test/confs/5890

   1 # Exim test configuration 5890
   2
   3 SERVER =
   4 OPTION = NORMAL
   5
   6 .include DIR/aux-var/tls_conf_prefix
   7
   8 primary_hostname = myhost.test.ex
   9
  10 # ----- Main settings -----
  11
  12 domainlist local_domains = test.ex : *.test.ex
  13
  14 acl_smtp_helo = check_helo
  15 acl_smtp_rcpt = check_recipient
  16 log_selector = +received_recipients +tls_resumption +tls_peerdn +outgoing_port
  17
  18 tls_advertise_hosts = *
  19 tls_on_connect_ports =  PORT_D2
  20
  21 # Set certificate only if server
  22
  23 CDIR=DIR/aux-fixed/exim-ca/example.com
  24
  25 tls_certificate = CDIR/server1.example.com/server1.example.com.chain.pem
  26 tls_privatekey =  CDIR/server1.example.com/server1.example.com.unlocked.key
  27
  28 tls_require_ciphers = OPTION
  29 tls_resumption_hosts = 127.0.0.1
  30
  31
  32 # ------ ACL ------
  33
  34 begin acl
  35
  36 check_helo:
  37   accept condition =    ${if def:tls_in_cipher}
  38          logwrite =     tls_in_ver\t$tls_in_ver
  39          logwrite =     tls_in_resumption\t${listextract {$tls_in_resumption} {_RESUME_DECODE}}
  40          logwrite =     our cert subject\t${certextract {subject}{$tls_in_ourcert}}
  41          logwrite =     peer cert subject\t${certextract {subject}{$tls_in_peercert}}
  42          logwrite =     peer cert verified\t${tls_in_certificate_verified}
  43          logwrite =     peer dn\t${tls_in_peerdn}
  44          logwrite =     cipher\t${tls_in_cipher}
  45          logwrite =     bits\t${tls_in_bits}
  46   accept
  47
  48 check_recipient:
  49   accept domains =      +local_domains
  50   deny   message =      relay not permitted
  51
  52 log_resumption:
  53   accept condition =    ${if def:tls_out_cipher}
  54          condition =    ${if eq {$event_name}{tcp:close}}
  55          logwrite =     tls_out_ver\t$tls_out_ver
  56          logwrite =     tls_out_resumption ${listextract {$tls_out_resumption} {_RESUME_DECODE}}
  57          logwrite =     our cert subject\t${certextract {subject}{$tls_out_ourcert}}
  58          logwrite =     peer cert subject\t${certextract {subject}{$tls_out_peercert}}
  59          logwrite =     peer cert verified\t${tls_out_certificate_verified}
  60          logwrite =     peer dn\t${tls_out_peerdn}
  61          logwrite =     cipher\t${tls_out_cipher}
  62          logwrite =     bits\t${tls_out_bits}
  63
  64
  65 # ----- Routers -----
  66
  67 begin routers
  68
  69 client:
  70   driver =      accept
  71   condition =   ${if eq {SERVER}{server}{no}{yes}}
  72   transport =   send_to_server${if eq{$local_part}{hostnotresume}{2}{1}}
  73
  74 server:
  75   driver = redirect
  76   data = :blackhole:
  77
  78 # ----- Transports -----
  79
  80 begin transports
  81
  82 send_to_server1:
  83   driver =                      smtp
  84   allow_localhost
  85   hosts =                       127.0.0.1
  86 .ifdef SELECTOR
  87   port =                        PORT_D2
  88   protocol =                    smtps
  89   # Use HELO purely to get a P= different on the server <= line
  90   hosts_avoid_esmtp =           *
  91 .else
  92   port =                        PORT_D
  93 .endif
  94   helo_data =                   helo.data.changed
  95 .ifdef HELO_MSG
  96   host_name_extract =           HELO_MSG
  97 .endif
  98 .ifdef VALUE
  99   tls_resumption_hosts =        *
 100 .else
 101   tls_resumption_hosts =        :
 102 .endif
 103   tls_verify_certificates =     CDIR/CA/CA.pem
 104   tls_verify_cert_hostnames =   ${if match {$local_part}{^noverify} {*}{:}}
 105   tls_try_verify_hosts =        *
 106   event_action =                ${acl {log_resumption}}
 107
 108 send_to_server2:
 109   driver =                      smtp
 110   allow_localhost
 111   hosts =                       HOSTIPV4
 112   port =                        PORT_D
 113   hosts_try_fastopen =          :
 114   tls_verify_certificates =     CDIR/CA/CA.pem
 115   tls_verify_cert_hostnames =   :
 116   event_action =                ${acl {log_resumption}}
 117
 118
 119 # ----- Retry -----
 120
 121
 122 begin retry
 123
 124 * * F,5d,10s
 125
 126
 127 # End