X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ffiles%2Fcommon%2Fexim4.conf;h=90d29ed03ef6e63208ef9b0d74e3be58d4b56d68;hb=bbd65692ac82ca6ee5dfc5a32a66eec3a83bef44;hp=0378c3de3ef67d9290db0514c1ccd13fa52866e1;hpb=02a3bf618dc3fb9a644d4c8287ba3098ff498ba3;p=mirror%2Fdsa-puppet.git

diff --git a/modules/exim/files/common/exim4.conf b/modules/exim/files/common/exim4.conf
index 0378c3de3..90d29ed03 100644
--- a/modules/exim/files/common/exim4.conf
+++ b/modules/exim/files/common/exim4.conf
@@ -197,9 +197,12 @@ queue_list_requires_admin = false
 av_scanner = CLAMAV
 .endif
 
-.ifdef HAVE_USER_DEBBUGS MAIL_RELAY
+.ifdef HAVE_USER_DEBBUGS MAIL_RELAY STUPID_FIREWALL
 daemon_smtp_ports = 25 : 587
 .endif
+.ifdef EVEN_MORE_STUPID_FIREWALL
+daemon_smtp_ports = 25 : 2025
+.endif
 
 admin_groups = adm
 remote_sort_domains = *.debian.org:*.debian.net
@@ -316,6 +319,9 @@ check_helo:
 #!!# ACL that is used after the RCPT command on the submission port
 check_submission:
 
+  # Accept if the source is local SMTP (i.e. not over TCP/IP).
+  # We do this by testing for an empty sending host field.
+  accept  hosts = : 127.0.0.1
   # Defer after too many bad RCPT TO's.  Legit MTAs will retry later.
   # This is a rough pass at preventing addres harvesting or other mail blasts.
 
@@ -329,8 +335,20 @@ check_submission:
 
   defer
           ratelimit      = 5 / 60m / per_rcpt / $sender_host_address
+          !hosts         = +debianhosts
           message        = sorry, only 5 reports per hour for submission
 
+  accept  domains  = +local_domains
+          hosts    = +debianhosts
+          endpass
+	  message  = unknown user
+	  verify   = recipient
+
+  accept  domains  = +mailhubdomains
+          endpass
+	  message  = unknown user
+	  verify   = recipient/callout=30s,defer_ok,use_sender,no_cache
+
   accept  domains  = +submission_domains
           endpass
 	  message  = unknown user
@@ -502,7 +520,7 @@ check_recipient:
 
   warn    domains  = rt.debian.org
           set acl_m1 = RTMail
-          set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if match{$local_part}{[^+]+\\+\\d+} {RTMailRecipientHasSubaddress}}}}
+          set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{[^+]+\\+\\d+}}{match{$local_part}{[^+]+\\+new}}} {RTMailRecipientHasSubaddress}}}}
 
   warn    domains  = packages.qa.debian.org
           set acl_m1 = PTSMail
@@ -625,7 +643,7 @@ check_recipient:
   accept  domains  = +mailhubdomains
           endpass
 	  message  = unknown user
-	  verify   = recipient/callout,defer_ok
+	  verify   = recipient/callout=30s,defer_ok,use_sender,no_cache
 
   accept  domains  = +handled_domains
           endpass
@@ -770,6 +788,17 @@ ipliteral:
   transport = remote_smtp
   ignore_target_hosts = +reservedaddrs
 
+.ifdef SMARTHOST
+smarthost:
+  debug_print = "R: smarthost for $local_part@$domain"
+  driver = manualroute
+  domains = !+handled_domains
+  transport = remote_smtp_smarthost
+  route_list = * SMARTHOST
+  host_find_failed = defer
+  same_domain_copy_routing = yes
+  no_more
+.endif
 # This router routes to remote hosts over SMTP using a DNS lookup.
 # Ignore reserved network responses, including localhost.
 dnslookup:
@@ -964,7 +993,18 @@ bugs:
 .endif
 
 # This router delivers for rt.d.o
-rt:
+rt-force-new:
+  debug_print = "R: rt for $local_part+new@$domain"
+  driver = redirect
+  domains = rt.debian.org
+  require_files = /usr/bin/rt-mailgate : RT_QUEUE_MAP
+  local_parts = ${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}{$local_part}{}}
+  local_part_suffix = +new
+  pipe_transport = rt_pipe
+  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
+  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
+
+rt-otherwise:
   debug_print = "R: rt for $local_part@$domain"
   driver = redirect
   domains = rt.debian.org
@@ -1156,11 +1196,20 @@ remote_smtp:
   driver = smtp
   connect_timeout = 1m
 .ifdef USE_TLS
-  tls_tempfail_tryclear = true
   tls_certificate = /etc/exim4/ssl/thishost.crt
   tls_privatekey = /etc/exim4/ssl/thishost.key
-  tls_verify_certificates = /etc/exim4/ssl/ca.crt
-  tls_crl = /etc/exim4/ssl/ca.crl
+.endif
+
+remote_smtp_smarthost:
+  debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
+  driver = smtp
+.ifdef SMARTHST_PORT
+  port = SMARTHST_PORT
+.endif
+.ifdef USE_TLS
+  tls_tempfail_tryclear = false
+  tls_certificate = /etc/exim4/ssl/thishost.crt
+  tls_privatekey = /etc/exim4/ssl/thishost.key
 .endif
 
 # Send the message to procmail