Merge branch 'master' into 4.next

[exim.git] / src / src / verify.c

diff --git a/src/src/verify.c b/src/src/verify.c
index 6c71d7feb2427fedafb4545cfd51c0f10cd49b46..ac5eb667b026e12bb41cb9be3fa58c522b158b4d 100644 (file)
--- a/src/src/verify.c
+++ b/src/src/verify.c
@@ -68,9 +68,7 @@ int length, expire;
 time_t now;
 dbdata_callout_cache *cache_record;
 
-cache_record = dbfn_read_with_length(dbm_file, key, &length);
-
-if (cache_record == NULL)
+if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
   {
   HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
   return NULL;
@@ -797,12 +795,12 @@ tls_retry_connection:
       if (smtp_write_mail_and_rcpt_cmds(&sx, &yield) == 0)
        switch(addr->transport_return)
          {
-         case PENDING_OK:
+         case PENDING_OK:      /* random was accepted, unfortunately */
            new_domain_record.random_result = ccache_accept;
-           yield = OK;         /* Only usable result we can return */
+           yield = OK;         /* Only usable verify result we can return */
            done = TRUE;
            goto no_conn;
-         case FAIL:            /* the preferred result */
+         case FAIL:            /* rejected: the preferred result */
            new_domain_record.random_result = ccache_reject;
            sx.avoid_option = 0;
 
@@ -836,6 +834,8 @@ tls_retry_connection:
            sx.send_rset = TRUE;
            sx.completed_addr = FALSE;
            goto tls_retry_connection;
+         case DEFER:           /* 4xx response to random */
+           break;              /* Just to be clear. ccache_unknown, !done. */
          }
 
       /* Re-setup for main verify, or for the error message when failing */
@@ -993,7 +993,7 @@ no_conn:
        if (*sx.buffer == 0) Ustrcpy(sx.buffer, US"connection dropped");
 
        /*XXX test here is ugly; seem to have a split of responsibility for
-       building this message.  Need to reationalise.  Where is it done
+       building this message.  Need to rationalise.  Where is it done
        before here, and when not?
        Not == 5xx resp to MAIL on main-verify
        */
@@ -1789,16 +1789,16 @@ while (addr_new)
       transport. */
 
       transport_feedback tf = {
-        NULL,                       /* interface (=> any) */
-        US"smtp",                   /* port */
-        US"smtp",                   /* protocol */
-        NULL,                       /* hosts */
-        US"$smtp_active_hostname",  /* helo_data */
-        FALSE,                      /* hosts_override */
-        FALSE,                      /* hosts_randomize */
-        FALSE,                      /* gethostbyname */
-        TRUE,                       /* qualify_single */
-        FALSE                       /* search_parents */
+        .interface =           NULL,                       /* interface (=> any) */
+        .port =                        US"smtp",
+        .protocol =            US"smtp",
+        .hosts =               NULL,
+        .helo_data =           US"$smtp_active_hostname",
+        .hosts_override =      FALSE,
+        .hosts_randomize =     FALSE,
+        .gethostbyname =       FALSE,
+        .qualify_single =      TRUE,
+        .search_parents =      FALSE
         };
 
       /* If verification yielded a remote transport, we want to use that
@@ -2682,8 +2682,11 @@ if (ip_bind(sock, host_af, interface_address, 0) < 0)
   goto END_OFF;
   }
 
+/*XXX could take advantage of TFO early-data.  Hmm, what are the
+error returns; can we differentiate connect from data fails?
+Do we need to? */
 if (ip_connect(sock, host_af, sender_host_address, port,
-               rfc1413_query_timeout, TRUE) < 0)
+               rfc1413_query_timeout, &tcp_fastopen_nodata) < 0)
   {
   if (errno == ETIMEDOUT && LOGGING(ident_timeout))
     log_write(0, LOG_MAIN, "ident connection to %s timed out",
@@ -3154,18 +3157,16 @@ verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
 int rc;
 unsigned int *local_cache_bits = cache_bits;
 const uschar *save_host_address = deliver_host_address;
-check_host_block cb;
-cb.host_name = host_name;
-cb.host_address = host_address;
+check_host_block cb = { .host_name = host_name, .host_address = host_address };
 
-if (valueptr != NULL) *valueptr = NULL;
+if (valueptr) *valueptr = NULL;
 
 /* If the host address starts off ::ffff: it is an IPv6 address in
 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
 addresses. */
 
-cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
-  host_address + 7 : host_address;
+cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
+  ? host_address + 7 : host_address;
 
 /* During the running of the check, put the IP address into $host_address. In
 the case of calls from the smtp transport, it will already be there. However,