base.m4, exchange.m4: Improve key/value syntax in warnings.

[exim-config] / base.m4

diff --git a/base.m4 b/base.m4
index e0d9979..90fcca6 100644 (file)
--- a/base.m4
+++ b/base.m4
@@ -60,9 +60,7 @@ gecos_pattern = ([^,:]*)
 SECTION(global, incoming)m4_dnl
 received_header_text = Received: \
        ${if def:sender_rcvhost \
-            {from $sender_rcvhost\
-             ${if def:sender_helo_name \
-                  { (helo=$sender_helo_name)}}\n\t} \
+            {from $sender_rcvhost\n\t} \
             {${if def:sender_ident \
                   {from ${quote_local_part:$sender_ident} }}}}\
        by $primary_hostname \
@@ -72,7 +70,7 @@ received_header_text = Received: \
             {with $received_protocol \
              ${if def:tls_cipher {(cipher=$tls_cipher)}}}}\n\t\
        ${if def:sender_address \
-            {(envelope-from <$sender_address>\
+            {(envelope-from $sender_address\
              ${if def:authenticated_id \
                   {; auth=$authenticated_id}})\n\t}}\
        id $message_exim_id\
@@ -107,6 +105,11 @@ helo:
        ## and we should only care about the most recent one.
        warn     set acl_c_helo_warning = false
                !condition = \
+                       ${if and {{match_ip {$sender_host_address} \
+                                           {<; 127.0.0.0/8 ; ::1}} \
+                                 {match_domain {$sender_helo_name} \
+                                               {localhost : +thishost}}}}
+               !condition = \
                        ${if exists {CONF_sysconf_dir/helo.conf} \
                             {${lookup {$sender_helo_name} \
                                       partial0-lsearch \
@@ -120,6 +123,16 @@ helo:
        accept
 
 SECTION(global, acl)m4_dnl
+acl_not_smtp_start = not_smtp_start
+SECTION(acl, misc)m4_dnl
+not_smtp_start:
+       ## Record the user's name.
+       warn     set acl_c_user = $sender_ident
+
+       ## Done.
+       accept
+
+SECTION(global, acl)m4_dnl
 acl_smtp_mail = mail
 SECTION(acl, mail)m4_dnl
 mail:
@@ -130,8 +143,8 @@ mail:
                 add_header = :after_received:X-Distorted-Warning: \
                        BADHELO \
                        Client's HELO doesn't match its IP address.\n\t\
-                       HELO name = $sender_helo_name, \
-                       address = $sender_host_address
+                       helo-name=$sender_helo_name \
+                       address=$sender_host_address
 
        ## Always allow the empty sender, so that we can receive bounces.
        accept   senders = :
@@ -146,6 +159,15 @@ mail:
        warn     condition = ${if eq{$acl_c_mode}{submission}}
                 control = submission
 
+       ## Insist that a local client connect through TLS.
+       deny     message = Hosts within CONF_master_domain must use TLS
+               !condition = ${if eq{$acl_c_mode}{submission}}
+                hosts = +allnets
+               !encrypted = *
+
+       ## Check that a submitted message's sender address is allowable.
+       require  acl = mail_check_auth
+
 SECTION(acl, mail-tail)m4_dnl
        ## And we're done.
        accept
@@ -163,7 +185,7 @@ SECTION(acl, connect-tail)m4_dnl
 
 check_submission:
        ## See whether this message needs hacking on.
-       accept  !hosts = +localnet
+       accept  !hosts = +thishost
                !condition = ${if ={$received_port}{CONF_submission_port}}
                 set acl_c_mode = relay
 
@@ -212,6 +234,51 @@ expn_vrfy:
 
 DIVERT(null)
 ###--------------------------------------------------------------------------
+### Verification of sender address.
+
+SECTION(acl, misc)m4_dnl
+mail_check_auth:
+
+       ## If this isn't a submission then it doesn't need checking.
+       accept   condition = ${if !eq{$acl_c_mode}{submission}}
+
+       ## If the caller hasn't formally authenticated, but this is a
+       ## loopback connection, then we can trust identd to tell us the right
+       ## answer.  So we should stash the right name somewhere consistent.
+       warn     set acl_c_user = $authenticated_id
+                hosts = +thishost
+               !authenticated = *
+                set acl_c_user = $sender_ident
+
+       ## User must be authenticated.
+       deny     message = Sender not authenticated
+               !hosts = +thishost
+               !authenticated = *
+
+       ## Make sure that the local part is one that the authenticated sender
+       ## is allowed to claim.
+       deny     message = Sender address forbidden to calling user
+               !condition = ${LOOKUP_DOMAIN($sender_address_domain,
+                              {${if and {{match_local_part \
+                                           {$acl_c_user} \
+                                           {+dom_users}} \
+                                         {match_local_part \
+                                           {$sender_address_local_part} \
+                                           {+dom_locals}}}}},
+                              {${if and {{match_local_part \
+                                           {$sender_address_local_part} \
+                                           {+user_extaddr}} \
+                                         {or {{eq {$sender_address_domain} \
+                                                  {}} \
+                                              {match_domain \
+                                                {$sender_address_domain} \
+                                                {+public}}}}}}})}
+
+       ## All done.
+       accept
+
+DIVERT(null)
+###--------------------------------------------------------------------------
 ### Common options for forwarding routers.
 
 ## We're pretty permissive here.
@@ -247,6 +314,15 @@ m4_define(<:FILTER_TRANSPORTS:>,
        pipe_transport = pipe
        reply_transport = reply:>)
 
+m4_define(<:FILTER_ROUTER:>,
+<:$1_vrf:
+       $2
+       FILTER_VERIFY<::>$3
+$1:
+       $2
+       verify = no
+       FILTER_TRANSPORTS<::>$4:>)
+
 DIVERT(null)
 ###--------------------------------------------------------------------------
 ### Some standard transports.