Merge tag 'exim-4_82_1'
[exim.git] / test / confs / 5608
1 # Exim test configuration 5601
2 # OCSP stapling, client, tpda
3
4 SERVER =
5
6 exim_path = EXIM_PATH
7 host_lookup_order = bydns
8 primary_hostname = server1.example.com
9 rfc1413_query_timeout = 0s
10 spool_directory = DIR/spool
11 log_file_path = DIR/spool/log/SERVER%slog
12 gecos_pattern = ""
13 gecos_name = CALLER_NAME
14
15
16 # ----- Main settings -----
17
18 domainlist local_domains = test.ex : *.test.ex
19
20 acl_smtp_rcpt = check_recipient
21 acl_smtp_data = check_data
22
23 log_selector = +tls_peerdn
24 remote_max_parallel = 1
25
26 tls_advertise_hosts = *
27
28 # Set certificate only if server
29
30 tls_certificate = ${if eq {SERVER}{server}\
31 {DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem}\
32 fail\
33 }
34
35 #{DIR/aux-fixed/exim-ca/example.com/CA/CA.pem}\
36
37 tls_privatekey = ${if eq {SERVER}{server}\
38 {DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key}\
39 fail}
40
41 tls_ocsp_file = OCSP
42
43
44 # ------ ACL ------
45
46 begin acl
47
48 check_recipient:
49   accept  domains = +local_domains
50   deny    message = relay not permitted
51
52 check_data:
53   warn    condition   = ${if def:h_X-TLS-out:}
54           logwrite = client claims: $h_X-TLS-out:
55   accept
56
57 logger:
58   warn  logwrite = client ocsp status: $tls_out_ocsp \
59     (${listextract {${eval:$tls_out_ocsp+1}} \
60                 {notreq:notresp:vfynotdone:failed:verified}})
61   accept
62
63 # ----- Routers -----
64
65 begin routers
66
67 client:
68   driver = accept
69   condition = ${if eq {SERVER}{server}{no}{yes}}
70   retry_use_local_part
71   transport = send_to_server${if eq{$local_part}{nostaple}{1} \
72                                 {${if eq{$local_part}{norequire} {2} \
73                                 {${if eq{$local_part}{smtps} {4}{3}}} \
74                              }}}
75
76 server:
77   driver = redirect
78   data = :blackhole:
79   #retry_use_local_part
80   #transport = local_delivery
81
82
83 # ----- Transports -----
84
85 begin transports
86
87 local_delivery:
88   driver = appendfile
89   file = DIR/test-mail/$local_part
90   headers_add = TLS: cipher=$tls_cipher peerdn=$tls_peerdn
91   user = CALLER
92
93 # nostaple: deliberately do not request cert-status
94 send_to_server1:
95   driver = smtp
96   allow_localhost
97   hosts = HOSTIPV4
98   port = PORT_D
99   tls_verify_certificates =     DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
100   hosts_require_tls =   *
101   hosts_request_ocsp =  :
102   headers_add =                 X-TLS-out: ocsp status $tls_out_ocsp
103   tpda_delivery_action =        ${acl {logger}}
104   tpda_host_defer_action =      ${acl {logger}}
105
106 # norequire: request stapling but do not verify
107 send_to_server2:
108   driver = smtp
109   allow_localhost
110   hosts = HOSTIPV4
111   port = PORT_D
112   tls_verify_certificates =     DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
113   hosts_require_tls =   *
114 # note no ocsp mention here
115   headers_add =                 X-TLS-out: ocsp status $tls_out_ocsp
116   tpda_delivery_action =        ${acl {logger}}
117   tpda_host_defer_action =      ${acl {logger}}
118
119 # (any other name): request and verify
120 send_to_server3:
121   driver = smtp
122   allow_localhost
123   hosts = 127.0.0.1
124   port = PORT_D
125   helo_data = helo.data.changed
126   tls_verify_certificates =     DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
127   hosts_require_tls =   *
128   hosts_require_ocsp =  *
129   headers_add =                 X-TLS-out: ocsp status $tls_out_ocsp
130   tpda_delivery_action =        ${acl {logger}}
131   tpda_host_defer_action =      ${acl {logger}}
132
133 # (any other name): request and verify, ssl-on-connect
134 send_to_server4:
135   driver = smtp
136   allow_localhost
137   hosts = 127.0.0.1
138   port = PORT_D
139   helo_data = helo.data.changed
140   tls_verify_certificates =     DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
141   protocol =           smtps
142   hosts_require_tls =  *
143   hosts_require_ocsp = *
144   headers_add =                 X-TLS-out: ocsp status $tls_out_ocsp
145   tpda_delivery_action =        ${acl {logger}}
146   tpda_host_defer_action =      ${acl {logger}}
147
148
149 # ----- Retry -----
150
151
152 begin retry
153
154 * * F,5d,1s
155
156
157 # End