opendev/system-config
Code Issues Proposed changes

Merge "Only allow mail from jenkins from zuul"

Browse Source
This commit is contained in:
Jenkins 2014-02-12 22:51:28 +00:00 committed by Gerrit Code Review
commit 2c36767fd8
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
modules/exim/templates/exim4.conf.erb
View File

@ -457,6 +457,13 @@ acl_check_rcpt:
control = submission control = submission
control = dkim_disable_verify control = dkim_disable_verify
# In case people cargo-cult our Zuul configuration, only allow
# messages with an envelope sender of jenkins from OpenStack's Zuul.
deny senders = jenkins@openstack.org
!hosts = zuul.openstack.org : 127.0.0.1
message = Sender address not permitted from this host
# Insist that any other recipient address that we accept is either in one of # Insist that any other recipient address that we accept is either in one of
# our local domains, or is in a domain for which we explicitly allow # our local domains, or is in a domain for which we explicitly allow
# relaying. Any other domain is rejected as being unacceptable for relaying. # relaying. Any other domain is rejected as being unacceptable for relaying.
@ -529,6 +536,14 @@ acl_check_data:
# X-Spam_bar: $spam_bar\n\ # X-Spam_bar: $spam_bar\n\
# X-Spam_report: $spam_report # X-Spam_report: $spam_report
# In case people cargo-cult our Zuul configuration, only allow
# messages with a From header of jenkins from OpenStack's Zuul.
deny condition = ${if eq{${address:$h_from:}}\
{jenkins@openstack.org}}
!hosts = zuul.openstack.org : 127.0.0.1
message = From address not permitted from this host
# Accept the message. # Accept the message.
accept accept