satellite.m4: Apply `/etc/aliases' to master-domain-qualified addresses.

[exim-config] / base.m4

diff --git a/base.m4 b/base.m4
index f8b09e44c91b22943acc546daa1de3d09991b4e5..0aadb788b617824bbfd504f2650ded836706db8f 100644 (file)
--- a/base.m4
+++ b/base.m4
@@ -44,6 +44,7 @@ extra_local_interfaces = <; 0.0.0.0 ; ::0
 
 SECTION(global, resource)m4_dnl
 deliver_queue_load_max = 8
+message_size_limit = 500M
 queue_only_load = 12
 smtp_accept_max = 16
 smtp_accept_queue = 32
@@ -127,7 +128,7 @@ SECTION(acl, misc)m4_dnl
 helo:
        ## Don't worry if this is local submission.  MUAs won't necessarily
        ## have a clear idea of their hostnames.  (For some reason.)
-       accept   condition = ${if !eq{$acl_c_mode}{submission}}
+       accept   condition = ${if eq{$acl_c_mode}{submission}}
 
        ## Check that the caller's claimed identity is actually plausible.
        ## This seems like it's a fairly effective filter on spamminess, but
@@ -212,8 +213,7 @@ mail_check_sender:
 
        ## See whether there's a special exception for this sender domain.
        accept   senders = ${LOOKUP_DOMAIN($sender_address_domain,
-                            {KV(senders, {$value}{})},
-                            {})}
+                            {KV(senders)})}
 
        ## Ensure that the sender is routable.  This is important to prevent
        ## undeliverable bounces.
@@ -419,6 +419,64 @@ m4_define(<:APPLY_HEADER_CHANGES:>,
                <:${if def:acl_m_hdrrm{$acl_m_hdrrm:}}\
                $2:>):>)
 
+m4_define(<:DKIM_SIGN_P:>,
+       <:and {{exists{CONF_sysconf_dir/dkim-sign.conf}} \
+              {!def:h_DKIM-Signature:} \
+              {!def:h_List-ID:} \
+              {or {{def:authenticated_id} \
+                   {def:authenticated_sender}}}}:>)
+
+m4_define(<:DKIM_KEYS_INSTANCE:>,
+       <:${lookup {${domain:$h_From:}} partial0-lsearch \
+                       {CONF_sysconf_dir/dkim-sign.conf} \
+               _LOOKUP_ARGS(<:$1:>, <:$2:>)}:>)
+m4_define(<:DKIM_KEYS_STATE:>, <:${lookup {$1} lsearch \
+               {DKIM_KEYS_INSTANCE(<:{CONF_dkim_keys_dir/$value/active/dkim-keys.state}:>)} \
+       _LOOKUP_ARGS(<:$2:>, <:$3:>, <:fail:>)}:>)
+m4_define(<:DKIM_KEYS_INFO:>, <:DKIM_KEYS_STATE(<:params:>,
+       <:{${if and {{>={$tod_epoch}{KV(t0)}} \
+                   {<{$tod_epoch}{${eval:KV(t0) + KV(n)*KV(step)}}}} \
+               {DKIM_KEYS_STATE(<:info.${eval:($tod_epoch - KV(t0))/KV(step)}:>,
+                       <:$1:>, <:$2:>)} \
+               m4_ifelse(<:$2:>, <::>, <:fail:>, <:$2:>)}}:>,
+       m4_ifelse(<:$2:>, <::>, <:fail:>, <:$2:>)):>)
+
+m4_define(<:DKIM_SIGN:>,
+       <:dkim_domain = \
+               ${if DKIM_SIGN_P \
+                       {DKIM_KEYS_INSTANCE({${domain:$h_From:}})}}
+       dkim_selector = DKIM_KEYS_INFO(<:{KV(k)}:>)
+       dkim_private_key = \
+               DKIM_KEYS_INSTANCE(<:m4_dnl
+                       {CONF_dkim_keys_dir/$value/active/$dkim_selector.priv}:>)
+       dkim_canon = relaxed
+       dkim_strict = true
+       ## The following ridiculous stunt does two important jobs.  Firstly,
+       ## and more obviously, it arranges to include one more copy of each
+       ## header name than the message actually contains, thereby causing
+       ## the signature to fail if another header with the same name is
+       ## added.  And secondly, and far more subtly, it also trims the
+       ## spaces from the header names so that they're in the format that
+       ## the signing machinery secretly wants.
+       dkim_sign_headers = \
+               ${sg {${map {CONF_dkim_headers : \
+                            X-CONF_header_token-DKIM-Key-Publication} \
+                           {$item${sg {${expand:\$h_$item:}\n} \
+                                      {((?:[^\n]+|\n\\s+)*)\n} \
+                                      {:$item}}}}} \
+                    {::}{:}}
+       headers_add = \
+               ${if DKIM_SIGN_P \
+                       {DKIM_KEYS_INFO(<:m4_dnl
+                               {X-CONF_header_token-DKIM-Key-Publication: \
+                                       DKIM signature not suitable \
+                                       as evidence after delivery;\n\t\
+                                       DKIM private key KV(k) will be \
+                                       published\n\t\
+                                       at KV(u)\n\t\
+                                       on or before KV(tpub)}:>)}}:>)
+
+
 m4_define(<:SMTP_DELIVERY:>,
        <:## Prevent sending messages with overly long lines.  The use of
        ## `message_size_limit' here is somewhat misleading.
@@ -433,7 +491,9 @@ SECTION(transports)m4_dnl
 ## it into the transport name.  This is very unpleasant, of course.
 smtp:
        driver = smtp
+       SMTP_DELIVERY
        APPLY_HEADER_CHANGES
+       DKIM_SIGN
        tls_require_ciphers = CONF_acceptable_ciphers
        tls_dh_min_bits = 508
        tls_tempfail_tryclear = true
@@ -442,6 +502,7 @@ m4_define(<:SMTP_TRANS_DHBITS:>,
        <:driver = smtp
        SMTP_DELIVERY
        APPLY_HEADER_CHANGES
+       DKIM_SIGN
        hosts_try_auth = *
        hosts_require_tls = DOMKV(tls-peer-ca, {*}{})
        hosts_require_auth = \