chiark - git - mdw - exim-config/blob - exchange.m4

   1 ### -*-m4-*-
   2 ###
   3 ### Transmission to remote hosts for distorted.org.uk Exim configuration.
   4 ###
   5 ### (c) 2012 Mark Wooding
   6 ###
   7
   8 ###----- Licensing notice ---------------------------------------------------
   9 ###
  10 ### This program is free software; you can redistribute it and/or modify
  11 ### it under the terms of the GNU General Public License as published by
  12 ### the Free Software Foundation; either version 2 of the License, or
  13 ### (at your option) any later version.
  14 ###
  15 ### This program is distributed in the hope that it will be useful,
  16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18 ### GNU General Public License for more details.
  19 ###
  20 ### You should have received a copy of the GNU General Public License
  21 ### along with this program; if not, write to the Free Software Foundation,
  22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  23
  24 ###--------------------------------------------------------------------------
  25 ### Listen for incoming connections.
  26
  27 SECTION(global, daemon)m4_dnl
  28 daemon_smtp_ports = CONF_smtp_port : CONF_submission_port
  29
  30 SECTION(global, tls)m4_dnl
  31 tls_certificate = CONF_sysconf_dir/server.cert
  32 tls_privatekey = CONF_sysconf_dir/server.key
  33 tls_advertise_hosts = *
  34 tls_dhparam = CONF_ca_dir/dh-param-2048.pem
  35 tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \
  36                                {match_ip {$sender_host_address}{+trusted}}} \
  37                            {CONF_good_ciphers} \
  38                            {CONF_acceptable_ciphers}}
  39 tls_verify_certificates = CONF_ca_dir/ca.cert
  40 tls_verify_hosts = ${if eq{$acl_c_mode}{submission} {} {+allnets}}
  41
  42 DIVERT(null)
  43 ###--------------------------------------------------------------------------
  44 ### Check source addresses for apparently local senders.
  45
  46 SECTION(acl, mail-hooks)m4_dnl
  47         ## Check that a submitted message's sender address is allowable.
  48         require  acl = mail_client_addr
  49
  50         ## Insist that a local client connect through TLS.
  51         deny     message = Hosts within CONF_master_domain must use TLS
  52                 !condition = ${if eq{$acl_c_mode}{submission}}
  53                  hosts = +allnets
  54                 !encrypted = *
  55
  56 SECTION(acl, misc)m4_dnl
  57 mail_client_addr:
  58
  59         ## If this is a message submission then that's handled elsewhere.
  60         accept   condition = ${if eq{$acl_c_mode}{submission}}
  61
  62         ## Make sure that the sender matches the client address.  I feel like
  63         ## I want to reject these, but that will break stuff.  For example,
  64         ## if I send mail to an externally hosted address which is really a
  65         ## distribution list containing some local address, then we'll
  66         ## (approximately legitimately) receive mail with an apparently-local
  67         ## sender from a remote host.
  68         warn    !hosts = ${LOOKUP_DOMAIN($sender_address_domain,
  69                            {KV(hosts, {$value}{+allnets})},
  70                            {${if match_domain {$sender_address_domain} \
  71                                               {+public} \
  72                                  {+allnets}{! +allnets}}})}
  73                  add_header = :after_received:X-Distorted-Warning: \
  74                         RCLNTLSNDR \
  75                         Apparently local sender, but received from remote \
  76                         server.
  77
  78         ## OK.
  79         accept
  80
  81 DIVERT(null)
  82 ###--------------------------------------------------------------------------
  83 ### The obvious trivial router.
  84
  85 SECTION(routers, remote)m4_dnl
  86 ## Send mail on to a host in our own network.  We must apply extra security.
  87 local:
  88         driver = dnslookup
  89         domains = ! +known : *.CONF_master_domain
  90         self = fail
  91         transport = smtp_local
  92         no_more
  93
  94 ## Send mail on to unknown hosts.
  95 remote:
  96         driver = dnslookup
  97         domains = ! +known
  98         self = fail
  99         transport = smtp
 100         no_more
 101
 102 DIVERT(null)
 103 ###----- That's all, folks --------------------------------------------------