X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=38e89bd777b6bcb6a6b3889f345d86555327b701;hb=3aefff738687e27e594f9860bbab971f98cf94ab;hp=87cb24b252c6543ad9ef6a724974cdc17fa42b6b;hpb=6223d29ea525ff1ef4626af124280d5f10fea746;p=mirror%2Fdsa-puppet.git

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 87cb24b25..38e89bd77 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -108,6 +108,7 @@ if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty?
 end
 out
 %>
+acl_smtp_predata = acl_check_predata
 
 # accept domain literal syntax in e-mail addresses. To actually make use of
 # this a router is also required
@@ -280,6 +281,13 @@ RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
 ######################################################################
 begin acl
 
+acl_localonly:
+  accept  local_parts   = +local_only_users
+          domains       = +local_domains
+          hosts         = !+debianhosts
+
+  deny
+
 check_helo:
 
   warn    set acl_c1    = 0
@@ -513,10 +521,22 @@ out
           condition     = ${if match_local_part {$sender_address_local_part}{${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}{1}{0}}
 	  message       = no mail should ever come from <$sender_address>
 
-  deny    local_parts   = +local_only_users
-  	  domains       = +local_domains
-          hosts         = !+debianhosts
-	  message       = mail for $local_part is only accepted internally
+  warn    condition     = ${if eq{$acl_m6}{}}
+          acl           = acl_localonly
+          set acl_m6    = localonly
+          set acl_m7    = ${if eq{$acl_m7}{}{$local_part@$domain}{$acl_m7, $local_part@$domain}}
+
+  warn    condition     = ${if eq{$acl_m6}{}}
+          !acl          = acl_localonly
+          set acl_m6    = normal
+
+  defer   condition     = ${if eq{$acl_m6}{localonly}}
+          !acl          = acl_localonly
+          log_message   = Only one profile at a time, please
+
+  defer   condition     = ${if eq{$acl_m6}{normal}}
+          acl           = acl_localonly
+          log_message   = Only one profile at a time, please
 
 <%=
 out=''
@@ -550,7 +570,7 @@ out = '
   # closure, but I\'m fairly sure it\'s now worth it, since the backport of
   # policyd-weight is trivial.
   warn  !hosts         = +debianhosts
-        set acl_m9     = ${readsocket{inet:127.0.0.1:12525}\
+        set acl_m_pw   = ${readsocket{inet:127.0.0.1:12525}\
                           {request=smtpd_access_policy\n\
                            protocol_state=RCPT\n\
                            protocol_name=${uc:$received_protocol}\n\
@@ -567,33 +587,33 @@ out = '
 
   # Defer on socket error
   defer !hosts         = +debianhosts
-        condition      = ${if eq{$acl_m9}{socket failure}{yes}{no}}
+        condition      = ${if eq{$acl_m_pw}{socket failure}{yes}{no}}
         message        = Cannot connect to policyd-weight. Please try again later.
 
-  # Set proposed action to $acl_m8 and message to $acl_m7
+  # Set proposed action to $acl_m_act and message to $acl_m_mes
   warn  !hosts         = +debianhosts
-        set acl_m8     = ${extract{action}{$acl_m9}}
-        set acl_m7     = ${sg{$acl_m9}{\Naction=[^ ]+ (.*)\n\n\N}{\$1}}
+        set acl_m_mes  = ${extract{action}{$acl_m_pw}}
+        set acl_m_act  = ${sg{$acl_m_pw}{\Naction=[^ ]+ (.*)\n\n\N}{\$1}}
 
   # Add X-policyd-weight header line to message
   warn  !hosts         = +debianhosts
-        message        = $acl_m7
-        condition      = ${if eq{$acl_m8}{PREPEND}{yes}{no}}
+        message        = $acl_m_mes
+        condition      = ${if eq{$acl_m_act}{PREPEND}{yes}{no}}
 
   # Write log message, if policyd-weight can\'t run checks
   warn  !hosts         = +debianhosts
-        log_message    = policyd-weight message: $acl_m7
-        condition      = ${if eq{$acl_m8}{DUNNO}{yes}{no}}
+        log_message    = policyd-weight message: $acl_m_mes
+        condition      = ${if eq{$acl_m_act}{DUNNO}{yes}{no}}
 
   # Deny mails which policyd-weight thinks are spam
   deny  !hosts         = +debianhosts
-        message        = policyd-weight said: $acl_m7
-        condition      = ${if eq{$acl_m8}{550}{yes}{no}}
+        message        = policyd-weight said: $acl_m_mes
+        condition      = ${if eq{$acl_m_act}{550}{yes}{no}}
 
   # Defer messages when policyd-weight suggests so.
   defer  !hosts         = +debianhosts
-         message        = policyd-weight said: $acl_m7
-         condition      = ${if eq{$acl_m8}{450}{yes}{no}}
+         message        = policyd-weight said: $acl_m_mes
+         condition      = ${if eq{$acl_m_act}{450}{yes}{no}}
 '
 end
 out
@@ -614,7 +634,7 @@ out
 %>
 <%=
 out=''
-if nodeinfo['packagesmaster']
+if nodeinfo['packagesqamaster']
   out='
   warn    domains  = packages.qa.debian.org
           set acl_m1 = PTSMail
@@ -663,12 +683,12 @@ if has_variable?("greylistd") && greylistd == "true"
 elsif has_variable?("postgrey") && postgrey == "true"
   out = '
   # next three are greylisting, inspired by http://www.bebt.de/blog/debian/archives/2006/07/30/T06_12_27/index.html
-  # this adds acl_m4 if there isn\'t one (so unique per message)
+  # this adds acl_m_grey if there isn\'t one (so unique per message)
   warn
     !senders       = :
     !hosts         = : +debianhosts : WHITELIST
-    condition      = ${if def:acl_m4 {no}{yes}}
-    set acl_m4     = $pid.$tod_epoch.$sender_host_port
+    condition      = ${if def:acl_m_grey {no}{yes}}
+    set acl_m_grey = $pid.$tod_epoch.$sender_host_port
 
   # and defers the message if postgrey thinks it should be defered ...
   defer
@@ -677,22 +697,22 @@ elsif has_variable?("postgrey") && postgrey == "true"
     !authenticated = *
     domains        = +handled_domains : +rcpthosts
     local_parts    = GREYLIST_LOCAL_PARTS
-    set acl_m3     = request=smtpd_access_policy\n\
+    set acl_m_pgr  = request=smtpd_access_policy\n\
                      protocol_state=RCPT\n\
                      protocol_name=${uc:$received_protocol}\n\
-                     instance=${acl_m4}\n\
+                     instance=${acl_m_grey}\n\
                      helo_name=${sender_helo_name}\n\
                      client_address=${substr_-3:${mask:$sender_host_address/24}}\n\
                      client_name=${sender_host_name}\n\
                      sender=${sender_address}\n\
                      recipient=$local_part@$domain\n\n
-    set acl_m3     = ${sg{\
-                         ${readsocket{/var/run/postgrey/socket}{$acl_m3}\
+    set acl_m_pgr  = ${sg{\
+                         ${readsocket{/var/run/postgrey/socket}{$acl_m_pgr}\
                                {5s}{}{action=DUNNO}}\
                      }{action=}{}}
-    message        = ${sg{$acl_m3}{^\\\\w+\\\\s*}{}}
+    message        = ${sg{$acl_m_pgr}{^\\\\w+\\\\s*}{}}
     log_message    = greylisted.
-    condition      = ${if eq{${uc:${substr{0}{5}{$acl_m3}}}}{DEFER}}
+    condition      = ${if eq{${uc:${substr{0}{5}{$acl_m_pgr}}}}{DEFER}}
 
  # ... or adds a header with information about how long the delay was
  warn
@@ -701,8 +721,8 @@ elsif has_variable?("postgrey") && postgrey == "true"
     !authenticated = *
     domains        = +handled_domains : +rcpthosts
     local_parts    = GREYLIST_LOCAL_PARTS
-    condition      = ${if eq{${uc:${substr_0_7:$acl_m3}}}{PREPEND}}
-    message        = ${sg{$acl_m3}{^\\\\w+\\\\s*}{}}
+    condition      = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}}
+    message        = ${sg{$acl_m_pgr}{^\\\\w+\\\\s*}{}}
 '
 end
 out
@@ -777,10 +797,10 @@ out='
 acl_check_mime:
 
   deny   condition     = ${if <{$message_size}{256000}}
-         set acl_m5    = ${perl{surblspamcheck}}
-         condition     = ${if eq{$acl_m5}{false}{no}{yes}}
-         log_message   = $acl_m5
-         message       = $acl_m5
+         set acl_m_srb = ${perl{surblspamcheck}}
+         condition     = ${if eq{$acl_m_srb}{false}{no}{yes}}
+         log_message   = $acl_m_srb
+         message       = $acl_m_srb
 
   accept
 '
@@ -788,6 +808,13 @@ end
 out
 %>
 
+acl_check_predata:
+  deny   condition     = ${if eq{$acl_m6}{localonly}}
+         message       = mail for $acl_m7 is only accepted internally
+
+  accept
+
+
 #!!# ACL that is used after the DATA command
 check_message:
   require verify = header_syntax
@@ -808,7 +835,7 @@ out
 %>
 <%=
 out=''
-if nodeinfo['packagesmaster']
+if nodeinfo['packagesqamaster']
   out='
   deny    !hosts  = +debianhosts : 217.196.43.134
           condition = ${if eq {$acl_m1}{PTSMail}}
@@ -857,23 +884,15 @@ out = '
 end
 out
 %>
-
-  deny    spam            = $value/defer_ok
-          domains         = +handled_domains : +rcpthosts
-          message         = message got a spam score of $spam_score
-          local_parts     = ${if exists {/etc/exim4/sa_users}\
-			     {${if match_domain{$domain}{+virtual_domains}\
-			     {${lookup{$local_part@$domain}nwildlsearch{/etc/exim4/sa_users}{$local_part}{}}}\
-			     {${lookup{$local_part}lsearch{/etc/exim4/sa_users}{$local_part}{}}}}}}
-
 <%=
 out=''
 if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty?
 out='
   deny   condition     = ${if <{$message_size}{256000}}
-         set acl_m5    = ${perl{surblspamcheck}}
-         condition     = ${if eq{$acl_m5}{false}{no}{yes}}
-         log_message   = $acl_m5
+         set acl_m_srb = ${perl{surblspamcheck}}
+         condition     = ${if eq{$acl_m_srb}{false}{no}{yes}}
+         log_message   = $acl_m_srb
+         message       = $acl_m_srb
 '
 end
 out
@@ -1395,6 +1414,7 @@ address_reply:
 remote_smtp:
   driver = smtp
   connect_timeout = 1m
+  delay_after_cutoff = false
 <%=
 out = ""
 if has_variable?("exim_ssl_certs") && exim_ssl_certs == "true"
@@ -1411,6 +1431,7 @@ out = '
 remote_smtp_smarthost:
   debug_print = "T: remote_smtp_smarthost for $local_part@$domain"
   driver = smtp
+  delay_after_cutoff = false
   port = '
   out += nodeinfo['smarthost_port'].to_s + "\n"
   if has_variable?("exim_ssl_certs") && exim_ssl_certs == "true"