test/confs/5651

   1 # Exim test configuration 5651
   2 # OCSP stapling, client
   3
   4 SERVER =
   5
   6 exim_path = EXIM_PATH
   7 host_lookup_order = bydns
   8 primary_hostname = server1.example.com
   9 spool_directory = DIR/spool
  10 log_file_path = DIR/spool/log/SERVER%slog
  11 gecos_pattern = ""
  12 gecos_name = CALLER_NAME
  13
  14
  15 # ----- Main settings -----
  16
  17 domainlist local_domains = test.ex : *.test.ex
  18
  19 acl_smtp_rcpt = check_recipient
  20 acl_smtp_data = check_data
  21
  22 log_selector = +tls_peerdn
  23 remote_max_parallel = 1
  24
  25 tls_advertise_hosts = *
  26
  27 # Set certificate only if server
  28 tls_certificate = ${if eq {SERVER}{server}\
  29 {DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem}\
  30 fail\
  31 }
  32 tls_privatekey = ${if eq {SERVER}{server}\
  33 {DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key}\
  34 fail}
  35
  36 # from cmdline define
  37 tls_ocsp_file = OCSP
  38
  39
  40 # ------ ACL ------
  41
  42 begin acl
  43
  44 check_recipient:
  45   accept  domains = +local_domains
  46   deny    message = relay not permitted
  47
  48 check_data:
  49   warn    condition   = ${if def:h_X-TLS-out:}
  50           logwrite = client claims: $h_X-TLS-out:
  51   accept
  52
  53
  54 # ----- Routers -----
  55
  56 begin routers
  57
  58 client:
  59   driver = accept
  60   condition = ${if eq {SERVER}{server}{no}{yes}}
  61   retry_use_local_part
  62   transport = send_to_server${if eq{$local_part}{nostaple}{1} \
  63                                 {${if eq{$local_part}{norequire} {2} \
  64                                 {${if eq{$local_part}{smtps} {4}{3}}} \
  65                              }}}
  66
  67 server:
  68   driver = redirect
  69   data = :blackhole:
  70   #retry_use_local_part
  71   #transport = local_delivery
  72
  73
  74 # ----- Transports -----
  75
  76 begin transports
  77
  78 local_delivery:
  79   driver = appendfile
  80   file = DIR/test-mail/$local_part
  81   headers_add = TLS: cipher=$tls_cipher peerdn=$tls_peerdn
  82   user = CALLER
  83
  84 send_to_server1:
  85   driver = smtp
  86   allow_localhost
  87   hosts = HOSTIPV4
  88   port = PORT_D
  89   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
  90   tls_verify_cert_hostnames =
  91   hosts_require_tls = *
  92   hosts_request_ocsp = :
  93   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
  94     (${listextract {${eval:$tls_out_ocsp+1}} \
  95                 {notreq:notresp:vfynotdone:failed:verified}})
  96
  97 send_to_server2:
  98   driver = smtp
  99   allow_localhost
 100   hosts = HOSTIPV4
 101   port = PORT_D
 102   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
 103   tls_verify_cert_hostnames =
 104   hosts_require_tls = *
 105 # note no ocsp mention here
 106   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
 107     (${listextract {${eval:$tls_out_ocsp+1}} \
 108                 {notreq:notresp:vfynotdone:failed:verified}})
 109
 110 send_to_server3:
 111   driver = smtp
 112   allow_localhost
 113   hosts = 127.0.0.1
 114   port = PORT_D
 115   helo_data = helo.data.changed
 116   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
 117   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
 118   tls_try_verify_hosts =
 119   tls_verify_cert_hostnames =
 120   hosts_require_tls =  *
 121   hosts_require_ocsp = *
 122   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
 123     (${listextract {${eval:$tls_out_ocsp+1}} \
 124                 {notreq:notresp:vfynotdone:failed:verified}})
 125
 126 send_to_server4:
 127   driver = smtp
 128   allow_localhost
 129   hosts = 127.0.0.1
 130   port = PORT_D
 131   helo_data = helo.data.changed
 132   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
 133   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
 134   tls_verify_cert_hostnames =
 135   protocol =           smtps
 136   hosts_require_tls =  *
 137   hosts_require_ocsp = *
 138   headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
 139     (${listextract {${eval:$tls_out_ocsp+1}} \
 140                 {notreq:notresp:vfynotdone:failed:verified}})
 141
 142
 143 # ----- Retry -----
 144
 145
 146 begin retry
 147
 148 * * F,5d,1s
 149
 150
 151 # End