From: Julien Cristau <jcristau@debian.org>
Date: Sun, 29 Sep 2019 14:21:12 +0000 (+0200)
Subject: Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet
X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=7ca975698c14415282e911881890b3b7d8f8dc68;hp=c585c8dce34bcb0f057d871566d17179911586c0;p=mirror%2Fdsa-puppet.git

Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet
---

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 7839c131a..d303ba14d 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -136,6 +136,7 @@ domainlist google_mxen = aspmx.l.google.com : gmail-smtp-in.l.google.com : \
                          *.aspmx.l.google.com : *.gmail-smtp-in.l.google.com
 
 domainlist single_domain_mx = +google_mxen
+domainlist ipv4_only_domain_mx = +google_mxen
 
 <%- if @is_mailrelay -%>
 # Domains we relay for; that is domains that aren't considered local but we 
@@ -154,7 +155,6 @@ tls_crl = /etc/exim4/ssl/ca.crl
 # expensive, you can specify the networks for which a lookup is done, or
 # remove the setting entirely.
 host_lookup = *
-dns_ipv4_lookup = +google_mxen
 
 # If this option is set, then any process that is running as one of the
 # listed users may pass a message to Exim and specify the sender's
@@ -1129,7 +1129,11 @@ dnslookup:
                   {match_domain{$item}{+single_domain_mx}}\
                   {remote_smtp_single_domain}{remote_smtp}\
                }
-  ignore_target_hosts = +reservedaddrs
+  ignore_target_hosts = +reservedaddrs : \
+               ${if forany{${lookup dnsdb{>: mxh=$domain}}}\
+                  {match_domain{$item}{+ipv4_only_domain_mx}}\
+                  {::::/0}{}\
+               }
   no_more
 
 postmasterish:
@@ -1667,21 +1671,37 @@ rt_pipe:
 #                      RETRY CONFIGURATION                           #
 ######################################################################
 
-# This single retry rule applies to all domains and all errors. It specifies
-# retries every 15 minutes for 2 hours, then increasing retry intervals,
-# starting at 2 hours and increasing each time by a factor of 1.5, up to 16
-# hours, then retries every 8 hours until 4 days have passed since the first
-# failed delivery.
-
 # Domain               Error       Retries
 # ------               -----       -------
 
-
 begin retry
 
+## Note that retry rules specify when an address / host / mail should
+## become eligible for retrying. They do not specify when the retry
+## attempt will actually occur, as this is dependent on queue run
+## frequency and timing.
+
+# For mail to debian.org addresses, this rule starts with
+# retries every 10 minutes for 2 hours, then increasing retry intervals,
+# starting at 2 hours and increasing each time by a factor of 1.5, up to 16
+# hours, then retries every 8 hours until 14 days have passed since the first
+# failed delivery.
 debian.org	       *	   F,2h,10m; G,16h,2h,1.5; F,14d,8h
+
+# Bounces should get retried every 10 minutes for up to 2 hours
 *                      * senders=: F,2h,10m
+
+# Temporary errors at RCPT TO get retried at 5 minute intervals for
+# 2 hours, then 10 minute intervals for 4 hours, and finally at 15
+# minute intervals for 4 days. This assumes that the cause of the
+# error will get resolved quickly in most cases.
 *                      rcpt_4xx    F,2h,5m;  F,4h,10m; F,4d,15m
+
+# For all remaining mails, addresses and hosts, this rule starts with
+# retries every 15 minutes for 2 hours, then increasing retry intervals,
+# starting at 2 hours and increasing each time by a factor of 1.5, up to 16
+# hours, then retries every 8 hours until 4 days have passed since the first
+# failed delivery.
 *                      *           F,2h,15m; G,16h,2h,1.5; F,4d,8h
 
 # End of Exim 4 configuration
diff --git a/modules/fail2ban/files/filter/dsa-exim-strict.conf b/modules/fail2ban/files/filter/dsa-exim-strict.conf
index 33310abc1..2dcdfb1bd 100644
--- a/modules/fail2ban/files/filter/dsa-exim-strict.conf
+++ b/modules/fail2ban/files/filter/dsa-exim-strict.conf
@@ -4,4 +4,4 @@
 before = exim-common.conf
 
 [Definition]
-failregex = ^%(pid)s SMTP protocol error in "(?i:AUTH LOGIN)" .* \[<HOST>\] AUTH command used when not advertised$
+failregex = (?i)^%(pid)s SMTP protocol error in "AUTH LOGIN" %(host_info)sAUTH command used when not advertised$
diff --git a/modules/fail2ban/files/jail/dsa-exim-strict.conf b/modules/fail2ban/files/jail/dsa-exim-strict.conf
index 3030e4908..a06947358 100644
--- a/modules/fail2ban/files/jail/dsa-exim-strict.conf
+++ b/modules/fail2ban/files/jail/dsa-exim-strict.conf
@@ -6,3 +6,4 @@ logpath = /var/log/exim4/mainlog
 maxretry = 1
 findtime = 3600
 bantime = 10800
+logencoding = utf-8
diff --git a/modules/fail2ban/files/jail/dsa-exim.conf b/modules/fail2ban/files/jail/dsa-exim.conf
index 412c028f3..d142446d3 100644
--- a/modules/fail2ban/files/jail/dsa-exim.conf
+++ b/modules/fail2ban/files/jail/dsa-exim.conf
@@ -6,3 +6,4 @@ logpath = /var/log/exim4/mainlog
 maxretry = 6
 findtime = 900
 bantime = 10800
+logencoding = utf-8