When following a CNAME chain, if any lookup is insecure the whole must be too

[exim.git] / src / src / verify.c

diff --git a/src/src/verify.c b/src/src/verify.c
index dba09164ed3f40ccc16d107d69c7925778bb4e01..96740f8f382acdf44f13ac99e940005efbfe992a 100644 (file)
--- a/src/src/verify.c
+++ b/src/src/verify.c
@@ -468,6 +468,7 @@ else
     deliver_host_address = host->address;
     deliver_host_port = host->port;
     deliver_domain = addr->domain;
+    transport_name = addr->transport->name;
 
     if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
             US"callout") ||
@@ -490,14 +491,13 @@ else
       tls_out.dane_verified = FALSE;
       tls_out.tlsa_usage = 0;
 
-      dane_required = verify_check_this_host(&ob->hosts_require_dane, NULL,
-                               host->name, host->address, NULL) == OK;
+      dane_required =
+       verify_check_given_host(&ob->hosts_require_dane, host) == OK;
 
       if (host->dnssec == DS_YES)
        {
        if(  dane_required
-         || verify_check_this_host(&ob->hosts_try_dane, NULL,
-                               host->name, host->address, NULL) == OK
+         || verify_check_given_host(&ob->hosts_try_dane, host) == OK
          )
          if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK)
            return rc;
@@ -548,6 +548,7 @@ else
       {
       addr->message = string_sprintf("could not connect to %s [%s]: %s",
           host->name, host->address, strerror(errno));
+      transport_name = NULL;
       deliver_host = deliver_host_address = NULL;
       deliver_domain = save_deliver_domain;
       continue;
@@ -582,18 +583,21 @@ else
         goto RESPONSE_FAILED;
 
 #ifdef EXPERIMENTAL_EVENT
+      lookup_dnssec_authenticated = host->dnssec==DS_YES ? US"yes"
+       : host->dnssec==DS_NO ? US"no" : NULL;
       if (event_raise(addr->transport->event_action,
-                           US"smtp:connect", responsebuffer) == DEFER)
+                           US"smtp:connect", responsebuffer))
        {
+       lookup_dnssec_authenticated = NULL;
        /* Logging?  Debug? */
        goto RESPONSE_FAILED;
        }
+      lookup_dnssec_authenticated = NULL;
 #endif
       }
 
     /* Not worth checking greeting line for ESMTP support */
-    if (!(esmtp = verify_check_this_host(&(ob->hosts_avoid_esmtp), NULL,
-      host->name, host->address, NULL) != OK))
+    if (!(esmtp = verify_check_given_host(&(ob->hosts_avoid_esmtp), host) != OK))
       DEBUG(D_transport)
         debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
 
@@ -651,11 +655,9 @@ else
     for error analysis. */
 
 #ifdef SUPPORT_TLS
-    if (tls_offered &&
-       verify_check_this_host(&(ob->hosts_avoid_tls), NULL, host->name,
-         host->address, NULL) != OK &&
-       verify_check_this_host(&(ob->hosts_verify_avoid_tls), NULL, host->name,
-         host->address, NULL) != OK
+    if (  tls_offered
+       && verify_check_given_host(&ob->hosts_avoid_tls, host) != OK
+       && verify_check_given_host(&ob->hosts_verify_avoid_tls, host) != OK
        )
       {
       uschar buffer2[4096];
@@ -703,8 +705,7 @@ else
          if (  rc == DEFER
             && ob->tls_tempfail_tryclear
             && !smtps
-            && verify_check_this_host(&(ob->hosts_require_tls), NULL,
-              host->name, host->address, NULL) != OK
+            && verify_check_given_host(&ob->hosts_require_tls, host) != OK
             )
            {
            (void)close(inblock.sock);
@@ -743,8 +744,7 @@ else
 #ifdef EXPERIMENTAL_DANE
         dane ||
 #endif
-         verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
-             host->address, NULL) == OK
+         verify_check_given_host(&ob->hosts_require_tls, host) == OK
         )
         {
         /*save_errno = ERRNO_TLSREQUIRED;*/
@@ -879,9 +879,7 @@ else
         /* If accepted, we aren't going to do any further tests below. */
 
         if (random_ok)
-          {
           new_domain_record.random_result = ccache_accept;
-          }
 
         /* Otherwise, cache a real negative response, and get back to the right
         state to send RCPT. Unless there's some problem such as a dropped
@@ -1852,8 +1850,10 @@ while (addr_new != NULL)
 #ifdef SUPPORT_TLS
          deliver_set_expansions(addr);
 #endif
+         verify_mode = is_recipient ? US"R" : US"S";
           rc = do_callout(addr, host_list, &tf, callout, callout_overall,
             callout_connect, options, se_mailfrom, pm_mailfrom);
+         verify_mode = NULL;
           }
         }
       else
@@ -3156,6 +3156,15 @@ return rc;
 
 
 
+/*************************************************
+*      Check the given host item matches a list  *
+*************************************************/
+int
+verify_check_given_host(uschar **listptr, host_item *host)
+{
+return verify_check_this_host(listptr, NULL, host->name, host->address, NULL);
+}
+
 /*************************************************
 *      Check the remote host matches a list      *
 *************************************************/