test/confs/5895

   1 # Exim test configuration 5895
   2
   3 SERVER =
   4
   5 .include DIR/aux-var/tls_conf_prefix
   6
   7 primary_hostname = myhost.test.ex
   8
   9 # ----- Main settings -----
  10
  11 domainlist local_domains = test.ex : *.test.ex
  12
  13 acl_smtp_helo = check_helo
  14 acl_smtp_rcpt = check_recipient
  15 log_selector = +received_recipients +tls_resumption +tls_peerdn
  16
  17 openssl_options = +no_sslv2 +no_sslv3 +single_dh_use
  18 tls_advertise_hosts = *
  19
  20 # Set certificate only if server
  21
  22 CDIR=DIR/aux-fixed/exim-ca/example.com
  23
  24 tls_certificate = CDIR/server1.example.com/server1.example.com.chain.pem
  25 tls_privatekey =  CDIR/server1.example.com/server1.example.com.unlocked.key
  26 tls_ocsp_file =   CDIR/server1.example.com/server1.example.com.ocsp.good.resp
  27
  28 tls_resumption_hosts = 127.0.0.1
  29
  30
  31 # ------ ACL ------
  32
  33 begin acl
  34
  35 check_helo:
  36   accept  condition =   ${if def:tls_in_cipher}
  37           logwrite =    tls_in_resumption\t${listextract {$tls_in_resumption} {_RESUME_DECODE}}
  38           logwrite =    our cert subject\t${certextract {subject}{$tls_in_ourcert}}
  39           logwrite =    peer cert subject\t${certextract {subject}{$tls_in_peercert}}
  40           logwrite =    peer cert verified\t${tls_in_certificate_verified}
  41           logwrite =    peer dn\t${tls_in_peerdn}
  42           logwrite =    ocsp\t${tls_in_ocsp}
  43           logwrite =    cipher\t${tls_in_cipher}
  44           logwrite =    bits\t${tls_in_bits}
  45   accept
  46
  47 check_recipient:
  48   accept  domains =     +local_domains
  49   deny    message =     relay not permitted
  50
  51 log_resumption:
  52   accept condition =    ${if def:tls_out_cipher}
  53          condition =    ${if eq {$event_name}{tcp:close}}
  54          logwrite =     tls_out_resumption ${listextract {$tls_out_resumption} {_RESUME_DECODE}}
  55           logwrite =    our cert subject\t${certextract {subject}{$tls_out_ourcert}}
  56           logwrite =    peer cert subject\t${certextract {subject}{$tls_out_peercert}}
  57           logwrite =    peer cert verified\t${tls_out_certificate_verified}
  58           logwrite =    peer dn\t${tls_out_peerdn}
  59           logwrite =    ocsp\t${tls_out_ocsp}
  60           logwrite =    cipher\t${tls_out_cipher}
  61           logwrite =    bits\t${tls_out_bits}
  62
  63
  64 # ----- Routers -----
  65
  66 begin routers
  67
  68 client:
  69   driver =      accept
  70   condition =   ${if eq {SERVER}{server}{no}{yes}}
  71   transport =   send_to_server${if eq{$local_part}{abcd}{2}{1}}
  72
  73 server:
  74   driver = redirect
  75   data = :blackhole:
  76
  77 # ----- Transports -----
  78
  79 begin transports
  80
  81 send_to_server1:
  82   driver =                      smtp
  83   allow_localhost
  84   hosts =                       127.0.0.1
  85   port =                        PORT_D
  86   helo_data =                   helo.data.changed
  87 .ifdef VALUE
  88   tls_resumption_hosts =        *
  89 .else
  90   tls_resumption_hosts =        :
  91 .endif
  92   tls_verify_certificates =     CDIR/CA/CA.pem
  93   tls_verify_cert_hostnames =   ${if match {$local_part}{^noverify} {*}{:}}
  94   tls_try_verify_hosts =        *
  95   event_action =                ${acl {log_resumption}}
  96
  97 send_to_server2:
  98   driver = smtp
  99   allow_localhost
 100   hosts = HOSTIPV4
 101   port = PORT_D
 102   hosts_try_fastopen =  :
 103   tls_verify_certificates =     CDIR/CA/CA.pem
 104   tls_verify_cert_hostnames =   :
 105   event_action =                ${acl {log_resumption}}
 106
 107
 108 # ----- Retry -----
 109
 110
 111 begin retry
 112
 113 * * F,5d,10s
 114
 115
 116 # End