deny message = Sender not authenticated
condition = ${if !def:acl_c_user}
- ## Make sure that the local part is one that the authenticated sender
- ## is allowed to claim.
- deny message = Sender address forbidden to calling user
- !condition = \
- ${if exists {CONF_sysconf_dir/auth-sender.conf} \
- {${lookup {$acl_c_user} \
- lsearch \
- {CONF_sysconf_dir/auth-sender.conf} \
- {${if match_address \
- {$sender_address} \
- {+value}}} \
- {false}}}}
- !condition = ${LOOKUP_DOMAIN($sender_address_domain,
- {${if and {{match_local_part \
- {$acl_c_user} \
- {+dom_users}} \
- {match_local_part \
- {$sender_address_local_part} \
- {+dom_locals}}}}},
- {${if and {{match_local_part \
- {$sender_address_local_part} \
- {+user_extaddr}} \
- {or {{eq {$sender_address_domain} \
- {}} \
- {match_domain \
- {$sender_address_domain} \
- {+public}}}}}}})}
-
## All done.
accept
## User address suffix handling.
DEFCONF(user_suffix_list, +* : -*)
-DEFCONF(user_extaddr_regexp, $acl_c_user([-+@]|\$))
DEFCONF(user_extaddr_fixup, ${sg {$local_part_suffix}{^[-+]}{}})
## Other hosts allowed to relay mail through us.
{$item.$qualify_domain}}
domainlist public = +thishost : CONF_sysdomains
-## Some magic lists used because `match_local_parts' and friends don't expand
-## their right-hand sides.
-localpartlist dom_users = ${expand:KV(users, {$value}{*})}
-localpartlist dom_locals = ${expand:KV(locals, {$value}{+user_extaddr})}
-localpartlist user_extaddr = ^CONF_user_extaddr_regexp
-addresslist user_extaddr = ^CONF_user_extaddr_regexp
-addresslist value = $value
-
## All of the `standard' local parts which ought to be provided by a domain.
localpartlist required = postmaster : abuse
SECTION(global, priv)m4_dnl
local_from_suffix = CONF_user_suffix_list
-SECTION(global, process)m4_dnl
-## Restrict users to plausible envelope sender addresses. This is
-## surprisingly fiddly. What I actually want to say is that the local part
-## must match ^$sender_ident(\$|-) and the domain part must match an
-## appropriate domain; but writing a conjunction is rather tricky. And so we
-## must burn some addresslist variables.
-addresslist wrong_local = ! +user_extaddr
-addresslist wrong_domain = ! *@+public
-addresslist wrong_address = +wrong_local : +wrong_domain
-untrusted_set_sender = : \
- ${if exists {CONF_sysconf_dir/auth-sender.conf} \
- {${lookup {$sender_ident} \
- lsearch {CONF_sysconf_dir/auth-sender.conf} \
- {$value}}}} : \
- ${LOOKUP_DOMAIN($sender_address_domain,
- {${if and {{match_local_part {$sender_ident} {+dom_users}} \
- {match_local_part {$sender_address_local_part} \
- {+dom_locals}}} \
- {*}}})} : \
- ! +wrong_address
-
###--------------------------------------------------------------------------
### Forwarding and redirection for incoming mail.