X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=5db40f36c7cc48fe0957593bbdfd89456ab2919e;hb=6901e51f8f300b6a61c812f6841c1e2168e3353b;hp=f55c0f796099aef8b56f5273fc65c917921f5691;hpb=9b3b9b27fccaa62aae90ef3713d3af0407116854;p=mirror%2Fdsa-puppet.git

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index f55c0f796..5db40f36c 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -266,6 +266,7 @@ tls_advertise_hosts = *
 smtp_enforce_sync = true
 
 log_selector = \
+               +subject \
                +tls_cipher \
                +tls_peerdn \
                +queue_time \
@@ -306,7 +307,14 @@ GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\
                        {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\
                        {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \
                        ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
-HAS_DEFAULT_OPTIONS  = ${if eq{${lookup{$local_part}dbmnz{/var/lib/misc/$primary_hostname/default-mail-options.db}{$value}{TRUE}}}{TRUE}}
+# Users from LDAP can decide whether to subscribe to default filtering.
+# If a user has not explicitly disabled the option, the assumption is in
+# favour of filtering.
+HAS_DEFAULT_OPTIONS = ${if and {\
+		        {eq{${lookup{$local_part}dbmnz{/var/lib/misc/$primary_hostname/default-mail-options.db}{$value}{TRUE}}}{TRUE}}\
+		        {exists{${extract{directory}{VDOMAINDATA}{${value}/mail-forward.db}}}}\
+		        {! eq {${lookup{$local_part}dbmnz{${extract{directory}{VDOMAINDATA}{${value}/mail-forward.db}}}}}{}}\
+			}}
 <%- if @is_rtmaster -%>
 # This subject rewrite is embedded in double-quoted strings. As such, some of
 # the items need more escaping than usual, otherwise \N becomes simply "N" and
@@ -700,6 +708,12 @@ check_recipient:
           condition     = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}}{true}}
 	  message       = no mail should ever come from <$sender_address>
 
+  deny    domains       = +virtual_domains
+          senders       = :
+          condition     = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}}
+          condition     = ${lookup{$local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}{true}}
+          message       = <$local_part@$domain> does not send mail; rejecting bogus NDR
+
   warn    condition     = ${if eq{$acl_m_prf}{localonly}}
           set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}}
 
@@ -881,7 +895,7 @@ check_recipient:
           domains       = +virtual_domains : +bsmtp_domains
 
 <%- unless @use_smarthost -%>
-  deny    message  = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
+  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
 		     {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}\
 		     {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}{$value}{}}}{}}}\
@@ -890,19 +904,19 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
-  deny    message  = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
+  deny    message  = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
           dnslists = noserver.dnsbl.sorbs.net
           domains  = +handled_domains
           !hosts   = +debianhosts : WHITELIST
 
-  deny    message   = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
+  deny    message   = host $sender_host_address is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
           condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}}
-          dnslists  = relays.dnsbl.sorbs.net
+          dnslists  = relays.dnsbl.sorbs.net : xbl.spamhaus.org
           domains   = +handled_domains
           !hosts    = +debianhosts : WHITELIST
 
 <%- end -%>
-  deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
 		     {${if exists {${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}\
 		     {${expand:${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}{$value}{}}}}{}}}\
@@ -911,11 +925,17 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
-  deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
           dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain
           domains  = +handled_domains
           !hosts   = +debianhosts : WHITELIST
 
+  deny    message   = domain $sender_address_domain is listed in $dnslist_domain ($dnslist_value); see $dnslist_text
+          condition = ${if bool_lax{HAS_DEFAULT_OPTIONS}}
+          dnslists  = dbl.spamhaus.org/$sender_address_domain
+          domains   = +handled_domains
+          !hosts    = +debianhosts : WHITELIST
+
 <%- unless @use_smarthost -%>
   deny    domains  = +handled_domains
           local_parts = ${if match_domain{$domain}{+virtual_domains}\
@@ -1471,7 +1491,11 @@ virt_direct_verify:
   modemask = 002
   directory_transport = address_directory
   domains = +virtual_domains
+<%- if @is_trackermaster -%>
+  local_part_suffix = +*
+<%- else -%>
   local_part_suffix = -*
+<%- end -%>
   local_part_suffix_optional
   file = $home/.forward-\
               ${if exists {${home}/.forward-${local_part}}{${local_part}}\
@@ -1501,7 +1525,11 @@ virt_direct:
   group = ${extract{group}{VDOMAINDATA}}
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
   modemask = 002
+<%- if @is_trackermaster -%>
+  local_part_suffix = +*
+<%- else -%>
   local_part_suffix = -*
+<%- end -%>
   local_part_suffix_optional
   pipe_transport = address_pipe
   reply_transport = address_reply