test/confs/5893

   1 # Exim test configuration 5893
   2
   3 SERVER =
   4 OPTION =
   5
   6 .include DIR/aux-var/tls_conf_prefix
   7
   8 primary_hostname = myhost.test.ex
   9
  10 # ----- Main settings -----
  11
  12 domainlist local_domains = test.ex : *.test.ex
  13
  14 acl_smtp_helo = check_helo
  15 acl_smtp_rcpt = check_recipient
  16 log_selector = +received_recipients +tls_resumption +tls_peerdn
  17
  18 .ifdef _OPT_OPENSSL_NO_TLSV1_3_X
  19 openssl_options = +no_sslv2 +no_sslv3 +single_dh_use OPTION
  20 .else
  21 openssl_options = +no_sslv2 +no_sslv3 +single_dh_use
  22 .endif
  23 tls_advertise_hosts = *
  24
  25 # Set certificate only if server
  26
  27 CDIR=DIR/aux-fixed/exim-ca/example.com
  28
  29 tls_certificate = CDIR/server1.example.com/server1.example.com.chain.pem
  30 tls_privatekey =  CDIR/server1.example.com/server1.example.com.unlocked.key
  31 tls_ocsp_file =   CDIR/server1.example.com/server1.example.com.ocsp.good.resp
  32
  33 tls_resumption_hosts = 127.0.0.1
  34
  35
  36 # ------ ACL ------
  37
  38 begin acl
  39
  40 check_helo:
  41   accept  condition =   ${if def:tls_in_cipher}
  42           logwrite =    tls_in_resumption\t${listextract {$tls_in_resumption} {_RESUME_DECODE}}
  43           logwrite =    our cert subject\t${certextract {subject}{$tls_in_ourcert}}
  44           logwrite =    peer cert subject\t${certextract {subject}{$tls_in_peercert}}
  45           logwrite =    peer cert verified\t${tls_in_certificate_verified}
  46           logwrite =    peer dn\t${tls_in_peerdn}
  47           logwrite =    ocsp\t${tls_in_ocsp}
  48           logwrite =    cipher\t${tls_in_cipher}
  49           logwrite =    bits\t${tls_in_bits}
  50   accept
  51
  52 check_recipient:
  53   accept  domains =     +local_domains
  54   deny    message =     relay not permitted
  55
  56 log_resumption:
  57   accept condition =    ${if def:tls_out_cipher}
  58          condition =    ${if eq {$event_name}{tcp:close}}
  59          logwrite =     tls_out_resumption ${listextract {$tls_out_resumption} {_RESUME_DECODE}}
  60           logwrite =    our cert subject\t${certextract {subject}{$tls_out_ourcert}}
  61           logwrite =    peer cert subject\t${certextract {subject}{$tls_out_peercert}}
  62           logwrite =    peer cert verified\t${tls_out_certificate_verified}
  63           logwrite =    peer dn\t${tls_out_peerdn}
  64           logwrite =    ocsp\t${tls_out_ocsp}
  65           logwrite =    cipher\t${tls_out_cipher}
  66           logwrite =    bits\t${tls_out_bits}
  67
  68
  69 # ----- Routers -----
  70
  71 begin routers
  72
  73 client:
  74   driver =      accept
  75   condition =   ${if eq {SERVER}{server}{no}{yes}}
  76   transport =   send_to_server${if eq{$local_part}{abcd}{2}{1}}
  77
  78 server:
  79   driver = redirect
  80   data = :blackhole:
  81
  82 # ----- Transports -----
  83
  84 begin transports
  85
  86 send_to_server1:
  87   driver =                      smtp
  88   allow_localhost
  89   hosts =                       127.0.0.1
  90   port =                        PORT_D
  91   helo_data =                   helo.data.changed
  92 .ifdef VALUE
  93   tls_resumption_hosts =        *
  94 .else
  95   tls_resumption_hosts =        :
  96 .endif
  97   tls_verify_certificates =     CDIR/CA/CA.pem
  98   tls_verify_cert_hostnames =   ${if match {$local_part}{^noverify} {*}{:}}
  99   tls_try_verify_hosts =        *
 100   event_action =                ${acl {log_resumption}}
 101
 102 send_to_server2:
 103   driver = smtp
 104   allow_localhost
 105   hosts = HOSTIPV4
 106   port = PORT_D
 107   hosts_try_fastopen =  :
 108   tls_verify_certificates =     CDIR/CA/CA.pem
 109   tls_verify_cert_hostnames =   :
 110   event_action =                ${acl {log_resumption}}
 111
 112
 113 # ----- Retry -----
 114
 115
 116 begin retry
 117
 118 * * F,5d,10s
 119
 120
 121 # End