X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fdsa-puppet.git;a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=a11e8d5de99b7f628ef9971ceafd8dcca8d973b7;hp=7073f747513dc37bb0d4c649b9e7a1fafb77c541;hb=b245fb07a6f516d223dd5285e4e650224267b760;hpb=972761e1dd6a6465190c3f63d88b3eec95a2020b

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 7073f7475..a11e8d5de 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -303,7 +303,12 @@ GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\
                        {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \
                        ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
 <%- if @is_rtmaster -%>
-RT_SUBJECT = Subject: ${if and {{first_delivery}{match {${sg {$rh_Subject:}{\N\n\s+\N}{ }}}{\N(?is)(.*?)\[?debian rt\]?[:\s]*(.*)\N}}} {$1$2}{$h_subject:}}
+# This subject rewrite is embedded in double-quoted strings. As such, some of
+# the items need more escaping than usual, otherwise \N becomes simply "N" and
+# the following "\[" a literal "[".
+# Note that the lack of space in "Subject:${" is intentional, as the raw Subject
+# header will include the leading space, if present.
+RT_SUBJECT = Subject:${if and {{first_delivery}{match {${sg {$rh_Subject:}{\\n([ \\t])}{ }}}{\\N(?i)(.*?)\\[?debian rt\\]?[:\\t ]*(.*)\\N}}}{$1$2}{$h_subject:}}
 RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
 <%- end -%>
 
@@ -450,14 +455,17 @@ check_helo:
   # These are in HELO acl so that they are only run once.  They increment a counter,
   # so we don't want it to increment per rcpt to.
 
+  # high trust
   warn    dnslists       = list.dnswl.org&0.0.0.3
           log_message    = Hit on list.dnswl.org for $sender_host_address
           set acl_c_scr  = ${eval:$acl_c_scr-30}
 
+  # >= medium trust
   warn    dnslists       = list.dnswl.org&0.0.0.2
           log_message    = Hit on list.dnswl.org for $sender_host_address
           set acl_c_scr  = ${eval:$acl_c_scr-20}
 
+  # any form of listing
   warn    dnslists       = list.dnswl.org
           log_message    = Hit on list.dnswl.org for $sender_host_address
           set acl_c_scr  = ${eval:$acl_c_scr-10}
@@ -470,15 +478,18 @@ check_helo:
           condition      = ${if eq{$host_lookup_failed}{1}}
           set acl_c_scr  = ${eval:$acl_c_scr+20}
 
+  # HELO looks like a dynamic address (with RDNS match)
   warn    !hosts         = +debianhosts
           condition      = ${if eq{$host_lookup_failed}{0}}
           condition      = ${if match{$sender_host_name}{\N(^[^\.]*[0-9]\-+[0-9]|^[^\.]*[0-9]{5,}[^\.]|^([^\.]+\.)?[0-9][^ \.]*\.[^\.]+\..+\.[a-z]|^[^\.]*[0-9]\.[^\.]*[0-9]-[0-9]|^(dyn|cable|dhcp|dialup|ppp|adsl)[^\.]*[0-9])\N}}
           set acl_c_scr  = ${eval:$acl_c_scr+20}
 
+  # HELO looks like a dynamic address
   warn    !hosts         = +debianhosts
           condition      = ${if match{$sender_helo_name}{\N(^[^\.]*[0-9]\-+[0-9]|^[^\.]*[0-9]{5,}[^\.]|^([^\.]+\.)?[0-9][^ \.]*\.[^\.]+\..+\.[a-z]|^[^\.]*[0-9]\.[^\.]*[0-9]-[0-9]|^(dyn|cable|dhcp|dialup|ppp|adsl)[^\.]*[0-9])\N}}
           set acl_c_scr  = ${eval:$acl_c_scr+20}
 
+  # mail from a dynamic IP address range
   warn    !hosts         = +debianhosts
           dnslists       = dul.dnsbl.sorbs.net
           set acl_c_scr  = ${eval:$acl_c_scr+15}
@@ -857,6 +868,11 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
+  deny    message  = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
+          dnslists = noserver.dnsbl.sorbs.net
+          domains  = +handled_domains
+          !hosts   = +debianhosts : WHITELIST
+
 <%- end -%>
   deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
@@ -867,6 +883,11 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
+          dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain
+          domains  = +handled_domains
+          !hosts   = +debianhosts : WHITELIST
+
 <%- unless @use_smarthost -%>
   deny    domains  = +handled_domains
           local_parts = ${if match_domain{$domain}{+virtual_domains}\
@@ -921,6 +942,14 @@ acl_check_mime:
          condition     = ${if !eq{$acl_m_srb}{false}}
          message       = X-Surbl-Hit: $primary_hostname: $acl_m_srb
 
+  # Dump MIME parts to disk. "default" creates sequentially-named files
+  # in <spool_directory>/scan/<message_id>/ which should then be
+  # automagically unlinked after processing.
+  warn   decode        = default
+
+  # Log some information about attachments for debugging
+  warn   log_message   = MIME part [$mime_part_count] -> [${extract{-1}{.}{${lc:$mime_filename}}}] [$mime_content_type]
+
   accept
 
 <%- end -%>