Delay ACL header edits until transport time.

[exim-config] / exchange.m4

diff --git a/exchange.m4 b/exchange.m4
index 3e771c61b8dc09e10ea9fdb7ab339fa9505311ea..9f8324a6c9f74bd862f788e308c2d76f4d70a273 100644 (file)
--- a/exchange.m4
+++ b/exchange.m4
@@ -27,18 +27,6 @@
 SECTION(global, daemon)m4_dnl
 daemon_smtp_ports = CONF_smtp_port : CONF_submission_port
 
-SECTION(global, tls)m4_dnl
-tls_certificate = CONF_sysconf_dir/server.cert
-tls_privatekey = CONF_sysconf_dir/server.key
-tls_advertise_hosts = *
-tls_dhparam = CONF_ca_dir/dh-param-2048.pem
-tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \
-                              {match_ip {$sender_host_address}{+trusted}}} \
-                          {CONF_good_ciphers} \
-                          {CONF_acceptable_ciphers}}
-tls_verify_certificates = CONF_ca_dir/ca.cert
-tls_verify_hosts = ${if eq{$acl_c_mode}{submission} {} {+allnets}}
-
 DIVERT(null)
 ###--------------------------------------------------------------------------
 ### Check source addresses for apparently local senders.
@@ -47,12 +35,6 @@ SECTION(acl, mail-hooks)m4_dnl
        ## Check that a submitted message's sender address is allowable.
        require  acl = mail_client_addr
 
-       ## Insist that a local client connect through TLS.
-       deny     message = Hosts within CONF_master_domain must use TLS
-               !condition = ${if eq{$acl_c_mode}{submission}}
-                hosts = +allnets
-               !encrypted = *
-
 SECTION(acl, misc)m4_dnl
 mail_client_addr:
 
@@ -70,12 +52,12 @@ mail_client_addr:
                           {${if match_domain {$sender_address_domain} \
                                              {+public} \
                                 {+allnets}{! +allnets}}})}
-                add_header = :after_received:X-Distorted-Warning: \
+                ADD_HEADER(<:X-CONF_header_token-Warning: \
                        RCLNTLSNDR \
                        Apparently local sender, but received from remote \
                        server.\n\t\
-                       sender=$sender_address, \
-                       host=$sender_host_address
+                       sender=$sender_address \
+                       host=$sender_host_address:>)
 
        ## OK.
        accept
@@ -88,7 +70,12 @@ SECTION(routers, remote)m4_dnl
 ## Send mail on to a host in our own network.  We must apply extra security.
 local:
        driver = dnslookup
-       domains = ! +known : *.CONF_master_domain
+       domains = ${if bool {${LOOKUP_DOMAIN($domain,
+                              {KV(service, {$value}{true})},
+                              {false})}} \
+                      {}{ ! +public : \
+                          CONF_master_domain : \
+                          *.CONF_master_domain }}
        self = fail
        transport = smtp_local
        no_more
@@ -96,7 +83,10 @@ local:
 ## Send mail on to unknown hosts.
 remote:
        driver = dnslookup
-       domains = ! +known
+       domains = ${if bool {${LOOKUP_DOMAIN($domain,
+                              {KV(service, {$value}{true})},
+                              {false})}} \
+                      {}{ ! +public }}
        self = fail
        transport = smtp
        no_more