Re: [Exim] ACL help

Αρχική Σελίδα
Delete this message
Reply to this message
Συντάκτης: Dave C.
Ημερομηνία:  
Προς: Dr Andrew C Aitchison
Υ/ο: exim-users
Αντικείμενο: Re: [Exim] ACL help

On Tue, 4 Jun 2002, Dave C. wrote:

> On Tue, 4 Jun 2002, Dr Andrew C Aitchison wrote:
>
> > On Mon, 3 Jun 2002, Dave C. wrote:
> > > I cant seem to find a way to make an "OR" out of two "require"s
> > >
> > > acl_check_rcpt:
> > >   deny          local_parts     = ^.*[@%!/|]
> > >   require       verify          = sender/callout=5s/callout_defer_ok
> > >   require       verify          = recipient/callout=5s
> > >   accept        hosts           = :
> > >   accept        hosts           = +relay_from_hosts
> > >   accept        domains         = MY.DOMAIN
> > >   accept        domains         = lsearch;/path/to/more/of/MY.DOMAINS
> > >   deny          message         = Access denied

> >
> > I'm not entirely clear yet, but...
> > If they are ORed, how are they different from an accept ?
> > Is it enough to accept the first and require the second ?
>
>
> The way I understand it, if I 'accept', the ACL ends and no further
> processing is done. Or is this not the case?
>
> I want to
>
> require - either local_part = postmaster or recipient/callout.....
>
> If I do
>
> require local_part = postmaster
> require verify recipient = callout/....
>
> It will still run the callout even if the local_part = postmaster
>
> If I accept, it wont follow the rest of the ACL:
>
> accept hosts = :
> accept hosts = +relay_from_hosts
> etc..
> and the final deny if none of the hosts or domains match...



Ok, I've come up with this, but its too early in the morning for me to
be sure if this will work or not.

If I put this in place of the require:

deny !local_parts = postmaster
     !verify = recipient/callout


It *seems* as though the deny conditions are AND-ed, and run in the
order given

So if local_part was postmaster, the first line is false, and we dont
deny, go on to next. If it is, then if we CAN verify with callout, thats
false, go on to next. If its postmaster, AND it doesnt verify, deny.

Convoluted, but it seems like it should accomplish what I'm looking for
(I havent tested it yet)



--