Fix cert-try-verify when denied by event action

diff --combined src/src/tls-openssl.c
index c489ea51da4f36fa50744bb44e7aaa330fb9528a,a2e1136d0d5f6f3aad466d2a588eb01350b08a6c..fe1b208ac5b2e4d708b913e2f466e11733ad0450
--- 1/src/src/tls-openssl.c
--- 2/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@@ -294,11 -294,8 +294,11 @@@ verify_callback(int state, X509_STORE_C
  {
  X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
  int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 -uschar * ev;
  static uschar txt[256];
 +#ifdef EXPERIMENTAL_EVENT
 +uschar * ev;
 +uschar * yield;
 +#endif
  
  X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
  
@@@ -308,7 -305,6 +308,6 @@@ if (state == 0
      depth,
      X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
      txt);
-   tlsp->certificate_verified = FALSE;
    *calledp = TRUE;
    if (!*optionalp)
      {
@@@ -338,13 -334,15 +337,15 @@@ else if (depth != 0
    if (ev)
      {
      tlsp->peercert = X509_dup(cert);
 -    if (event_raise(ev, US"tls:cert", string_sprintf("%d", depth)) == DEFER)
 +    if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
        {
        log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
 -                            "depth=%d cert=%s", depth, txt);
 +                            "depth=%d cert=%s: %s", depth, txt, yield);
-       tlsp->certificate_verified = FALSE;
        *calledp = TRUE;
-       return 0;                           /* reject */
+       if (!*optionalp)
+       return 0;                           /* reject */
+       DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
+       "(host in tls_try_verify_hosts)\n");
        }
      X509_free(tlsp->peercert);
      tlsp->peercert = NULL;
@@@ -389,7 -387,11 +390,11 @@@ els
        {
        log_write(0, LOG_MAIN,
        "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
-       return 0;                               /* reject */
+       *calledp = TRUE;
+       if (!*optionalp)
+       return 0;                           /* reject */
+       DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
+       "tls_try_verify_hosts)\n");
        }
      }
  # else
@@@ -397,7 -399,11 +402,11 @@@
        {
        log_write(0, LOG_MAIN,
        "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
-       return 0;                               /* reject */
+       *calledp = TRUE;
+       if (!*optionalp)
+       return 0;                           /* reject */
+       DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
+       "tls_try_verify_hosts)\n");
        }
  # endif
  #endif        /*EXPERIMENTAL_CERTNAMES*/
@@@ -405,13 -411,15 +414,15 @@@
  #ifdef EXPERIMENTAL_EVENT
    ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
    if (ev)
 -    if (event_raise(ev, US"tls:cert", US"0") == DEFER)
 +    if ((yield = event_raise(ev, US"tls:cert", US"0")))
        {
        log_write(0, LOG_MAIN, "SSL verify denied by event-action: "
 -                            "depth=0 cert=%s", txt);
 +                            "depth=0 cert=%s: %s", txt, yield);
-       tlsp->certificate_verified = FALSE;
        *calledp = TRUE;
-       return 0;                           /* reject */
+       if (!*optionalp)
+       return 0;                           /* reject */
+       DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
+       "(host in tls_try_verify_hosts)\n");
        }
  #endif
  
@@@ -449,7 -457,6 +460,7 @@@ X509 * cert = X509_STORE_CTX_get_curren
  static uschar txt[256];
  #ifdef EXPERIMENTAL_EVENT
  int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 +uschar * yield;
  #endif
  
  X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
@@@ -461,11 -468,11 +472,11 @@@ tls_out.peercert = X509_dup(cert)
  #ifdef EXPERIMENTAL_EVENT
    if (client_static_cbinfo->event_action)
      {
 -    if (event_raise(client_static_cbinfo->event_action,
 -                  US"tls:cert", string_sprintf("%d", depth)) == DEFER)
 +    if ((yield = event_raise(client_static_cbinfo->event_action,
 +                  US"tls:cert", string_sprintf("%d", depth))))
        {
        log_write(0, LOG_MAIN, "DANE verify denied by event-action: "
 -                            "depth=%d cert=%s", depth, txt);
 +                            "depth=%d cert=%s: %s", depth, txt, yield);
        tls_out.certificate_verified = FALSE;
        return 0;                           /* reject */
        }