From 6aae076feb9b8fc05099dc68fc00100472004701 Mon Sep 17 00:00:00 2001 Message-Id: <6aae076feb9b8fc05099dc68fc00100472004701.1714723141.git.mdw@distorted.org.uk> From: Mark Wooding Date: Mon, 17 Mar 2014 21:25:54 +0000 Subject: [PATCH] base.m4, exchange.m4: Move TLS tweaks to `base.m4'. Organization: Straylight/Edgeware From: Mark Wooding Non-hub hosts want this so that they can receive mail for local users. --- base.m4 | 12 ++++++++++++ exchange.m4 | 12 ------------ 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/base.m4 b/base.m4 index 90fcca6..8211506 100644 --- a/base.m4 +++ b/base.m4 @@ -88,6 +88,18 @@ qualify_domain = CONF_master_domain SECTION(global, bounce)m4_dnl delay_warning = 1h : 24h : 2d +SECTION(global, tls)m4_dnl +tls_certificate = CONF_sysconf_dir/server.cert +tls_privatekey = CONF_sysconf_dir/server.key +tls_advertise_hosts = ${if exists {CONF_sysconf_dir/server.key} {*}{}} +tls_dhparam = CONF_ca_dir/dh-param-2048.pem +tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \ + {match_ip {$sender_host_address}{+trusted}}} \ + {CONF_good_ciphers} \ + {CONF_acceptable_ciphers}} +tls_verify_certificates = CONF_ca_dir/ca.cert +tls_verify_hosts = ${if eq{$acl_c_mode}{submission} {} {+allnets}} + DIVERT(null) ###-------------------------------------------------------------------------- ### Access control lists. diff --git a/exchange.m4 b/exchange.m4 index e7d5fa4..b0dab45 100644 --- a/exchange.m4 +++ b/exchange.m4 @@ -27,18 +27,6 @@ SECTION(global, daemon)m4_dnl daemon_smtp_ports = CONF_smtp_port : CONF_submission_port -SECTION(global, tls)m4_dnl -tls_certificate = CONF_sysconf_dir/server.cert -tls_privatekey = CONF_sysconf_dir/server.key -tls_advertise_hosts = * -tls_dhparam = CONF_ca_dir/dh-param-2048.pem -tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \ - {match_ip {$sender_host_address}{+trusted}}} \ - {CONF_good_ciphers} \ - {CONF_acceptable_ciphers}} -tls_verify_certificates = CONF_ca_dir/ca.cert -tls_verify_hosts = ${if eq{$acl_c_mode}{submission} {} {+allnets}} - DIVERT(null) ###-------------------------------------------------------------------------- ### Check source addresses for apparently local senders. -- [mdw]