Merge branch 'master' into dane

Conflicts:
	doc/doc-txt/ChangeLog
	src/src/tls-openssl.c
	src/src/transports/smtp.c
	src/src/verify.c

diff --cc doc/doc-txt/experimental-spec.txt
Simple merge

diff --cc src/src/deliver.c
index ab0815ed4a1fb35ed08e81519cd10e75a007dae8,48d3fd7ec8b58923587bfd0830e447bbc18d121c..d00af9c11a6e5cf1c2c1a3228df7ca946165cad1
--- 1/src/src/deliver.c
--- 2/src/src/deliver.c
+++ b/src/src/deliver.c
@@@ -4133,12 -4153,9 +4161,12 @@@ for (delivery_count = 0; addr_remote !
  
        /* The certificate verification status goes into the flags */
        if (tls_out.certificate_verified) setflag(addr, af_cert_verified);
 +#ifdef EXPERIMENTAL_DANE
 +      if (tls_out.dane_verified)        setflag(addr, af_dane_verified);
 +#endif
  
        /* Use an X item only if there's something to send */
-       #ifdef SUPPORT_TLS
+ #ifdef SUPPORT_TLS
        if (addr->cipher)
          {
          ptr = big_buffer;

diff --cc src/src/exim.c
Simple merge

diff --cc src/src/expand.c
Simple merge

diff --cc src/src/globals.c
Simple merge

diff --cc src/src/globals.h
Simple merge

diff --cc src/src/structs.h
Simple merge

diff --cc src/src/tls-openssl.c
index 3431226156fd587cde8483e8766a3f1eb712ceec,c031b8e4d10f0013387d4df1efc80acef493d76a..735ebff06dc558d540b2556ee69ce7ed30c6905f
--- 1/src/src/tls-openssl.c
--- 2/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@@ -1726,74 -1596,21 +1769,75 @@@ Returns:           OK on succes
  
  int
  tls_client_start(int fd, host_item *host, address_item *addr,
-   void *v_ob)
+   transport_instance *tb)
  {
- smtp_transport_options_block * ob = v_ob;
+ smtp_transport_options_block * ob =
+   (smtp_transport_options_block *)tb->options_block;
  static uschar txt[256];
 -uschar *expciphers;
 -X509* server_cert;
 +uschar * expciphers;
 +X509 * server_cert;
  int rc;
  static uschar cipherbuf[256];
 +
  #ifndef DISABLE_OCSP
 -BOOL require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
 -  NULL, host->name, host->address, NULL) == OK;
 -BOOL request_ocsp = require_ocsp ? TRUE
 -  : verify_check_this_host(&ob->hosts_request_ocsp,
 -      NULL, host->name, host->address, NULL) == OK;
 +BOOL request_ocsp = FALSE;
 +BOOL require_ocsp = FALSE;
 +#endif
 +#ifdef EXPERIMENTAL_DANE
 +dns_answer tlsa_dnsa;
 +BOOL dane = FALSE;
 +BOOL dane_required;
 +#endif
 +
 +#ifdef EXPERIMENTAL_DANE
 +tls_out.dane_verified = FALSE;
 +tls_out.tlsa_usage = 0;
 +dane_required = verify_check_this_host(&ob->hosts_require_dane, NULL,
 +                        host->name, host->address, NULL) == OK;
 +
 +if (host->dnssec == DS_YES)
 +  {
 +  if(  dane_required
 +    || verify_check_this_host(&ob->hosts_try_dane, NULL,
 +                        host->name, host->address, NULL) == OK
 +    )
 +    if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK)
 +      return rc;
 +  }
 +else if (dane_required)
 +  {
 +  /*XXX a shame we only find this after making tcp & smtp connection */
 +  /* move the test earlier? */
 +  log_write(0, LOG_MAIN, "DANE error: previous lookup not DNSSEC");
 +  return FAIL;
 +  }
 +#endif
 +
 +#ifndef DISABLE_OCSP
 +  {
 +  if ((require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
 +    NULL, host->name, host->address, NULL) == OK))
 +    request_ocsp = TRUE;
 +  else
 +    {
 +# ifdef EXPERIMENTAL_DANE
 +    if (  dane
 +       && ob->hosts_request_ocsp[0] == '*'
 +       && ob->hosts_request_ocsp[1] == '\0'
 +       )
 +      {
 +      /* Unchanged from default.  Use a safer one under DANE */
 +      request_ocsp = TRUE;
 +      ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
 +                                      "   {= {4}{$tls_out_tlsa_usage}} } "
 +                                 " {*}{}}";
 +      }
 +    else
 +# endif
 +      request_ocsp = verify_check_this_host(&ob->hosts_request_ocsp,
 +        NULL, host->name, host->address, NULL) == OK;
 +    }
 +  }
  #endif
  
  rc = tls_init(&client_ctx, host, NULL,

diff --cc src/src/transports/smtp.c
index 1865adee8abba2ae6d0e55a94d69ccc140910a94,0dfa01958faf2aa8a94b96bdcbad4f3f42f07e2a..7b2a7d5594fcd4244d2f422cf2f6f650a2282f78
--- 1/src/src/transports/smtp.c
--- 2/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@@ -3277,17 -3276,11 +3293,17 @@@ for (cutoff_retry = 0; expired &
        session, so the in-clear transmission after those errors, if permitted,
        happens inside smtp_deliver().] */
  
-       #ifdef SUPPORT_TLS
+ #ifdef SUPPORT_TLS
 -      if (rc == DEFER && first_addr->basic_errno == ERRNO_TLSFAILURE &&
 -           ob->tls_tempfail_tryclear &&
 -           verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
 -             host->address, NULL) != OK)
 +      if (  rc == DEFER
 +       && first_addr->basic_errno == ERRNO_TLSFAILURE
 +       && ob->tls_tempfail_tryclear
 +       && verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
 +             host->address, NULL) != OK
- #ifdef EXPERIMENTAL_DANE
++# ifdef EXPERIMENTAL_DANE
 +       && verify_check_this_host(&(ob->hosts_require_dane), NULL, host->name,
 +             host->address, NULL) != OK
- #endif
++# endif
 +       )
          {
          log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
            "to %s [%s] (not in hosts_require_tls)", host->name, host->address);
@@@ -3296,12 -3289,12 +3312,12 @@@
            expanded_hosts != NULL, &message_defer, TRUE);
          if (rc == DEFER && first_addr->basic_errno != ERRNO_AUTHFAIL)
            write_logs(first_addr, host);
-         #ifdef EXPERIMENTAL_TPDA
+ # ifdef EXPERIMENTAL_TPDA
          if (rc == DEFER)
-           tpda_deferred(ob, first_addr, host);
-         #endif
+           tpda_deferred(first_addr, host);
+ # endif
          }
-       #endif
 -#endif
++#endif        /*SUPPORT_TLS*/
        }
  
      /* Delivery attempt finished */

diff --cc src/src/transports/smtp.h
Simple merge

diff --cc src/src/verify.c
index c2ee4789288620bcee27469cc42497453cd9cfd2,8564aacc2c5bb6bbef7391f9d8b95da3c62d97ef..edd9ad17d7e210b89e04d0c4f238b8414cf1fe8c
--- 1/src/src/verify.c
--- 2/src/src/verify.c
+++ b/src/src/verify.c
@@@ -643,30 -660,27 +660,30 @@@ els
          /* TLS negotiation failed; give an error.  Try in clear on a new connection,
             if the options permit it for this host. */
          if (rc != OK)
--          {
-       if (  rc == DEFER
-          && ob->tls_tempfail_tryclear
-          && !smtps
-          && verify_check_this_host(&(ob->hosts_require_tls), NULL,
-            host->name, host->address, NULL) != OK
 -        if (rc == DEFER && ob->tls_tempfail_tryclear && !smtps &&
 -           verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
 -             host->address, NULL) != OK)
 -          {
 -          (void)close(inblock.sock);
 -#ifdef EXPERIMENTAL_TPDA
 -          (void) tpda_raise_event(addr->transport->tpda_event_action,
 -                                  US"tcp:close", NULL);
++        {
++        if (  rc == DEFER
++           && ob->tls_tempfail_tryclear
++           && !smtps
++           && verify_check_this_host(&(ob->hosts_require_tls), NULL,
++             host->name, host->address, NULL) != OK
 +#ifdef EXPERIMENTAL_DANE
-          && verify_check_this_host(&(ob->hosts_require_dane), NULL,
-            host->name, host->address, NULL) != OK
++           && verify_check_this_host(&(ob->hosts_require_dane), NULL,
++             host->name, host->address, NULL) != OK
  #endif
-          )
-         {
-             (void)close(inblock.sock);
-         log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
-           "to %s [%s] (not in hosts_require_tls)", host->name, host->address);
-         suppress_tls = TRUE;
-         goto tls_retry_connection;
-         }
-       /*save_errno = ERRNO_TLSFAILURE;*/
-       /*message = US"failure while setting up TLS session";*/
-       send_quit = FALSE;
-       done= FALSE;
-       goto TLS_FAILED;
-       }
++           )
++          {
++            (void)close(inblock.sock);
+           log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
+             "to %s [%s] (not in hosts_require_tls)", host->name, host->address);
+           suppress_tls = TRUE;
+           goto tls_retry_connection;
+           }
+         /*save_errno = ERRNO_TLSFAILURE;*/
+         /*message = US"failure while setting up TLS session";*/
+         send_quit = FALSE;
+         done= FALSE;
+         goto TLS_FAILED;
+         }
  
          /* TLS session is set up.  Copy info for logging. */
          addr->cipher = tls_out.cipher;

diff --cc test/runtest
Simple merge