eximconf: reject messages that the sender says are spam

[mirror/dsa-puppet.git] / modules / exim / templates / eximconf.erb

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 1441c9b..da1b73f 100644 (file)
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -810,7 +810,7 @@ check_recipient:
     log_message = greylisted.
     condition      = ${if or { \
                                  {eq{$acl_m_grey_recip}{1}} \
-                                 {bool_lax{HAS_DEFAULT_OPTIONS}} \
+                                 {bool_lax{$acl_m_defopt}} \
                              } \
                       }
     !senders       = :
@@ -851,7 +851,7 @@ check_recipient:
     domains        = +handled_domains
     condition      = ${if or { \
                                  {eq{$acl_m_grey_recip}{1}} \
-                                 {bool_lax{HAS_DEFAULT_OPTIONS}} \
+                                 {bool_lax{$acl_m_defopt}} \
                              } \
                       }
     set acl_m_pgr  = request=smtpd_access_policy\n\
@@ -881,7 +881,7 @@ check_recipient:
     domains        = +handled_domains
     condition      = ${if or { \
                                  {eq{$acl_m_grey_recip}{1}} \
-                                 {bool_lax{HAS_DEFAULT_OPTIONS}} \
+                                 {bool_lax{$acl_m_defopt}} \
                              } \
                       }
     condition      = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}}
@@ -900,7 +900,7 @@ check_recipient:
           domains       = +virtual_domains : +bsmtp_domains
 
 <%- unless @use_smarthost -%>
-  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
                     {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}\
                     {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}{$value}{}}}{}}}\
@@ -909,19 +909,19 @@ check_recipient:
          domains       = +handled_domains
          !hosts        = +debianhosts : WHITELIST
 
-  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           dnslists = noserver.dnsbl.sorbs.net
           domains  = +handled_domains
           !hosts   = +debianhosts : WHITELIST
 
-  deny    message   = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
-          condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}}
+  deny    message   = host $sender_host_address is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
+          condition = ${if bool_lax{$acl_m_defopt}}
           dnslists  = relays.dnsbl.sorbs.net : xbl.spamhaus.org
           domains   = +handled_domains
           !hosts    = +debianhosts : WHITELIST
 
 <%- end -%>
-  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
                     {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}\
                     {${expand:${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}{$value}{}}}}{}}}\
@@ -930,13 +930,13 @@ check_recipient:
          domains       = +handled_domains
          !hosts        = +debianhosts : WHITELIST
 
-  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain
           domains  = +handled_domains
           !hosts   = +debianhosts : WHITELIST
 
-  deny    message   = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
-          condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}}
+  deny    message   = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
+          condition = ${if bool_lax{$acl_m_defopt}}
           dnslists  = dbl.spamhaus.org/$sender_address_domain
           domains   = +handled_domains
           !hosts    = +debianhosts : WHITELIST
@@ -1020,6 +1020,10 @@ check_message:
   # header.  Take their crack pipe away.
   drop   condition = ${if match{${lc:$h_From:}}{\Npostmaster@([^.]+\.)?debian\.org\N}}
 
+  # If the sending system says the mail is spam, believe them
+  deny    condition = ${if eqi {$h_X-Spam-Status:}{YES}}
+          message   = Incoming spam flags
+
 <%- if @is_rtmaster -%>
   deny    condition = ${if eq {$acl_m_prf}{RTMail}}
           condition = ${if and{{!match {${lc:$rh_Subject:}} {debian rt}} \
@@ -1056,7 +1060,7 @@ check_message:
 # postfix's strict_7bit_headers option, but only checks a few common problem
 # headers, as there doesn't appear to be an easy way to check them all.
   deny
-         condition       = ${if or {{match {$rh_Subject:}{[\200-\377]}}\
+         condition       = ${if or {{match {$rh_Subject:}{[\200-\377]}}\
                                 {match {$rh_To:}{[\200-\377]}}\
                                 {match {$rh_From:}{[\200-\377]}}\
                                 {match {$rh_Cc:}{[\200-\377]}}}}