Merge branch 'master' into dane

[exim.git] / src / src / verify.c

diff --git a/src/src/verify.c b/src/src/verify.c
index 8564aacc2c5bb6bbef7391f9d8b95da3c62d97ef..edd9ad17d7e210b89e04d0c4f238b8414cf1fe8c 100644 (file)
--- a/src/src/verify.c
+++ b/src/src/verify.c
@@ -660,16 +660,19 @@ else
         /* TLS negotiation failed; give an error.  Try in clear on a new connection,
            if the options permit it for this host. */
         if (rc != OK)
-          {
-         if (rc == DEFER && ob->tls_tempfail_tryclear && !smtps &&
-            verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
-              host->address, NULL) != OK)
-           {
-           (void)close(inblock.sock);
-#ifdef EXPERIMENTAL_TPDA
-           (void) tpda_raise_event(addr->transport->tpda_event_action,
-                                   US"tcp:close", NULL);
+         {
+         if (  rc == DEFER
+            && ob->tls_tempfail_tryclear
+            && !smtps
+            && verify_check_this_host(&(ob->hosts_require_tls), NULL,
+              host->name, host->address, NULL) != OK
+#ifdef EXPERIMENTAL_DANE
+            && verify_check_this_host(&(ob->hosts_require_dane), NULL,
+              host->name, host->address, NULL) != OK
 #endif
+            )
+           {
+             (void)close(inblock.sock);
            log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
              "to %s [%s] (not in hosts_require_tls)", host->name, host->address);
            suppress_tls = TRUE;
@@ -697,8 +700,13 @@ else
 
     /* If the host is required to use a secure channel, ensure that we have one. */
     if (tls_out.active < 0)
-      if (verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
-       host->address, NULL) == OK)
+      if (  verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
+             host->address, NULL) == OK
+#ifdef EXPERIMENTAL_DANE
+        || verify_check_this_host(&(ob->hosts_require_dane), NULL, host->name,
+             host->address, NULL) == OK
+#endif
+        )
         {
         /*save_errno = ERRNO_TLSREQUIRED;*/
         log_write(0, LOG_MAIN, "a TLS session is required for %s [%s], but %s",