eximconf: reject messages that the sender says are spam

[mirror/dsa-puppet.git] / modules / exim / templates / eximconf.erb

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index ee73e02..da1b73f 100644 (file)
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -900,7 +900,7 @@ check_recipient:
           domains       = +virtual_domains : +bsmtp_domains
 
 <%- unless @use_smarthost -%>
-  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
                     {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}\
                     {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}{$value}{}}}{}}}\
@@ -909,19 +909,19 @@ check_recipient:
          domains       = +handled_domains
          !hosts        = +debianhosts : WHITELIST
 
-  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           dnslists = noserver.dnsbl.sorbs.net
           domains  = +handled_domains
           !hosts   = +debianhosts : WHITELIST
 
-  deny    message   = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message   = host $sender_host_address is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           condition = ${if bool_lax{$acl_m_defopt}}
           dnslists  = relays.dnsbl.sorbs.net : xbl.spamhaus.org
           domains   = +handled_domains
           !hosts    = +debianhosts : WHITELIST
 
 <%- end -%>
-  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
                     {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}\
                     {${expand:${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}{$value}{}}}}{}}}\
@@ -930,12 +930,12 @@ check_recipient:
          domains       = +handled_domains
          !hosts        = +debianhosts : WHITELIST
 
-  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain
           domains  = +handled_domains
           !hosts   = +debianhosts : WHITELIST
 
-  deny    message   = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+  deny    message   = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value)${if >{${strlen:${dnslist_text}}}{0}{; see $dnslist_text}}
           condition = ${if bool_lax{$acl_m_defopt}}
           dnslists  = dbl.spamhaus.org/$sender_address_domain
           domains   = +handled_domains
@@ -1020,6 +1020,10 @@ check_message:
   # header.  Take their crack pipe away.
   drop   condition = ${if match{${lc:$h_From:}}{\Npostmaster@([^.]+\.)?debian\.org\N}}
 
+  # If the sending system says the mail is spam, believe them
+  deny    condition = ${if eqi {$h_X-Spam-Status:}{YES}}
+          message   = Incoming spam flags
+
 <%- if @is_rtmaster -%>
   deny    condition = ${if eq {$acl_m_prf}{RTMail}}
           condition = ${if and{{!match {${lc:$rh_Subject:}} {debian rt}} \
@@ -1056,7 +1060,7 @@ check_message:
 # postfix's strict_7bit_headers option, but only checks a few common problem
 # headers, as there doesn't appear to be an easy way to check them all.
   deny
-         condition       = ${if or {{match {$rh_Subject:}{[\200-\377]}}\
+         condition       = ${if or {{match {$rh_Subject:}{[\200-\377]}}\
                                 {match {$rh_To:}{[\200-\377]}}\
                                 {match {$rh_From:}{[\200-\377]}}\
                                 {match {$rh_Cc:}{[\200-\377]}}}}