base.m4, exchange.m4: Improve key/value syntax in warnings.

[exim-config] / exchange.m4

diff --git a/exchange.m4 b/exchange.m4
index 08fe4a0..e7d5fa4 100644 (file)
--- a/exchange.m4
+++ b/exchange.m4
@@ -24,11 +24,14 @@
 ###--------------------------------------------------------------------------
 ### Listen for incoming connections.
 
+SECTION(global, daemon)m4_dnl
+daemon_smtp_ports = CONF_smtp_port : CONF_submission_port
+
 SECTION(global, tls)m4_dnl
 tls_certificate = CONF_sysconf_dir/server.cert
 tls_privatekey = CONF_sysconf_dir/server.key
 tls_advertise_hosts = *
-tls_dhparam = CONF_ca_dir/dh-param.pem
+tls_dhparam = CONF_ca_dir/dh-param-2048.pem
 tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \
                               {match_ip {$sender_host_address}{+trusted}}} \
                           {CONF_good_ciphers} \
@@ -44,25 +47,29 @@ SECTION(acl, mail-hooks)m4_dnl
        ## Check that a submitted message's sender address is allowable.
        require  acl = mail_client_addr
 
-       ## Insist that a local client connect through TLS.
-       deny     message = Hosts within CONF_master_domain must use TLS
-               !condition = ${if eq{$acl_c_mode}{submission}}
-                hosts = +allnets
-               !encrypted = *
-
 SECTION(acl, misc)m4_dnl
 mail_client_addr:
 
        ## If this is a message submission then that's handled elsewhere.
        accept   condition = ${if eq{$acl_c_mode}{submission}}
 
-       ## Make sure that the sender matches the client address.
-       require  message = Client host invalid for sender domain
-                hosts = ${LOOKUP_DOMAIN($sender_address_domain,
+       ## Make sure that the sender matches the client address.  I feel like
+       ## I want to reject these, but that will break stuff.  For example,
+       ## if I send mail to an externally hosted address which is really a
+       ## distribution list containing some local address, then we'll
+       ## (approximately legitimately) receive mail with an apparently-local
+       ## sender from a remote host.
+       warn    !hosts = ${LOOKUP_DOMAIN($sender_address_domain,
                           {KV(hosts, {$value}{+allnets})},
                           {${if match_domain {$sender_address_domain} \
                                              {+public} \
                                 {+allnets}{! +allnets}}})}
+                add_header = :after_received:X-Distorted-Warning: \
+                       RCLNTLSNDR \
+                       Apparently local sender, but received from remote \
+                       server.\n\t\
+                       sender=$sender_address \
+                       host=$sender_host_address
 
        ## OK.
        accept