summaryrefslogtreecommitdiff
path: root/test/confs/2033
blob: 73dcde61e16f3ec67724a0d578474ac37ec032e9 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
# Exim test configuration 2033
# TLS client: verify certificate from server - name-fails

SERVER=

.include DIR/aux-var/tls_conf_prefix

primary_hostname = myhost.test.ex

FX = DIR/aux-fixed
S1 = FX/exim-ca/example.com/server1.example.com

CA1 =   S1/ca_chain.pem 
CERT1 = S1/server1.example.com.pem
KEY1 =  S1/server1.example.com.unlocked.key
CA2 =   FX/cert2
CERT2 = FX/cert2
KEY2 =  FX/cert2

# ----- Main settings -----

disable_ipv6 = true

acl_smtp_rcpt = accept

log_selector =  +tls_peerdn+tls_certificate_verified

queue_only
queue_run_in_order

tls_advertise_hosts = *

# Set certificate only if server

tls_certificate = ${if eq {SERVER}{server}{CERT1}fail}
tls_privatekey = ${if eq {SERVER}{server}{KEY1}fail}

tls_verify_hosts = *
tls_verify_certificates = ${if eq {SERVER}{server}{CERT2}fail}


# ----- Routers -----

begin routers

server_dump:
  driver = redirect
  condition = ${if eq {SERVER}{server}{yes}{no}}
  data = :blackhole:

client_x:
  driver = accept
  local_parts = userx
  retry_use_local_part
  transport = send_to_server_failcert
  errors_to = ""

client_y:
  driver = accept
  local_parts = usery
  retry_use_local_part
  transport = send_to_server_retry

client_z:
  driver = accept
  local_parts = userz
  retry_use_local_part
  transport = send_to_server_crypt

client_q:
  driver = accept
  local_parts = userq
  retry_use_local_part
  transport = send_to_server_req_fail

client_r:
  driver = accept
  local_parts = userr
  retry_use_local_part
  transport = send_to_server_req_failname

client_s:
  driver = accept
  local_parts = users
  retry_use_local_part
  transport = send_to_server_req_passname

client_t:
  driver = accept
  local_parts = usert
  retry_use_local_part
  transport = send_to_server_req_failcarryon

# ----- Transports -----

begin transports

# this will fail to verify the cert at HOSTIPV4 so fail the crypt requirement
send_to_server_failcert:
  driver = smtp
  allow_localhost
  hosts = HOSTIPV4
  hosts_require_tls = HOSTIPV4
  port = PORT_D
  tls_certificate = CERT2
  tls_privatekey = CERT2

  tls_verify_certificates = CA2

# this will fail to verify the cert at HOSTIPV4 so fail the crypt, then retry on 127.1; ok
send_to_server_retry:
  driver = smtp
  allow_localhost
  hosts = HOSTIPV4 : 127.0.0.1
  hosts_require_tls = HOSTIPV4
  port = PORT_D
  tls_certificate = CERT2
  tls_privatekey = CERT2

  tls_verify_certificates = \
    ${if eq{$host_address}{127.0.0.1}{CA1}{CA2}}

# this will fail to verify the cert but continue unverified though crypted
send_to_server_crypt:
  driver = smtp
  allow_localhost
  hosts = HOSTIPV4
  hosts_require_tls = HOSTIPV4
  port = PORT_D
  tls_certificate = CERT2
  tls_privatekey = CERT2

  tls_verify_certificates = CA2
  tls_try_verify_hosts = *

# this will fail to verify the cert at HOSTNAME and fallback to unencrypted
# Fail due to lack of correct CA
send_to_server_req_fail:
  driver = smtp
  allow_localhost
  hosts = HOSTNAME
  port = PORT_D
  tls_certificate = CERT2
  tls_privatekey = CERT2

  tls_verify_certificates = CA2
  tls_verify_hosts = *

# this will fail to verify the cert name and fallback to unencrypted
# fail because the cert is "server1.example.com" and the test system is something else
send_to_server_req_failname:
  driver = smtp
  allow_localhost
  hosts = HOSTNAME
  port = PORT_D
  tls_certificate = CERT2
  tls_privatekey = CERT2

  tls_verify_certificates = CA1
  tls_verify_cert_hostnames = *
  tls_verify_hosts = *

# this will pass the cert verify including name check
# our stunt DNS has an A record for server1.example.com -> HOSTIPV4
send_to_server_req_passname:
  driver = smtp
  allow_localhost
  hosts = server1.example.com
  port = PORT_D
  tls_certificate = CERT2
  tls_privatekey = CERT2

  tls_verify_certificates = CA1
  tls_verify_cert_hostnames = *
  tls_verify_hosts = *

# this will fail to verify the cert name but carry on (try-verify mode)
# fail because the cert is "server1.example.com" and the test system is something else
send_to_server_req_failcarryon:
  driver = smtp
  allow_localhost
  hosts = HOSTNAME
  port = PORT_D
  tls_certificate = CERT2
  tls_privatekey = CERT2

  tls_verify_certificates = CA1
  tls_verify_cert_hostnames = *
  tls_try_verify_hosts = *

# End