X-Git-Url: https://git.distorted.org.uk/~mdw/exim-config/blobdiff_plain/1dda4df9f8a4a6ff0d36ea1a7ee4648cb212e057..d2f0fabd8d5f1bbedfc40740e5952852b33a6ec4:/base.m4

diff --git a/base.m4 b/base.m4
index c0dd892..0620a9b 100644
--- a/base.m4
+++ b/base.m4
@@ -44,6 +44,7 @@ extra_local_interfaces = <; 0.0.0.0 ; ::0
 
 SECTION(global, resource)m4_dnl
 deliver_queue_load_max = 8
+message_size_limit = 500M
 queue_only_load = 12
 smtp_accept_max = 16
 smtp_accept_queue = 32
@@ -125,6 +126,10 @@ SECTION(global, acl)m4_dnl
 acl_smtp_helo = helo
 SECTION(acl, misc)m4_dnl
 helo:
+	## Don't worry if this is local submission.  MUAs won't necessarily
+	## have a clear idea of their hostnames.  (For some reason.)
+	accept	 condition = ${if eq{$acl_c_mode}{submission}}
+
 	## Check that the caller's claimed identity is actually plausible.
 	## This seems like it's a fairly effective filter on spamminess, but
 	## it's too blunt a tool.  Rather than reject, add a warning header.
@@ -208,8 +213,7 @@ mail_check_sender:
 
 	## See whether there's a special exception for this sender domain.
 	accept	 senders = ${LOOKUP_DOMAIN($sender_address_domain,
-			     {KV(senders, {$value}{})},
-			     {})}
+			     {KV(senders)})}
 
 	## Ensure that the sender is routable.  This is important to prevent
 	## undeliverable bounces.
@@ -239,6 +243,7 @@ check_submission:
 
 	## Remember to apply submission controls.
 	warn	 set acl_c_mode = submission
+		 control = no_enforce_sync
 
 	## Done.
 	accept
@@ -414,6 +419,50 @@ m4_define(<:APPLY_HEADER_CHANGES:>,
 		<:${if def:acl_m_hdrrm{$acl_m_hdrrm:}}\
 		$2:>):>)
 
+m4_define(<:DKIM_SIGN_P:>,
+	<:and {{exists{CONF_sysconf_dir/dkim-sign.conf}} \
+	       {!def:h_DKIM-Signature:} \
+	       {!def:h_List-ID:} \
+	       {or {{def:authenticated_id} \
+		    {def:authenticated_sender}}}}:>)
+
+m4_define(<:DKIM_KEYS_INSTANCE:>,
+	<:${lookup {${domain:$h_From:}} partial0-lsearch \
+			{CONF_sysconf_dir/dkim-sign.conf} \
+		_LOOKUP_ARGS(<:$1:>, <:$2:>)}:>)
+m4_define(<:DKIM_KEYS_STATE:>, <:${lookup {$1} lsearch \
+		{DKIM_KEYS_INSTANCE(<:{CONF_dkim_keys_dir/$value/active/dkim-keys.state}:>)} \
+	_LOOKUP_ARGS(<:$2:>, <:$3:>, <:fail:>)}:>)
+m4_define(<:DKIM_KEYS_INFO:>, <:DKIM_KEYS_STATE(<:params:>,
+	<:{${if and {{>={$tod_epoch}{KV(t0)}} \
+		    {<{$tod_epoch}{${eval:KV(t0) + KV(n)*KV(step)}}}} \
+		{DKIM_KEYS_STATE(<:info.${eval:($tod_epoch - KV(t0))/KV(step)}:>,
+			<:$1:>, <:$2:>)} \
+		m4_ifelse(<:$2:>, <::>, <:fail:>, <:$2:>)}}:>,
+	m4_ifelse(<:$2:>, <::>, <:fail:>, <:$2:>)):>)
+
+m4_define(<:DKIM_SIGN:>,
+	<:dkim_domain = \
+		${if DKIM_SIGN_P \
+			{DKIM_KEYS_INSTANCE({${domain:$h_From:}})}}
+	dkim_selector = DKIM_KEYS_INFO(<:{KV(k)}:>)
+	dkim_private_key = \
+		DKIM_KEYS_INSTANCE(<:m4_dnl
+			{CONF_dkim_keys_dir/$value/active/$dkim_selector.priv}:>)
+	dkim_canon = relaxed
+	dkim_strict = true
+	dkim_sign_headers = CONF_dkim_headers:\
+		X-CONF_header_token-DKIM-Key-Publication
+	headers_add = \
+		${if DKIM_SIGN_P \
+			{DKIM_KEYS_INFO(<:m4_dnl
+				{X-CONF_header_token-DKIM-Key-Publication: \
+					DKIM signature not suitable for \
+					as evidence after delivery; \
+					DKIM private key KV(k) will be \
+					published at KV(u) on or before \
+					KV(tpub)}:>)}}:>)
+
 m4_define(<:SMTP_DELIVERY:>,
 	<:## Prevent sending messages with overly long lines.  The use of
 	## `message_size_limit' here is somewhat misleading.
@@ -428,7 +477,9 @@ SECTION(transports)m4_dnl
 ## it into the transport name.  This is very unpleasant, of course.
 smtp:
 	driver = smtp
+	SMTP_DELIVERY
 	APPLY_HEADER_CHANGES
+	DKIM_SIGN
 	tls_require_ciphers = CONF_acceptable_ciphers
 	tls_dh_min_bits = 508
 	tls_tempfail_tryclear = true
@@ -437,6 +488,7 @@ m4_define(<:SMTP_TRANS_DHBITS:>,
 	<:driver = smtp
 	SMTP_DELIVERY
 	APPLY_HEADER_CHANGES
+	DKIM_SIGN
 	hosts_try_auth = *
 	hosts_require_tls = DOMKV(tls-peer-ca, {*}{})
 	hosts_require_auth = \
@@ -527,6 +579,13 @@ DIVERT(null)
 ### Retry configuration.
 
 SECTION(retry, default)m4_dnl
+## Be persistent when sending to the site relay.  It ought to work, but
+## particularly satellites such as laptops often encounter annoying temporary
+## failures due to network unavailability, and the usual gradual policy can
+## leave mail building up for no good reason.
+CONF_smarthost				* \
+	F,4d,15m
+
 ## Default.
 *					* \
 	F,2h,15m; G,16h,2h,1.5; F,4d,6h