From e1988655a3a6cbc785bacd3a75595a12de81aa77 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 7 Dec 2022 19:51:13 +0100 Subject: Revert "Revert "exim-smarthost: check SPF"" This reverts commit 2eb33e60b45c2b37d51a57b0fbe4a023861a7429. --- krebs/3modules/exim-smarthost.nix | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) (limited to 'krebs/3modules/exim-smarthost.nix') diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix index 38cc828bb..5923b610d 100644 --- a/krebs/3modules/exim-smarthost.nix +++ b/krebs/3modules/exim-smarthost.nix @@ -126,8 +126,9 @@ let domainlist sender_domains = ${concatStringsSep ":" cfg.sender_domains} hostlist relay_from_hosts = <;${concatStringsSep ";" cfg.relay_from_hosts} - acl_smtp_rcpt = acl_check_rcpt acl_smtp_data = acl_check_data + acl_smtp_mail = acl_check_mail + acl_smtp_rcpt = acl_check_rcpt never_users = root @@ -179,6 +180,36 @@ let accept + acl_check_mail: + accept + sender_domains = +sender_domains + hosts = +relay_from_hosts + deny + spf = fail : softfail + log_message = spf=$spf_result + message = SPF validation failed: \ + $sender_host_address is not allowed to send mail from \ + ''${if def:sender_address_domain\ + {$sender_address_domain}\ + {$sender_helo_name}} + deny + spf = permerror + log_message = spf=$spf_result + message = SPF validation failed: \ + syntax error in SPF record(s) for \ + ''${if def:sender_address_domain\ + {$sender_address_domain}\ + {$sender_helo_name}} + defer + spf = temperror + log_message = spf=$spf_result; deferred + message = temporary error during SPF validation; \ + please try again later + warn + spf = none : neutral + log_message = spf=$spf_result + accept + add_header = $spf_received begin routers -- cgit v1.2.3 From df93a24faae49012aae107031b12c43f2e6e5c54 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 7 Dec 2022 19:57:46 +0100 Subject: exim-smarthost: don't check SPF when authenticated --- krebs/3modules/exim-smarthost.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'krebs/3modules/exim-smarthost.nix') diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix index 5923b610d..218d83ab4 100644 --- a/krebs/3modules/exim-smarthost.nix +++ b/krebs/3modules/exim-smarthost.nix @@ -181,6 +181,8 @@ let accept acl_check_mail: + accept + authenticated = * accept sender_domains = +sender_domains hosts = +relay_from_hosts -- cgit v1.2.3 From 1796bf491246bc3e728d8b8502cc27c7ea9d06ea Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 7 Dec 2022 20:03:15 +0100 Subject: exim-smarthost: make SPF check optional --- krebs/3modules/exim-smarthost.nix | 67 +++++++++++++++++++++------------------ 1 file changed, 36 insertions(+), 31 deletions(-) (limited to 'krebs/3modules/exim-smarthost.nix') diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix index 218d83ab4..7c176d224 100644 --- a/krebs/3modules/exim-smarthost.nix +++ b/krebs/3modules/exim-smarthost.nix @@ -12,6 +12,8 @@ let api = { enable = mkEnableOption "krebs.exim-smarthost"; + enableSPFVerification = mkEnableOption "SPF verification"; + authenticators = mkOption { type = types.attrsOf types.str; default = {}; @@ -181,37 +183,40 @@ let accept acl_check_mail: - accept - authenticated = * - accept - sender_domains = +sender_domains - hosts = +relay_from_hosts - deny - spf = fail : softfail - log_message = spf=$spf_result - message = SPF validation failed: \ - $sender_host_address is not allowed to send mail from \ - ''${if def:sender_address_domain\ - {$sender_address_domain}\ - {$sender_helo_name}} - deny - spf = permerror - log_message = spf=$spf_result - message = SPF validation failed: \ - syntax error in SPF record(s) for \ - ''${if def:sender_address_domain\ - {$sender_address_domain}\ - {$sender_helo_name}} - defer - spf = temperror - log_message = spf=$spf_result; deferred - message = temporary error during SPF validation; \ - please try again later - warn - spf = none : neutral - log_message = spf=$spf_result - accept - add_header = $spf_received + ${if cfg.enableSPFVerification then indent /* exim */ '' + accept + authenticated = * + accept + hosts = +relay_from_hosts + deny + spf = fail : softfail + log_message = spf=$spf_result + message = SPF validation failed: \ + $sender_host_address is not allowed to send mail from \ + ''${if def:sender_address_domain\ + {$sender_address_domain}\ + {$sender_helo_name}} + deny + spf = permerror + log_message = spf=$spf_result + message = SPF validation failed: \ + syntax error in SPF record(s) for \ + ''${if def:sender_address_domain\ + {$sender_address_domain}\ + {$sender_helo_name}} + defer + spf = temperror + log_message = spf=$spf_result; deferred + message = temporary error during SPF validation; \ + please try again later + warn + spf = none : neutral + log_message = spf=$spf_result + accept + add_header = $spf_received + '' else indent /* exim */ '' + accept + ''} begin routers -- cgit v1.2.3