libextractor

mbox_extractor.c (61661B)

---

 /*
      This file is part of libextractor.
      Copyright (C) 2026 Vidyut Samanta and Christian Grothoff
 
      libextractor is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
      by the Free Software Foundation; either version 3, or (at your
      option) any later version.
 
      libextractor is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      General Public License for more details.
 
      You should have received a copy of the GNU General Public License
      along with libextractor; see the file COPYING.  If not, write to the
      Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
      Boston, MA 02110-1301, USA.
  */
 /**
  * @file plugins/mbox_extractor.c
  * @brief plugin to support Unix mbox mailboxes and RFC 5322 messages
  * @author Christian Grothoff
  *
  * What is worth having out of a mail file is the routing metadata, not
  * the prose: the `Received' chain and the IP literals in it say which
  * machines the message actually passed through, `Message-ID' usually
  * carries the originating host's name on the right of the `@',
  * `X-Mailer' fingerprints the client, and the `d=' tag of a
  * `DKIM-Signature' names the domain that vouched for it.  Those are the
  * fields this plugin goes after.
  *
  * Only the *first* message is parsed in full; the rest are counted.
  * That is the deliberate trade-off of a first pass over a large volume:
  * a mailbox can be gigabytes, and a characterisation plus a count beats
  * an inventory that never finishes.
  *
  * Known limits of the scanner, stated once here:
  *
  * - The message count is the number of lines that begin with `From '
  *   (plus the first message).  That is the mbox format's well-known
  *   ambiguity: a *body* line beginning with "From " that the writer
  *   failed to escape as ">From " is indistinguishable from a separator,
  *   and inflates the count.  There is no fix that does not involve
  *   parsing every message.
  * - MIME parts are found by looking for `Content-Type' and
  *   `Content-Disposition' lines in the body, not by following the
  *   boundary; a part header quoted inside a body would be picked up.
  * - Only the first message's body is searched for attachment names.
  * - Encoded words are decoded for UTF-8, US-ASCII and the ISO-8859-1
  *   family; ISO-8859-15 and windows-1252 are decoded *as* ISO-8859-1,
  *   which is right for every position except the handful those two
  *   redefine.  Any other charset is left as the raw encoded word rather
  *   than guessed at.
  */
 #include "platform.h"
 #include "extractor.h"
 #include "forensics.h"
 
 
 /**
  * How many bytes of the mailbox we are willing to read.
  */
 #define MBOX_SCAN_CAP (256 * 1024)
 
 /**
  * How much of the start of the file the magic check looks at.
  */
 #define MBOX_MAGIC_WINDOW 8192
 
 /**
  * Largest header block we will walk, in bytes.
  */
 #define MBOX_MAX_HDR_BLOCK 65536
 
 /**
  * Most header fields we will look at in one message.
  */
 #define MBOX_MAX_HDR_LINES 1024
 
 /**
  * Working buffer for one unfolded header value.
  */
 #define MBOX_HDR_VALUE 4096
 
 /**
  * How many bytes of the first message's body we search for MIME part
  * headers.
  */
 #define MBOX_BODY_SCAN (128 * 1024)
 
 /**
  * Longest text an RFC 2231 parameter may assemble to.
  */
 #define MBOX_MAX_PARAM 512
 
 /**
  * Most RFC 2231 continuation segments we will join.
  */
 #define MBOX_MAX_CONT 16
 
 /**
  * Most distinct attachment names we will remember for de-duplication.
  */
 #define MBOX_MAX_FILENAMES 32
 
 
 /**
  * Distinct IP literals seen in the routing headers.
  */
 struct MboxIps
 {
   /**
    * The addresses, in the order they were found.  46 bytes is the
    * longest textual IPv6 address plus a NUL.
    */
   char ip[EXTRACTOR_FORENSIC_MAX_ITEMS][46];
 
   /**
    * Number of entries used in @e ip.
    */
   unsigned int count;
 };
 
 
 /**
  * The single-valued headers of the first message.  First occurrence
  * wins: a header that appears twice is either a duplicate or an
  * injection attempt, and the first one is the one the reader saw.
  */
 struct MboxHeaders
 {
   char from[1024];
   char to[2048];
   char cc[2048];
   char subject[1024];
   char date[256];
   char msgid[512];
   char inreplyto[512];
   char references[2048];
   char mailer[512];
   char org[512];
   char ctype[1024];
   char dkim[2048];
   char authres[1024];
   char charset[128];
 };
 
 
 /**
  * Everything the plugin allocates in one block, so that every exit path
  * is a single `free()'.
  */
 struct MboxState
 {
   struct MboxHeaders h;
   struct MboxIps ips;
   char val[MBOX_HDR_VALUE];
 
   /**
    * Attachment names already reported.  A MIME part usually carries the
    * same name twice, once as the `name' of its `Content-Type' and once
    * as the `filename' of its `Content-Disposition'; reporting it twice
    * would suggest two attachments.
    */
   char fnames[MBOX_MAX_FILENAMES][MBOX_MAX_PARAM];
 
   /**
    * Number of entries used in @e fnames.
    */
   unsigned int nfnames;
 };
 
 
 /**
  * ASCII lower case.  Header field names and MIME parameter names are
  * ASCII by definition, so no locale is involved.
  *
  * @param c the character
  * @return @a c folded to lower case
  */
 static char
 mbox_lc (char c)
 {
   if ( ('A' <= c) && ('Z' >= c) )
     return (char) (c - 'A' + 'a');
   return c;
 }
 
 
 /**
  * Value of a hexadecimal digit.
  *
  * @param c the character
  * @return 0-15, or -1 if @a c is not a hexadecimal digit
  */
 static int
 mbox_hex (char c)
 {
   if ( ('0' <= c) && ('9' >= c) )
     return c - '0';
   if ( ('a' <= c) && ('f' >= c) )
     return c - 'a' + 10;
   if ( ('A' <= c) && ('F' >= c) )
     return c - 'A' + 10;
   return -1;
 }
 
 
 /**
  * Case-insensitive comparison of a counted string against a
  * NUL-terminated one.
  *
  * @param a the counted string
  * @param alen number of bytes in @a a
  * @param b the NUL-terminated string
  * @return 1 if they are equal ignoring case, 0 otherwise
  */
 static int
 mbox_ieq (const char *a,
           size_t alen,
           const char *b)
 {
   size_t blen = strlen (b);
 
   if (alen != blen)
     return 0;
   for (size_t i = 0; i < alen; i++)
     if (mbox_lc (a[i]) != mbox_lc (b[i]))
       return 0;
   return 1;
 }
 
 
 /**
  * Store a value in a fixed-width slot, first writer wins.
  *
  * @param dst the slot
  * @param dstsize number of bytes in @a dst
  * @param v the value
  * @param vlen number of bytes in @a v
  */
 static void
 mbox_store (char *dst,
             size_t dstsize,
             const char *v,
             size_t vlen)
 {
   if ('\0' != dst[0])
     return;
   if (vlen >= dstsize)
     vlen = dstsize - 1;
   memcpy (dst,
           v,
           vlen);
   dst[vlen] = '\0';
 }
 
 
 /**
  * Days since 1970-01-01 for a proleptic Gregorian date.  (Howard
  * Hinnant's `days_from_civil'.)
  *
  * @param y year
  * @param m month, 1-12
  * @param d day of month, 1-31
  * @return day number, negative before the epoch
  */
 static int64_t
 mbox_days_from_civil (int64_t y,
                       int64_t m,
                       int64_t d)
 {
   int64_t era;
   int64_t yoe;
   int64_t doy;
   int64_t doe;
 
   y -= (m <= 2);
   era = (y >= 0 ? y : y - 399) / 400;
   yoe = y - era * 400;
   doy = (153 * (m + (m > 2 ? -3 : 9)) + 2) / 5 + d - 1;
   doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
   return era * 146097 + doe - 719468;
 }
 
 
 /**
  * Parse an RFC 5322 `Date:' value into seconds since the Unix epoch.
  *
  * Handles the current syntax (`Tue, 12 Mar 2024 09:41:07 +0100') and the
  * obsolete forms that are still common in archives: a two- or
  * three-digit year, a missing seconds field, and an alphabetic zone
  * (`GMT', `UT', `EST' and the rest of the US set).  An unrecognised
  * alphabetic zone is treated as UTC, which is what RFC 5322 says to do
  * with the obsolete military single letters.
  *
  * @param s the value
  * @param len number of bytes in @a s
  * @param[out] when where to store the result
  * @return 1 on success, 0 if @a s is not a date
  */
 static int
 mbox_parse_date (const char *s,
                  size_t len,
                  int64_t *when)
 {
   static const char *months[12] = {
     "jan", "feb", "mar", "apr", "may", "jun",
     "jul", "aug", "sep", "oct", "nov", "dec"
   };
   static const struct
   {
     const char *name;
     int hours;
   } zones[] = {
     { "ut", 0 }, { "gmt", 0 }, { "z", 0 },
     { "est", -5 }, { "edt", -4 },
     { "cst", -6 }, { "cdt", -5 },
     { "mst", -7 }, { "mdt", -6 },
     { "pst", -8 }, { "pdt", -7 },
     { NULL, 0 }
   };
   size_t i = 0;
   int64_t day;
   int64_t mon = -1;
   int64_t year;
   int64_t hh;
   int64_t mm;
   int64_t ss = 0;
   int64_t off = 0;
   size_t digits;
 
 #define SKIP_WS() while ( (i < len) && \
                           ( (' ' == s[i]) || ('\t' == s[i]) ) ) i++
 
   SKIP_WS ();
   /* optional `Tue, ' */
   {
     size_t j = i;
 
     while ( (j < len) &&
             ( ( ('a' <= mbox_lc (s[j])) && ('z' >= mbox_lc (s[j])) ) ) )
       j++;
     if ( (j > i) &&
          (j < len) &&
          (',' == s[j]) )
       i = j + 1;
   }
   SKIP_WS ();
   digits = 0;
   day = 0;
   while ( (i < len) &&
           (digits < 2) &&
           ('0' <= s[i]) && ('9' >= s[i]) )
   {
     day = day * 10 + (s[i] - '0');
     i++;
     digits++;
   }
   if ( (0 == digits) ||
        (day < 1) || (day > 31) )
     return 0;
   SKIP_WS ();
   if (i + 3 > len)
     return 0;
   for (unsigned int m = 0; m < 12; m++)
     if ( (mbox_lc (s[i]) == months[m][0]) &&
          (mbox_lc (s[i + 1]) == months[m][1]) &&
          (mbox_lc (s[i + 2]) == months[m][2]) )
     {
       mon = m + 1;
       break;
     }
   if (0 > mon)
     return 0;
   i += 3;
   /* an obsolete long month name may follow; skip the rest of the word */
   while ( (i < len) &&
           ('a' <= mbox_lc (s[i])) && ('z' >= mbox_lc (s[i])) )
     i++;
   SKIP_WS ();
   digits = 0;
   year = 0;
   while ( (i < len) &&
           (digits < 4) &&
           ('0' <= s[i]) && ('9' >= s[i]) )
   {
     year = year * 10 + (s[i] - '0');
     i++;
     digits++;
   }
   if (0 == digits)
     return 0;
   if (2 == digits)
     year += (year < 50) ? 2000 : 1900;   /* RFC 5322 4.3 */
   else if (3 == digits)
     year += 1900;
   else if (4 != digits)
     return 0;
   SKIP_WS ();
   digits = 0;
   hh = 0;
   while ( (i < len) &&
           (digits < 2) &&
           ('0' <= s[i]) && ('9' >= s[i]) )
   {
     hh = hh * 10 + (s[i] - '0');
     i++;
     digits++;
   }
   if ( (0 == digits) ||
        (i >= len) ||
        (':' != s[i]) )
     return 0;
   i++;
   digits = 0;
   mm = 0;
   while ( (i < len) &&
           (digits < 2) &&
           ('0' <= s[i]) && ('9' >= s[i]) )
   {
     mm = mm * 10 + (s[i] - '0');
     i++;
     digits++;
   }
   if (0 == digits)
     return 0;
   if ( (i < len) &&
        (':' == s[i]) )
   {
     i++;
     digits = 0;
     while ( (i < len) &&
             (digits < 2) &&
             ('0' <= s[i]) && ('9' >= s[i]) )
     {
       ss = ss * 10 + (s[i] - '0');
       i++;
       digits++;
     }
     if (0 == digits)
       return 0;
   }
   if ( (hh > 23) || (mm > 59) || (ss > 60) )
     return 0;
   SKIP_WS ();
   if ( (i < len) &&
        ( ('+' == s[i]) || ('-' == s[i]) ) )
   {
     int neg = ('-' == s[i]);
     int64_t v = 0;
 
     i++;
     digits = 0;
     while ( (i < len) &&
             (digits < 4) &&
             ('0' <= s[i]) && ('9' >= s[i]) )
     {
       v = v * 10 + (s[i] - '0');
       i++;
       digits++;
     }
     if (4 != digits)
       return 0;
     off = (v / 100) * 3600 + (v % 100) * 60;
     if (neg)
       off = -off;
   }
   else if (i < len)
   {
     size_t j = i;
 
     while ( (j < len) &&
             (j - i < 8) &&
             ('a' <= mbox_lc (s[j])) && ('z' >= mbox_lc (s[j])) )
       j++;
     for (unsigned int z = 0; NULL != zones[z].name; z++)
       if (mbox_ieq (&s[i],
                     j - i,
                     zones[z].name))
       {
         off = zones[z].hours * 3600;
         break;
       }
   }
 #undef SKIP_WS
   *when = mbox_days_from_civil (year,
                                 mon,
                                 day) * 86400
           + hh * 3600 + mm * 60 + ss
           - off;
   return 1;
 }
 
 
 /**
  * Decode a base64 body into @a out, ignoring white space.
  *
  * @param in the encoded text
  * @param inlen number of bytes in @a in
  * @param[out] out where to write the bytes
  * @param outsize number of bytes available in @a out
  * @return number of bytes written, or 0 on a malformed input
  */
 static size_t
 mbox_b64 (const char *in,
           size_t inlen,
           char *out,
           size_t outsize)
 {
   static const char alpha[] =
     "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
   uint32_t acc = 0;
   unsigned int bits = 0;
   size_t o = 0;
 
   for (size_t i = 0; i < inlen; i++)
   {
     const char *p;
 
     if ( (' ' == in[i]) || ('\t' == in[i]) ||
          ('\r' == in[i]) || ('\n' == in[i]) )
       continue;
     if ('=' == in[i])
       break;
     p = memchr (alpha,
                 in[i],
                 64);
     if (NULL == p)
       return 0;   /* not base64 after all */
     acc = (acc << 6) | (uint32_t) (p - alpha);
     bits += 6;
     if (bits >= 8)
     {
       bits -= 8;
       if (o >= outsize)
         return o;
       out[o++] = (char) ((acc >> bits) & 0xFF);
     }
   }
   return o;
 }
 
 
 /**
  * Decode the quoted-printable variant used inside RFC 2047 encoded
  * words, where `_' stands for a space.
  *
  * @param in the encoded text
  * @param inlen number of bytes in @a in
  * @param[out] out where to write the bytes
  * @param outsize number of bytes available in @a out
  * @return number of bytes written
  */
 static size_t
 mbox_qp (const char *in,
          size_t inlen,
          char *out,
          size_t outsize)
 {
   size_t o = 0;
 
   for (size_t i = 0; (i < inlen) && (o < outsize); i++)
   {
     if ('_' == in[i])
     {
       out[o++] = ' ';
       continue;
     }
     if ( ('=' == in[i]) &&
          (i + 2 < inlen) &&
          (0 <= mbox_hex (in[i + 1])) &&
          (0 <= mbox_hex (in[i + 2])) )
     {
       out[o++] = (char) ((mbox_hex (in[i + 1]) << 4)
                          | mbox_hex (in[i + 2]));
       i += 2;
       continue;
     }
     out[o++] = in[i];
   }
   return o;
 }
 
 
 /**
  * Which charsets we know how to turn into UTF-8.
  */
 enum MboxCharset
 {
   /**
    * Not a charset we handle; leave the encoded word alone.
    */
   MBOX_CS_UNKNOWN = 0,
 
   /**
    * Already UTF-8 (or a subset of it).
    */
   MBOX_CS_UTF8 = 1,
 
   /**
    * A single-byte charset whose lower half is ASCII; decoded as
    * ISO-8859-1.
    */
   MBOX_CS_LATIN1 = 2
 };
 
 
 /**
  * Classify a charset name from an encoded word.
  *
  * @param name the charset name (a `*' language suffix is tolerated)
  * @param len number of bytes in @a name
  * @return how to decode the octets
  */
 static enum MboxCharset
 mbox_charset (const char *name,
               size_t len)
 {
   /* RFC 2231 allows a `*language' suffix on the charset of an encoded
      word; cut it off before comparing. */
   for (size_t i = 0; i < len; i++)
     if ('*' == name[i])
     {
       len = i;
       break;
     }
   if (mbox_ieq (name, len, "utf-8") ||
       mbox_ieq (name, len, "utf8") ||
       mbox_ieq (name, len, "us-ascii") ||
       mbox_ieq (name, len, "ascii") )
     return MBOX_CS_UTF8;
   /* ISO-8859-15 and windows-1252 differ from ISO-8859-1 only in a few
      positions; decoding them as Latin-1 gets everything else right and
      never produces invalid UTF-8. */
   if (mbox_ieq (name, len, "iso-8859-1") ||
       mbox_ieq (name, len, "iso8859-1") ||
       mbox_ieq (name, len, "latin1") ||
       mbox_ieq (name, len, "iso-8859-15") ||
       mbox_ieq (name, len, "iso8859-15") ||
       mbox_ieq (name, len, "windows-1252") ||
       mbox_ieq (name, len, "cp1252") )
     return MBOX_CS_LATIN1;
   return MBOX_CS_UNKNOWN;
 }
 
 
 /**
  * Append @a len bytes of Latin-1 to @a out as UTF-8.
  *
  * @param in the bytes
  * @param len number of bytes in @a in
  * @param[out] out output buffer
  * @param outsize number of bytes available in @a out
  * @param o current write offset in @a out
  * @return the new write offset
  */
 static size_t
 mbox_latin1 (const char *in,
              size_t len,
              char *out,
              size_t outsize,
              size_t o)
 {
   for (size_t i = 0; i < len; i++)
   {
     unsigned char c = (unsigned char) in[i];
 
     if (c < 0x80)
     {
       if (o + 1 >= outsize)
         break;
       out[o++] = (char) c;
     }
     else
     {
       if (o + 2 >= outsize)
         break;
       out[o++] = (char) (0xC0 | (c >> 6));
       out[o++] = (char) (0x80 | (c & 0x3F));
     }
   }
   return o;
 }
 
 
 /**
  * Decode the RFC 2047 encoded words in a header value.
  *
  * Encoded words that are adjacent (separated only by white space) have
  * that white space removed, as RFC 2047 section 6.2 requires -- without
  * that, a subject split across two words gains a stray space.
  *
  * @param in the raw header value
  * @param inlen number of bytes in @a in
  * @param[out] out where to write the decoded text
  * @param outsize number of bytes available in @a out
  * @return number of bytes written to @a out
  */
 static size_t
 mbox_decode_words (const char *in,
                    size_t inlen,
                    char *out,
                    size_t outsize)
 {
   size_t i = 0;
   size_t o = 0;
   int prev_was_word = 0;
 
   while ( (i < inlen) &&
           (o + 1 < outsize) )
   {
     size_t cs;
     size_t cse;
     size_t enc;
     size_t txt;
     size_t end;
     enum MboxCharset kind;
 
     if ( ('=' == in[i]) &&
          (i + 1 < inlen) &&
          ('?' == in[i + 1]) )
     {
       /* =?charset?E?text?= */
       cs = i + 2;
       cse = cs;
       while ( (cse < inlen) &&
               (cse - cs < 64) &&
               ('?' != in[cse]) )
         cse++;
       if ( (cse >= inlen) ||
            ('?' != in[cse]) ||
            (cse == cs) )
       {
         out[o++] = in[i++];
         prev_was_word = 0;
         continue;
       }
       enc = cse + 1;
       if ( (enc + 1 >= inlen) ||
            ('?' != in[enc + 1]) )
       {
         out[o++] = in[i++];
         prev_was_word = 0;
         continue;
       }
       txt = enc + 2;
       end = txt;
       while ( (end + 1 < inlen) &&
               (end - txt < 1024) &&
               ! ( ('?' == in[end]) && ('=' == in[end + 1]) ) )
         end++;
       if ( (end + 1 >= inlen) ||
            ('?' != in[end]) )
       {
         out[o++] = in[i++];
         prev_was_word = 0;
         continue;
       }
       kind = mbox_charset (&in[cs],
                            cse - cs);
       if (MBOX_CS_UNKNOWN == kind)
       {
         out[o++] = in[i++];   /* leave the word verbatim */
         prev_was_word = 0;
         continue;
       }
       {
         char raw[1024];
         size_t rlen = 0;
 
         if ( ('b' == mbox_lc (in[enc])) )
           rlen = mbox_b64 (&in[txt],
                            end - txt,
                            raw,
                            sizeof (raw));
         else if ('q' == mbox_lc (in[enc]))
           rlen = mbox_qp (&in[txt],
                           end - txt,
                           raw,
                           sizeof (raw));
         else
           rlen = 0;
         if (0 == rlen)
         {
           out[o++] = in[i++];
           prev_was_word = 0;
           continue;
         }
         if (MBOX_CS_UTF8 == kind)
         {
           if (rlen > outsize - o - 1)
             rlen = outsize - o - 1;
           memcpy (&out[o],
                   raw,
                   rlen);
           o += rlen;
         }
         else
         {
           o = mbox_latin1 (raw,
                            rlen,
                            out,
                            outsize,
                            o);
         }
       }
       i = end + 2;
       prev_was_word = 1;
       continue;
     }
     if ( (' ' == in[i]) ||
          ('\t' == in[i]) )
     {
       size_t j = i;
 
       while ( (j < inlen) &&
               ( (' ' == in[j]) || ('\t' == in[j]) ) )
         j++;
       if (prev_was_word &&
           (j + 1 < inlen) &&
           ('=' == in[j]) && ('?' == in[j + 1]) )
       {
         i = j;    /* white space between adjacent encoded words: drop */
         continue;
       }
       out[o++] = ' ';
       i = j;
       prev_was_word = 0;
       continue;
     }
     out[o++] = in[i++];
     prev_was_word = 0;
   }
   return o;
 }
 
 
 /**
  * Emit a header value, decoding its encoded words first.  If decoding
  * produced something that is not valid UTF-8 -- a mislabelled charset,
  * say -- the raw value is emitted instead, which is at worst unreadable
  * but is never wrong.
  *
  * @param ec extraction context
  * @param type meta data type
  * @param raw the raw (unfolded) header value
  * @param rawlen number of bytes in @a raw
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 mbox_emit_hdr (struct EXTRACTOR_ExtractContext *ec,
                enum EXTRACTOR_MetaType type,
                const char *raw,
                size_t rawlen)
 {
   char dec[EXTRACTOR_FORENSIC_MAX_STRING];
   size_t dlen;
 
   dlen = mbox_decode_words (raw,
                             rawlen,
                             dec,
                             sizeof (dec));
   if (EXTRACTOR_forensic_utf8_valid_ (dec,
                                       dlen))
     return EXTRACTOR_forensic_emit_text_ (ec,
                                           "mbox",
                                           type,
                                           dec,
                                           dlen);
   return EXTRACTOR_forensic_emit_text_ (ec,
                                         "mbox",
                                         type,
                                         raw,
                                         rawlen);
 }
 
 
 /**
  * Is @a s, of length @a len, a dotted-quad IPv4 address?
  *
  * @param s the candidate
  * @param len number of bytes in @a s
  * @return 1 if it is, 0 if not
  */
 static int
 mbox_is_ipv4 (const char *s,
               size_t len)
 {
   size_t i = 0;
 
   for (unsigned int part = 0; part < 4; part++)
   {
     unsigned int v = 0;
     unsigned int digits = 0;
 
     while ( (i < len) &&
             ('0' <= s[i]) && ('9' >= s[i]) &&
             (digits < 3) )
     {
       v = v * 10 + (unsigned int) (s[i] - '0');
       i++;
       digits++;
     }
     if ( (0 == digits) ||
          (v > 255) )
       return 0;
     if (part < 3)
     {
       if ( (i >= len) ||
            ('.' != s[i]) )
         return 0;
       i++;
     }
   }
   return (i == len);
 }
 
 
 /**
  * Is @a s, of length @a len, an IPv6 address?
  *
  * Deliberately conservative: hexadecimal groups separated by colons,
  * at most one `::', at most eight groups, optionally ending in a
  * dotted-quad (the IPv4-mapped form that shows up in `Received' lines).
  * A zone index (`%eth0') is rejected rather than guessed at.
  *
  * @param s the candidate
  * @param len number of bytes in @a s
  * @return 1 if it is, 0 if not
  */
 static int
 mbox_is_ipv6 (const char *s,
               size_t len)
 {
   unsigned int groups = 0;
   int dbl = 0;
   size_t i = 0;
   size_t tail;
 
   if ( (0 == len) ||
        (len > 45) )
     return 0;
   /* a trailing dotted-quad counts as two groups */
   tail = len;
   for (size_t k = 0; k < len; k++)
     if ('.' == s[k])
     {
       size_t start = 0;
 
       for (size_t j = len; j > 0; j--)
         if (':' == s[j - 1])
         {
           start = j;
           break;
         }
       if (0 == start)
         return 0;
       if (! mbox_is_ipv4 (&s[start],
                           len - start))
         return 0;
       tail = start - 1;   /* keep the colon that precedes it */
       groups = 2;
       break;
     }
   while (i < tail)
   {
     unsigned int digits = 0;
 
     if (':' == s[i])
     {
       if ( (i + 1 < tail) &&
            (':' == s[i + 1]) )
       {
         if (dbl)
           return 0;   /* only one `::' is allowed */
         dbl = 1;
         i += 2;
         continue;
       }
       if (0 == i)
         return 0;   /* a single leading colon is not valid */
       i++;
       continue;
     }
     while ( (i < tail) &&
             (digits < 4) &&
             (0 <= mbox_hex (s[i])) )
     {
       i++;
       digits++;
     }
     if (0 == digits)
       return 0;
     groups++;
     if (groups > 8)
       return 0;
     if ( (i < tail) &&
          (':' != s[i]) )
       return 0;
   }
   if ( (tail < len) &&
        (0 == groups) )
     return 0;
   if (dbl)
     return (groups <= 7);
   return (8 == groups);
 }
 
 
 /**
  * Remember an IP literal, ignoring duplicates.
  *
  * @param ips the list
  * @param s the address text
  * @param len number of bytes in @a s
  */
 static void
 mbox_add_ip (struct MboxIps *ips,
              const char *s,
              size_t len)
 {
   /* `IPv6:' prefixes the literal inside the brackets of a Received
      line, per RFC 5321. */
   if ( (len > 5) &&
        mbox_ieq (s,
                  5,
                  "ipv6:") )
   {
     s += 5;
     len -= 5;
   }
   if ( (0 == len) ||
        (len >= sizeof (ips->ip[0])) )
     return;
   if ( (! mbox_is_ipv4 (s, len)) &&
        (! mbox_is_ipv6 (s, len)) )
     return;
   for (unsigned int i = 0; i < ips->count; i++)
     if ( (strlen (ips->ip[i]) == len) &&
          (0 == memcmp (ips->ip[i], s, len)) )
       return;
   if (ips->count >= EXTRACTOR_FORENSIC_MAX_ITEMS)
     return;
   memcpy (ips->ip[ips->count],
           s,
           len);
   ips->ip[ips->count][len] = '\0';
   ips->count++;
 }
 
 
 /**
  * Harvest the bracketed IP literals out of a `Received' value.
  *
  * @param v the value
  * @param vlen number of bytes in @a v
  * @param ips where to collect the addresses
  */
 static void
 mbox_harvest_bracketed (const char *v,
                         size_t vlen,
                         struct MboxIps *ips)
 {
   for (size_t i = 0; i < vlen; i++)
   {
     size_t j;
 
     if ('[' != v[i])
       continue;
     j = i + 1;
     while ( (j < vlen) &&
             (j - i <= 64) &&
             (']' != v[j]) )
       j++;
     if ( (j >= vlen) ||
          (']' != v[j]) )
       continue;
     mbox_add_ip (ips,
                  &v[i + 1],
                  j - i - 1);
     i = j;
   }
 }
 
 
 /**
  * Harvest IP literals out of a value that is a bare list of them, as in
  * `X-Originating-IP' and `X-Forwarded-For'.
  *
  * @param v the value
  * @param vlen number of bytes in @a v
  * @param ips where to collect the addresses
  */
 static void
 mbox_harvest_tokens (const char *v,
                      size_t vlen,
                      struct MboxIps *ips)
 {
   size_t i = 0;
 
   while (i < vlen)
   {
     size_t start;
 
     while ( (i < vlen) &&
             (NULL != strchr (" \t,;[]()<>", v[i])) )
       i++;
     start = i;
     while ( (i < vlen) &&
             (NULL == strchr (" \t,;[]()<>", v[i])) )
       i++;
     if (i > start)
       mbox_add_ip (ips,
                    &v[start],
                    i - start);
   }
 }
 
 
 /**
  * Split a mailbox into its display name and its addr-spec.
  *
  * Handles `Name <a@b>', `"Name" <a@b>', `a@b' and the obsolete
  * `a@b (Name)'.
  *
  * @param in the mailbox text
  * @param len number of bytes in @a in
  * @param[out] nstart offset of the display name in @a in
  * @param[out] nlen length of the display name, 0 if there is none
  * @param[out] astart offset of the addr-spec in @a in
  * @param[out] alen length of the addr-spec, 0 if there is none
  */
 static void
 mbox_split_addr (const char *in,
                  size_t len,
                  size_t *nstart,
                  size_t *nlen,
                  size_t *astart,
                  size_t *alen)
 {
   size_t lt = (size_t) -1;
   size_t gt = (size_t) -1;
 
   *nstart = 0;
   *nlen = 0;
   *astart = 0;
   *alen = 0;
   for (size_t i = 0; i < len; i++)
     if ('<' == in[i])
     {
       lt = i;
       break;
     }
   if (((size_t) -1) != lt)
     for (size_t i = len; i > lt + 1; i--)
       if ('>' == in[i - 1])
       {
         gt = i - 1;
         break;
       }
   if ( (((size_t) -1) != lt) &&
        (((size_t) -1) != gt) )
   {
     *astart = lt + 1;
     *alen = gt - lt - 1;
     *nstart = 0;
     *nlen = lt;
   }
   else
   {
     size_t par = (size_t) -1;
 
     for (size_t i = 0; i < len; i++)
       if ('(' == in[i])
       {
         par = i;
         break;
       }
     if (((size_t) -1) != par)
     {
       size_t close = len;
 
       for (size_t i = len; i > par + 1; i--)
         if (')' == in[i - 1])
         {
           close = i - 1;
           break;
         }
       *astart = 0;
       *alen = par;
       *nstart = par + 1;
       *nlen = (close > par + 1) ? close - par - 1 : 0;
     }
     else
     {
       *astart = 0;
       *alen = len;
     }
   }
   /* trim both parts and strip the quotes around a quoted display name */
   while ( (*nlen > 0) &&
           ( (' ' == in[*nstart]) || ('\t' == in[*nstart]) ) )
   {
     (*nstart)++;
     (*nlen)--;
   }
   while ( (*nlen > 0) &&
           ( (' ' == in[*nstart + *nlen - 1]) ||
             ('\t' == in[*nstart + *nlen - 1]) ) )
     (*nlen)--;
   if ( (*nlen >= 2) &&
        ('"' == in[*nstart]) &&
        ('"' == in[*nstart + *nlen - 1]) )
   {
     (*nstart)++;
     *nlen -= 2;
   }
   while ( (*alen > 0) &&
           ( (' ' == in[*astart]) || ('\t' == in[*astart]) ) )
   {
     (*astart)++;
     (*alen)--;
   }
   while ( (*alen > 0) &&
           ( (' ' == in[*astart + *alen - 1]) ||
             ('\t' == in[*astart + *alen - 1]) ) )
     (*alen)--;
 }
 
 
 /**
  * Emit each address of an address list, capped.
  *
  * The list is split on commas that are not inside a quoted string, an
  * angle-addr or a comment, so that a display name containing a comma
  * does not become two recipients.
  *
  * @param ec extraction context
  * @param type meta data type to report each address under
  * @param v the header value
  * @param vlen number of bytes in @a v
  * @param[in,out] emitted how many have been emitted so far
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 mbox_emit_addr_list (struct EXTRACTOR_ExtractContext *ec,
                      enum EXTRACTOR_MetaType type,
                      const char *v,
                      size_t vlen,
                      unsigned int *emitted)
 {
   size_t start = 0;
   int quote = 0;
   int angle = 0;
   int paren = 0;
 
   for (size_t i = 0; i <= vlen; i++)
   {
     int split = (i == vlen);
 
     if (! split)
     {
       char c = v[i];
 
       if (quote)
       {
         if ('"' == c)
           quote = 0;
         continue;
       }
       switch (c)
       {
       case '"':
         quote = 1;
         break;
       case '<':
         angle++;
         break;
       case '>':
         if (angle > 0)
           angle--;
         break;
       case '(':
         paren++;
         break;
       case ')':
         if (paren > 0)
           paren--;
         break;
       case ',':
         if ( (0 == angle) && (0 == paren) )
           split = 1;
         break;
       default:
         break;
       }
     }
     if (! split)
       continue;
     if (i > start)
     {
       size_t s = start;
       size_t l = i - start;
 
       while ( (l > 0) &&
               ( (' ' == v[s]) || ('\t' == v[s]) ) )
       {
         s++;
         l--;
       }
       while ( (l > 0) &&
               ( (' ' == v[s + l - 1]) || ('\t' == v[s + l - 1]) ) )
         l--;
       if (0 != l)
       {
         if (*emitted >= EXTRACTOR_FORENSIC_MAX_ITEMS)
           return 0;
         (*emitted)++;
         if (mbox_emit_hdr (ec,
                            type,
                            &v[s],
                            l))
           return 1;
       }
     }
     start = i + 1;
   }
   return 0;
 }
 
 
 /**
  * Find the value of a MIME parameter in a structured header value.
  *
  * Understands `name=token', `name="quoted string"', the RFC 2231
  * extended form `name*=charset'lang'pct-encoded' and the RFC 2231
  * continuation form `name*0=', `name*1=', ... which is joined back
  * together in index order.
  *
  * @param v the header value, after the media type
  * @param vlen number of bytes in @a v
  * @param name the parameter name, lower case
  * @param[out] out where to write the value
  * @param outsize number of bytes available in @a out
  * @return length of the value, 0 if the parameter is absent
  */
 static size_t
 mbox_param (const char *v,
             size_t vlen,
             const char *name,
             char *out,
             size_t outsize)
 {
   size_t nlen = strlen (name);
   size_t i = 0;
   size_t o = 0;
   unsigned int segs = 0;
   int simple = 0;
 
   while ( (i < vlen) &&
           (segs < MBOX_MAX_CONT) )
   {
     size_t ps;
     size_t pe;
     size_t vs;
     size_t ve;
     int extended = 0;
     int is_cont = 0;
 
     /* advance to the next `;' separated parameter */
     while ( (i < vlen) &&
             (';' != v[i]) )
     {
       if ('"' == v[i])
       {
         i++;
         while ( (i < vlen) &&
                 ('"' != v[i]) )
         {
           if ( ('\\' == v[i]) &&
                (i + 1 < vlen) )
             i++;
           i++;
         }
       }
       if (i < vlen)
         i++;
     }
     if (i >= vlen)
       break;
     i++;   /* skip the `;' */
     while ( (i < vlen) &&
             ( (' ' == v[i]) || ('\t' == v[i]) ) )
       i++;
     ps = i;
     while ( (i < vlen) &&
             (';' != v[i]) && ('=' != v[i]) &&
             (' ' != v[i]) && ('\t' != v[i]) )
       i++;
     pe = i;
     while ( (i < vlen) &&
             ( (' ' == v[i]) || ('\t' == v[i]) ) )
       i++;
     if ( (i >= vlen) ||
          ('=' != v[i]) )
       continue;
     i++;
     while ( (i < vlen) &&
             ( (' ' == v[i]) || ('\t' == v[i]) ) )
       i++;
     if ( (i < vlen) &&
          ('"' == v[i]) )
     {
       i++;
       vs = i;
       while ( (i < vlen) &&
               ('"' != v[i]) )
       {
         if ( ('\\' == v[i]) &&
              (i + 1 < vlen) )
           i++;
         i++;
       }
       ve = i;
       if (i < vlen)
         i++;
     }
     else
     {
       vs = i;
       while ( (i < vlen) &&
               (';' != v[i]) )
         i++;
       ve = i;
       while ( (ve > vs) &&
               ( (' ' == v[ve - 1]) || ('\t' == v[ve - 1]) ) )
         ve--;
     }
     /* does the parameter name match? */
     if (pe - ps < nlen)
       continue;
     if (! mbox_ieq (&v[ps],
                     nlen,
                     name))
       continue;
     if (pe - ps == nlen)
     {
       simple = 1;
     }
     else if ('*' == v[ps + nlen])
     {
       size_t k = ps + nlen + 1;
 
       while ( (k < pe) &&
               ('0' <= v[k]) && ('9' >= v[k]) )
       {
         is_cont = 1;
         k++;
       }
       if ( (k < pe) &&
            ('*' == v[k]) )
       {
         extended = 1;
         k++;
       }
       if (k != pe)
         continue;   /* something else entirely */
       if (! is_cont)
         extended = 1;
     }
     else
     {
       continue;
     }
     if (simple &&
         (0 != segs) )
       continue;   /* continuations already won */
     if (extended)
     {
       /* charset'language'pct-encoded -- drop the first two fields */
       size_t q = vs;
       unsigned int seen = 0;
 
       if (! is_cont)
       {
         while ( (q < ve) &&
                 (seen < 2) )
         {
           if ('\'' == v[q])
             seen++;
           q++;
         }
         if (2 != seen)
           q = vs;
       }
       while ( (q < ve) &&
               (o + 1 < outsize) )
       {
         if ( ('%' == v[q]) &&
              (q + 2 < ve) &&
              (0 <= mbox_hex (v[q + 1])) &&
              (0 <= mbox_hex (v[q + 2])) )
         {
           out[o++] = (char) ((mbox_hex (v[q + 1]) << 4)
                              | mbox_hex (v[q + 2]));
           q += 3;
           continue;
         }
         out[o++] = v[q++];
       }
     }
     else
     {
       size_t q = vs;
 
       while ( (q < ve) &&
               (o + 1 < outsize) )
       {
         if ( ('\\' == v[q]) &&
              (q + 1 < ve) )
           q++;
         out[o++] = v[q++];
       }
     }
     segs++;
     if (simple)
       break;
   }
   if (o < outsize)
     out[o] = '\0';
   return o;
 }
 
 
 /**
  * Walk the header block once, handing each field to @a cb.
  *
  * Continuation lines (those starting with a space or a tab) are folded
  * into the previous value with the fold replaced by a single space.
  *
  * @param buf the buffer
  * @param hstart offset of the first header line
  * @param hend offset one past the last header byte
  * @param[in,out] pos iteration cursor, initialise to @a hstart
  * @param[out] nstart offset of the field name
  * @param[out] nlen length of the field name
  * @param[out] val where to copy the unfolded value
  * @param valsize number of bytes available in @a val
  * @param[out] vlen number of bytes written to @a val
  * @return 1 if a field was returned, 0 at the end of the block
  */
 static int
 mbox_next_header (const char *buf,
                   size_t hstart,
                   size_t hend,
                   size_t *pos,
                   size_t *nstart,
                   size_t *nlen,
                   char *val,
                   size_t valsize,
                   size_t *vlen)
 {
   (void) hstart;
   while (*pos < hend)
   {
     size_t ls = *pos;
     size_t le;
     size_t colon = (size_t) -1;
     size_t vs;
     size_t o = 0;
 
     le = ls;
     while ( (le < hend) &&
             ('\n' != buf[le]) )
       le++;
     for (size_t i = ls; (i < le) && (i - ls < 128); i++)
     {
       if (':' == buf[i])
       {
         colon = i;
         break;
       }
       /* a field name is printable ASCII other than the colon */
       if ( (buf[i] < 33) ||
            (buf[i] > 126) )
         break;
     }
     if ( (((size_t) -1) == colon) ||
          (colon == ls) )
     {
       *pos = (le < hend) ? le + 1 : hend;
       continue;   /* not a header line; skip it */
     }
     *nstart = ls;
     *nlen = colon - ls;
     vs = colon + 1;
     while ( (vs < le) &&
             ( (' ' == buf[vs]) || ('\t' == buf[vs]) ) )
       vs++;
     {
       size_t e = le;
 
       while ( (e > vs) &&
               ('\r' == buf[e - 1]) )
         e--;
       if (e - vs > valsize - 1)
         e = vs + valsize - 1;
       memcpy (val,
               &buf[vs],
               e - vs);
       o = e - vs;
     }
     *pos = (le < hend) ? le + 1 : hend;
     /* fold in the continuation lines */
     while (*pos < hend)
     {
       size_t cs = *pos;
       size_t ce;
       size_t ts;
 
       if ( (' ' != buf[cs]) &&
            ('\t' != buf[cs]) )
         break;
       ce = cs;
       while ( (ce < hend) &&
               ('\n' != buf[ce]) )
         ce++;
       ts = cs;
       while ( (ts < ce) &&
               ( (' ' == buf[ts]) || ('\t' == buf[ts]) ) )
         ts++;
       {
         size_t e = ce;
 
         while ( (e > ts) &&
                 ('\r' == buf[e - 1]) )
           e--;
         if ( (o + 1 < valsize) &&
              (0 != o) )
           val[o++] = ' ';
         if (e - ts > valsize - 1 - o)
           e = ts + (valsize - 1 - o);
         if (e > ts)
         {
           memcpy (&val[o],
                   &buf[ts],
                   e - ts);
           o += e - ts;
         }
       }
       *pos = (ce < hend) ? ce + 1 : hend;
     }
     val[o] = '\0';
     *vlen = o;
     return 1;
   }
   return 0;
 }
 
 
 /**
  * Does the buffer start with something that is plausibly an RFC 5322
  * header block?
  *
  * Deliberately strict: "a text file with colons in it" is not a mail
  * message, and claiming one would be worse than missing a real message.
  * We require a well-formed `Name: value' block, with folded
  * continuations, terminated by a blank line, and at least one of the
  * fields a message cannot really do without.
  *
  * @param buf the buffer
  * @param len number of bytes in @a buf
  * @return 1 if this looks like a message, 0 if not
  */
 static int
 mbox_looks_like_message (const char *buf,
                          size_t len)
 {
   size_t i = 0;
   unsigned int fields = 0;
   int required = 0;
 
   if (len > MBOX_MAGIC_WINDOW)
     len = MBOX_MAGIC_WINDOW;
   for (unsigned int line = 0; line < 200; line++)
   {
     size_t ls = i;
     size_t le;
     size_t colon = (size_t) -1;
 
     if (ls >= len)
       return 0;   /* ran out before the blank line: too little evidence */
     le = ls;
     while ( (le < len) &&
             ('\n' != buf[le]) )
       le++;
     if ( (le == ls) ||
          ( (le == ls + 1) && ('\r' == buf[ls]) ) )
       return ( (0 != required) && (fields >= 2) );   /* blank line */
     if ( (' ' == buf[ls]) ||
          ('\t' == buf[ls]) )
     {
       if (0 == fields)
         return 0;   /* a continuation cannot come first */
       i = (le < len) ? le + 1 : len;
       continue;
     }
     for (size_t k = ls; (k < le) && (k - ls < 100); k++)
     {
       if (':' == buf[k])
       {
         colon = k;
         break;
       }
       if ( (buf[k] < 33) ||
            (buf[k] > 126) )
         return 0;   /* not a field name */
     }
     if ( (((size_t) -1) == colon) ||
          (colon == ls) )
       return 0;
     fields++;
     if (mbox_ieq (&buf[ls], colon - ls, "received") ||
         mbox_ieq (&buf[ls], colon - ls, "message-id") ||
         mbox_ieq (&buf[ls], colon - ls, "from") ||
         mbox_ieq (&buf[ls], colon - ls, "date") ||
         mbox_ieq (&buf[ls], colon - ls, "subject") )
       required = 1;
     if (le >= len)
       return 0;
     i = le + 1;
   }
   return 0;
 }
 
 
 /**
  * Report the attachment names, and the charset of the first MIME part,
  * out of the first message's body.
  *
  * @param ec extraction context
  * @param buf the buffer
  * @param from offset of the first body byte
  * @param to offset one past the last body byte
  * @param[in,out] st plugin state, for the charset fallback
  * @return 1 if the caller should stop extracting, 0 to continue
  */
 static int
 mbox_do_body (struct EXTRACTOR_ExtractContext *ec,
               const char *buf,
               size_t from,
               size_t to,
               struct MboxState *st)
 {
   unsigned int emitted = 0;
   size_t i = from;
 
   if (to > from + MBOX_BODY_SCAN)
     to = from + MBOX_BODY_SCAN;
   while ( (i < to) &&
           (emitted < EXTRACTOR_FORENSIC_MAX_ITEMS) )
   {
     size_t ls = i;
     size_t nstart;
     size_t nlen;
     size_t vlen;
     size_t pos = ls;
     int is_disp;
     int is_type;
 
     /* advance to the start of the next line first, so that we always
        make progress even when the line is not one we want */
     {
       size_t le = ls;
 
       while ( (le < to) &&
               ('\n' != buf[le]) )
         le++;
       i = (le < to) ? le + 1 : to;
     }
     is_disp = ( (ls + 20 <= to) &&
                 mbox_ieq (&buf[ls], 20, "Content-Disposition:") );
     is_type = ( (ls + 13 <= to) &&
                 mbox_ieq (&buf[ls], 13, "Content-Type:") );
     if ( (! is_disp) &&
          (! is_type) )
       continue;
     if (! mbox_next_header (buf,
                             ls,
                             to,
                             &pos,
                             &nstart,
                             &nlen,
                             st->val,
                             sizeof (st->val),
                             &vlen))
       continue;
     i = pos;   /* skip the folded continuation lines as well */
     {
       char param[MBOX_MAX_PARAM];
       size_t plen;
 
       plen = mbox_param (st->val,
                          vlen,
                          "filename",
                          param,
                          sizeof (param));
       if (0 == plen)
         plen = mbox_param (st->val,
                            vlen,
                            "name",
                            param,
                            sizeof (param));
       if (0 != plen)
       {
         int seen = 0;
 
         for (unsigned int k = 0; k < st->nfnames; k++)
           if ( (strlen (st->fnames[k]) == plen) &&
                (0 == memcmp (st->fnames[k],
                              param,
                              plen)) )
           {
             seen = 1;
             break;
           }
         if (! seen)
         {
           if (st->nfnames < MBOX_MAX_FILENAMES)
           {
             memcpy (st->fnames[st->nfnames],
                     param,
                     plen);
             st->fnames[st->nfnames][plen] = '\0';
             st->nfnames++;
           }
           emitted++;
           if (mbox_emit_hdr (ec,
                              EXTRACTOR_METATYPE_FILENAME,
                              param,
                              plen))
             return 1;
         }
       }
       if (is_type &&
           ('\0' == st->h.charset[0]) )
       {
         plen = mbox_param (st->val,
                            vlen,
                            "charset",
                            param,
                            sizeof (param));
         if (0 != plen)
           mbox_store (st->h.charset,
                       sizeof (st->h.charset),
                       param,
                       plen);
       }
     }
   }
   return 0;
 }
 
 
 /**
  * Main entry method for the mbox extraction plugin.
  *
  * @param ec extraction context provided to the plugin
  */
 void
 EXTRACTOR_mbox_extract_method (struct EXTRACTOR_ExtractContext *ec);
 
 void
 EXTRACTOR_mbox_extract_method (struct EXTRACTOR_ExtractContext *ec)
 {
   char head[MBOX_MAGIC_WINDOW];
   char *buf = NULL;
   struct MboxState *st = NULL;
   size_t hlen = 0;
   size_t len = 0;
   size_t cap;
   size_t hstart;
   size_t hend;
   size_t body;
   size_t msg1_end;
   size_t pos;
   size_t nstart;
   size_t nlen;
   size_t vlen;
   uint64_t fsize;
   uint64_t messages = 1;
   unsigned int received = 0;
   unsigned int recipients = 0;
   int is_mbox;
   int truncated;
 
   /* Magic first: for a mailbox the file must literally start with
      `From ', and for a bare message the header block has to hold up to
      inspection.  Nothing else gets past this point. */
   {
     void *data;
     ssize_t ret;
 
     if (0 != ec->seek (ec->cls,
                        0,
                        SEEK_SET))
       return;
     while (hlen < sizeof (head))
     {
       ret = ec->read (ec->cls,
                       &data,
                       sizeof (head) - hlen);
       if (0 >= ret)
         break;
       if (((size_t) ret) > sizeof (head) - hlen)
         return;   /* the IPC layer is misbehaving */
       memcpy (&head[hlen],
               data,
               (size_t) ret);
       hlen += (size_t) ret;
     }
   }
   if (hlen < 32)
     return;
   is_mbox = (0 == memcmp (head,
                           "From ",
                           5));
   if (! is_mbox)
   {
     if (! mbox_looks_like_message (head,
                                    hlen))
       return;
   }
   else
   {
     /* the envelope line must be followed by a header block */
     size_t nl = 0;
 
     while ( (nl < hlen) &&
             ('\n' != head[nl]) )
       nl++;
     if ( (nl + 1 >= hlen) ||
          (! mbox_looks_like_message (&head[nl + 1],
                                      hlen - nl - 1)) )
       return;
   }
 
   fsize = ec->get_size (ec->cls);
   cap = MBOX_SCAN_CAP;
   if ( (UINT64_MAX != fsize) &&
        (fsize < (uint64_t) cap) )
     cap = (size_t) fsize;
   if (cap < hlen)
     cap = hlen;
   buf = malloc (cap);
   if (NULL == buf)
     return;
   st = malloc (sizeof (struct MboxState));
   if (NULL == st)
   {
     free (buf);
     return;
   }
   memset (st,
           0,
           sizeof (struct MboxState));
   if (0 != ec->seek (ec->cls,
                      0,
                      SEEK_SET))
     goto out;
   while (len < cap)
   {
     void *data;
     ssize_t ret;
 
     ret = ec->read (ec->cls,
                     &data,
                     cap - len);
     if (0 >= ret)
       break;
     if (((size_t) ret) > cap - len)
       break;   /* the IPC layer is misbehaving */
     memcpy (&buf[len],
             data,
             (size_t) ret);
     len += (size_t) ret;
   }
   if (len < 32)
     goto out;
   truncated = ( (UINT64_MAX == fsize) ||
                 (fsize > (uint64_t) len) );
 
   if (0 != ec->proc (ec->cls,
                      "mbox",
                      EXTRACTOR_METATYPE_MIMETYPE,
                      EXTRACTOR_METAFORMAT_UTF8,
                      "text/plain",
                      is_mbox ? "application/mbox" : "message/rfc822",
                      is_mbox
                      ? strlen ("application/mbox") + 1
                      : strlen ("message/rfc822") + 1))
     goto out;
 
   /* Where the first message's headers start, and where the next message
      begins.  A line that starts with "From " is a separator; the mboxo
      escaping of a body line that would look like one is ">From ", which
      is why this counts fewer than it might otherwise. */
   hstart = 0;
   msg1_end = len;
   if (is_mbox)
   {
     while ( (hstart < len) &&
             ('\n' != buf[hstart]) )
       hstart++;
     if (hstart < len)
       hstart++;
     for (size_t i = hstart; i + 6 <= len; i++)
       if ( ('\n' == buf[i]) &&
            (0 == memcmp (&buf[i + 1],
                          "From ",
                          5)) )
       {
         if (len == msg1_end)
           msg1_end = i + 1;
         messages++;
       }
   }
 
   /* the header block ends at the first blank line */
   hend = len;
   {
     size_t i = hstart;
 
     for (unsigned int line = 0;
          (line < MBOX_MAX_HDR_LINES) && (i < len);
          line++)
     {
       size_t le = i;
 
       while ( (le < len) &&
               ('\n' != buf[le]) )
         le++;
       if ( (le == i) ||
            ( (le == i + 1) && ('\r' == buf[i]) ) )
       {
         hend = i;
         break;
       }
       if (le >= len)
       {
         hend = len;
         break;
       }
       i = le + 1;
       if (i - hstart > MBOX_MAX_HDR_BLOCK)
       {
         hend = i;
         break;
       }
     }
     if (hend > msg1_end)
       hend = msg1_end;
     body = hend;
     while ( (body < msg1_end) &&
             ( ('\r' == buf[body]) || ('\n' == buf[body]) ) )
       body++;
   }
 
   /* pass over the header fields */
   pos = hstart;
   while (mbox_next_header (buf,
                            hstart,
                            hend,
                            &pos,
                            &nstart,
                            &nlen,
                            st->val,
                            sizeof (st->val),
                            &vlen))
   {
     const char *n = &buf[nstart];
 
     if (mbox_ieq (n, nlen, "received"))
     {
       /* The route the message actually took, most recent hop first.
          Everything up to the `;' is the routing part; what follows is
          the receiving MTA's timestamp, which we do not need. */
       size_t l = vlen;
 
       for (size_t k = 0; k < vlen; k++)
         if (';' == st->val[k])
         {
           l = k;
           break;
         }
       mbox_harvest_bracketed (st->val,
                               vlen,
                               &st->ips);
       if (received < EXTRACTOR_FORENSIC_MAX_ITEMS)
       {
         received++;
         if (EXTRACTOR_forensic_emit_text_ (ec,
                                            "mbox",
                                            EXTRACTOR_METATYPE_RECEIVED_FROM,
                                            st->val,
                                            l))
           goto out;
       }
       continue;
     }
     if (mbox_ieq (n, nlen, "x-originating-ip") ||
         mbox_ieq (n, nlen, "x-forwarded-for") ||
         mbox_ieq (n, nlen, "x-sender-ip") )
     {
       mbox_harvest_tokens (st->val,
                            vlen,
                            &st->ips);
       continue;
     }
     if (mbox_ieq (n, nlen, "from"))
       mbox_store (st->h.from, sizeof (st->h.from), st->val, vlen);
     else if (mbox_ieq (n, nlen, "to"))
       mbox_store (st->h.to, sizeof (st->h.to), st->val, vlen);
     else if (mbox_ieq (n, nlen, "cc"))
       mbox_store (st->h.cc, sizeof (st->h.cc), st->val, vlen);
     else if (mbox_ieq (n, nlen, "subject"))
       mbox_store (st->h.subject, sizeof (st->h.subject), st->val, vlen);
     else if (mbox_ieq (n, nlen, "date"))
       mbox_store (st->h.date, sizeof (st->h.date), st->val, vlen);
     else if (mbox_ieq (n, nlen, "message-id"))
       mbox_store (st->h.msgid, sizeof (st->h.msgid), st->val, vlen);
     else if (mbox_ieq (n, nlen, "in-reply-to"))
       mbox_store (st->h.inreplyto, sizeof (st->h.inreplyto), st->val, vlen);
     else if (mbox_ieq (n, nlen, "references"))
       mbox_store (st->h.references, sizeof (st->h.references), st->val, vlen);
     else if (mbox_ieq (n, nlen, "x-mailer") ||
              mbox_ieq (n, nlen, "user-agent") )
       mbox_store (st->h.mailer, sizeof (st->h.mailer), st->val, vlen);
     else if (mbox_ieq (n, nlen, "organization"))
       mbox_store (st->h.org, sizeof (st->h.org), st->val, vlen);
     else if (mbox_ieq (n, nlen, "content-type"))
       mbox_store (st->h.ctype, sizeof (st->h.ctype), st->val, vlen);
     else if (mbox_ieq (n, nlen, "dkim-signature"))
       mbox_store (st->h.dkim, sizeof (st->h.dkim), st->val, vlen);
     else if (mbox_ieq (n, nlen, "authentication-results"))
       mbox_store (st->h.authres, sizeof (st->h.authres), st->val, vlen);
   }
 
   /* From: split into the display name and the addr-spec */
   if ('\0' != st->h.from[0])
   {
     size_t ns;
     size_t nl2;
     size_t as;
     size_t al;
 
     mbox_split_addr (st->h.from,
                      strlen (st->h.from),
                      &ns,
                      &nl2,
                      &as,
                      &al);
     if ( (0 != nl2) &&
          mbox_emit_hdr (ec,
                         EXTRACTOR_METATYPE_AUTHOR_NAME,
                         &st->h.from[ns],
                         nl2) )
       goto out;
     if ( (0 != al) &&
          EXTRACTOR_forensic_emit_text_ (ec,
                                         "mbox",
                                         EXTRACTOR_METATYPE_AUTHOR_EMAIL,
                                         &st->h.from[as],
                                         al) )
       goto out;
   }
   if ( ('\0' != st->h.to[0]) &&
        mbox_emit_addr_list (ec,
                             EXTRACTOR_METATYPE_RECIPIENT,
                             st->h.to,
                             strlen (st->h.to),
                             &recipients) )
     goto out;
   if ( ('\0' != st->h.cc[0]) &&
        mbox_emit_addr_list (ec,
                             EXTRACTOR_METATYPE_RECIPIENT,
                             st->h.cc,
                             strlen (st->h.cc),
                             &recipients) )
     goto out;
   if ('\0' != st->h.subject[0])
   {
     if (mbox_emit_hdr (ec,
                        EXTRACTOR_METATYPE_SUBJECT,
                        st->h.subject,
                        strlen (st->h.subject)))
       goto out;
     if (mbox_emit_hdr (ec,
                        EXTRACTOR_METATYPE_TITLE,
                        st->h.subject,
                        strlen (st->h.subject)))
       goto out;
   }
   if ('\0' != st->h.date[0])
   {
     int64_t when;
 
     if (mbox_parse_date (st->h.date,
                          strlen (st->h.date),
                          &when))
     {
       if (EXTRACTOR_forensic_emit_unix_time_ (ec,
                                               "mbox",
                                               EXTRACTOR_METATYPE_CREATION_DATE,
                                               when))
         goto out;
     }
     else if (EXTRACTOR_forensic_emit_text_ (ec,
                                             "mbox",
                                             EXTRACTOR_METATYPE_UNKNOWN_DATE,
                                             st->h.date,
                                             strlen (st->h.date)))
     {
       goto out;
     }
   }
   /* Message-ID: the right-hand side of the `@' is, for most mailers,
      the name of the machine that composed the message -- often an
      internal host name that appears nowhere else in the file.  Where it
      does not match any domain the sender is known to use, that is a
      lead worth following. */
   if ('\0' != st->h.msgid[0])
   {
     const char *v = st->h.msgid;
     size_t l = strlen (v);
 
     if ( (l >= 2) &&
          ('<' == v[0]) &&
          ('>' == v[l - 1]) )
     {
       v++;
       l -= 2;
     }
     if (EXTRACTOR_forensic_emit_text_ (ec,
                                        "mbox",
                                        EXTRACTOR_METATYPE_MESSAGE_ID,
                                        v,
                                        l))
       goto out;
   }
   {
     const char *v = NULL;
     size_t l = 0;
 
     if ('\0' != st->h.inreplyto[0])
     {
       v = st->h.inreplyto;
       l = strlen (v);
     }
     else if ('\0' != st->h.references[0])
     {
       /* the last entry of References is the message being replied to */
       size_t rl = strlen (st->h.references);
       size_t lt = (size_t) -1;
 
       for (size_t i = rl; i > 0; i--)
         if ('<' == st->h.references[i - 1])
         {
           lt = i - 1;
           break;
         }
       if (((size_t) -1) != lt)
       {
         v = &st->h.references[lt];
         l = rl - lt;
       }
     }
     if (NULL != v)
     {
       if ( (l >= 2) &&
            ('<' == v[0]) &&
            ('>' == v[l - 1]) )
       {
         v++;
         l -= 2;
       }
       if ( (0 != l) &&
            EXTRACTOR_forensic_emit_text_ (ec,
                                           "mbox",
                                           EXTRACTOR_METATYPE_IN_REPLY_TO,
                                           v,
                                           l) )
         goto out;
     }
   }
   for (unsigned int i = 0; i < st->ips.count; i++)
     if (EXTRACTOR_forensic_emit_text_ (ec,
                                        "mbox",
                                        EXTRACTOR_METATYPE_IP_ADDRESS,
                                        st->ips.ip[i],
                                        strlen (st->ips.ip[i])))
       goto out;
   if ( ('\0' != st->h.mailer[0]) &&
        mbox_emit_hdr (ec,
                       EXTRACTOR_METATYPE_CREATED_BY_SOFTWARE,
                       st->h.mailer,
                       strlen (st->h.mailer)) )
     goto out;
   if ('\0' != st->h.dkim[0])
   {
     /* the `d=' tag names the domain that signed the message */
     char dom[256];
     size_t dl;
 
     dl = mbox_param (st->h.dkim,
                      strlen (st->h.dkim),
                      "d",
                      dom,
                      sizeof (dom));
     if ( (0 == dl) &&
          (strlen (st->h.dkim) > 2) &&
          ('d' == st->h.dkim[0]) &&
          ('=' == st->h.dkim[1]) )
     {
       /* mbox_param() only sees parameters after a `;'; a signature that
          opens with the d= tag needs this. */
       size_t k = 2;
 
       while ( (k < strlen (st->h.dkim)) &&
               (';' != st->h.dkim[k]) )
         k++;
       dl = k - 2;
       if (dl >= sizeof (dom))
         dl = sizeof (dom) - 1;
       memcpy (dom,
               &st->h.dkim[2],
               dl);
       dom[dl] = '\0';
     }
     if ( (0 != dl) &&
          EXTRACTOR_forensic_emit_text_ (ec,
                                         "mbox",
                                         EXTRACTOR_METATYPE_SIGNER,
                                         dom,
                                         dl) )
       goto out;
   }
   if ( ('\0' != st->h.authres[0]) &&
        EXTRACTOR_forensic_emit_ (ec,
                                  "mbox",
                                  EXTRACTOR_METATYPE_COMMENT,
                                  "Authentication-Results: %s",
                                  st->h.authres) )
     goto out;
   if ( ('\0' != st->h.org[0]) &&
        mbox_emit_hdr (ec,
                       EXTRACTOR_METATYPE_ORGANIZATION,
                       st->h.org,
                       strlen (st->h.org)) )
     goto out;
   if ('\0' != st->h.ctype[0])
   {
     size_t l = strlen (st->h.ctype);
     size_t m = 0;
     char param[MBOX_MAX_PARAM];
     size_t plen;
 
     while ( (m < l) &&
             (';' != st->h.ctype[m]) )
       m++;
     if ( (0 != m) &&
          EXTRACTOR_forensic_emit_text_ (ec,
                                         "mbox",
                                         EXTRACTOR_METATYPE_FORMAT,
                                         st->h.ctype,
                                         m) )
       goto out;
     plen = mbox_param (st->h.ctype,
                        l,
                        "charset",
                        param,
                        sizeof (param));
     if (0 != plen)
       mbox_store (st->h.charset,
                   sizeof (st->h.charset),
                   param,
                   plen);
     plen = mbox_param (st->h.ctype,
                        l,
                        "boundary",
                        param,
                        sizeof (param));
     if ( (0 != plen) &&
          EXTRACTOR_forensic_emit_ (ec,
                                    "mbox",
                                    EXTRACTOR_METATYPE_COMMENT,
                                    "MIME boundary: %.*s",
                                    (int) plen,
                                    param) )
       goto out;
   }
   /* Attachment names, and -- when the message itself is multipart, so
      that its own Content-Type carries no charset -- the charset of the
      first part. */
   if ( (body < msg1_end) &&
        mbox_do_body (ec,
                      buf,
                      body,
                      msg1_end,
                      st) )
     goto out;
   if ( ('\0' != st->h.charset[0]) &&
        EXTRACTOR_forensic_emit_text_ (ec,
                                       "mbox",
                                       EXTRACTOR_METATYPE_CHARACTER_SET,
                                       st->h.charset,
                                       strlen (st->h.charset)) )
     goto out;
   if (EXTRACTOR_forensic_emit_ (ec,
                                 "mbox",
                                 EXTRACTOR_METATYPE_ENTRY_COUNT,
                                 "%llu",
                                 (unsigned long long) messages))
     goto out;
   if (truncated &&
       EXTRACTOR_forensic_emit_ (ec,
                                 "mbox",
                                 EXTRACTOR_METATYPE_COMMENT,
                                 "scan truncated at 256 KiB; the message"
                                 " count above covers only that prefix of"
                                 " the file") )
     goto out;
 out:
   free (st);
   free (buf);
 }
 
 
 /* end of mbox_extractor.c */