testsuite: add 0990 for allow_insecure_tainted_data
[exim.git] / test / confs / 5892
1 # Exim test configuration 5892
2
3 SERVER =
4 OPTION =
5
6 .include DIR/aux-var/tls_conf_prefix
7
8 primary_hostname = myhost.test.ex
9
10 # ----- Main settings -----
11
12 domainlist local_domains = test.ex : *.test.ex
13
14 acl_smtp_helo = check_helo
15 acl_smtp_rcpt = check_recipient
16 log_selector = +received_recipients +tls_resumption +tls_peerdn
17
18 .ifdef _OPT_OPENSSL_NO_TLSV1_3_X
19 openssl_options = +no_sslv2 +no_sslv3 +single_dh_use OPTION
20 .else
21 openssl_options = +no_sslv2 +no_sslv3 +single_dh_use
22 .endif
23 tls_advertise_hosts = *
24
25 # Set certificate only if server
26
27 CDIR=DIR/aux-fixed/exim-ca/example.com
28
29 tls_certificate = CDIR/server1.example.com/server1.example.com.chain.pem
30 tls_privatekey =  CDIR/server1.example.com/server1.example.com.unlocked.key
31
32 tls_resumption_hosts = 127.0.0.1
33
34
35 # ------ ACL ------
36
37 begin acl
38
39 check_helo:
40   accept  condition =   ${if def:tls_in_cipher}
41           logwrite =    tls_in_resumption\t${listextract {$tls_in_resumption} {_RESUME_DECODE}}
42           logwrite =    our cert subject\t${certextract {subject}{$tls_in_ourcert}}
43           logwrite =    peer cert subject\t${certextract {subject}{$tls_in_peercert}}
44           logwrite =    peer cert verified\t${tls_in_certificate_verified}
45           logwrite =    peer dn\t${tls_in_peerdn}
46           logwrite =    cipher\t${tls_in_cipher}
47           logwrite =    bits\t${tls_in_bits}
48   accept
49
50 check_recipient:
51   accept  domains =     +local_domains
52   deny    message =     relay not permitted
53
54 log_resumption:
55   accept condition =    ${if def:tls_out_cipher}
56          condition =    ${if eq {$event_name}{tcp:close}}
57          logwrite =     tls_out_resumption ${listextract {$tls_out_resumption} {_RESUME_DECODE}}
58           logwrite =    our cert subject\t${certextract {subject}{$tls_out_ourcert}}
59           logwrite =    peer cert subject\t${certextract {subject}{$tls_out_peercert}}
60           logwrite =    peer cert verified\t${tls_out_certificate_verified}
61           logwrite =    peer dn\t${tls_out_peerdn}
62           logwrite =    cipher\t${tls_out_cipher}
63           logwrite =    bits\t${tls_out_bits}
64
65
66 # ----- Routers -----
67
68 begin routers
69
70 client:
71   driver =      accept
72   condition =   ${if eq {SERVER}{server}{no}{yes}}
73   transport =   send_to_server${if eq{$local_part}{abcd}{2}{1}}
74
75 server:
76   driver = redirect
77   data = :blackhole:
78
79 # ----- Transports -----
80
81 begin transports
82
83 send_to_server1:
84   driver =                      smtp
85   allow_localhost
86   hosts =                       127.0.0.1
87   port =                        PORT_D
88   helo_data =                   helo.data.changed
89 .ifdef VALUE
90   tls_resumption_hosts =        *
91 .else
92   tls_resumption_hosts =        :
93 .endif
94   tls_verify_certificates =     CDIR/CA/CA.pem
95   tls_verify_cert_hostnames =   ${if match {$local_part}{^noverify} {*}{:}}
96   tls_try_verify_hosts =        *
97   event_action =                ${acl {log_resumption}}
98
99 send_to_server2:
100   driver = smtp
101   allow_localhost
102   hosts = HOSTIPV4
103   port = PORT_D
104   hosts_try_fastopen =  :
105   tls_verify_certificates =     CDIR/CA/CA.pem
106   tls_verify_cert_hostnames =   :
107   event_action =                ${acl {log_resumption}}
108
109
110 # ----- Retry -----
111
112
113 begin retry
114
115 * * F,5d,10s
116
117
118 # End