner = sophie : DIR/eximdir/sophie_sock
+av_scanner = f-prot6d : localhost4 PORT_S
 
 # ----- Main settings -----
 
@@ -17,7 +16,7 @@ begin acl
 
 c_data:
   accept !malware = * OPT
-  deny	 logwrite = malware_name $malware_name
+  deny	 logwrite = $callout_address malware_name $malware_name
 
 # ----- Routers -----
 
diff --git a/test/confs/4005 b/test/confs/4014
index 0ebb2be7b..e4582fa3d 100644
--- a/test/confs/4005
+++ b/test/confs/4014
@@ -1,16 +1,11 @@
-# Exim test configuration 4005
-# Content-scan: clamav interface
-
-OPT=
-CONTROL=
+# Exim test configuration 4014
+# Content-scan: sock interface
 
 .include DIR/aux-var/std_conf_prefix
 
-log_selector = +subject
 primary_hostname = myhost.test.ex
 
-#XXX we need an additional test for tcp-connected clamd
-av_scanner = clamd : DIR/eximdir/clam_sock CONTROL
+av_scanner = sock : 127.0.0.1 PORT_S : : BAD : NAME:: (\w+)
 
 # ----- Main settings -----
 
@@ -21,7 +16,7 @@ begin acl
 
 c_data:
   accept !malware = * OPT
-  deny	 logwrite = malware_name $malware_name
+  deny	 logwrite = $callout_address malware_name $malware_name
 
 # ----- Routers -----
 
diff --git a/test/confs/4015 b/test/confs/4015
index eb8888460..4a5de2315 120000
--- a/test/confs/4015
+++ b/test/confs/4015
@@ -1 +1 @@
-4009
\ No newline at end of file
+4002
\ No newline at end of file
diff --git a/test/log/4001 b/test/log/4001
index aa48800aa..c1176fee6 100644
--- a/test/log/4001
+++ b/test/log/4001
@@ -1,9 +1,6 @@
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1]:1111 malware_name wibble
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 (= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4002 b/test/log/4002
index ee008a250..32535f5ac 100644
--- a/test/log/4002
+++ b/test/log/4002
@@ -1,19 +1,17 @@
-1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
-1999-03-02 09:44:33 10HmbD-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmbB-0005vi-00 malware_name VNAME
-1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="accept this, overriding the scan daemon temp-error"
+1999-03-02 09:44:33 10HmbA-0005vi-00 spam acl condition: spamd: failed to connect to any address for ip4.ip4.ip4.ip4: Connection refused
+1999-03-02 09:44:33 10HmbA-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
 1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbC-0005vi-00 malware_name VNAME
-1999-03-02 09:44:33 10HmbC-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
diff --git a/test/log/4003 b/test/log/4003
index cfdd01805..d8bbb9b18 100644
--- a/test/log/4003
+++ b/test/log/4003
@@ -1,13 +1,4 @@
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
-1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware_name VNAME
-1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
-1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER Warning: reject Action: reject\n Symbol: FAKE_SYMBOL_A(15.00)\n Symbol: FAKE_SYMBOL_B(0.00)\n Message-ID: undef
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
diff --git a/test/log/4004 b/test/log/4004
deleted file mode 100644
index 28cbd960e..000000000
--- a/test/log/4004
+++ /dev/null
@@ -1,13 +0,0 @@
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
-1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : scanner reported error
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
-1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted destpite timeout"
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
diff --git a/test/log/4005 b/test/log/4005
deleted file mode 100644
index 33f47f90e..000000000
--- a/test/log/4005
+++ /dev/null
@@ -1,16 +0,0 @@
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
-1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : ClamAV returned: scanned_file_name: 666 ERROR
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
-1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="accept this one despite timeout"
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted after a retry"
-1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
diff --git a/test/log/4006 b/test/log/4006
index bd0ec8720..33f47f90e 100644
--- a/test/log/4006
+++ b/test/log/4006
@@ -1,13 +1,16 @@
 1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
 1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : ClamAV returned: scanned_file_name: 666 ERROR
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
 1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
 1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="accept this one despite timeout"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted after a retry"
+1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
diff --git a/test/log/4007 b/test/log/4007
index 057a436ee..bd0ec8720 100644
--- a/test/log/4007
+++ b/test/log/4007
@@ -1,11 +1,13 @@
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware_name VNAME
-1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
+1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite a timeout"
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
+1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
diff --git a/test/log/4008 b/test/log/4008
index d8bbb9b18..2cde8338d 100644
--- a/test/log/4008
+++ b/test/log/4008
@@ -1,4 +1,11 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER Warning: reject Action: reject\n Symbol: FAKE_SYMBOL_A(15.00)\n Symbol: FAKE_SYMBOL_B(0.00)\n Message-ID: undef
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware_name VNAME
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4008.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4008.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite a timeout"
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4009 b/test/log/4009
index 32535f5ac..28cbd960e 100644
--- a/test/log/4009
+++ b/test/log/4009
@@ -1,17 +1,13 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
+1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : scanner reported error
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
+1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted destpite timeout"
 1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 spam acl condition: spamd: failed to connect to any address for ip4.ip4.ip4.ip4: Connection refused
-1999-03-02 09:44:33 10HmbA-0005vi-00 U=fromuser Warning: [127.0.0.1]:1111 no action Spam detection software, running on the system "demo",\n has NOT identified this incoming email as spam.  The original\n message has been attached to this so you can view it or label\n similar future email.  If you have any questions, see\n @@CONTACT_ADDRESS@@ for details.\n \n Content preview:  test [...]\n \n Content analysis details:   (4.5 points, 5.0 required)\n \n  pts rule name              description\n ---- ---------------------- --------------------------------------------------\n -1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP\n  1.2 MISSING_HEADERS        Missing To: header\n  1.0 MISSING_FROM           Missing From: header\n  1.8 MISSING_SUBJECT        Missing Subject: header\n  1.4 MISSING_DATE           Missing Date: header\n  0.1 MISSING_MID            Missing Message-Id: header
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= fromuser@myhost.test.ex U=fromuser P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
diff --git a/test/log/4010 b/test/log/4010
index c1176fee6..cfdd01805 100644
--- a/test/log/4010
+++ b/test/log/4010
@@ -1,6 +1,13 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 (= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
+1999-03-02 09:44:33 10HmbB-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware_name VNAME
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: fsecure TESTSUITE/eximdir/fsec_sock : unable to read answer 0 (Connection timed out)
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 malware_name VNAME
+1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
diff --git a/test/log/4011 b/test/log/4011
index 48f0f886c..ee008a250 100644
--- a/test/log/4011
+++ b/test/log/4011
@@ -1,11 +1,19 @@
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted"
+1999-03-02 09:44:33 10HmbD-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmbB-0005vi-00 malware_name VNAME
+1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="message should be accepted despite timeout"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss T="accept this, overriding the scan daemon temp-error"
 1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 [127.0.0.1]:1111 malware_name EICAR_Test_File
-1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbC-0005vi-00 malware_name VNAME
+1999-03-02 09:44:33 10HmbC-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
diff --git a/test/log/4012 b/test/log/4012
index 4d602c230..aa48800aa 100644
--- a/test/log/4012
+++ b/test/log/4012
@@ -1,5 +1,9 @@
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1]:1111 malware_name wibble
 1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
diff --git a/test/log/4013 b/test/log/4013
new file mode 100644
index 000000000..48f0f886c
--- /dev/null
+++ b/test/log/4013
@@ -0,0 +1,11 @@
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaZ-0005vi-00 [127.0.0.1]:1111 malware_name EICAR_Test_File
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4014 b/test/log/4014
new file mode 100644
index 000000000..4d602c230
--- /dev/null
+++ b/test/log/4014
@@ -0,0 +1,5 @@
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=r
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1]:1111 malware_name wibble
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
diff --git a/test/log/4016 b/test/log/4016
deleted file mode 100644
index b48693db9..000000000
--- a/test/log/4016
+++ /dev/null
@@ -1,25 +0,0 @@
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=abcde
-1999-03-02 09:44:33 10HmbA-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
-1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
-1999-03-02 09:44:33 10HmbB-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
-1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=20041217133501.GA3058@test.ex
-1999-03-02 09:44:33 10HmbC-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
-1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmbD-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
-1999-03-02 09:44:33 10HmbD-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss id=20041217133501.GA3058@test.ex
-1999-03-02 09:44:33 10HmbE-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
-1999-03-02 09:44:33 10HmbE-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss id=41C2F849.3060203@projectile.test.ex
-1999-03-02 09:44:33 10HmbF-0005vi-00 => userx <userx@test.ex> R=r1 T=t1
-1999-03-02 09:44:33 10HmbF-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA: Found Eicar-Test-Signature
diff --git a/test/log/4028 b/test/log/4028
deleted file mode 100644
index 373bdf0c8..000000000
--- a/test/log/4028
+++ /dev/null
@@ -1,9 +0,0 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=my_smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-
-******** SERVER ********
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=yes DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" S=sss id=E10HmaX-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=server
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/log/4029 b/test/log/4029
deleted file mode 100644
index a2ef850f1..000000000
--- a/test/log/4029
+++ /dev/null
@@ -1,11 +0,0 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local-esmtp S=sss
-1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1] SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 10HmaX-0005vi-00 [127.0.0.1] SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=my_smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-
-******** SERVER ********
-1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 CV=yes DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" S=sss id=E10HmaX-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <userx@test.ex> R=server
-1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
diff --git a/test/mail/4010.userx b/test/mail/4001.userx
index 59fa44af8..59fa44af8 100644
--- a/test/mail/4010.userx
+++ b/test/mail/4001.userx
diff --git a/test/mail/4016.userx b/test/mail/4016.userx
deleted file mode 100644
index 34c51ccfc..000000000
--- a/test/mail/4016.userx
+++ /dev/null
@@ -1,340 +0,0 @@
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaY-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
-From: CALLER_NAME <CALLER@myhost.test.ex>
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-X-Router-SSint: was preserved
-
-A message without any headers.
-
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaZ-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-From: Test person <tp@cam.ac.uk>
-To: Me <userx@test.ex>
-Subject: A real test message
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-Message-ID: <41C2F849.3060203@projectile.test.ex>
-Sender: CALLER_NAME <CALLER@myhost.test.ex>
-X-Router-SSint: was preserved
-
-OK, this should look like a genuine message.
-
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbA-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-From: 99Junk99@somewhere.com
-To:
-Subject: MAKE MONEY FAST!!!!
-Message-id: abcde
-Sender: CALLER_NAME <CALLER@myhost.test.ex>
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-X-Router-SSint: was preserved
-
-This should be enough to trip the threshold.
-
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbB-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-From: Test person <tp@cam.ac.uk>
-To: Me <userx@test.ex>
-Subject: A real test message
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-Message-ID: <41C2F849.3060203@projectile.test.ex>
-FakeReject: test fakereject
-Sender: CALLER_NAME <CALLER@myhost.test.ex>
-X-Regex: Regex matched
-X-Router-SSint: was preserved
-
-OK, this should look like a genuine message, but
-it will trip on THIS REGEX.
-
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbC-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-From: J Caesar <jcaesar@test.ex>
-To: a-list00@exim.org
-Message-ID: <20041217133501.GA3058@test.ex>
-Mime-Version: 1.0
-Content-Type: multipart/mixed; boundary="T4sUOijqQbZv57TR"
-Content-Disposition: inline
-Subject: [exim] Re: Bug#286074: eximstats: uses message count as data for
-	the "volume" charts
-X-BeenThere: a-list00@exim.org
-X-Mailman-Version: 2.1.5
-Precedence: list
-Sender: CALLER_NAME <CALLER@myhost.test.ex>
-X-0-content-type: multipart/mixed
-X-0-filename: 
-X-0-charset: 
-X-0-boundary: T4sUOijqQbZv57TR
-X-0-content-disposition: inline
-X-0-content-transfer-encoding: 
-X-0-content-id: 
-X-0-content-description: 
-X-0-is-multipart: 1
-X-0-is-coverletter: 1
-X-0-is-rfc822: 0
-X-0-decode-filename: TESTSUITE/spool/scan/10HmbC-0005vi-00/10HmbC-0005vi-00-00000
-X-0-content-size: 2
-X-1-content-type: text/plain
-X-1-filename: 
-X-1-charset: US-ASCII
-X-1-boundary: 
-X-1-content-disposition: inline
-X-1-content-transfer-encoding: quoted-printable
-X-1-content-id: 
-X-1-content-description: 
-X-1-is-multipart: 0
-X-1-is-coverletter: 1
-X-1-is-rfc822: 0
-X-1-decode-filename: TESTSUITE/spool/scan/10HmbC-0005vi-00/10HmbC-0005vi-00-00001
-X-1-content-size: 1
-X-mime-regex: matched
-X-2-content-type: text/plain
-X-2-filename: 
-X-2-charset: us-ascii
-X-2-boundary: 
-X-2-content-disposition: inline
-X-2-content-transfer-encoding: 
-X-2-content-id: 
-X-2-content-description: 
-X-2-is-multipart: 0
-X-2-is-coverletter: 0
-X-2-is-rfc822: 0
-X-2-decode-filename: TESTSUITE/spool/scan/10HmbC-0005vi-00/10HmbC-0005vi-00-00002
-X-2-content-size: 1
-X-3-content-type: text/plain
-X-3-filename: working-patch
-X-3-charset: us-ascii
-X-3-boundary: 
-X-3-content-disposition: attachment
-X-3-content-transfer-encoding: 
-X-3-content-id: 
-X-3-content-description: 
-X-3-is-multipart: 0
-X-3-is-coverletter: 0
-X-3-is-rfc822: 0
-X-3-decode-filename: TESTSUITE/spool/scan/10HmbC-0005vi-00/10HmbC-0005vi-00-00003
-X-3-content-size: 1
-X-4-content-type: text/plain
-X-4-filename: 
-X-4-charset: us-ascii
-X-4-boundary: 
-X-4-content-disposition: inline
-X-4-content-transfer-encoding: 7bit
-X-4-content-id: 
-X-4-content-description: 
-X-4-is-multipart: 0
-X-4-is-coverletter: 0
-X-4-is-rfc822: 0
-X-4-decode-filename: TESTSUITE/spool/scan/10HmbC-0005vi-00/10HmbC-0005vi-00-00004
-X-4-content-size: 1
-X-Router-SSint: was preserved
-
---T4sUOijqQbZv57TR
-Content-Type: text/plain; charset=US-ASCII
-Content-Transfer-Encoding: quoted-printable
-Content-Disposition: inline
-
-Test quoted-printable =3D    
-Space at end of line=40
-Continued line =    
-with this text.
-
---T4sUOijqQbZv57TR
-Content-Type: text/plain; charset=us-ascii
-Content-Disposition: inline
-
-There was a part of the patch missing, complete one is attached.
-     sorry for wasting your time
-
---T4sUOijqQbZv57TR
-Content-Type: text/plain; charset=us-ascii
-Content-Disposition: attachment; filename=working-patch
-
---- /usr/sbin/eximstats 2004-12-17 13:36:44.381983753 +0100
-+++ eximstats	2004-12-17 13:47:37.763185260 +0100
-@@ -1107,11 +1107,11 @@
-   if (scalar @chartdatanames < $ntopchart)
-     {
-     push(@chartdatanames, $key);
--    push(@chartdatavals, $$m_count{$key});
-+    push(@chartdatavals, $$m_data{$key});
-     }
-   else
-     {
--    $chartotherval += $$m_count{$key};
-+    $chartotherval += $$m_data{$key};
-     }
-   }
- push(@chartdatanames, "Other");
-
---T4sUOijqQbZv57TR
-Content-Type: text/plain; charset="us-ascii"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Content-Disposition: inline
-
--- 
-
---T4sUOijqQbZv57TR--
-
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from CALLER by myhost.test.ex with local (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbD-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-Message-Id: <E10HmbD-0005vi-00@myhost.test.ex>
-From: CALLER_NAME <CALLER@myhost.test.ex>
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-X-Router-SSint: was preserved
-
-A message without any headers.
-
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from CALLER by myhost.test.ex with local (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbE-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-From: J Caesar <jcaesar@test.ex>
-To: a-list00@exim.org
-Message-ID: <20041217133501.GA3058@test.ex>
-Mime-Version: 1.0
-Content-Type: multipart/mixed; boundary="T4sUOijqQbZv57TR"
-Content-Disposition: inline
-Subject: [exim] Re: Bug#286074: eximstats: uses message count as data for
-	the "volume" charts
-X-BeenThere: a-list00@exim.org
-X-Mailman-Version: 2.1.5
-Precedence: list
-Sender: CALLER_NAME <CALLER@myhost.test.ex>
-X-0-content-type: multipart/mixed
-X-0-filename: 
-X-0-charset: 
-X-0-boundary: T4sUOijqQbZv57TR
-X-0-content-disposition: inline
-X-0-content-transfer-encoding: 
-X-0-content-id: 
-X-0-content-description: 
-X-0-is-multipart: 1
-X-0-is-coverletter: 1
-X-0-is-rfc822: 0
-X-0-decode-filename: TESTSUITE/spool/scan/10HmbE-0005vi-00/10HmbE-0005vi-00-00000
-X-0-content-size: 1
-X-1-content-type: text/plain
-X-1-filename: 
-X-1-charset: us-ascii
-X-1-boundary: 
-X-1-content-disposition: inline
-X-1-content-transfer-encoding: 
-X-1-content-id: 
-X-1-content-description: 
-X-1-is-multipart: 0
-X-1-is-coverletter: 1
-X-1-is-rfc822: 0
-X-1-decode-filename: TESTSUITE/spool/scan/10HmbE-0005vi-00/10HmbE-0005vi-00-00001
-X-1-content-size: 1
-X-2-content-type: text/plain
-X-2-filename: working-patch
-X-2-charset: us-ascii
-X-2-boundary: 
-X-2-content-disposition: attachment
-X-2-content-transfer-encoding: 
-X-2-content-id: 
-X-2-content-description: 
-X-2-is-multipart: 0
-X-2-is-coverletter: 0
-X-2-is-rfc822: 0
-X-2-decode-filename: TESTSUITE/spool/scan/10HmbE-0005vi-00/10HmbE-0005vi-00-00002
-X-2-content-size: 1
-X-3-content-type: text/plain
-X-3-filename: 
-X-3-charset: us-ascii
-X-3-boundary: 
-X-3-content-disposition: inline
-X-3-content-transfer-encoding: 7bit
-X-3-content-id: 
-X-3-content-description: 
-X-3-is-multipart: 0
-X-3-is-coverletter: 0
-X-3-is-rfc822: 0
-X-3-decode-filename: TESTSUITE/spool/scan/10HmbE-0005vi-00/10HmbE-0005vi-00-00003
-X-3-content-size: 1
-X-Router-SSint: was preserved
-
---T4sUOijqQbZv57TR
-Content-Type: text/plain; charset=us-ascii
-Content-Disposition: inline
-
-There was a part of the patch missing, complete one is attached.
-     sorry for wasting your time
-
---T4sUOijqQbZv57TR
-Content-Type: text/plain; charset=us-ascii
-Content-Disposition: attachment; filename=working-patch
-
---- /usr/sbin/eximstats 2004-12-17 13:36:44.381983753 +0100
-+++ eximstats	2004-12-17 13:47:37.763185260 +0100
-@@ -1107,11 +1107,11 @@
-   if (scalar @chartdatanames < $ntopchart)
-     {
-     push(@chartdatanames, $key);
--    push(@chartdatavals, $$m_count{$key});
-+    push(@chartdatavals, $$m_data{$key});
-     }
-   else
-     {
--    $chartotherval += $$m_count{$key};
-+    $chartotherval += $$m_data{$key};
-     }
-   }
- push(@chartdatanames, "Other");
-
---T4sUOijqQbZv57TR
-Content-Type: text/plain; charset="us-ascii"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Content-Disposition: inline
-
--- 
-
---T4sUOijqQbZv57TR--
-
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbF-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-From: Test person <tp@cam.ac.uk>
-To: Me <userx@test.ex>
-Subject: A real test message
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-Message-ID: <41C2F849.3060203@projectile.test.ex>
-FakeDefer: test fakedefer
-Sender: CALLER_NAME <CALLER@myhost.test.ex>
-X-Regex: Regex matched
-X-Router-SSint: was preserved
-
-OK, this should look like a genuine message, but
-it will trip on THIS REGEX.
-
diff --git a/test/paniclog/4002 b/test/paniclog/4002
deleted file mode 100644
index a6521b25e..000000000
--- a/test/paniclog/4002
+++ /dev/null
@@ -1,4 +0,0 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
diff --git a/test/paniclog/4005 b/test/paniclog/4005
deleted file mode 100644
index adfca5304..000000000
--- a/test/paniclog/4005
+++ /dev/null
@@ -1,3 +0,0 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : ClamAV returned: scanned_file_name: 666 ERROR
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
diff --git a/test/paniclog/4006 b/test/paniclog/4006
index 5236f07f2..adfca5304 100644
--- a/test/paniclog/4006
+++ b/test/paniclog/4006
@@ -1,3 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : ClamAV returned: scanned_file_name: 666 ERROR
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
diff --git a/test/paniclog/4007 b/test/paniclog/4007
index ece05e2cb..5236f07f2 100644
--- a/test/paniclog/4007
+++ b/test/paniclog/4007
@@ -1,2 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
diff --git a/test/paniclog/4008 b/test/paniclog/4008
new file mode 100644
index 000000000..f3193849f
--- /dev/null
+++ b/test/paniclog/4008
@@ -0,0 +1,2 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4008.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4008.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
diff --git a/test/paniclog/4004 b/test/paniclog/4009
index 1de0ab5aa..1de0ab5aa 100644
--- a/test/paniclog/4004
+++ b/test/paniclog/4009
diff --git a/test/paniclog/4003 b/test/paniclog/4010
index 0efd096fb..0efd096fb 100644
--- a/test/paniclog/4003
+++ b/test/paniclog/4010
diff --git a/test/paniclog/4011 b/test/paniclog/4011
index 73c3c0111..a6521b25e 100644
--- a/test/paniclog/4011
+++ b/test/paniclog/4011
@@ -1,2 +1,4 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
diff --git a/test/paniclog/4013 b/test/paniclog/4013
new file mode 100644
index 000000000..73c3c0111
--- /dev/null
+++ b/test/paniclog/4013
@@ -0,0 +1,2 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
diff --git a/test/rejectlog/4002 b/test/rejectlog/4002
deleted file mode 100644
index 16c708986..000000000
--- a/test/rejectlog/4002
+++ /dev/null
@@ -1,48 +0,0 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-Envelope-from: <CALLER@myhost.test.ex>
-Envelope-to: <userx@test.ex>
-P Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaX-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-  Date: Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: defer this one (daemon tmp-err)
-I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
-F From: CALLER_NAME <CALLER@myhost.test.ex>
-1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-Envelope-from: <CALLER@myhost.test.ex>
-Envelope-to: <userx@test.ex>
-P Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbB-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-  Date: Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: message should be rejected (virus found)
-I Message-Id: <E10HmbB-0005vi-00@myhost.test.ex>
-F From: CALLER_NAME <CALLER@myhost.test.ex>
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-Envelope-from: <CALLER@myhost.test.ex>
-Envelope-to: <userx@test.ex>
-P Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaY-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-  Date: Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: message should be deferred due to timeout
-I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
-F From: CALLER_NAME <CALLER@myhost.test.ex>
-1999-03-02 09:44:33 10HmbC-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
-Envelope-from: <CALLER@myhost.test.ex>
-Envelope-to: <userx@test.ex>
-P Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbC-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-  Date: Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: message should be rejected (virus found)
-I Message-Id: <E10HmbC-0005vi-00@myhost.test.ex>
-F From: CALLER_NAME <CALLER@myhost.test.ex>
diff --git a/test/rejectlog/4006 b/test/rejectlog/4006
index 6ba3a2659..f9626e35a 100644
--- a/test/rejectlog/4006
+++ b/test/rejectlog/4006
@@ -7,7 +7,7 @@ P Received: from CALLER (helo=test.ex)
 	id 10HmaX-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: defer this one, the scanner had an error
+  Subject: defer this one due to scanner error
 I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
 1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
@@ -31,6 +31,6 @@ P Received: from CALLER (helo=test.ex)
 	id 10HmaY-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: message should be tmp-rejected due to timeout
+  Subject: defer this one due to timeout
 I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
diff --git a/test/rejectlog/4007 b/test/rejectlog/4007
index 2c4463ad0..6ba3a2659 100644
--- a/test/rejectlog/4007
+++ b/test/rejectlog/4007
@@ -1,24 +1,36 @@
-1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+Envelope-from: <CALLER@myhost.test.ex>
+Envelope-to: <userx@test.ex>
+P Received: from CALLER (helo=test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaX-0005vi-00
+	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+  Date: Tue, 2 Mar 1999 09:44:33 +0000
+  Subject: defer this one, the scanner had an error
+I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
+F From: CALLER_NAME <CALLER@myhost.test.ex>
+1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
 Envelope-from: <CALLER@myhost.test.ex>
 Envelope-to: <userx@test.ex>
 P Received: from CALLER (helo=test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaZ-0005vi-00
+	id 10HmbA-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
   Subject: message should be rejected
-I Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
+I Message-Id: <E10HmbA-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 Envelope-from: <CALLER@myhost.test.ex>
 Envelope-to: <userx@test.ex>
 P Received: from CALLER (helo=test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaX-0005vi-00
+	id 10HmaY-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
   Subject: message should be tmp-rejected due to timeout
-I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
+I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
diff --git a/test/rejectlog/4005 b/test/rejectlog/4008
index f9626e35a..2c4463ad0 100644
--- a/test/rejectlog/4005
+++ b/test/rejectlog/4008
@@ -1,36 +1,24 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
-Envelope-from: <CALLER@myhost.test.ex>
-Envelope-to: <userx@test.ex>
-P Received: from CALLER (helo=test.ex)
-	by myhost.test.ex with local-esmtp (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaX-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-  Date: Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: defer this one due to scanner error
-I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
-F From: CALLER_NAME <CALLER@myhost.test.ex>
-1999-03-02 09:44:33 10HmbA-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
 Envelope-from: <CALLER@myhost.test.ex>
 Envelope-to: <userx@test.ex>
 P Received: from CALLER (helo=test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbA-0005vi-00
+	id 10HmaZ-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
   Subject: message should be rejected
-I Message-Id: <E10HmbA-0005vi-00@myhost.test.ex>
+I Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 Envelope-from: <CALLER@myhost.test.ex>
 Envelope-to: <userx@test.ex>
 P Received: from CALLER (helo=test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaY-0005vi-00
+	id 10HmaX-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: defer this one due to timeout
-I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
+  Subject: message should be tmp-rejected due to timeout
+I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
diff --git a/test/rejectlog/4004 b/test/rejectlog/4009
index 5aad09639..5aad09639 100644
--- a/test/rejectlog/4004
+++ b/test/rejectlog/4009
diff --git a/test/rejectlog/4003 b/test/rejectlog/4010
index fbe3b69f0..fbe3b69f0 100644
--- a/test/rejectlog/4003
+++ b/test/rejectlog/4010
diff --git a/test/rejectlog/4011 b/test/rejectlog/4011
index adeded6fb..16c708986 100644
--- a/test/rejectlog/4011
+++ b/test/rejectlog/4011
@@ -1,24 +1,48 @@
-1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 Envelope-from: <CALLER@myhost.test.ex>
 Envelope-to: <userx@test.ex>
 P Received: from CALLER (helo=test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaZ-0005vi-00
+	id 10HmaX-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: message should be rejected
-I Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
+  Subject: defer this one (daemon tmp-err)
+I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmbB-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
 Envelope-from: <CALLER@myhost.test.ex>
 Envelope-to: <userx@test.ex>
 P Received: from CALLER (helo=test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaX-0005vi-00
+	id 10HmbB-0005vi-00
+	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+  Date: Tue, 2 Mar 1999 09:44:33 +0000
+  Subject: message should be rejected (virus found)
+I Message-Id: <E10HmbB-0005vi-00@myhost.test.ex>
+F From: CALLER_NAME <CALLER@myhost.test.ex>
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+Envelope-from: <CALLER@myhost.test.ex>
+Envelope-to: <userx@test.ex>
+P Received: from CALLER (helo=test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaY-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
   Subject: message should be deferred due to timeout
-I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
+I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
+F From: CALLER_NAME <CALLER@myhost.test.ex>
+1999-03-02 09:44:33 10HmbC-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+Envelope-from: <CALLER@myhost.test.ex>
+Envelope-to: <userx@test.ex>
+P Received: from CALLER (helo=test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbC-0005vi-00
+	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+  Date: Tue, 2 Mar 1999 09:44:33 +0000
+  Subject: message should be rejected (virus found)
+I Message-Id: <E10HmbC-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
diff --git a/test/rejectlog/4012 b/test/rejectlog/4012
index bd26ac2a4..8ec883c54 100644
--- a/test/rejectlog/4012
+++ b/test/rejectlog/4012
@@ -10,3 +10,15 @@ P Received: from CALLER (helo=test.ex)
   Subject: message should be rejected
 I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
+1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+Envelope-from: <CALLER@myhost.test.ex>
+Envelope-to: <userx@test.ex>
+P Received: from CALLER (helo=test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaY-0005vi-00
+	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+  Date: Tue, 2 Mar 1999 09:44:33 +0000
+  Subject: message should be deferred due to timeout
+I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
+F From: CALLER_NAME <CALLER@myhost.test.ex>
diff --git a/test/rejectlog/4001 b/test/rejectlog/4013
index 8ec883c54..adeded6fb 100644
--- a/test/rejectlog/4001
+++ b/test/rejectlog/4013
@@ -1,24 +1,24 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
+1999-03-02 09:44:33 10HmaZ-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
 Envelope-from: <CALLER@myhost.test.ex>
 Envelope-to: <userx@test.ex>
 P Received: from CALLER (helo=test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaX-0005vi-00
+	id 10HmaZ-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
   Subject: message should be rejected
-I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
+I Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
-1999-03-02 09:44:33 10HmaY-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> temporarily rejected after DATA
 Envelope-from: <CALLER@myhost.test.ex>
 Envelope-to: <userx@test.ex>
 P Received: from CALLER (helo=test.ex)
 	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaY-0005vi-00
+	id 10HmaX-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
   Date: Tue, 2 Mar 1999 09:44:33 +0000
   Subject: message should be deferred due to timeout
-I Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
+I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
diff --git a/test/rejectlog/4016 b/test/rejectlog/4014
index c477c0534..bd26ac2a4 100644
--- a/test/rejectlog/4016
+++ b/test/rejectlog/4014
@@ -1,11 +1,12 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA: Found Eicar-Test-Signature
+1999-03-02 09:44:33 10HmaX-0005vi-00 U=CALLER F=<CALLER@myhost.test.ex> rejected after DATA
 Envelope-from: <CALLER@myhost.test.ex>
 Envelope-to: <userx@test.ex>
-P Received: from CALLER by myhost.test.ex with local-smtp (Exim x.yz)
+P Received: from CALLER (helo=test.ex)
+	by myhost.test.ex with local-esmtp (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
 	id 10HmaX-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-  Subject: a virus test
+  Date: Tue, 2 Mar 1999 09:44:33 +0000
+  Subject: message should be rejected
 I Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
 F From: CALLER_NAME <CALLER@myhost.test.ex>
-  Date: Tue, 2 Mar 1999 09:44:33 +0000
diff --git a/test/runtest b/test/runtest
index d0de8622e..5671fead2 100755
--- a/test/runtest
+++ b/test/runtest
@@ -1158,6 +1158,7 @@ RESET_AFTER_EXTRA_LINE_READ:
                 /^Support for:/ ||
                 /^Routers:/ ||
                 /^Transports:/ ||
+                /^Malware:/ ||
                 /^log selectors =/ ||
                 /^cwd=/ ||
                 /^Fixed never_users:/ ||
@@ -2840,6 +2841,15 @@ while (<EXIMINFO>)
         }
       }
     }
+
+  elsif (/^Malware: (.*)/)
+    {
+    print;
+    @temp = split /(\s+)/, $1;
+    push(@temp, ' ');
+    %parm_malware = @temp;
+    }
+
   }
 close(EXIMINFO);
 print "-" x 78, "\n";
@@ -3510,6 +3520,10 @@ DIR: for (my $i = 0; $i < @test_dirs; $i++)
         {
         if (!defined $parm_transports{$1}) { $wantthis = 0; last; }
         }
+      elsif (/^malware (.*)$/)
+        {
+        if (!defined $parm_malware{$1}) { $wantthis = 0; last; }
+        }
       else
         {
         tests_exit(-1, "Unknown line in \"scripts/$testdir/REQUIRES\": \"$_\"");
diff --git a/test/scripts/4000-scanning/4001 b/test/scripts/4000-scanning/4001
index 6f746307e..a660f6805 100644
--- a/test/scripts/4000-scanning/4001
+++ b/test/scripts/4000-scanning/4001
@@ -1,95 +1,38 @@
-# content scan interface: f-protd
-need_ipv4
-munge loopback
-#
-server PORT_S
-<GET
-<
-><summary code="11">
->*eof
-****
-#
-#
-#
-exim -odi -bs -DOPT=
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be accepted
-
-.
-quit
-****
-#
-#
-#
-server PORT_S
-<GET
-<
->
->
->
-><detected type="foo">
-><name>wibble</name>
-><summary code="11">
->*eof
-****
-#
-#
-#
-exim -odi -bs -DOPT=
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be rejected
-
-due to the server response (above)
-.
-quit
-****
-#
-#
-#
-server PORT_S
-<GET
-*sleep 3
-****
-#
+# ACL regex= test
 #
+# These tests are copies from testcase 4000;
+# they should be removed from there but I don't
+# run spamassassin so can't verify the change.
 #
-exim -odi -bs -DOPT="/tmo=2s"
+exim -odi -bs
 ehlo test.ex
 mail from:<>
 rcpt to:<userx@test.ex>
 data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be deferred due to timeout
+From: Test person <tp@cam.ac.uk>
+To: Me <userx@test.ex>
+Subject: A real test message
+Date: Fri, 17 Dec 2004 16:13:04 +0100
+Message-ID: <41C2F849.3060203@projectile.test.ex>
 
+OK, this should look like a genuine message.
 .
 quit
 ****
-#
-#
-#
-server PORT_S
-<GET
-*sleep 3
-****
-#
-#
-#
-exim -odi -bs -DOPT="/tmo=2s/defer_ok"
+exim -odi -bs
 ehlo test.ex
 mail from:<>
 rcpt to:<userx@test.ex>
 data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be accepted despite timeout
+From: Test person <tp@cam.ac.uk>
+To: Me <userx@test.ex>
+Subject: A real test message
+Date: Fri, 17 Dec 2004 16:13:04 +0100
+Message-ID: <41C2F849.3060203@projectile.test.ex>
+FakeReject: test fakereject
 
+OK, this should look like a genuine message, but
+it will trip on THIS gazornenplaz REGEX.
 .
 quit
 ****
diff --git a/test/scripts/4000-scanning/4002 b/test/scripts/4000-scanning/4002
index 4754609c0..d9849c341 100644
--- a/test/scripts/4000-scanning/4002
+++ b/test/scripts/4000-scanning/4002
@@ -1,168 +1,242 @@
-# content scan interface: aveserver
-#
-server DIR/eximdir/aveserver_sock
->200 ready
-<SCAN
->200 done
-<quit
->200 ready
+# content scan interface: spamassassin
+#
+# The spooled file for scanning includes the test-runner's user name
+# hence size varies.  Munge that.
+munge scanfile_size
+#
+#
+# A good-comms test, returning not-spam.
+# (we could use a second one that returns is-spam...)
+server 7833
+<REPORT SPAMC
+<User:
+<Content-length:
+<
+<From
+<X-Envelope-From
+<X-Envelope-To
+<Received:
+<	by
+<	(envelope
+<	id
+<	for
+<Content-type: text/plain
+<Message-Id:
+<From:
+<Date:
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
 *eof
 ****
-#
-#
-#
-exim -odi -bs -DOPT=
+exim -odi -oMt fromuser -bs
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@myhost.test.ex>
 rcpt to:<userx@test.ex>
 data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be accepted
+Content-type: text/plain
 
+test
 .
 quit
 ****
 #
 #
 #
-server DIR/eximdir/aveserver_sock
->2xx ready
-<SCAN
->5xx defer
-<quit
->2xx ready
-*eof
-****
-#
-#
-#
-exim -odi -bs -DOPT=
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: defer this one (daemon tmp-err)
-
-.
-quit
-****
-#
-#
 #
-server DIR/eximdir/aveserver_sock
->2xx ready
-<SCAN
->322 VNAME found
->2xx ready
-<quit
->2xx ready
+# Server spec line with timeout option, not exercised
+# (could we cut down the massive content?)
+server 7833
+<REPORT SPAMC
+<User:
+<Content-length:
+<
+<From
+<X-Envelope-From
+<X-Envelope-To
+<Received:
+<	by
+<	(envelope
+<	id
+<	for
+<Content-type: text/plain
+<Message-Id:
+<From:
+<Date:
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
 *eof
 ****
-#
-#
-#
-exim -odi -bs -DOPT=
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be rejected (virus found)
-
-.
-quit
-****
-#
-#
-#
-server DIR/eximdir/aveserver_sock
-*sleep 3
-****
-#
-#
-#
-exim -odi -bs -DOPT="/tmo=2s"
+exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=10s'
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@myhost.test.ex>
 rcpt to:<userx@test.ex>
 data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be deferred due to timeout
+Content-type: text/plain
 
+test
 .
 quit
 ****
 #
 #
 #
-server DIR/eximdir/aveserver_sock
-*sleep 3
+# Server spec line with timeout option, exercised
+server -i 2 7833
+<REPORT SPAMC
+<User:
+<Content-length:
+<
+<From
+<X-Envelope-From
+<X-Envelope-To
+<Received:
+<	by
+<	(envelope
+<	id
+<	for
+<Content-type: text/plain
+<Message-Id:
+<From:
+<Date:
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
+*eof
 ****
-#
-#
-#
-exim -odi -bs -DOPT="/tmo=2s / defer_ok"
+exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=4s'
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@myhost.test.ex>
 rcpt to:<userx@test.ex>
 data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be accepted despite timeout
+Content-type: text/plain
 
+test
 .
 quit
 ****
 #
 #
 #
-server DIR/eximdir/aveserver_sock
->2xx ready
-<SCAN
->5xx defer
-<quit
->2xx ready
+# Multiple servers, prioritised, with timeout spec; first one fails
+# List separator changed
+server 7833
+<REPORT SPAMC
+<User:
+<Content-length:
+<
+<From
+<X-Envelope-From
+<X-Envelope-To
+<Received:
+<	by
+<	(envelope
+<	id
+<	for
+<Content-type: text/plain
+<Message-Id:
+<From:
+<Date:
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
 *eof
 ****
-#
-#
-#
-exim -odi -bs -DOPT=" / defer_ok"
+exim -odi -oMt fromuser -bs -DOPT='<; 127.0.0.1 7833 ; HOSTIPV4 7834 pri=2 tmo=2s'
 ehlo test.ex
-mail from:<>
+mail from:<fromuser@myhost.test.ex>
 rcpt to:<userx@test.ex>
 data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: accept this, overriding the scan daemon temp-error
+Content-type: text/plain
 
+test
 .
 quit
 ****
 #
 #
-#
-# Recheck that defer_ok option does not affect a malware detection
-#
-server DIR/eximdir/aveserver_sock
->2xx ready
-<SCAN
->322 VNAME found
->2xx ready
-<quit
->2xx ready
-*eof
-****
-#
-#
-#
-exim -odi -bs -DOPT="/defer_ok"
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be rejected (virus found)
-
-.
-quit
-****
diff --git a/test/scripts/4000-scanning/4003 b/test/scripts/4000-scanning/4003
index 49d331bf1..e5a7c9492 100644
--- a/test/scripts/4000-scanning/4003
+++ b/test/scripts/4000-scanning/4003
@@ -1,134 +1,51 @@
-# content scan interface: fsecure
-# also testing alternate list separator for malware= args
-#
-server DIR/eximdir/fsec_sock
-<CONFIGURE
->ignored_response
-<CONFIGURE
->ignored_response
-<CONFIGURE
->ignored_response
-<CONFIGURE
->ignored_response
-<SCAN
->LF>random ignored line
->LF>random ignored line 2
->LF>OK	Scan ok.
-*eof
-****
-#
-#
-#
-exim -odi -bs -DOPT=
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be accepted
-
-.
-quit
-****
-#
-#
-#
-server DIR/eximdir/fsec_sock
-<CONFIGURE
->ignored_response
-<CONFIGURE
->ignored_response
-<CONFIGURE
->ignored_response
-<CONFIGURE
->ignored_response
-<SCAN
->LF>xxxINFECTED	blah	VNAME	blah
->LF>OK	Scan ok.
-*eof
-****
-#
-#
-#
-exim -odi -bs -DOPT=
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be rejected
-
-.
-quit
-****
-#
-#
-#
-server DIR/eximdir/fsec_sock
-*sleep 3
-****
-#
-#
-#
-exim -odi -bs -DOPT=";tmo=2s"
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be tmp-rejected due to timeout
-
-.
-quit
-****
-#
-#
-#
-server DIR/eximdir/fsec_sock
-*sleep 3
-****
-#
-#
-#
-exim -odi -bs -DOPT=";defer_ok;tmo=2s"
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be accepted despite timeout
-
-.
-quit
-****
-#
-#
-#
-server DIR/eximdir/fsec_sock
-<CONFIGURE
->ignored_response
-<CONFIGURE
->ignored_response
-<CONFIGURE
->ignored_response
-<CONFIGURE
->ignored_response
-<SCAN
->LF>xxxINFECTED	blah	VNAME	blah
->LF>OK	Scan ok.
+# content scan interface: rspamd
+#
+# The spooled file for scanning includes the test-runner's user name
+# hence size varies.  Munge that.
+munge scanfile_size
+#
+server 11333
+<CHECK RSPAMC/1.3
+<Content-length:
+<Queue-Id:
+<From:
+<Recipient-Number: 1
+<Rcpt:
+<Helo:
+<User:
+<
+<From
+<X-Envelope-From
+<X-Envelope-To
+<Received:
+<	by
+<	(envelope
+<	id
+<	for
+<From:
+<Content-type: text/plain
+<Message-Id:
+<Sender:
+<Date:
+<
+<test
+>RSPAMD/1.3 0 EX_OK
+>Metric: default; True; 15.00 / 15.00 / 0.0
+>Action: reject
+>Symbol: FAKE_SYMBOL_A(15.00)
+>Symbol: FAKE_SYMBOL_B(0.00)
+>Message-ID: undef
 *eof
 ****
-#
-#
-#
-exim -odi -bs -DOPT="; defer_ok ; tmo=5h"
+exim -odi -bs
 ehlo test.ex
 mail from:<>
 rcpt to:<userx@test.ex>
 data
-Date: Fri, 17 Dec 2004 14:35:01 +0100
-Subject: message should be rejected as the options are not relevant
+From: MAILER_DAEMON <>
+Content-type: text/plain
 
+test
 .
 quit
 ****
diff --git a/test/scripts/4000-scanning/4008 b/test/scripts/4000-scanning/4008
deleted file mode 100644
index e5a7c9492..000000000
--- a/test/scripts/4000-scanning/4008
+++ /dev/null
@@ -1,51 +0,0 @@
-# content scan interface: rspamd
-#
-# The spooled file for scanning includes the test-runner's user name
-# hence size varies.  Munge that.
-munge scanfile_size
-#
-server 11333
-<CHECK RSPAMC/1.3
-<Content-length:
-<Queue-Id:
-<From:
-<Recipient-Number: 1
-<Rcpt:
-<Helo:
-<User:
-<
-<From
-<X-Envelope-From
-<X-Envelope-To
-<Received:
-<	by
-<	(envelope
-<	id
-<	for
-<From:
-<Content-type: text/plain
-<Message-Id:
-<Sender:
-<Date:
-<
-<test
->RSPAMD/1.3 0 EX_OK
->Metric: default; True; 15.00 / 15.00 / 0.0
->Action: reject
->Symbol: FAKE_SYMBOL_A(15.00)
->Symbol: FAKE_SYMBOL_B(0.00)
->Message-ID: undef
-*eof
-****
-exim -odi -bs
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-From: MAILER_DAEMON <>
-Content-type: text/plain
-
-test
-.
-quit
-****
diff --git a/test/scripts/4000-scanning/4009 b/test/scripts/4000-scanning/4009
deleted file mode 100644
index d9849c341..000000000
--- a/test/scripts/4000-scanning/4009
+++ /dev/null
@@ -1,242 +0,0 @@
-# content scan interface: spamassassin
-#
-# The spooled file for scanning includes the test-runner's user name
-# hence size varies.  Munge that.
-munge scanfile_size
-#
-#
-# A good-comms test, returning not-spam.
-# (we could use a second one that returns is-spam...)
-server 7833
-<REPORT SPAMC
-<User:
-<Content-length:
-<
-<From
-<X-Envelope-From
-<X-Envelope-To
-<Received:
-<	by
-<	(envelope
-<	id
-<	for
-<Content-type: text/plain
-<Message-Id:
-<From:
-<Date:
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-*eof
-****
-exim -odi -oMt fromuser -bs
-ehlo test.ex
-mail from:<fromuser@myhost.test.ex>
-rcpt to:<userx@test.ex>
-data
-Content-type: text/plain
-
-test
-.
-quit
-****
-#
-#
-#
-#
-# Server spec line with timeout option, not exercised
-# (could we cut down the massive content?)
-server 7833
-<REPORT SPAMC
-<User:
-<Content-length:
-<
-<From
-<X-Envelope-From
-<X-Envelope-To
-<Received:
-<	by
-<	(envelope
-<	id
-<	for
-<Content-type: text/plain
-<Message-Id:
-<From:
-<Date:
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-*eof
-****
-exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=10s'
-ehlo test.ex
-mail from:<fromuser@myhost.test.ex>
-rcpt to:<userx@test.ex>
-data
-Content-type: text/plain
-
-test
-.
-quit
-****
-#
-#
-#
-# Server spec line with timeout option, exercised
-server -i 2 7833
-<REPORT SPAMC
-<User:
-<Content-length:
-<
-<From
-<X-Envelope-From
-<X-Envelope-To
-<Received:
-<	by
-<	(envelope
-<	id
-<	for
-<Content-type: text/plain
-<Message-Id:
-<From:
-<Date:
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-*eof
-****
-exim -odi -oMt fromuser -bs -DOPT='127.0.0.1 7833 retry=4s'
-ehlo test.ex
-mail from:<fromuser@myhost.test.ex>
-rcpt to:<userx@test.ex>
-data
-Content-type: text/plain
-
-test
-.
-quit
-****
-#
-#
-#
-# Multiple servers, prioritised, with timeout spec; first one fails
-# List separator changed
-server 7833
-<REPORT SPAMC
-<User:
-<Content-length:
-<
-<From
-<X-Envelope-From
-<X-Envelope-To
-<Received:
-<	by
-<	(envelope
-<	id
-<	for
-<Content-type: text/plain
-<Message-Id:
-<From:
-<Date:
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-*eof
-****
-exim -odi -oMt fromuser -bs -DOPT='<; 127.0.0.1 7833 ; HOSTIPV4 7834 pri=2 tmo=2s'
-ehlo test.ex
-mail from:<fromuser@myhost.test.ex>
-rcpt to:<userx@test.ex>
-data
-Content-type: text/plain
-
-test
-.
-quit
-****
-#
-#
diff --git a/test/scripts/4000-scanning/4010 b/test/scripts/4000-scanning/4010
deleted file mode 100644
index a660f6805..000000000
--- a/test/scripts/4000-scanning/4010
+++ /dev/null
@@ -1,38 +0,0 @@
-# ACL regex= test
-#
-# These tests are copies from testcase 4000;
-# they should be removed from there but I don't
-# run spamassassin so can't verify the change.
-#
-exim -odi -bs
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-From: Test person <tp@cam.ac.uk>
-To: Me <userx@test.ex>
-Subject: A real test message
-Date: Fri, 17 Dec 2004 16:13:04 +0100
-Message-ID: <41C2F849.3060203@projectile.test.ex>
-
-OK, this should look like a genuine message.
-.
-quit
-****
-exim -odi -bs
-ehlo test.ex
-mail from:<>
-rcpt to:<userx@test.ex>
-data
-From: Test person <tp@cam.ac.uk>
-To: Me <userx@test.ex>
-Subject: A real test message
-Date: Fri, 17 Dec 2004 16:13:04 +0100
-Message-ID: <41C2F849.3060203@projectile.test.ex>
-FakeReject: test fakereject
-
-OK, this should look like a genuine message, but
-it will trip on THIS gazornenplaz REGEX.
-.
-quit
-****
diff --git a/test/scripts/4000-scanning/4005 b/test/scripts/4006_scan_clamd/4006
index d251c1a1f..d251c1a1f 100644
--- a/test/scripts/4000-scanning/4005
+++ b/test/scripts/4006_scan_clamd/4006
diff --git a/test/scripts/4006_scan_clamd/REQUIRES b/test/scripts/4006_scan_clamd/REQUIRES
new file mode 100644
index 000000000..0a1e8374e
--- /dev/null
+++ b/test/scripts/4006_scan_clamd/REQUIRES
@@ -0,0 +1,2 @@
+support Content_Scanning
+malware clamd
diff --git a/test/scripts/4000-scanning/4006 b/test/scripts/4007_scan_avast/4007
index a58188c95..a58188c95 100644
--- a/test/scripts/4000-scanning/4006
+++ b/test/scripts/4007_scan_avast/4007
diff --git a/test/scripts/4007_scan_avast/REQUIRES b/test/scripts/4007_scan_avast/REQUIRES
new file mode 100644
index 000000000..d5a69793c
--- /dev/null
+++ b/test/scripts/4007_scan_avast/REQUIRES
@@ -0,0 +1,2 @@
+support Content_Scanning
+malware avast
diff --git a/test/scripts/4000-scanning/4007 b/test/scripts/4008_scan_cmdline/4008
index 9684056a0..9684056a0 100644
--- a/test/scripts/4000-scanning/4007
+++ b/test/scripts/4008_scan_cmdline/4008
diff --git a/test/scripts/4008_scan_cmdline/REQUIRES b/test/scripts/4008_scan_cmdline/REQUIRES
new file mode 100644
index 000000000..975694bc3
--- /dev/null
+++ b/test/scripts/4008_scan_cmdline/REQUIRES
@@ -0,0 +1,2 @@
+support Content_Scanning
+malware cmdline
diff --git a/test/scripts/4000-scanning/4004 b/test/scripts/4009_scan_sophie/4009
index 956f04507..956f04507 100644
--- a/test/scripts/4000-scanning/4004
+++ b/test/scripts/4009_scan_sophie/4009
diff --git a/test/scripts/4009_scan_sophie/REQUIRES b/test/scripts/4009_scan_sophie/REQUIRES
new file mode 100644
index 000000000..0da03b09d
--- /dev/null
+++ b/test/scripts/4009_scan_sophie/REQUIRES
@@ -0,0 +1,2 @@
+support Content_Scanning
+malware sophie
diff --git a/test/scripts/4010_scan_fsecure/4010 b/test/scripts/4010_scan_fsecure/4010
new file mode 100644
index 000000000..49d331bf1
--- /dev/null
+++ b/test/scripts/4010_scan_fsecure/4010
@@ -0,0 +1,134 @@
+# content scan interface: fsecure
+# also testing alternate list separator for malware= args
+#
+server DIR/eximdir/fsec_sock
+<CONFIGURE
+>ignored_response
+<CONFIGURE
+>ignored_response
+<CONFIGURE
+>ignored_response
+<CONFIGURE
+>ignored_response
+<SCAN
+>LF>random ignored line
+>LF>random ignored line 2
+>LF>OK	Scan ok.
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT=
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be accepted
+
+.
+quit
+****
+#
+#
+#
+server DIR/eximdir/fsec_sock
+<CONFIGURE
+>ignored_response
+<CONFIGURE
+>ignored_response
+<CONFIGURE
+>ignored_response
+<CONFIGURE
+>ignored_response
+<SCAN
+>LF>xxxINFECTED	blah	VNAME	blah
+>LF>OK	Scan ok.
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT=
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be rejected
+
+.
+quit
+****
+#
+#
+#
+server DIR/eximdir/fsec_sock
+*sleep 3
+****
+#
+#
+#
+exim -odi -bs -DOPT=";tmo=2s"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be tmp-rejected due to timeout
+
+.
+quit
+****
+#
+#
+#
+server DIR/eximdir/fsec_sock
+*sleep 3
+****
+#
+#
+#
+exim -odi -bs -DOPT=";defer_ok;tmo=2s"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be accepted despite timeout
+
+.
+quit
+****
+#
+#
+#
+server DIR/eximdir/fsec_sock
+<CONFIGURE
+>ignored_response
+<CONFIGURE
+>ignored_response
+<CONFIGURE
+>ignored_response
+<CONFIGURE
+>ignored_response
+<SCAN
+>LF>xxxINFECTED	blah	VNAME	blah
+>LF>OK	Scan ok.
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT="; defer_ok ; tmo=5h"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be rejected as the options are not relevant
+
+.
+quit
+****
diff --git a/test/scripts/4010_scan_fsecure/REQUIRES b/test/scripts/4010_scan_fsecure/REQUIRES
new file mode 100644
index 000000000..3b8b57b2c
--- /dev/null
+++ b/test/scripts/4010_scan_fsecure/REQUIRES
@@ -0,0 +1,2 @@
+support Content_Scanning
+malware fsecure
diff --git a/test/scripts/4011_scan_ave/4011 b/test/scripts/4011_scan_ave/4011
new file mode 100644
index 000000000..4754609c0
--- /dev/null
+++ b/test/scripts/4011_scan_ave/4011
@@ -0,0 +1,168 @@
+# content scan interface: aveserver
+#
+server DIR/eximdir/aveserver_sock
+>200 ready
+<SCAN
+>200 done
+<quit
+>200 ready
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT=
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be accepted
+
+.
+quit
+****
+#
+#
+#
+server DIR/eximdir/aveserver_sock
+>2xx ready
+<SCAN
+>5xx defer
+<quit
+>2xx ready
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT=
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: defer this one (daemon tmp-err)
+
+.
+quit
+****
+#
+#
+#
+server DIR/eximdir/aveserver_sock
+>2xx ready
+<SCAN
+>322 VNAME found
+>2xx ready
+<quit
+>2xx ready
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT=
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be rejected (virus found)
+
+.
+quit
+****
+#
+#
+#
+server DIR/eximdir/aveserver_sock
+*sleep 3
+****
+#
+#
+#
+exim -odi -bs -DOPT="/tmo=2s"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be deferred due to timeout
+
+.
+quit
+****
+#
+#
+#
+server DIR/eximdir/aveserver_sock
+*sleep 3
+****
+#
+#
+#
+exim -odi -bs -DOPT="/tmo=2s / defer_ok"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be accepted despite timeout
+
+.
+quit
+****
+#
+#
+#
+server DIR/eximdir/aveserver_sock
+>2xx ready
+<SCAN
+>5xx defer
+<quit
+>2xx ready
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT=" / defer_ok"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: accept this, overriding the scan daemon temp-error
+
+.
+quit
+****
+#
+#
+#
+# Recheck that defer_ok option does not affect a malware detection
+#
+server DIR/eximdir/aveserver_sock
+>2xx ready
+<SCAN
+>322 VNAME found
+>2xx ready
+<quit
+>2xx ready
+*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT="/defer_ok"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be rejected (virus found)
+
+.
+quit
+****
diff --git a/test/scripts/4011_scan_ave/REQUIRES b/test/scripts/4011_scan_ave/REQUIRES
new file mode 100644
index 000000000..3cfac9b6b
--- /dev/null
+++ b/test/scripts/4011_scan_ave/REQUIRES
@@ -0,0 +1,2 @@
+support Content_Scanning
+malware aveserver
diff --git a/test/scripts/4012_scan_fprotd/4012 b/test/scripts/4012_scan_fprotd/4012
new file mode 100644
index 000000000..6f746307e
--- /dev/null
+++ b/test/scripts/4012_scan_fprotd/4012
@@ -0,0 +1,95 @@
+# content scan interface: f-protd
+need_ipv4
+munge loopback
+#
+server PORT_S
+<GET
+<
+><summary code="11">
+>*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT=
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be accepted
+
+.
+quit
+****
+#
+#
+#
+server PORT_S
+<GET
+<
+>
+>
+>
+><detected type="foo">
+><name>wibble</name>
+><summary code="11">
+>*eof
+****
+#
+#
+#
+exim -odi -bs -DOPT=
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be rejected
+
+due to the server response (above)
+.
+quit
+****
+#
+#
+#
+server PORT_S
+<GET
+*sleep 3
+****
+#
+#
+#
+exim -odi -bs -DOPT="/tmo=2s"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be deferred due to timeout
+
+.
+quit
+****
+#
+#
+#
+server PORT_S
+<GET
+*sleep 3
+****
+#
+#
+#
+exim -odi -bs -DOPT="/tmo=2s/defer_ok"
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@test.ex>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be accepted despite timeout
+
+.
+quit
+****
diff --git a/test/scripts/4012_scan_fprotd/REQUIRES b/test/scripts/4012_scan_fprotd/REQUIRES
new file mode 100644
index 000000000..819b11337
--- /dev/null
+++ b/test/scripts/4012_scan_fprotd/REQUIRES
@@ -0,0 +1,2 @@
+support Content_Scanning
+malware f-protd
diff --git a/test/scripts/4000-scanning/4011 b/test/scripts/4013_scan_fprot6d/4013
index 20e6ab2b8..20e6ab2b8 100644
--- a/test/scripts/4000-scanning/4011
+++ b/test/scripts/4013_scan_fprot6d/4013
diff --git a/test/scripts/4013_scan_fprot6d/REQUIRES b/test/scripts/4013_scan_fprot6d/REQUIRES
new file mode 100644
index 000000000..5389d9509
--- /dev/null
+++ b/test/scripts/4013_scan_fprot6d/REQUIRES
@@ -0,0 +1,2 @@
+support Content_Scanning
+malware f-prot6d
diff --git a/test/scripts/4000-scanning/4012 b/test/scripts/4014_scan_sock/4014
index 42d108c86..42d108c86 100644
--- a/test/scripts/4000-scanning/4012
+++ b/test/scripts/4014_scan_sock/4014
diff --git a/test/scripts/4014_scan_sock/REQUIRES b/test/scripts/4014_scan_sock/REQUIRES
new file mode 100644
index 000000000..3450a21a2
--- /dev/null
+++ b/test/scripts/4014_scan_sock/REQUIRES
@@ -0,0 +1,2 @@
+support Content_Scanning
+malware sock
diff --git a/test/stderr/4002 b/test/stderr/4002
deleted file mode 100644
index a6521b25e..000000000
--- a/test/stderr/4002
+++ /dev/null
@@ -1,4 +0,0 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
-1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
diff --git a/test/stderr/4006 b/test/stderr/4006
index 5236f07f2..adfca5304 100644
--- a/test/stderr/4006
+++ b/test/stderr/4006
@@ -1,3 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
-1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : ClamAV returned: scanned_file_name: 666 ERROR
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: clamd TESTSUITE/eximdir/clam_sock : unable to read from socket (Connection timed out)
diff --git a/test/stderr/4007 b/test/stderr/4007
index ece05e2cb..5236f07f2 100644
--- a/test/stderr/4007
+++ b/test/stderr/4007
@@ -1,2 +1,3 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4007.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : invalid response from scanner: 'blah	[E]'
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: avast TESTSUITE/eximdir/avast_sock : timeout from scanner
diff --git a/test/stderr/4008 b/test/stderr/4008
new file mode 100644
index 000000000..f3193849f
--- /dev/null
+++ b/test/stderr/4008
@@ -0,0 +1,2 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4008.script -o pause3 TESTSUITE/spool/scan/10HmaX-0005vi-00 2>&1): Connection timed out
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: cmdline  : unable to read from scanner (TESTSUITE/aux-fixed/4008.script -o pause3 TESTSUITE/spool/scan/10HmaY-0005vi-00 2>&1): Connection timed out
diff --git a/test/stderr/4009 b/test/stderr/4009
new file mode 100644
index 000000000..1de0ab5aa
--- /dev/null
+++ b/test/stderr/4009
@@ -0,0 +1,3 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : scanner reported error
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: sophie TESTSUITE/eximdir/sophie_sock : unable to read from UNIX socket (TESTSUITE/eximdir/sophie_sock)
diff --git a/test/stderr/4003 b/test/stderr/4010
index 0efd096fb..0efd096fb 100644
--- a/test/stderr/4003
+++ b/test/stderr/4010
diff --git a/test/stderr/4011 b/test/stderr/4011
index 73c3c0111..a6521b25e 100644
--- a/test/stderr/4011
+++ b/test/stderr/4011
@@ -1,2 +1,4 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
-1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml (Responded: 5xx defer).
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmaZ-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unavailable (Responded: nothing).
+1999-03-02 09:44:33 10HmbA-0005vi-00 malware acl condition: aveserver TESTSUITE/eximdir/aveserver_sock : unable to scan file TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml (Responded: 5xx defer).
diff --git a/test/stderr/4013 b/test/stderr/4013
new file mode 100644
index 000000000..73c3c0111
--- /dev/null
+++ b/test/stderr/4013
@@ -0,0 +1,2 @@
+1999-03-02 09:44:33 10HmaX-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
+1999-03-02 09:44:33 10HmaY-0005vi-00 malware acl condition: f-prot6d [127.0.0.1]:1111 : unable to read from socket (Connection timed out)
diff --git a/test/stdout/4001 b/test/stdout/4001
index 6d66c7d64..2db3157dd 100644
--- a/test/stdout/4001
+++ b/test/stdout/4001
@@ -7,7 +7,7 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaZ-0005vi-00

+250 OK id=10HmaX-0005vi-00

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

 250-myhost.test.ex Hello CALLER at test.ex

@@ -18,58 +18,7 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-550 Administrative prohibition

+550-Your message has been rejected but is being kept for evaluation.

+550-If it was a legitimate message, it may still be delivered to the target

+550 recipient(s).

 221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-451 Temporary local problem - please try later

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbA-0005vi-00

-221 myhost.test.ex closing connection

-
-******** SERVER ********
-Listening on port 1224 ... 
-Connection request from [IP_LOOPBACK_ADDR]
-<GET TESTSUITE/spool/scan/10HmaZ-0005vi-00/10HmaZ-0005vi-00.eml HTTP/1.0
-<
-><summary code="11">
->*eof
-End of script
-Listening on port 1224 ... 
-Connection request from [IP_LOOPBACK_ADDR]
-<GET TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml HTTP/1.0
-<
->
->
->
-><detected type="foo">
-><name>wibble</name>
-><summary code="11">
->*eof
-End of script
-Listening on port 1224 ... 
-Connection request from [IP_LOOPBACK_ADDR]
-<GET TESTSUITE/spool/scan/10HmaY-0005vi-00/10HmaY-0005vi-00.eml HTTP/1.0
-*sleep 3
-End of script
-Listening on port 1224 ... 
-Connection request from [IP_LOOPBACK_ADDR]
-<GET TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml HTTP/1.0
-*sleep 3
-End of script
diff --git a/test/stdout/4002 b/test/stdout/4002
index db7a98ebe..5c16c636a 100644
--- a/test/stdout/4002
+++ b/test/stdout/4002
@@ -1,5 +1,5 @@
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

+250-myhost.test.ex Hello fromuser at test.ex

 250-SIZE 52428800

 250-8BITMIME

 250-PIPELINING

@@ -7,10 +7,10 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbD-0005vi-00

+250 OK id=10HmaX-0005vi-00

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

+250-myhost.test.ex Hello fromuser at test.ex

 250-SIZE 52428800

 250-8BITMIME

 250-PIPELINING

@@ -18,32 +18,10 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-451 Temporary local problem - please try later

+250 OK id=10HmaY-0005vi-00

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-550 Administrative prohibition

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-451 Temporary local problem - please try later

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

+250-myhost.test.ex Hello fromuser at test.ex

 250-SIZE 52428800

 250-8BITMIME

 250-PIPELINING

@@ -54,7 +32,7 @@
 250 OK id=10HmaZ-0005vi-00

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

+250-myhost.test.ex Hello fromuser at test.ex

 250-SIZE 52428800

 250-8BITMIME

 250-PIPELINING

@@ -64,71 +42,182 @@
 354 Enter message, ending with "." on a line by itself

 250 OK id=10HmbA-0005vi-00

 221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-550 Administrative prohibition

-221 myhost.test.ex closing connection

 
 ******** SERVER ********
-Listening on TESTSUITE/eximdir/aveserver_sock ... 
-Connection request
->200 ready
-<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmbD-0005vi-00/10HmbD-0005vi-00.eml
->200 done
-<quit
->200 ready
+Listening on port 7833 ... 
+Connection request from [127.0.0.1]
+<REPORT SPAMC/1.2
+<User: nobody
+<Content-length: ddd
+<
+<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
+<X-Envelope-From: <fromuser@myhost.test.ex>
+<X-Envelope-To: userx@test.ex
+<Received: from fromuser (helo=test.ex)
+<	by myhost.test.ex with local-esmtp (Exim x.yz)
+<	(envelope-from <fromuser@myhost.test.ex>)
+<	id 10HmaX-0005vi-00
+<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+<Content-type: text/plain
+<Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
+<From: fromuser@myhost.test.ex
+<Date: Tue, 2 Mar 1999 09:44:33 +0000
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
 Expected EOF read from client
 End of script
-Listening on TESTSUITE/eximdir/aveserver_sock ... 
-Connection request
->2xx ready
-<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml
->5xx defer
-<quit
->2xx ready
+Listening on port 7833 ... 
+Connection request from [127.0.0.1]
+<REPORT SPAMC/1.2
+<User: nobody
+<Content-length: ddd
+<
+<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
+<X-Envelope-From: <fromuser@myhost.test.ex>
+<X-Envelope-To: userx@test.ex
+<Received: from fromuser (helo=test.ex)
+<	by myhost.test.ex with local-esmtp (Exim x.yz)
+<	(envelope-from <fromuser@myhost.test.ex>)
+<	id 10HmaY-0005vi-00
+<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+<Content-type: text/plain
+<Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
+<From: fromuser@myhost.test.ex
+<Date: Tue, 2 Mar 1999 09:44:33 +0000
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
 Expected EOF read from client
 End of script
-Listening on TESTSUITE/eximdir/aveserver_sock ... 
-Connection request
->2xx ready
-<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmbB-0005vi-00/10HmbB-0005vi-00.eml
->322 VNAME found
->2xx ready
-<quit
->2xx ready
-Expected EOF read from client
-End of script
-Listening on TESTSUITE/eximdir/aveserver_sock ... 
-Connection request
-*sleep 3
-End of script
-Listening on TESTSUITE/eximdir/aveserver_sock ... 
-Connection request
-*sleep 3
-End of script
-Listening on TESTSUITE/eximdir/aveserver_sock ... 
-Connection request
->2xx ready
-<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml
->5xx defer
-<quit
->2xx ready
+Inital pause of 2 seconds
+Listening on port 7833 ... 
+Connection request from [127.0.0.1]
+<REPORT SPAMC/1.2
+<User: nobody
+<Content-length: ddd
+<
+<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
+<X-Envelope-From: <fromuser@myhost.test.ex>
+<X-Envelope-To: userx@test.ex
+<Received: from fromuser (helo=test.ex)
+<	by myhost.test.ex with local-esmtp (Exim x.yz)
+<	(envelope-from <fromuser@myhost.test.ex>)
+<	id 10HmaZ-0005vi-00
+<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+<Content-type: text/plain
+<Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
+<From: fromuser@myhost.test.ex
+<Date: Tue, 2 Mar 1999 09:44:33 +0000
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
 Expected EOF read from client
 End of script
-Listening on TESTSUITE/eximdir/aveserver_sock ... 
-Connection request
->2xx ready
-<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmbC-0005vi-00/10HmbC-0005vi-00.eml
->322 VNAME found
->2xx ready
-<quit
->2xx ready
+Listening on port 7833 ... 
+Connection request from [127.0.0.1]
+<REPORT SPAMC/1.2
+<User: nobody
+<Content-length: ddd
+<
+<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
+<X-Envelope-From: <fromuser@myhost.test.ex>
+<X-Envelope-To: userx@test.ex
+<Received: from fromuser (helo=test.ex)
+<	by myhost.test.ex with local-esmtp (Exim x.yz)
+<	(envelope-from <fromuser@myhost.test.ex>)
+<	id 10HmbA-0005vi-00
+<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+<Content-type: text/plain
+<Message-Id: <E10HmbA-0005vi-00@myhost.test.ex>
+<From: fromuser@myhost.test.ex
+<Date: Tue, 2 Mar 1999 09:44:33 +0000
+<
+<test
+>SPAMD/1.1 0 EX_OK
+>Spam: False ; 4.5 / 5.0
+>
+>Spam detection software, running on the system "demo",
+>has NOT identified this incoming email as spam.  The original
+>message has been attached to this so you can view it or label
+>similar future email.  If you have any questions, see
+>@@CONTACT_ADDRESS@@ for details.
+>
+>Content preview:  test [...]
+>
+>Content analysis details:   (4.5 points, 5.0 required)
+>
+> pts rule name              description
+>---- ---------------------- --------------------------------------------------
+>-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
+> 1.2 MISSING_HEADERS        Missing To: header
+> 1.0 MISSING_FROM           Missing From: header
+> 1.8 MISSING_SUBJECT        Missing Subject: header
+> 1.4 MISSING_DATE           Missing Date: header
+> 0.1 MISSING_MID            Missing Message-Id: header
+>
 Expected EOF read from client
 End of script
diff --git a/test/stdout/4003 b/test/stdout/4003
index e705096f6..afff4e4df 100644
--- a/test/stdout/4003
+++ b/test/stdout/4003
@@ -7,105 +7,41 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbB-0005vi-00

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-550 Administrative prohibition

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-451 Temporary local problem - please try later

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaY-0005vi-00

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-550 Administrative prohibition

+250 OK id=10HmaX-0005vi-00

 221 myhost.test.ex closing connection

 
 ******** SERVER ********
-Listening on TESTSUITE/eximdir/fsec_sock ... 
-Connection request
-<CONFIGURE	ARCHIVE	1
->ignored_response
-<CONFIGURE	TIMEOUT	0
->ignored_response
-<CONFIGURE	MAXARCH	5
->ignored_response
-<CONFIGURE	MIME	1
->ignored_response
-<SCAN	TESTSUITE/spool/scan/10HmbB-0005vi-00/10HmbB-0005vi-00.eml
->LF>random ignored line
->LF>random ignored line 2
->LF>OK\x09Scan ok.
-Expected EOF read from client
-End of script
-Listening on TESTSUITE/eximdir/fsec_sock ... 
-Connection request
-<CONFIGURE	ARCHIVE	1
->ignored_response
-<CONFIGURE	TIMEOUT	0
->ignored_response
-<CONFIGURE	MAXARCH	5
->ignored_response
-<CONFIGURE	MIME	1
->ignored_response
-<SCAN	TESTSUITE/spool/scan/10HmaZ-0005vi-00/10HmaZ-0005vi-00.eml
->LF>xxxINFECTED\x09blah\x09VNAME\x09blah
->LF>OK\x09Scan ok.
-Expected EOF read from client
-End of script
-Listening on TESTSUITE/eximdir/fsec_sock ... 
-Connection request
-*sleep 3
-End of script
-Listening on TESTSUITE/eximdir/fsec_sock ... 
-Connection request
-*sleep 3
-End of script
-Listening on TESTSUITE/eximdir/fsec_sock ... 
-Connection request
-<CONFIGURE	ARCHIVE	1
->ignored_response
-<CONFIGURE	TIMEOUT	0
->ignored_response
-<CONFIGURE	MAXARCH	5
->ignored_response
-<CONFIGURE	MIME	1
->ignored_response
-<SCAN	TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml
->LF>xxxINFECTED\x09blah\x09VNAME\x09blah
->LF>OK\x09Scan ok.
+Listening on port 11333 ... 
+Connection request from [127.0.0.1]
+<CHECK RSPAMC/1.3
+<Content-length: ddd
+<Queue-Id: 10HmaX-0005vi-00
+<From: <CALLER@myhost.test.ex>
+<Recipient-Number: 1
+<Rcpt: <userx@test.ex>
+<Helo: test.ex
+<User: CALLER
+<
+<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
+<X-Envelope-From: <CALLER@myhost.test.ex>
+<X-Envelope-To: userx@test.ex
+<Received: from CALLER (helo=test.ex)
+<	by myhost.test.ex with local-esmtp (Exim x.yz)
+<	(envelope-from <CALLER@myhost.test.ex>)
+<	id 10HmaX-0005vi-00
+<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+<From: MAILER_DAEMON <>
+<Content-type: text/plain
+<Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
+<Sender: CALLER_NAME <CALLER@myhost.test.ex>
+<Date: Tue, 2 Mar 1999 09:44:33 +0000
+<
+<test
+>RSPAMD/1.3 0 EX_OK
+>Metric: default; True; 15.00 / 15.00 / 0.0
+>Action: reject
+>Symbol: FAKE_SYMBOL_A(15.00)
+>Symbol: FAKE_SYMBOL_B(0.00)
+>Message-ID: undef
 Expected EOF read from client
 End of script
diff --git a/test/stdout/4005 b/test/stdout/4005
deleted file mode 100644
index 4d858c5b1..000000000
--- a/test/stdout/4005
+++ /dev/null
@@ -1,101 +0,0 @@
-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbB-0005vi-00

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-451 Temporary local problem - please try later

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-550 Administrative prohibition

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-451 Temporary local problem - please try later

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaZ-0005vi-00

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbC-0005vi-00

-221 myhost.test.ex closing connection

-
-******** SERVER ********
-Listening on TESTSUITE/eximdir/clam_sock ... 
-Connection request
-<SCAN TESTSUITE/spool/scan/10HmbB-0005vi-00/10HmbB-0005vi-00.eml
->LF>scanned_file_name: OK
-Unexpected EOF read from client
-End of script
-Listening on TESTSUITE/eximdir/clam_sock ... 
-Connection request
-<SCAN TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml
->LF>scanned_file_name: 666 ERROR
-Unexpected EOF read from client
-End of script
-Listening on TESTSUITE/eximdir/clam_sock ... 
-Connection request
-<SCAN TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml
->LF>scanned_file_name: VNAME FOUND
-Unexpected EOF read from client
-End of script
-Listening on TESTSUITE/eximdir/clam_sock ... 
-Connection request
-*sleep 3
-End of script
-Listening on TESTSUITE/eximdir/clam_sock ... 
-Connection request
-*sleep 3
-End of script
-Inital pause of 2 seconds
-Listening on TESTSUITE/eximdir/clam_sock ... 
-Connection request
-<SCAN TESTSUITE/spool/scan/10HmbC-0005vi-00/10HmbC-0005vi-00.eml
->LF>scanned_file_name: OK
-Unexpected EOF read from client
-End of script
diff --git a/test/stdout/4006 b/test/stdout/4006
index 19e0f305b..4d858c5b1 100644
--- a/test/stdout/4006
+++ b/test/stdout/4006
@@ -53,42 +53,49 @@
 354 Enter message, ending with "." on a line by itself

 250 OK id=10HmaZ-0005vi-00

 221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+250 OK id=10HmbC-0005vi-00

+221 myhost.test.ex closing connection

 
 ******** SERVER ********
-Listening on TESTSUITE/eximdir/avast_sock ... 
+Listening on TESTSUITE/eximdir/clam_sock ... 
 Connection request
->LF>220 ready
-<FLAGS -fullfiles
->LF>210 FLAGS DATA
->LF>200 FLAGS OK
-<SCAN TESTSUITE/spool/scan/10HmbB-0005vi-00
->LF>210 SCAN DATA
->LF>blah\x09[+]
->LF>200 SCAN OK
-<QUIT
+<SCAN TESTSUITE/spool/scan/10HmbB-0005vi-00/10HmbB-0005vi-00.eml
+>LF>scanned_file_name: OK
 Unexpected EOF read from client
 End of script
-Listening on TESTSUITE/eximdir/avast_sock ... 
+Listening on TESTSUITE/eximdir/clam_sock ... 
 Connection request
->LF>220 ready
-<SCAN TESTSUITE/spool/scan/10HmaX-0005vi-00
->LF>210 SCAN DATA
->LF>blah\x09[E]
->LF>200 SCAN OK
+<SCAN TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml
+>LF>scanned_file_name: 666 ERROR
 Unexpected EOF read from client
-Listening on TESTSUITE/eximdir/avast_sock ... 
+End of script
+Listening on TESTSUITE/eximdir/clam_sock ... 
 Connection request
->LF>220 ready
-<SCAN TESTSUITE/spool/scan/10HmbA-0005vi-00
->LF>210 SCAN DATA
->LF>b\\ l\\ a\\ h\x09[L]9.9\x099 VNAME
->LF>200 SCAN OK
+<SCAN TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml
+>LF>scanned_file_name: VNAME FOUND
 Unexpected EOF read from client
-Listening on TESTSUITE/eximdir/avast_sock ... 
+End of script
+Listening on TESTSUITE/eximdir/clam_sock ... 
 Connection request
 *sleep 3
 End of script
-Listening on TESTSUITE/eximdir/avast_sock ... 
+Listening on TESTSUITE/eximdir/clam_sock ... 
 Connection request
 *sleep 3
 End of script
+Inital pause of 2 seconds
+Listening on TESTSUITE/eximdir/clam_sock ... 
+Connection request
+<SCAN TESTSUITE/spool/scan/10HmbC-0005vi-00/10HmbC-0005vi-00.eml
+>LF>scanned_file_name: OK
+Unexpected EOF read from client
+End of script
diff --git a/test/stdout/4007 b/test/stdout/4007
index c72e085ce..19e0f305b 100644
--- a/test/stdout/4007
+++ b/test/stdout/4007
@@ -7,7 +7,18 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbA-0005vi-00

+250 OK id=10HmbB-0005vi-00

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+451 Temporary local problem - please try later

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

 250-myhost.test.ex Hello CALLER at test.ex

@@ -40,5 +51,44 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaY-0005vi-00

+250 OK id=10HmaZ-0005vi-00

 221 myhost.test.ex closing connection

+
+******** SERVER ********
+Listening on TESTSUITE/eximdir/avast_sock ... 
+Connection request
+>LF>220 ready
+<FLAGS -fullfiles
+>LF>210 FLAGS DATA
+>LF>200 FLAGS OK
+<SCAN TESTSUITE/spool/scan/10HmbB-0005vi-00
+>LF>210 SCAN DATA
+>LF>blah\x09[+]
+>LF>200 SCAN OK
+<QUIT
+Unexpected EOF read from client
+End of script
+Listening on TESTSUITE/eximdir/avast_sock ... 
+Connection request
+>LF>220 ready
+<SCAN TESTSUITE/spool/scan/10HmaX-0005vi-00
+>LF>210 SCAN DATA
+>LF>blah\x09[E]
+>LF>200 SCAN OK
+Unexpected EOF read from client
+Listening on TESTSUITE/eximdir/avast_sock ... 
+Connection request
+>LF>220 ready
+<SCAN TESTSUITE/spool/scan/10HmbA-0005vi-00
+>LF>210 SCAN DATA
+>LF>b\\ l\\ a\\ h\x09[L]9.9\x099 VNAME
+>LF>200 SCAN OK
+Unexpected EOF read from client
+Listening on TESTSUITE/eximdir/avast_sock ... 
+Connection request
+*sleep 3
+End of script
+Listening on TESTSUITE/eximdir/avast_sock ... 
+Connection request
+*sleep 3
+End of script
diff --git a/test/stdout/4008 b/test/stdout/4008
index afff4e4df..c72e085ce 100644
--- a/test/stdout/4008
+++ b/test/stdout/4008
@@ -7,41 +7,38 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaX-0005vi-00

+250 OK id=10HmbA-0005vi-00

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+550 Administrative prohibition

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+451 Temporary local problem - please try later

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+250 OK id=10HmaY-0005vi-00

 221 myhost.test.ex closing connection

-
-******** SERVER ********
-Listening on port 11333 ... 
-Connection request from [127.0.0.1]
-<CHECK RSPAMC/1.3
-<Content-length: ddd
-<Queue-Id: 10HmaX-0005vi-00
-<From: <CALLER@myhost.test.ex>
-<Recipient-Number: 1
-<Rcpt: <userx@test.ex>
-<Helo: test.ex
-<User: CALLER
-<
-<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <CALLER@myhost.test.ex>
-<X-Envelope-To: userx@test.ex
-<Received: from CALLER (helo=test.ex)
-<	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <CALLER@myhost.test.ex>)
-<	id 10HmaX-0005vi-00
-<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-<From: MAILER_DAEMON <>
-<Content-type: text/plain
-<Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
-<Sender: CALLER_NAME <CALLER@myhost.test.ex>
-<Date: Tue, 2 Mar 1999 09:44:33 +0000
-<
-<test
->RSPAMD/1.3 0 EX_OK
->Metric: default; True; 15.00 / 15.00 / 0.0
->Action: reject
->Symbol: FAKE_SYMBOL_A(15.00)
->Symbol: FAKE_SYMBOL_B(0.00)
->Message-ID: undef
-Expected EOF read from client
-End of script
diff --git a/test/stdout/4009 b/test/stdout/4009
index 5c16c636a..a23806e00 100644
--- a/test/stdout/4009
+++ b/test/stdout/4009
@@ -1,5 +1,5 @@
 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello fromuser at test.ex

+250-myhost.test.ex Hello CALLER at test.ex

 250-SIZE 52428800

 250-8BITMIME

 250-PIPELINING

@@ -7,10 +7,10 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaX-0005vi-00

+250 OK id=10HmbB-0005vi-00

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello fromuser at test.ex

+250-myhost.test.ex Hello CALLER at test.ex

 250-SIZE 52428800

 250-8BITMIME

 250-PIPELINING

@@ -18,10 +18,10 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaY-0005vi-00

+451 Temporary local problem - please try later

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello fromuser at test.ex

+250-myhost.test.ex Hello CALLER at test.ex

 250-SIZE 52428800

 250-8BITMIME

 250-PIPELINING

@@ -29,10 +29,10 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaZ-0005vi-00

+550 Administrative prohibition

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello fromuser at test.ex

+250-myhost.test.ex Hello CALLER at test.ex

 250-SIZE 52428800

 250-8BITMIME

 250-PIPELINING

@@ -40,184 +40,44 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbA-0005vi-00

+451 Temporary local problem - please try later

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+250 OK id=10HmaZ-0005vi-00

 221 myhost.test.ex closing connection

 
 ******** SERVER ********
-Listening on port 7833 ... 
-Connection request from [127.0.0.1]
-<REPORT SPAMC/1.2
-<User: nobody
-<Content-length: ddd
-<
-<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <fromuser@myhost.test.ex>
-<X-Envelope-To: userx@test.ex
-<Received: from fromuser (helo=test.ex)
-<	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <fromuser@myhost.test.ex>)
-<	id 10HmaX-0005vi-00
-<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-<Content-type: text/plain
-<Message-Id: <E10HmaX-0005vi-00@myhost.test.ex>
-<From: fromuser@myhost.test.ex
-<Date: Tue, 2 Mar 1999 09:44:33 +0000
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
+Listening on TESTSUITE/eximdir/sophie_sock ... 
+Connection request
+<TESTSUITE/spool/scan/10HmbB-0005vi-00
+>0 no problems mate
 Expected EOF read from client
 End of script
-Listening on port 7833 ... 
-Connection request from [127.0.0.1]
-<REPORT SPAMC/1.2
-<User: nobody
-<Content-length: ddd
-<
-<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <fromuser@myhost.test.ex>
-<X-Envelope-To: userx@test.ex
-<Received: from fromuser (helo=test.ex)
-<	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <fromuser@myhost.test.ex>)
-<	id 10HmaY-0005vi-00
-<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-<Content-type: text/plain
-<Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
-<From: fromuser@myhost.test.ex
-<Date: Tue, 2 Mar 1999 09:44:33 +0000
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
+Listening on TESTSUITE/eximdir/sophie_sock ... 
+Connection request
+<TESTSUITE/spool/scan/10HmaX-0005vi-00
+>-1 oops, internal error in scanner
 Expected EOF read from client
 End of script
-Inital pause of 2 seconds
-Listening on port 7833 ... 
-Connection request from [127.0.0.1]
-<REPORT SPAMC/1.2
-<User: nobody
-<Content-length: ddd
-<
-<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <fromuser@myhost.test.ex>
-<X-Envelope-To: userx@test.ex
-<Received: from fromuser (helo=test.ex)
-<	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <fromuser@myhost.test.ex>)
-<	id 10HmaZ-0005vi-00
-<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-<Content-type: text/plain
-<Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
-<From: fromuser@myhost.test.ex
-<Date: Tue, 2 Mar 1999 09:44:33 +0000
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
+Listening on TESTSUITE/eximdir/sophie_sock ... 
+Connection request
+<TESTSUITE/spool/scan/10HmbA-0005vi-00
+>LF>1 VNAME
 Expected EOF read from client
 End of script
-Listening on port 7833 ... 
-Connection request from [127.0.0.1]
-<REPORT SPAMC/1.2
-<User: nobody
-<Content-length: ddd
-<
-<From MAILER-DAEMON Tue Mar 02 09:44:33 1999
-<X-Envelope-From: <fromuser@myhost.test.ex>
-<X-Envelope-To: userx@test.ex
-<Received: from fromuser (helo=test.ex)
-<	by myhost.test.ex with local-esmtp (Exim x.yz)
-<	(envelope-from <fromuser@myhost.test.ex>)
-<	id 10HmbA-0005vi-00
-<	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-<Content-type: text/plain
-<Message-Id: <E10HmbA-0005vi-00@myhost.test.ex>
-<From: fromuser@myhost.test.ex
-<Date: Tue, 2 Mar 1999 09:44:33 +0000
-<
-<test
->SPAMD/1.1 0 EX_OK
->Spam: False ; 4.5 / 5.0
->
->Spam detection software, running on the system "demo",
->has NOT identified this incoming email as spam.  The original
->message has been attached to this so you can view it or label
->similar future email.  If you have any questions, see
->@@CONTACT_ADDRESS@@ for details.
->
->Content preview:  test [...]
->
->Content analysis details:   (4.5 points, 5.0 required)
->
-> pts rule name              description
->---- ---------------------- --------------------------------------------------
->-1.0 ALL_TRUSTED            Passed through trusted hosts only via SMTP
-> 1.2 MISSING_HEADERS        Missing To: header
-> 1.0 MISSING_FROM           Missing From: header
-> 1.8 MISSING_SUBJECT        Missing Subject: header
-> 1.4 MISSING_DATE           Missing Date: header
-> 0.1 MISSING_MID            Missing Message-Id: header
->
-Expected EOF read from client
+Listening on TESTSUITE/eximdir/sophie_sock ... 
+Connection request
+*sleep 3
+End of script
+Listening on TESTSUITE/eximdir/sophie_sock ... 
+Connection request
+*sleep 3
 End of script
diff --git a/test/stdout/4010 b/test/stdout/4010
index 2db3157dd..e705096f6 100644
--- a/test/stdout/4010
+++ b/test/stdout/4010
@@ -7,7 +7,7 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaX-0005vi-00

+250 OK id=10HmbB-0005vi-00

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

 250-myhost.test.ex Hello CALLER at test.ex

@@ -18,7 +18,94 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-550-Your message has been rejected but is being kept for evaluation.

-550-If it was a legitimate message, it may still be delivered to the target

-550 recipient(s).

+550 Administrative prohibition

 221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+451 Temporary local problem - please try later

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+250 OK id=10HmaY-0005vi-00

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+550 Administrative prohibition

+221 myhost.test.ex closing connection

+
+******** SERVER ********
+Listening on TESTSUITE/eximdir/fsec_sock ... 
+Connection request
+<CONFIGURE	ARCHIVE	1
+>ignored_response
+<CONFIGURE	TIMEOUT	0
+>ignored_response
+<CONFIGURE	MAXARCH	5
+>ignored_response
+<CONFIGURE	MIME	1
+>ignored_response
+<SCAN	TESTSUITE/spool/scan/10HmbB-0005vi-00/10HmbB-0005vi-00.eml
+>LF>random ignored line
+>LF>random ignored line 2
+>LF>OK\x09Scan ok.
+Expected EOF read from client
+End of script
+Listening on TESTSUITE/eximdir/fsec_sock ... 
+Connection request
+<CONFIGURE	ARCHIVE	1
+>ignored_response
+<CONFIGURE	TIMEOUT	0
+>ignored_response
+<CONFIGURE	MAXARCH	5
+>ignored_response
+<CONFIGURE	MIME	1
+>ignored_response
+<SCAN	TESTSUITE/spool/scan/10HmaZ-0005vi-00/10HmaZ-0005vi-00.eml
+>LF>xxxINFECTED\x09blah\x09VNAME\x09blah
+>LF>OK\x09Scan ok.
+Expected EOF read from client
+End of script
+Listening on TESTSUITE/eximdir/fsec_sock ... 
+Connection request
+*sleep 3
+End of script
+Listening on TESTSUITE/eximdir/fsec_sock ... 
+Connection request
+*sleep 3
+End of script
+Listening on TESTSUITE/eximdir/fsec_sock ... 
+Connection request
+<CONFIGURE	ARCHIVE	1
+>ignored_response
+<CONFIGURE	TIMEOUT	0
+>ignored_response
+<CONFIGURE	MAXARCH	5
+>ignored_response
+<CONFIGURE	MIME	1
+>ignored_response
+<SCAN	TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml
+>LF>xxxINFECTED\x09blah\x09VNAME\x09blah
+>LF>OK\x09Scan ok.
+Expected EOF read from client
+End of script
diff --git a/test/stdout/4011 b/test/stdout/4011
index dd4eddeee..db7a98ebe 100644
--- a/test/stdout/4011
+++ b/test/stdout/4011
@@ -7,7 +7,18 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbA-0005vi-00

+250 OK id=10HmbD-0005vi-00

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+451 Temporary local problem - please try later

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

 250-myhost.test.ex Hello CALLER at test.ex

@@ -40,29 +51,84 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaY-0005vi-00

+250 OK id=10HmaZ-0005vi-00

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+250 OK id=10HmbA-0005vi-00

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+550 Administrative prohibition

 221 myhost.test.ex closing connection

 
 ******** SERVER ********
-Listening on port 1224 ... 
-Connection request from [IP_LOOPBACK_ADDR]
-<SCAN FILE TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml
->0 <clean>
->*eof
+Listening on TESTSUITE/eximdir/aveserver_sock ... 
+Connection request
+>200 ready
+<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmbD-0005vi-00/10HmbD-0005vi-00.eml
+>200 done
+<quit
+>200 ready
+Expected EOF read from client
+End of script
+Listening on TESTSUITE/eximdir/aveserver_sock ... 
+Connection request
+>2xx ready
+<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml
+>5xx defer
+<quit
+>2xx ready
+Expected EOF read from client
 End of script
-Listening on port 1224 ... 
-Connection request from [IP_LOOPBACK_ADDR]
-<SCAN FILE TESTSUITE/spool/scan/10HmaZ-0005vi-00/10HmaZ-0005vi-00.eml
->0 <infected: EICAR_Test_File> DIR/spool/scan/10HmbB-0005vi-00/10HmbB-0005vi-00.eml
->*eof
+Listening on TESTSUITE/eximdir/aveserver_sock ... 
+Connection request
+>2xx ready
+<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmbB-0005vi-00/10HmbB-0005vi-00.eml
+>322 VNAME found
+>2xx ready
+<quit
+>2xx ready
+Expected EOF read from client
 End of script
-Listening on port 1224 ... 
-Connection request from [IP_LOOPBACK_ADDR]
-<SCAN FILE TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml
+Listening on TESTSUITE/eximdir/aveserver_sock ... 
+Connection request
 *sleep 3
 End of script
-Listening on port 1224 ... 
-Connection request from [IP_LOOPBACK_ADDR]
-<SCAN FILE TESTSUITE/spool/scan/10HmaY-0005vi-00/10HmaY-0005vi-00.eml
+Listening on TESTSUITE/eximdir/aveserver_sock ... 
+Connection request
 *sleep 3
 End of script
+Listening on TESTSUITE/eximdir/aveserver_sock ... 
+Connection request
+>2xx ready
+<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml
+>5xx defer
+<quit
+>2xx ready
+Expected EOF read from client
+End of script
+Listening on TESTSUITE/eximdir/aveserver_sock ... 
+Connection request
+>2xx ready
+<SCAN bPQRSTUW TESTSUITE/spool/scan/10HmbC-0005vi-00/10HmbC-0005vi-00.eml
+>322 VNAME found
+>2xx ready
+<quit
+>2xx ready
+Expected EOF read from client
+End of script
diff --git a/test/stdout/4012 b/test/stdout/4012
index fa6770563..6d66c7d64 100644
--- a/test/stdout/4012
+++ b/test/stdout/4012
@@ -7,7 +7,7 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaY-0005vi-00

+250 OK id=10HmaZ-0005vi-00

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

 250-myhost.test.ex Hello CALLER at test.ex

@@ -20,16 +20,56 @@
 354 Enter message, ending with "." on a line by itself

 550 Administrative prohibition

 221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+451 Temporary local problem - please try later

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+250 OK id=10HmbA-0005vi-00

+221 myhost.test.ex closing connection

 
 ******** SERVER ********
 Listening on port 1224 ... 
 Connection request from [IP_LOOPBACK_ADDR]
-TESTSUITE/spool/scan/10HmaY-0005vi-00/10HmaY-0005vi-00.eml
->LF>RESULT: OK
+<GET TESTSUITE/spool/scan/10HmaZ-0005vi-00/10HmaZ-0005vi-00.eml HTTP/1.0
+<
+><summary code="11">
+>*eof
+End of script
+Listening on port 1224 ... 
+Connection request from [IP_LOOPBACK_ADDR]
+<GET TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml HTTP/1.0
+<
+>
+>
+>
+><detected type="foo">
+><name>wibble</name>
+><summary code="11">
+>*eof
+End of script
+Listening on port 1224 ... 
+Connection request from [IP_LOOPBACK_ADDR]
+<GET TESTSUITE/spool/scan/10HmaY-0005vi-00/10HmaY-0005vi-00.eml HTTP/1.0
+*sleep 3
 End of script
 Listening on port 1224 ... 
 Connection request from [IP_LOOPBACK_ADDR]
-TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml
->LF>RESULT: BAD
->LF>NAME: wibble
+<GET TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml HTTP/1.0
+*sleep 3
 End of script
diff --git a/test/stdout/4004 b/test/stdout/4013
index a23806e00..dd4eddeee 100644
--- a/test/stdout/4004
+++ b/test/stdout/4013
@@ -7,18 +7,7 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbB-0005vi-00

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-451 Temporary local problem - please try later

+250 OK id=10HmbA-0005vi-00

 221 myhost.test.ex closing connection

 220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

 250-myhost.test.ex Hello CALLER at test.ex

@@ -51,33 +40,29 @@
 250 OK

 250 Accepted

 354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaZ-0005vi-00

+250 OK id=10HmaY-0005vi-00

 221 myhost.test.ex closing connection

 
 ******** SERVER ********
-Listening on TESTSUITE/eximdir/sophie_sock ... 
-Connection request
-<TESTSUITE/spool/scan/10HmbB-0005vi-00
->0 no problems mate
-Expected EOF read from client
-End of script
-Listening on TESTSUITE/eximdir/sophie_sock ... 
-Connection request
-<TESTSUITE/spool/scan/10HmaX-0005vi-00
->-1 oops, internal error in scanner
-Expected EOF read from client
+Listening on port 1224 ... 
+Connection request from [IP_LOOPBACK_ADDR]
+<SCAN FILE TESTSUITE/spool/scan/10HmbA-0005vi-00/10HmbA-0005vi-00.eml
+>0 <clean>
+>*eof
 End of script
-Listening on TESTSUITE/eximdir/sophie_sock ... 
-Connection request
-<TESTSUITE/spool/scan/10HmbA-0005vi-00
->LF>1 VNAME
-Expected EOF read from client
+Listening on port 1224 ... 
+Connection request from [IP_LOOPBACK_ADDR]
+<SCAN FILE TESTSUITE/spool/scan/10HmaZ-0005vi-00/10HmaZ-0005vi-00.eml
+>0 <infected: EICAR_Test_File> DIR/spool/scan/10HmbB-0005vi-00/10HmbB-0005vi-00.eml
+>*eof
 End of script
-Listening on TESTSUITE/eximdir/sophie_sock ... 
-Connection request
+Listening on port 1224 ... 
+Connection request from [IP_LOOPBACK_ADDR]
+<SCAN FILE TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml
 *sleep 3
 End of script
-Listening on TESTSUITE/eximdir/sophie_sock ... 
-Connection request
+Listening on port 1224 ... 
+Connection request from [IP_LOOPBACK_ADDR]
+<SCAN FILE TESTSUITE/spool/scan/10HmaY-0005vi-00/10HmaY-0005vi-00.eml
 *sleep 3
 End of script
diff --git a/test/stdout/4014 b/test/stdout/4014
new file mode 100644
index 000000000..fa6770563
--- /dev/null
+++ b/test/stdout/4014
@@ -0,0 +1,35 @@
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+250 OK id=10HmaY-0005vi-00

+221 myhost.test.ex closing connection

+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

+250-myhost.test.ex Hello CALLER at test.ex

+250-SIZE 52428800

+250-8BITMIME

+250-PIPELINING

+250 HELP

+250 OK

+250 Accepted

+354 Enter message, ending with "." on a line by itself

+550 Administrative prohibition

+221 myhost.test.ex closing connection

+
+******** SERVER ********
+Listening on port 1224 ... 
+Connection request from [IP_LOOPBACK_ADDR]
+TESTSUITE/spool/scan/10HmaY-0005vi-00/10HmaY-0005vi-00.eml
+>LF>RESULT: OK
+End of script
+Listening on port 1224 ... 
+Connection request from [IP_LOOPBACK_ADDR]
+TESTSUITE/spool/scan/10HmaX-0005vi-00/10HmaX-0005vi-00.eml
+>LF>RESULT: BAD
+>LF>NAME: wibble
+End of script
diff --git a/test/stdout/4016 b/test/stdout/4016
deleted file mode 100644
index 819f449ef..000000000
--- a/test/stdout/4016
+++ /dev/null
@@ -1,70 +0,0 @@
-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaY-0005vi-00

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaZ-0005vi-00

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbA-0005vi-00

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-550-Your message has been rejected but is being kept for evaluation.

-550-If it was a legitimate message, it may still be delivered to the target

-550 recipient(s).

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmbC-0005vi-00

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-PIPELINING

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-450-Your message has been rejected but is being kept for evaluation.

-450-If it was a legitimate message, it may still be delivered to the target

-450 recipient(s).

-221 myhost.test.ex closing connection

-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-550 Found Eicar-Test-Signature

-221 myhost.test.ex closing connection

diff --git a/test/stdout/4028 b/test/stdout/4028
deleted file mode 100644
index 9c94d76e6..000000000
--- a/test/stdout/4028
+++ /dev/null
@@ -1,12 +0,0 @@
-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250-STARTTLS

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaX-0005vi-00

-221 myhost.test.ex closing connection

diff --git a/test/stdout/4029 b/test/stdout/4029
deleted file mode 100644
index 9c94d76e6..000000000
--- a/test/stdout/4029
+++ /dev/null
@@ -1,12 +0,0 @@
-220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000

-250-myhost.test.ex Hello CALLER at test.ex

-250-SIZE 52428800

-250-8BITMIME

-250-PIPELINING

-250-STARTTLS

-250 HELP

-250 OK

-250 Accepted

-354 Enter message, ending with "." on a line by itself

-250 OK id=10HmaX-0005vi-00

-221 myhost.test.ex closing connection