projects / mirror / dsa-puppet.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
exim: treat Subject as a single line during regexp match for RT
[mirror/dsa-puppet.git] / modules / exim / templates / eximconf.erb
diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index aec6edb..9b141ef 100644 (file)
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -77,7 +77,7 @@
 ######################################################################
 
 <%- if scope.lookupvar('site::nodeinfo').has_key?('heavy_exim') and scope.lookupvar('site::nodeinfo')['heavy_exim'] -%>
-perl_startup = do '/etc/exim4/exim_surbl.pl'
+ perl_startup = do '/etc/exim4/exim_surbl.pl'
 <%- end -%>
 
 # These options specify the Access Control Lists (ACLs) that
@@ -151,6 +151,11 @@ host_lookup = *
 
 untrusted_set_sender = *
 
+# Some spam scanners (*cough* irritated *cough*) want the Sender field
+# to exist.  Appease them by not actually adding a Sender field.
+
+local_from_check = false
+
 # Some operating systems use the "gecos" field in the system password file
 # to hold other information in addition to users' real names. Exim looks up
 # this field when it is creating "sender" and "from" headers. If these options
@@ -206,7 +211,7 @@ queue_only_load = 8
 <%- end -%>
 queue_list_requires_admin = false
 
-<%- if has_variable?("clamd") && clamd == "true" -%>
+<%- if has_variable?("clamd") && @clamd -%>
 av_scanner = clamd:/var/run/clamav/clamd.ctl
 <%- end -%>
 
@@ -215,7 +220,7 @@ ports = []
 out = "daemon_smtp_ports = "
 ports << 25
 
-if @is_bugsmaster or @is_bugsmx
+if @is_bugsmx
   ports << 587
 end
 
@@ -264,6 +269,9 @@ GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\
                        ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
 RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
 
+keep_environment =
+add_environment =
+
 ######################################################################
 #                        ACL CONFIGURATION                           #
 ######################################################################
@@ -309,7 +317,7 @@ acl_getprofile:
   accept  condition      = ${if eq {$acl_m_rprf}{}{no}{yes}}
 
 <%- end -%>
-<%- if @is_bugsmaster or @is_bugsmx -%>
+<%- if @is_bugsmx -%>
   warn    domains        = bugs.debian.org
           set acl_m_rprf = BugsMail
 
@@ -589,10 +597,10 @@ check_recipient:
 
   # disabled accounts don't even get local mail.
   deny   domains       = +virtual_domains
-         local_parts   = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}\
-                                     {lsearch;${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}\
+         condition    = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}\
+                                     {${lookup{${extract{1}{-}{$local_part}}}lsearch{${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}{true}{false}}}\
                                      {}}
-         message       = ${lookup{$local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}{$value}}
+         message       = ${lookup{${extract{1}{-}{$local_part}}}lsearch{${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}{$value}}
 
   deny   local_parts   = lsearch;/var/lib/misc/$primary_hostname/mail-disable
          domains       = +local_domains
@@ -634,7 +642,7 @@ check_recipient:
 
   deny    condition     = ${if match_domain{$sender_address_domain}{+virtual_domains}{1}{0}}
           condition     = ${if exists {${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}}{1}{0}}
-          condition     = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}{true}}
+          condition     = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}}{true}}
          message       = no mail should ever come from <$sender_address>
 
   warn    condition     = ${if eq{$acl_m_prf}{localonly}}
@@ -655,7 +663,7 @@ check_recipient:
           ratelimit      = 10 / 60m / per_rcpt / $sender_host_address
           message        = slow down (no reverse dns, mismatched ehlo, dialup, or in blacklists)
 
-<%- if has_variable?("policydweight") && policydweight == "true" -%>
+<%- if has_variable?("policydweight") && @policydweight -%>
   # Check with policyd-weight - this only works with a version after etch's,
   # sadly.  etch's version attempts to hold the socket open, since that's what
   # postfix expects.  Exim, on the other hand, expects the remote side to close
@@ -726,7 +734,7 @@ check_recipient:
 
 
 <%- end -%>
-<%- if has_variable?("greylistd") && greylistd == "true" -%>
+<%- if has_variable?("greylistd") && @greylistd -%>
   defer
     message  = $sender_host_address is not yet authorized to deliver mail from <$sender_address> to <$local_part@$domain>.
     log_message = greylisted.
@@ -751,7 +759,7 @@ check_recipient:
                                   $local_part@$domain}\
                                  {5s}{}{false}}
 
-<%- elsif has_variable?("postgrey") && postgrey == "true" -%>
+<%- elsif has_variable?("postgrey") && @postgrey -%>
   # next three are greylisting, inspired by http://www.bebt.de/blog/debian/archives/2006/07/30/T06_12_27/index.html
   # this adds acl_m_grey if there isn't one (so unique per message)
   warn
@@ -774,7 +782,11 @@ check_recipient:
                      protocol_name=${uc:$received_protocol}\n\
                      instance=${acl_m_grey}\n\
                      helo_name=${sender_helo_name}\n\
+<%- if scope.call_function('versioncmp', [@lsbmajdistrelease, '8']) <= 0 -%>
                      client_address=${substr_-3:${mask:$sender_host_address/24}}\n\
+<%- else -%>
+                     client_address=${sender_host_address}\n\
+<%- end -%>
                      client_name=${sender_host_name}\n\
                      sender=${sender_address}\n\
                      recipient=$local_part@$domain\n\n
@@ -798,9 +810,6 @@ check_recipient:
     message        = ${sg{$acl_m_pgr}{^\\w+\\s*}{}}
 
 <%- end -%>
-  accept  local_parts   = +postmasterish
-          domains       = +virtual_domains : +bsmtp_domains
-
   deny    hosts        = ${if exists{/etc/exim4/host_blacklist}{/etc/exim4/host_blacklist}{}}
           message      = I'm terribly sorry, but it seems you have been blacklisted
           log_message  = blacklisted IP
@@ -809,6 +818,9 @@ check_recipient:
          senders       = ${if exists{/etc/exim4/blacklist}{/etc/exim4/blacklist}{}}
          message       = We have blacklisted <$sender_address>.  Please stop mailing us
 
+  accept  local_parts   = +postmasterish
+          domains       = +virtual_domains : +bsmtp_domains
+
 <%- if scope.lookupvar('site::nodeinfo')['smarthost'].empty? -%>
   deny    message  = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
@@ -948,20 +960,26 @@ check_message:
           condition       = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}}
          message         = Your mailer is not RFC 2047 compliant: message rejected
 
-<%- if has_variable?("clamd") && clamd == "true" -%>
+<%- if has_variable?("clamd") && @clamd -%>
   discard condition       = ${if eq {$acl_m_prf}{blackhole}}
+  <%- if scope.call_function('versioncmp', [@lsbmajdistrelease, '8']) <= 0 -%>
           demime          = *
+  <%- end -%>
           malware         = */defer_ok
           log_message     = discarded malware message for $recipients
 
   deny    condition       = ${if eq {$acl_m_prf}{markup}{no}{yes}}
           condition       = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}}
+  <%- if scope.call_function('versioncmp', [@lsbmajdistrelease, '8']) <= 0 -%>
          demime          = *
+  <%- end -%>
           malware         = */defer_ok
           message         = malware detected: $malware_name: message rejected
 
   warn    condition       = ${if eq {$acl_m_prf}{markup}}
+  <%- if scope.call_function('versioncmp', [@lsbmajdistrelease, '8']) <= 0 -%>
          demime          = *
+  <%- end -%>
           malware         = */defer_ok
           message         = X-malware detected: $malware_name
 
@@ -1017,7 +1035,7 @@ check_message:
 
 begin rewrite
 
-\N^buildd_(.*)@franck\.debian\.org$\N buildd_$1@buildd.debian.org T
+\N^buildd_(.*)@fasolo\.debian\.org$\N buildd_$1@buildd.debian.org T
 *@debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
 *@people.debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
 #*@${primary_hostname} "${if exists{/etc/exim4/email-addresses}{${lookup{$1}lsearch{/etc/exim4/email-addresses}{$value}fail}}fail}" fFs
@@ -1327,9 +1345,9 @@ rt_force_new_verbose:
   local_parts = ${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}{$local_part}{}}
   local_part_suffix = +new
   pipe_transport = rt_pipe
-  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
+  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
   headers_remove = Subject
-  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
+  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?is)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
 
 # FIXME: figure out how to generalize this approach so that all of the following would work
 # - rt+NNNN@rt.debian.org          : attach correspondence to ticket (verbose)
@@ -1344,9 +1362,9 @@ rt_force_new_quiesce:
   local_parts = ${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}{$local_part}{}}
   local_part_suffix = +new-quiesce
   pipe_transport = rt_pipe
-  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
+  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
   headers_remove = Subject
-  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
+  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?is)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
 
 rt_otherwise:
   debug_print = "R: rt for $local_part@$domain"
@@ -1357,7 +1375,7 @@ rt_otherwise:
   local_part_suffix = +*
   local_part_suffix_optional
   pipe_transport = rt_pipe
-  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-(comment|done)}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --extension ticket --action ${if match{$local_part}{.*-comment.*}{comment}{${if match{$local_part}{.*-done.*}{correspond-resolve}{correspond}}}}"
+  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-(comment|done)}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --extension ticket --action ${if match{$local_part}{.*-comment.*}{comment}{${if match{$local_part}{.*-done.*}{correspond-resolve}{correspond}}}}"
   headers_remove = Subject
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
 <%- end -%>
@@ -1450,11 +1468,8 @@ virt_users:
 
 <%=
 out = ""
-if @is_bugsmaster or @is_bugsmx
+if @is_bugsmx
   domain = 'bugs.debian.org'
-  if @is_bugsmaster
-    domain = 'bugs-master.debian.org'
-  end
   out = '
 # This router delivers for bugs.d.o
 bugs:
@@ -1463,12 +1478,12 @@ bugs:
   transport = bugs_pipe
   domains = ' + domain + '
   cannot_route_message = Unknown or archived bug
-  require_files = /org/bugs.debian.org/mail/run-procmail
+  require_files = /srv/bugs.debian.org/mail/run-procmail
   no_more
   local_parts = ${if match\
                   {$local_part}\
                   {\N^(\d+)(\d{2})(?:-(?:(?:submit|maintonly|quiet|forwarded|done|close|request|submitter)|(?:unsubscribe|ignore|help|(?:sub(?:scribe|help|yes|approve|reject))|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*))?$\N}\
-               {${if exists{/org/bugs.debian.org/spool/db-h/$2/$1$2.summary}\
+               {${if exists{/srv/bugs.debian.org/spool/db-h/$2/$1$2.summary}\
               {$local_part}fail}}fail}
 '
 end
@@ -1604,10 +1619,10 @@ bsmtp:
                     {$value}fail}\
                   }}
 
-<%- if @is_bugsmaster or @is_bugsmx -%>
+<%- if @is_bugsmx -%>
 bugs_pipe:
   driver = pipe
-  command = /org/bugs.debian.org/mail/run-procmail
+  command = /srv/bugs.debian.org/mail/run-procmail
   environment = "EXTENSION=${substr_1:${local_part_suffix}}:\
                  EXT=${substr_1:${local_part_suffix}}:\
                  LOCAL=${local_part}${local_part_suffix}:\
Unnamed repository; edit this file 'description' to name the repository.