Merge branch 'master' of git.distorted.org.uk:~mdw/publish/public-git/exim-config

[exim-config] / base.m4

diff --git a/base.m4 b/base.m4
index d42d98d..807c57a 100644 (file)
--- a/base.m4
+++ b/base.m4
@@ -89,7 +89,7 @@ SECTION(global, bounce)m4_dnl
 delay_warning = 1h : 24h : 2d
 
 SECTION(global, tls)m4_dnl
-tls_certificate = CONF_sysconf_dir/server.cert
+tls_certificate = CONF_sysconf_dir/server.certlist
 tls_privatekey = CONF_sysconf_dir/server.key
 tls_advertise_hosts = ${if exists {CONF_sysconf_dir/server.key} {*}{}}
 tls_dhparam = CONF_ca_dir/dh-param-2048.pem
@@ -161,11 +161,8 @@ mail:
        ## Always allow the empty sender, so that we can receive bounces.
        accept   senders = :
 
-       ## Ensure that the sender is routable.  This is important to prevent
-       ## undeliverable bounces.
-       require  message = Invalid sender; \
-                       ($sender_verify_failure; $acl_verify_message)
-                verify = sender
+       ## Ensure that the sender looks valid.
+       require  acl = mail_check_sender
 
        ## If this is directly from a client then hack on it for a while.
        warn     condition = ${if eq{$acl_c_mode}{submission}}
@@ -184,6 +181,23 @@ SECTION(acl, mail-tail)m4_dnl
        ## And we're done.
        accept
 
+SECTION(acl, misc)m4_dnl
+mail_check_sender:
+
+       ## See whether there's a special exception for this sender domain.
+       accept   senders = ${LOOKUP_DOMAIN($sender_address_domain,
+                            {KV(senders, {$value}{})},
+                            {})}
+
+       ## Ensure that the sender is routable.  This is important to prevent
+       ## undeliverable bounces.
+       require  message = Invalid sender; \
+                       ($sender_verify_failure; $acl_verify_message)
+                verify = sender
+
+       ## We're good, then.
+       accept
+
 SECTION(global, acl)m4_dnl
 acl_smtp_connect = connect
 SECTION(acl, connect)m4_dnl
@@ -414,7 +428,7 @@ smtp_dhbits_2048:
 smtp_local:
        driver = smtp
        hosts_require_tls = *
-       tls_certificate = CONF_sysconf_dir/client.cert
+       tls_certificate = CONF_sysconf_dir/client.certlist
        tls_privatekey = CONF_sysconf_dir/client.key
        tls_verify_certificates = CONF_ca_dir/ca.cert
        tls_require_ciphers = CONF_good_ciphers