LibreSSL: fixes pulled from OpenBSD patchset
[exim.git] / test / confs / 5895
1 # Exim test configuration 5895
2
3 SERVER =
4
5 .include DIR/aux-var/tls_conf_prefix
6
7 primary_hostname = myhost.test.ex
8
9 # ----- Main settings -----
10
11 domainlist local_domains = test.ex : *.test.ex
12
13 acl_smtp_helo = check_helo
14 acl_smtp_rcpt = check_recipient
15 log_selector = +received_recipients +tls_resumption +tls_peerdn
16
17 openssl_options = +no_sslv2 +no_sslv3 +single_dh_use
18 tls_advertise_hosts = *
19
20 # Set certificate only if server
21
22 CDIR=DIR/aux-fixed/exim-ca/example.com
23
24 tls_certificate = CDIR/server1.example.com/server1.example.com.chain.pem
25 tls_privatekey =  CDIR/server1.example.com/server1.example.com.unlocked.key
26 tls_ocsp_file =   CDIR/server1.example.com/server1.example.com.ocsp.good.resp
27
28 tls_resumption_hosts = 127.0.0.1
29
30
31 # ------ ACL ------
32
33 begin acl
34
35 check_helo:
36   accept  condition =   ${if def:tls_in_cipher}
37           logwrite =    tls_in_resumption\t${listextract {$tls_in_resumption} {_RESUME_DECODE}}
38           logwrite =    our cert subject\t${certextract {subject}{$tls_in_ourcert}}
39           logwrite =    peer cert subject\t${certextract {subject}{$tls_in_peercert}}
40           logwrite =    peer cert verified\t${tls_in_certificate_verified}
41           logwrite =    peer dn\t${tls_in_peerdn}
42           logwrite =    ocsp\t${tls_in_ocsp}
43           logwrite =    cipher\t${tls_in_cipher}
44           logwrite =    bits\t${tls_in_bits}
45   accept
46
47 check_recipient:
48   accept  domains =     +local_domains
49   deny    message =     relay not permitted
50
51 log_resumption:
52   accept condition =    ${if def:tls_out_cipher}
53          condition =    ${if eq {$event_name}{tcp:close}}
54          logwrite =     tls_out_resumption ${listextract {$tls_out_resumption} {_RESUME_DECODE}}
55           logwrite =    our cert subject\t${certextract {subject}{$tls_out_ourcert}}
56           logwrite =    peer cert subject\t${certextract {subject}{$tls_out_peercert}}
57           logwrite =    peer cert verified\t${tls_out_certificate_verified}
58           logwrite =    peer dn\t${tls_out_peerdn}
59           logwrite =    ocsp\t${tls_out_ocsp}
60           logwrite =    cipher\t${tls_out_cipher}
61           logwrite =    bits\t${tls_out_bits}
62
63
64 # ----- Routers -----
65
66 begin routers
67
68 client:
69   driver =      accept
70   condition =   ${if eq {SERVER}{server}{no}{yes}}
71   transport =   send_to_server${if eq{$local_part}{abcd}{2}{1}}
72
73 server:
74   driver = redirect
75   data = :blackhole:
76
77 # ----- Transports -----
78
79 begin transports
80
81 send_to_server1:
82   driver =                      smtp
83   allow_localhost
84   hosts =                       127.0.0.1
85   port =                        PORT_D
86   helo_data =                   helo.data.changed
87 .ifdef VALUE
88   tls_resumption_hosts =        *
89 .else
90   tls_resumption_hosts =        :
91 .endif
92   tls_verify_certificates =     CDIR/CA/CA.pem
93   tls_verify_cert_hostnames =   ${if match {$local_part}{^noverify} {*}{:}}
94   tls_try_verify_hosts =        *
95 .ifdef _HAVE_EVENT
96   event_action =                ${acl {log_resumption}}
97 .endif
98
99 send_to_server2:
100   driver = smtp
101   allow_localhost
102   hosts = HOSTIPV4
103   port = PORT_D
104   hosts_try_fastopen =  :
105   tls_verify_certificates =     CDIR/CA/CA.pem
106   tls_verify_cert_hostnames =   :
107 .ifdef _HAVE_EVENT
108   event_action =                ${acl {log_resumption}}
109 .endif
110
111
112 # ----- Retry -----
113
114
115 begin retry
116
117 * * F,5d,10s
118
119
120 # End