diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2018-03-06 12:13:14 +0000 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2018-03-07 14:09:18 +0000 |
| commit | c4b57fddcae8301f324d2626083c13b2c5e60521 (patch) | |
| tree | 574047a3bad27546bb527ff4faace82102fe0d8e /test/confs | |
| parent | bd5b3f3c47654ba803f2a71daa4b739a2af39467 (diff) | |
DANE: add dane:fail event
Diffstat (limited to 'test/confs')
| -rw-r--r-- | test/confs/5861 | 96 | ||||
| l--------- | test/confs/5881 | 1 |
2 files changed, 97 insertions, 0 deletions
diff --git a/test/confs/5861 b/test/confs/5861 new file mode 100644 index 000000000..93e2bb715 --- /dev/null +++ b/test/confs/5861 @@ -0,0 +1,96 @@ +# Exim test configuration 5890 +# DANE/fail-events + +SERVER= + +.include DIR/aux-var/tls_conf_prefix + +primary_hostname = myhost.test.ex + +# ----- Main settings ----- + +.ifndef OPT +acl_smtp_rcpt = accept logwrite = "rcpt ACL" +.else +acl_smtp_rcpt = accept verify = recipient/callout +.endif + +log_selector = +received_recipients +tls_peerdn +tls_certificate_verified + +queue_run_in_order + +tls_advertise_hosts = * + +.ifdef _HAVE_GNUTLS +# needed to force generation +tls_dhparam = historic +.endif + +# Set certificate only if server +CDIR1 = DIR/aux-fixed/exim-ca/example.net/server1.example.net +CDIR2 = DIR/aux-fixed/exim-ca/example.com/server1.example.com + + +tls_certificate = ${if eq {SERVER}{server} \ + {${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \ + {CDIR2/fullchain.pem}\ + {CDIR1/fullchain.pem}}}\ + fail} + +tls_privatekey = ${if eq {SERVER}{server} \ + {${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \ + {CDIR2/server1.example.com.unlocked.key}\ + {CDIR1/server1.example.net.unlocked.key}}}\ + fail} + +# ----- ACL ----- +begin acl + +dane_fail: + accept condition = ${if eq {dane} {${listextract{1}{$event_name}}}} + logwrite = $event_name <$event_data> + +# ----- Routers ----- + +begin routers + +client: + driver = dnslookup + condition = ${if eq {SERVER}{}} + dnssec_request_domains = * + self = send + transport = send_to_server + errors_to = "" + +server: + driver = redirect + data = :blackhole: + + +# ----- Transports ----- + +begin transports + +send_to_server: + driver = smtp + allow_localhost + port = PORT_D + + hosts_try_dane = * + hosts_require_dane = HOSTIPV4 + tls_verify_cert_hostnames = ${if eq {OPT}{no_certname} {}{*}} + tls_try_verify_hosts = thishost.test.ex + tls_verify_certificates = CDIR2/ca_chain.pem + event_action = ${acl {dane_fail}} + + + +# ----- Retry ----- + + +begin retry + +* * F,5d,10s + + +# End diff --git a/test/confs/5881 b/test/confs/5881 new file mode 120000 index 000000000..290da5418 --- /dev/null +++ b/test/confs/5881 @@ -0,0 +1 @@ +5861
\ No newline at end of file |