blob: 89ee8fd53f439aefa414821584729a3324cde866 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
# Exim test configuration 5891
SERVER =
OPTION = NORMAL
.include DIR/aux-var/tls_conf_prefix
primary_hostname = myhost.test.ex
# ----- Main settings -----
domainlist local_domains = test.ex : *.test.ex
acl_smtp_helo = check_helo
acl_smtp_rcpt = check_recipient
log_selector = +received_recipients +tls_resumption +tls_peerdn
tls_advertise_hosts = *
# Set certificate only if server
CDIR=DIR/aux-fixed/exim-ca/example.com
tls_certificate = CDIR/server1.example.com/server1.example.com.chain.pem
tls_privatekey = CDIR/server1.example.com/server1.example.com.unlocked.key
tls_ocsp_file = CDIR/server1.example.com/server1.example.com.ocsp.good.resp
tls_require_ciphers = OPTION
tls_resumption_hosts = 127.0.0.1
# ------ ACL ------
begin acl
check_helo:
accept condition = ${if def:tls_in_cipher}
logwrite = tls_in_resumption\t${listextract {$tls_in_resumption} {_RESUME_DECODE}}
logwrite = our cert subject\t${certextract {subject}{$tls_in_ourcert}}
logwrite = peer cert subject\t${certextract {subject}{$tls_in_peercert}}
logwrite = peer cert verified\t${tls_in_certificate_verified}
logwrite = peer dn\t${tls_in_peerdn}
logwrite = ocsp\t${tls_in_ocsp}
logwrite = cipher\t${tls_in_cipher}
logwrite = bits\t${tls_in_bits}
accept
check_recipient:
accept domains = +local_domains
deny message = relay not permitted
log_resumption:
accept condition = ${if def:tls_out_cipher}
condition = ${if eq {$event_name}{tcp:close}}
logwrite = tls_out_resumption ${listextract {$tls_out_resumption} {_RESUME_DECODE}}
logwrite = our cert subject\t${certextract {subject}{$tls_out_ourcert}}
logwrite = peer cert subject\t${certextract {subject}{$tls_out_peercert}}
logwrite = peer cert verified\t${tls_out_certificate_verified}
logwrite = peer dn\t${tls_out_peerdn}
logwrite = ocsp\t${tls_out_ocsp}
logwrite = cipher\t${tls_out_cipher}
logwrite = bits\t${tls_out_bits}
# ----- Routers -----
begin routers
client:
driver = accept
condition = ${if eq {SERVER}{server}{no}{yes}}
transport = send_to_server${if eq{$local_part}{abcd}{2}{1}}
server:
driver = redirect
data = :blackhole:
# ----- Transports -----
begin transports
send_to_server1:
driver = smtp
allow_localhost
hosts = 127.0.0.1
port = PORT_D
helo_data = helo.data.changed
.ifdef VALUE
tls_resumption_hosts = *
.else
tls_resumption_hosts = :
.endif
tls_verify_certificates = CDIR/CA/CA.pem
tls_verify_cert_hostnames = ${if match {$local_part}{^noverify} {*}{:}}
tls_try_verify_hosts = *
event_action = ${acl {log_resumption}}
send_to_server2:
driver = smtp
allow_localhost
hosts = HOSTIPV4
port = PORT_D
hosts_try_fastopen = :
tls_verify_certificates = CDIR/CA/CA.pem
tls_verify_cert_hostnames = :
event_action = ${acl {log_resumption}}
# ----- Retry -----
begin retry
* * F,5d,10s
# End
|
