GnuTLS: Move to more-modern stapling API
[exim.git] / test / confs / 5730
CommitLineData
4b4a0e99 1# Exim test configuration 5730
774ef2d7 2# OCSP stapling, client, events
018058b2
JH
3
4SERVER =
5
e5489333
JH
6exim_path = EXIM_PATH
7keep_environment = ^EXIM_TESTHARNESS_DISABLE_[O]CSPVALIDITYCHECK$
8host_lookup_order = bydns
9spool_directory = DIR/spool
10log_file_path = DIR/spool/log/SERVER%slog
11gecos_pattern = ""
12gecos_name = CALLER_NAME
13chunking_advertise_hosts =
d4dc049f 14
018058b2 15primary_hostname = server1.example.com
e5489333
JH
16
17.ifdef _HAVE_DMARC
18dmarc_tld_file =
19.endif
018058b2
JH
20
21
22# ----- Main settings -----
23
24domainlist local_domains = test.ex : *.test.ex
25
26acl_smtp_rcpt = check_recipient
27acl_smtp_data = check_data
28
29log_selector = +tls_peerdn
30remote_max_parallel = 1
31
32tls_advertise_hosts = *
33
34# Set certificate only if server
35tls_certificate = ${if eq {SERVER}{server}\
36{DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem}\
37fail\
38}
39tls_privatekey = ${if eq {SERVER}{server}\
40{DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key}\
41fail}
42
43# from cmdline define
0a6583ae 44tls_ocsp_file = OPT
018058b2
JH
45
46
47# ------ ACL ------
48
49begin acl
50
51check_recipient:
52 accept domains = +local_domains
53 deny message = relay not permitted
54
55check_data:
56 warn condition = ${if def:h_X-TLS-out:}
57 logwrite = client claims: $h_X-TLS-out:
58 accept
59
60logger:
774ef2d7 61 accept condition = ${if !eq {msg} {${listextract{1}{$event_name}}}}
018058b2
JH
62 warn logwrite = client ocsp status: $tls_out_ocsp \
63 (${listextract {${eval:$tls_out_ocsp+1}} \
64 {notreq:notresp:vfynotdone:failed:verified}})
65 accept
66
67
68# ----- Routers -----
69
70begin routers
71
72client:
73 driver = accept
74 condition = ${if eq {SERVER}{server}{no}{yes}}
75 retry_use_local_part
76 transport = send_to_server${if eq{$local_part}{nostaple}{1} \
77 {${if eq{$local_part}{norequire} {2} \
78 {${if eq{$local_part}{smtps} {4}{3}}} \
79 }}}
80
81server:
82 driver = redirect
83 data = :blackhole:
84 #retry_use_local_part
85 #transport = local_delivery
86
87
88# ----- Transports -----
89
90begin transports
91
92local_delivery:
93 driver = appendfile
94 file = DIR/test-mail/$local_part
95 headers_add = TLS: cipher=$tls_cipher peerdn=$tls_peerdn
96 user = CALLER
97
98send_to_server1:
99 driver = smtp
100 allow_localhost
101 hosts = HOSTIPV4
102 port = PORT_D
103 tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
01a4a5c5 104 tls_verify_cert_hostnames =
018058b2
JH
105 hosts_require_tls = *
106 hosts_request_ocsp = :
107 headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
108 (${listextract {${eval:$tls_out_ocsp+1}} \
109 {notreq:notresp:vfynotdone:failed:verified}})
774ef2d7 110 event_action = ${acl {logger}}
018058b2
JH
111
112send_to_server2:
113 driver = smtp
114 allow_localhost
115 hosts = HOSTIPV4
116 port = PORT_D
117 tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
01a4a5c5 118 tls_verify_cert_hostnames =
018058b2
JH
119 hosts_require_tls = *
120# note no ocsp mention here
121 headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
122 (${listextract {${eval:$tls_out_ocsp+1}} \
123 {notreq:notresp:vfynotdone:failed:verified}})
774ef2d7 124 event_action = ${acl {logger}}
018058b2
JH
125
126send_to_server3:
127 driver = smtp
128 allow_localhost
129 hosts = 127.0.0.1
130 port = PORT_D
131 helo_data = helo.data.changed
132 #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
133 tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
610ff438 134 tls_try_verify_hosts =
01a4a5c5 135 tls_verify_cert_hostnames =
018058b2
JH
136 hosts_require_tls = *
137 hosts_require_ocsp = *
138 headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
139 (${listextract {${eval:$tls_out_ocsp+1}} \
140 {notreq:notresp:vfynotdone:failed:verified}})
774ef2d7 141 event_action = ${acl {logger}}
018058b2
JH
142
143send_to_server4:
144 driver = smtp
145 allow_localhost
146 hosts = 127.0.0.1
147 port = PORT_D
148 helo_data = helo.data.changed
149 #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
150 tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
01a4a5c5 151 tls_verify_cert_hostnames =
018058b2
JH
152 protocol = smtps
153 hosts_require_tls = *
154 hosts_require_ocsp = *
155 headers_add = X-TLS-out: OCSP status $tls_out_ocsp \
156 (${listextract {${eval:$tls_out_ocsp+1}} \
157 {notreq:notresp:vfynotdone:failed:verified}})
774ef2d7 158 event_action = ${acl {logger}}
018058b2
JH
159
160
161# ----- Retry -----
162
163
164begin retry
165
166* * F,5d,1s
167
168
169# End