X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fdsa-puppet.git;a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=589219ed22be892ab07b2e70ff56f1e4be6b883f;hp=7073f747513dc37bb0d4c649b9e7a1fafb77c541;hb=30914d14c748dfd87a9854645b81454238ae3dad;hpb=d1562b78d6fbb28adc0567ee289cf9a2cdc5223f

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 7073f7475..589219ed2 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -303,7 +303,10 @@ GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\
                        {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \
                        ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
 <%- if @is_rtmaster -%>
-RT_SUBJECT = Subject: ${if and {{first_delivery}{match {${sg {$rh_Subject:}{\N\n\s+\N}{ }}}{\N(?is)(.*?)\[?debian rt\]?[:\s]*(.*)\N}}} {$1$2}{$h_subject:}}
+# This subject rewrite is embedded in double-quoted strings. As such, some of
+# the items need more escaping than usual, otherwise \N becomes simply "N" and
+# the following \n a literal newline.
+RT_SUBJECT = Subject: ${if and {{first_delivery}{match {${sg{$rh_Subject:}{\\N\\n\[\\t \]\+\\N}{ }}}{\\N(?i)(.*?)\[?debian rt\]?[:\t ]*(.*)\\N}}} {$1$2}{$h_subject:}}
 RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
 <%- end -%>
 
@@ -450,14 +453,17 @@ check_helo:
   # These are in HELO acl so that they are only run once.  They increment a counter,
   # so we don't want it to increment per rcpt to.
 
+  # high trust
   warn    dnslists       = list.dnswl.org&0.0.0.3
           log_message    = Hit on list.dnswl.org for $sender_host_address
           set acl_c_scr  = ${eval:$acl_c_scr-30}
 
+  # >= medium trust
   warn    dnslists       = list.dnswl.org&0.0.0.2
           log_message    = Hit on list.dnswl.org for $sender_host_address
           set acl_c_scr  = ${eval:$acl_c_scr-20}
 
+  # any form of listing
   warn    dnslists       = list.dnswl.org
           log_message    = Hit on list.dnswl.org for $sender_host_address
           set acl_c_scr  = ${eval:$acl_c_scr-10}
@@ -470,15 +476,18 @@ check_helo:
           condition      = ${if eq{$host_lookup_failed}{1}}
           set acl_c_scr  = ${eval:$acl_c_scr+20}
 
+  # HELO looks like a dynamic address (with RDNS match)
   warn    !hosts         = +debianhosts
           condition      = ${if eq{$host_lookup_failed}{0}}
           condition      = ${if match{$sender_host_name}{\N(^[^\.]*[0-9]\-+[0-9]|^[^\.]*[0-9]{5,}[^\.]|^([^\.]+\.)?[0-9][^ \.]*\.[^\.]+\..+\.[a-z]|^[^\.]*[0-9]\.[^\.]*[0-9]-[0-9]|^(dyn|cable|dhcp|dialup|ppp|adsl)[^\.]*[0-9])\N}}
           set acl_c_scr  = ${eval:$acl_c_scr+20}
 
+  # HELO looks like a dynamic address
   warn    !hosts         = +debianhosts
           condition      = ${if match{$sender_helo_name}{\N(^[^\.]*[0-9]\-+[0-9]|^[^\.]*[0-9]{5,}[^\.]|^([^\.]+\.)?[0-9][^ \.]*\.[^\.]+\..+\.[a-z]|^[^\.]*[0-9]\.[^\.]*[0-9]-[0-9]|^(dyn|cable|dhcp|dialup|ppp|adsl)[^\.]*[0-9])\N}}
           set acl_c_scr  = ${eval:$acl_c_scr+20}
 
+  # mail from a dynamic IP address range
   warn    !hosts         = +debianhosts
           dnslists       = dul.dnsbl.sorbs.net
           set acl_c_scr  = ${eval:$acl_c_scr+15}
@@ -857,6 +866,11 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
+  deny    message  = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
+          dnslists = noserver.dnsbl.sorbs.net
+          domains  = +handled_domains
+          !hosts   = +debianhosts : WHITELIST
+
 <%- end -%>
   deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
@@ -867,6 +881,11 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
+          dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain
+          domains  = +handled_domains
+          !hosts   = +debianhosts : WHITELIST
+
 <%- unless @use_smarthost -%>
   deny    domains  = +handled_domains
           local_parts = ${if match_domain{$domain}{+virtual_domains}\