DANE: smtp transport option dane_require_tls_ciphers

[users/jgh/exim.git] / src / src / transports / smtp.c

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 2d81f3bff6db7702ccd003cfb6bf514031a9ecf5..bd1e20d7fc3a35667af2e79d9a71a71fc09ac1a2 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -38,6 +38,10 @@ optionlist smtp_transport_options[] = {
       (void *)offsetof(smtp_transport_options_block, connect_timeout) },
   { "connection_max_messages", opt_int | opt_public,
       (void *)offsetof(transport_instance, connection_max_messages) },
+# ifdef SUPPORT_DANE
+  { "dane_require_tls_ciphers", opt_stringptr,
+      (void *)offsetof(smtp_transport_options_block, dane_require_tls_ciphers) },
+# endif
   { "data_timeout",         opt_time,
       (void *)offsetof(smtp_transport_options_block, data_timeout) },
   { "delay_after_cutoff", opt_bool,
@@ -225,6 +229,7 @@ smtp_transport_options_block smtp_transport_option_defaults = {
 #ifdef SUPPORT_DANE
   .hosts_try_dane =            NULL,
   .hosts_require_dane =                NULL,
+  .dane_require_tls_ciphers =  NULL,
 #endif
   .hosts_try_fastopen =                NULL,
 #ifndef DISABLE_PRDR
@@ -1618,6 +1623,9 @@ if (!continue_hostname)
                                  string_sprintf("DANE error: tlsa lookup %s",
                                    rc == DEFER ? "DEFER" : "FAIL"),
                                  rc, FALSE);
+                               (void) event_raise(sx->tblock->event_action,
+                                 US"dane:fail", sx->dane_required
+                                   ?  US"dane-required" : US"dnssec-invalid");
                                return rc;
          }
       }
@@ -1626,6 +1634,8 @@ if (!continue_hostname)
       set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
        string_sprintf("DANE error: %s lookup not DNSSEC", sx->host->name),
        FAIL, FALSE);
+      (void) event_raise(sx->tblock->event_action,
+       US"dane:fail", US"dane-required");
       return FAIL;
       }
     }
@@ -1959,9 +1969,14 @@ if (  smtp_peer_options & OPTION_TLS
     if (rc != OK)
       {
 # ifdef SUPPORT_DANE
-      if (sx->dane) log_write(0, LOG_MAIN,
+      if (sx->dane)
+        {
+       log_write(0, LOG_MAIN,
          "DANE attempt failed; TLS connection to %s [%s]: %s",
          sx->host->name, sx->host->address, errstr);
+       (void) event_raise(sx->tblock->event_action,
+         US"dane:fail", US"validation-failure");       /* could do with better detail */
+       }
 # endif
 
       errno = ERRNO_TLSFAILURE;
@@ -2055,6 +2070,13 @@ else if (  sx->smtps
   message = string_sprintf("a TLS session is required, but %s",
     smtp_peer_options & OPTION_TLS
     ? "an attempt to start TLS failed" : "the server did not offer TLS support");
+# ifdef SUPPORT_DANE
+  if (sx->dane)
+    (void) event_raise(sx->tblock->event_action, US"dane:fail",
+      smtp_peer_options & OPTION_TLS
+      ? US"validation-failure"         /* could do with better detail */
+      : US"starttls-not-supported");
+# endif
   goto TLS_FAILED;
   }
 #endif /*SUPPORT_TLS*/
@@ -3207,8 +3229,11 @@ else
 #ifndef DISABLE_PRDR
       if (sx.prdr_active)
         {
+       const uschar * overall_message;
+
        /* PRDR - get the final, overall response.  For any non-success
        upgrade all the address statuses. */
+
         sx.ok = smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer), '2',
           sx.ob->final_timeout);
         if (!sx.ok)
@@ -3224,7 +3249,14 @@ else
          goto RESPONSE_FAILED;
          }
 
-       /* Update the journal, or setup retry. */
+       /* Append the overall response to the individual PRDR response for logging
+       and update the journal, or setup retry. */
+
+       overall_message = string_printing(sx.buffer);
+        for (addr = addrlist; addr != sx.first_addr; addr = addr->next)
+         if (addr->transport_return == OK)
+           addr->message = string_sprintf("%s\\n%s", addr->message, overall_message);
+
         for (addr = addrlist; addr != sx.first_addr; addr = addr->next)
          if (addr->transport_return == OK)
            {