Delivery: contined-connection maintaining TLS

31 files changed, 416 insertions, 135 deletions

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 9e1aa4e4b..ed8bdfd77 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -3828,7 +3828,7 @@ This option is not intended for use by external callers. It is used internally
 by Exim in conjunction with the &%-MC%& option. It signifies that the
 remote host supports the ESMTP &_DSN_& extension.
 
-.vitem &%-MCG%&
+.vitem &%-MCG%&&~<&'queue&~name'&>
 .oindex "&%-MCG%&"
 This option is not intended for use by external callers. It is used internally
 by Exim in conjunction with the &%-MC%& option. It signifies that an
@@ -3868,6 +3868,15 @@ This option is not intended for use by external callers. It is used internally
 by Exim in conjunction with the &%-MC%& option, and passes on the fact that the
 host to which Exim is connected supports TLS encryption.
 
+.new
+.vitem &%-MCt%&&~<&'IP&~address'&>&~<&'port&'&>&~
+.oindex "&%-MCt%&"
+This option is not intended for use by external callers. It is used internally
+by Exim in conjunction with the &%-MC%& option, and passes on the fact that the
+connection is being proxied by a parent process for handling TLS encryption.
+The pair of arguments give the local address and port being proxied.
+.wen
+
 .vitem &%-Mc%&&~<&'message&~id'&>&~<&'message&~id'&>&~...
 .oindex "&%-Mc%&"
 .cindex "hints database" "not overridden by &%-Mc%&"
@@ -23935,6 +23944,25 @@ been started will not be passed to a new delivery process for sending another
 message on the same connection. See section &<<SECTmulmessam>>& for an
 explanation of when this might be needed.
 
+.new
+.option hosts_noproxy_tls smtp "host list&!!" *
+.cindex "TLS" "passing connection"
+.cindex "multiple SMTP deliveries"
+.cindex "TLS" "multiple message deliveries"
+For any host that matches this list, a TLS session which has
+been started will not be passed to a new delivery process for sending another
+message on the same session.
+
+The traditional implementation closes down TLS and re-starts it in the new
+process, on the same open TCP connection, for each successive message
+sent.  If permitted by this option a pipe to to the new process is set up
+instead, and the original process maintains the TLS connection and proxies
+the SMTP connection from and to the new process and any subsequents.
+The new process has no access to TLS information, so cannot include it in
+logging.
+.wen
+
+
 
 .option hosts_override smtp boolean false
 If this option is set and the &%hosts%& option is also set, any hosts that are
@@ -35725,6 +35753,12 @@ SMTP RCPT commands in one transaction) the second and subsequent addresses are
 flagged with &`->`& instead of &`=>`&. When two or more messages are delivered
 down a single SMTP connection, an asterisk follows the IP address in the log
 lines for the second and subsequent messages.
+.new
+When two or more messages are delivered down a single TLS connection, the
+TLS-related information logged for the first message delivered
+(which may not be the earliest line in the log)
+will not be present in the log lines for the second and subsequent messages.
+.wen
 
 .cindex "delivery" "cutthrough; logging"
 .cindex "cutthrough" "logging"
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 35947201c..8462107c7 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -19,6 +19,13 @@ PP/01 Allow PKG_CONFIG_PATH to be set in Local/Makefile and use it correctly
 JH/02 Rework error string handling in DKIM to pass more info back to callers.
       This permits better logging.
 
+JH/03 Rework the transport continued-connection mechanism: when TLS is active,
+      do not close it down and have the child transport start it up again on
+      the passed-on TCP connection.  Instead, proxy the child (and any
+      subsequent ones) for TLS via a unix-domain socket channel.  Logging is
+      affected: the continued delivery log lines do not have any DNSSEC, TLS
+      cipher, Certificate or OCSP information.
+
 
 Exim version 4.89
 -----------------
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index efb8592cf..3594d1d6a 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -15,6 +15,12 @@ Version 4.90
  2. The ${readsocket } expansion now takes an option to not shutdown the
     connection after sending the query string.  The default remains to do so.
 
+ 3. An smtp transport option "hosts_noproxy_tls" to control whether multiple
+    deliveries on a single TCP connection can maintain a TLS connection
+    open.  By default disabled for all hosts, doing so saves the cost of
+    making new TLS sessions, at the cost of having to proxy the data via
+    another process.  Logging is also affected.
+
 
 Version 4.89
 ------------
diff --git a/doc/doc-txt/OptionLists.txt b/doc/doc-txt/OptionLists.txt
index 696b5f3fa..b6439e6ed 100644
--- a/doc/doc-txt/OptionLists.txt
+++ b/doc/doc-txt/OptionLists.txt
@@ -293,6 +293,7 @@ hosts_connection_nolog               host list       unset         main
 hosts_max_try                        integer         5             smtp              3.20
 hosts_max_try_hardlimit              integer         50            smtp              4.50
 hosts_nopass_tls                     host list       unset         smtp              4.00
+hosts_noproxy_tls                    host list       "*"           smtp              4.90
 hosts_override                       boolean         false         smtp              2.11
 hosts_randomize                      boolean         false         manualroute       4.00
                                                      false         smtp              3.14
diff --git a/src/src/exim.c b/src/src/exim.c
index a6a1ea82c..ee7bfcd22 100644
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -2708,18 +2708,19 @@ for (i = 1; i < argc; i++)
         return EXIT_FAILURE;
         }
 
-      /* Set up $sending_ip_address and $sending_port */
+      /* Set up $sending_ip_address and $sending_port, unless proxied */
 
-      if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
-          &size) == 0)
-        sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
-          &sending_port);
-      else
-        {
-        fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
-          strerror(errno));
-        return EXIT_FAILURE;
-        }
+      if (!continue_proxy)
+	if (getsockname(fileno(stdin), (struct sockaddr *)(&interface_sock),
+	    &size) == 0)
+	  sending_ip_address = host_ntoa(-1, &interface_sock, NULL,
+	    &sending_port);
+	else
+	  {
+	  fprintf(stderr, "exim: getsockname() failed after -MC option: %s\n",
+	    strerror(errno));
+	  return EXIT_FAILURE;
+	  }
 
       if (running_in_test_harness) millisleep(500);
       break;
@@ -2727,7 +2728,7 @@ for (i = 1; i < argc; i++)
 
     else if (*argrest == 'C' && argrest[1] && !argrest[2])
       {
-	switch(argrest[1])
+      switch(argrest[1])
 	{
     /* -MCA: set the smtp_authenticated flag; this is useful only when it
     precedes -MC (see above). The flag indicates that the host to which
@@ -2771,6 +2772,17 @@ for (i = 1; i < argc; i++)
 	case 'S': smtp_peer_options |= PEER_OFFERED_SIZE; break;
 
 #ifdef SUPPORT_TLS
+    /* -MCt: similar to -MCT below but the connection is still open
+    via a proxy proces which handles the TLS context and coding.
+    Require two arguments for the proxied local address and port.  */
+
+	case 't': continue_proxy = TRUE;
+		  if (++i < argc) sending_ip_address = argv[i];
+		  else badarg = TRUE;
+		  if (++i < argc) sending_port = (int)(Uatol(argv[i]));
+		  else badarg = TRUE;
+		  /*FALLTHROUGH*/
+
     /* -MCT: set the tls_offered flag; this is useful only when it
     precedes -MC (see above). The flag indicates that the host to which
     Exim is connected has offered TLS support. */
diff --git a/src/src/globals.c b/src/src/globals.c
index 79ac37f92..f3e4bad96 100644
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -533,6 +533,7 @@ uschar *continue_hostname      = NULL;
 uschar *continue_host_address  = NULL;
 BOOL    continue_more          = FALSE;
 int     continue_sequence      = 1;
+BOOL    continue_proxy	       = FALSE;
 uschar *continue_transport     = NULL;
 
 uschar *csa_status             = NULL;
diff --git a/src/src/globals.h b/src/src/globals.h
index 340f1aecf..750a960eb 100644
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -293,6 +293,7 @@ extern uschar *continue_hostname;      /* Host for continued delivery */
 extern uschar *continue_host_address;  /* IP address for ditto */
 extern BOOL    continue_more;          /* Flag more addresses waiting */
 extern int     continue_sequence;      /* Sequence num for continued delivery */
+extern BOOL    continue_proxy;	       /* Continued delivery is proxied for TLS */
 extern uschar *continue_transport;     /* Transport for continued delivery */
 
 extern uschar *csa_status;             /* Client SMTP Authorization result */
diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index c3f7241de..8836bb259 100644
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -2149,7 +2149,6 @@ if ((state_server.session == NULL) && (state_client.session == NULL))
   gnutls_global_deinit();
   exim_gnutls_base_init_done = FALSE;
   }
-
 }
 
 
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index dd9affb65..4a41ba192 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -2479,9 +2479,7 @@ if (error == SSL_ERROR_ZERO_RETURN)
   return -1;
   }
 else if (error != SSL_ERROR_NONE)
-  {
   return -1;
-  }
 
 return inbytes;
 }
diff --git a/src/src/transport.c b/src/src/transport.c
index 2caf6e5f0..aca33762b 100644
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -1959,7 +1959,7 @@ DEBUG(D_transport) debug_printf("transport_pass_socket entered\n");
 
 if ((pid = fork()) == 0)
   {
-  int i = 17;
+  int i = 19;
   const uschar **argv;
 
   /* Disconnect entirely from the parent process. If we are running in the
@@ -1982,7 +1982,15 @@ if ((pid = fork()) == 0)
   if (smtp_peer_options & PEER_OFFERED_PIPE) argv[i++] = US"-MCP";
   if (smtp_peer_options & PEER_OFFERED_SIZE) argv[i++] = US"-MCS";
 #ifdef SUPPORT_TLS
-  if (smtp_peer_options & PEER_OFFERED_TLS) argv[i++] = US"-MCT";
+  if (smtp_peer_options & PEER_OFFERED_TLS)
+    if (tls_out.active >= 0 || continue_proxy)
+      {
+      argv[i++] = US"-MCt";
+      argv[i++] = sending_ip_address;
+      argv[i++] = string_sprintf("%d", sending_port);
+      }
+    else
+      argv[i++] = US"-MCT";
 #endif
 
   if (queue_run_pid != (pid_t)0)
diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index c5908641e..41d0dc1ea 100644
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -87,6 +87,8 @@ optionlist smtp_transport_options[] = {
 #ifdef SUPPORT_TLS
   { "hosts_nopass_tls",     opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, hosts_nopass_tls) },
+  { "hosts_noproxy_tls",    opt_stringptr,
+      (void *)offsetof(smtp_transport_options_block, hosts_noproxy_tls) },
 #endif
   { "hosts_override",       opt_bool,
       (void *)offsetof(smtp_transport_options_block, hosts_override) },
@@ -219,6 +221,7 @@ smtp_transport_options_block smtp_transport_option_defaults = {
   NULL,                /* hosts_avoid_pipelining */
   NULL,                /* hosts_avoid_esmtp */
   NULL,                /* hosts_nopass_tls */
+  US"*",	       /* hosts_noproxy_tls */
   5*60,                /* command_timeout */
   5*60,                /* connect_timeout; shorter system default overrides */
   5*60,                /* data timeout */
@@ -283,6 +286,8 @@ static uschar *smtp_command;		/* Points to last cmd for error messages */
 static uschar *mail_command;		/* Points to MAIL cmd for error messages */
 static uschar *data_command = US"";	/* Points to DATA cmd for error messages */
 static BOOL    update_waiting;		/* TRUE to update the "wait" database */
+
+/*XXX move to smtp_context */
 static BOOL    pipelining_active;	/* current transaction is in pipe mode */
 
 
@@ -1810,10 +1815,22 @@ separate - we could match up by host ip+port as a bodge. */
 
 else
   {
-  sx->inblock.sock = sx->outblock.sock = fileno(stdin);
+  sx->inblock.sock = sx->outblock.sock = 0;	/* stdin */
   smtp_command = big_buffer;
   sx->host->port = sx->port;    /* Record the port that was used */
   sx->helo_data = NULL;		/* ensure we re-expand ob->helo_data */
+
+  /* For a continued connection with TLS being proxied for us, nothing
+  more to do. */
+
+  if (continue_proxy)
+    {
+    sx->peer_offered = smtp_peer_options;
+    pipelining_active = !!(smtp_peer_options & PEER_OFFERED_PIPE);
+    HDEBUG(D_transport) debug_printf("continued connection, proxied TLS\n");
+    return OK;
+    }
+  HDEBUG(D_transport) debug_printf("continued connection, no TLS\n");
   }
 
 /* If TLS is available on this connection, whether continued or not, attempt to
@@ -2489,6 +2506,93 @@ return 0;
 }
 
 
+#ifdef SUPPORT_TLS
+/*****************************************************
+* Proxy TLS connection for another transport process *
+******************************************************/
+/*
+Use the smtp-context buffer as a staging area, and select on both the slave
+process and the TLS'd fd for data to read (per the coding in ip_recv() and
+fd_ready() this is legitimate).  Do blocking full-size writes, and reads
+under a timeout.
+
+Arguments:
+  sx		smtp context block
+  proxy_fd	comms to proxied process
+  timeout	per-read timeout, seconds
+*/
+
+static void
+smtp_proxy_tls(smtp_context * sx, int proxy_fd, int timeout)
+{
+fd_set fds;
+int max_fd = MAX(proxy_fd, tls_out.active) + 1;
+int rc, i, fd_bits, nbytes;
+
+set_process_info("proxying TLS connection for continued transport");
+FD_ZERO(&fds);
+FD_SET(tls_out.active, &fds);
+FD_SET(proxy_fd, &fds);
+
+for (fd_bits = 3; fd_bits; )
+  {
+  time_t time_left = timeout;
+  time_t time_start = time(NULL);
+
+  /* wait for data */
+  do
+    {
+    struct timeval tv = { time_left, 0 };
+
+    rc = select(max_fd, (SELECT_ARG2_TYPE *)&fds, NULL, NULL, &tv);
+
+    if (rc < 0 && errno == EINTR)
+      if ((time_left -= time(NULL) - time_start) > 0) continue;
+
+    if (rc <= 0)
+      {
+      DEBUG(D_transport) if (rc == 0) debug_printf("%s: timed out\n", __FUNCTION__);
+      return;
+      }
+    }
+  while (rc < 0 || !(FD_ISSET(tls_out.active, &fds) || FD_ISSET(proxy_fd, &fds)));
+
+  /* handle inbound data */
+  if (FD_ISSET(tls_out.active, &fds))
+    if ((rc = tls_read(FALSE, sx->buffer, sizeof(sx->buffer))) <= 0)
+      {
+      fd_bits &= ~1;
+      FD_CLR(tls_out.active, &fds);
+      shutdown(proxy_fd, SHUT_WR);
+      }
+    else
+      {
+      for (nbytes = 0; rc - nbytes > 0; nbytes += i)
+	if ((i = write(proxy_fd, sx->buffer + nbytes, rc - nbytes)) < 0) return;
+      }
+  else if (fd_bits & 1)
+    FD_SET(tls_out.active, &fds);
+
+  /* handle outbound data */
+  if (FD_ISSET(proxy_fd, &fds))
+    if ((rc = read(proxy_fd, sx->buffer, sizeof(sx->buffer))) <= 0)
+      {
+      fd_bits &= ~2;
+      FD_CLR(proxy_fd, &fds);
+      shutdown(tls_out.active, SHUT_WR);
+      }
+    else
+      {
+      for (nbytes = 0; rc - nbytes > 0; nbytes += i)
+	if ((i = tls_write(FALSE, sx->buffer + nbytes, rc - nbytes)) < 0) return;
+      }
+  else if (fd_bits & 2)
+    FD_SET(proxy_fd, &fds);
+  }
+}
+#endif
+
+
 /*************************************************
 *       Deliver address list to given host       *
 *************************************************/
@@ -3171,10 +3275,13 @@ if (sx.completed_addr && sx.ok && sx.send_quit)
 
   if (  sx.first_addr != NULL
      || continue_more
-     || (  (  tls_out.active < 0
+     || (
+#ifdef SUPPORT_TLS
+	   (  tls_out.active < 0  &&  !continue_proxy
            || verify_check_given_host(&sx.ob->hosts_nopass_tls, host) != OK
 	   )
         &&
+#endif
            transport_check_waiting(tblock->name, host->name,
              tblock->connection_max_messages, new_message_id, &more,
 	     (oicf)smtp_are_same_identities, (void*)&t_compare)
@@ -3207,29 +3314,51 @@ if (sx.completed_addr && sx.ok && sx.send_quit)
 
     if (sx.ok)
       {
-      if (sx.first_addr != NULL)            /* More addresses still to be sent */
+      int pfd[2];
+      int socket_fd = sx.inblock.sock;
+
+
+      if (sx.first_addr != NULL)         /* More addresses still to be sent */
         {                                /*   in this run of the transport */
         continue_sequence++;             /* Causes * in logging */
         goto SEND_MESSAGE;
         }
       if (continue_more) return yield;   /* More addresses for another run */
 
-      /* Pass the socket to a new Exim process. Before doing so, we must shut
-      down TLS. Not all MTAs allow for the continuation of the SMTP session
-      when TLS is shut down. We test for this by sending a new EHLO. If we
-      don't get a good response, we don't attempt to pass the socket on. */
-
+      /* Pass the connection on to a new Exim process. */
 #ifdef SUPPORT_TLS
       if (tls_out.active >= 0)
-        {
-        tls_close(FALSE, TRUE);
-	smtp_peer_options = smtp_peer_options_wrap;
-	sx.ok = !sx.smtps
-          && smtp_write_command(&sx.outblock, FALSE,
-				    "EHLO %s\r\n", sx.helo_data) >= 0
-	  && smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer),
-				    '2', sx.ob->command_timeout);
-        }
+	if (verify_check_given_host(&sx.ob->hosts_noproxy_tls, host) == OK)
+	  {
+	  /* Pass the socket, for direct use, to a new Exim process. Before
+	  doing so, we must shut down TLS. Not all MTAs allow for the
+	  continuation of the SMTP session when TLS is shut down. We test for
+	  this by sending a new EHLO. If we don't get a good response, we don't
+	  attempt to pass the socket on. */
+
+	  tls_close(FALSE, TRUE);
+	  smtp_peer_options = smtp_peer_options_wrap;
+	  sx.ok = !sx.smtps
+	    && smtp_write_command(&sx.outblock, FALSE,
+				      "EHLO %s\r\n", sx.helo_data) >= 0
+	    && smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer),
+				      '2', sx.ob->command_timeout);
+	  }
+	else
+	  {
+	  /* Set up a pipe for proxying TLS for the new transport process */
+
+	  smtp_peer_options |= PEER_OFFERED_TLS;
+	  if (sx.ok = (socketpair(AF_LOCAL, SOCK_STREAM, 0, pfd) == 0))
+	    socket_fd = pfd[1];
+	  else
+	    set_errno(sx.first_addr, errno, US"internal allocation problem",
+		    DEFER, FALSE, host
+# ifdef EXPERIMENTAL_DSN_INFO
+		    , sx.smtp_greeting, sx.helo_response
+# endif
+		    );
+	  }
 #endif
 
       /* If the socket is successfully passed, we mustn't send QUIT (or
@@ -3239,13 +3368,38 @@ if (sx.completed_addr && sx.ok && sx.send_quit)
 propagate it from the initial
 */
       if (sx.ok && transport_pass_socket(tblock->name, host->name,
-	    host->address, new_message_id, sx.inblock.sock))
+	    host->address, new_message_id, socket_fd))
+	{
         sx.send_quit = FALSE;
+
+	/* If TLS is still active, we need to proxy it for the transport we
+	just passed the baton to.  Fork a child to to do it, and return to
+	get logging done asap.  Which way to place the work makes assumptions
+	about post-fork prioritisation which may not hold on all platforms. */
+
+	if (tls_out.active >= 0)
+	  {
+	  int pid = fork();
+	  if (pid > 0)		/* parent */
+	    {
+	    tls_close(FALSE, FALSE);
+	    (void)close(sx.inblock.sock);
+	    continue_transport = NULL;
+	    continue_hostname = NULL;
+	    return yield;
+	    }
+	  else if (pid == 0)	/* child */
+	    {
+	    smtp_proxy_tls(&sx, pfd[0], sx.ob->command_timeout);
+	    exim_exit(0);
+	    }
+	  }
+	}
       }
 
     /* If RSET failed and there are addresses left, they get deferred. */
-
-    else set_errno(sx.first_addr, errno, msg, DEFER, FALSE, host
+    else
+      set_errno(sx.first_addr, errno, msg, DEFER, FALSE, host
 #ifdef EXPERIMENTAL_DSN_INFO
 		  , sx.smtp_greeting, sx.helo_response
 #endif
@@ -3855,7 +4009,7 @@ for (cutoff_retry = 0;
       host_is_expired = retry_check_address(addrlist->domain, host, pistring,
         incl_ip, &retry_host_key, &retry_message_key);
 
-      DEBUG(D_transport) debug_printf("%s [%s]%s status = %s\n", host->name,
+      DEBUG(D_transport) debug_printf("%s [%s]%s retry-status = %s\n", host->name,
         (host->address == NULL)? US"" : host->address, pistring,
         (host->status == hstatus_usable)? "usable" :
         (host->status == hstatus_unusable)? "unusable" :
diff --git a/src/src/transports/smtp.h b/src/src/transports/smtp.h
index 4bb6d6da3..88b608bcc 100644
--- a/src/src/transports/smtp.h
+++ b/src/src/transports/smtp.h
@@ -46,7 +46,10 @@ typedef struct {
   uschar *hosts_verify_avoid_tls;
   uschar *hosts_avoid_pipelining;
   uschar *hosts_avoid_esmtp;
+#ifdef SUPPORT_TLS
   uschar *hosts_nopass_tls;
+  uschar *hosts_noproxy_tls;
+#endif
   int     command_timeout;
   int     connect_timeout;
   int     data_timeout;
diff --git a/test/confs/2013 b/test/confs/2013
index ebd253691..45d683cb4 100644
--- a/test/confs/2013
+++ b/test/confs/2013
@@ -10,7 +10,7 @@ primary_hostname = myhost.test.ex
 
 acl_smtp_rcpt = accept
 
-log_selector = +tls_peerdn+smtp_connection+incoming_port
+log_selector = +tls_peerdn+smtp_connection+incoming_port+received_recipients
 
 queue_only
 queue_run_in_order
@@ -55,6 +55,7 @@ send_to_server:
   driver = smtp
   allow_localhost
   hosts = 127.0.0.1
+  hosts_noproxy_tls = :
   port = PORT_D
 
 # End
diff --git a/test/confs/2113 b/test/confs/2113
index f2c49c9b8..bb64867a9 100644
--- a/test/confs/2113
+++ b/test/confs/2113
@@ -10,7 +10,7 @@ primary_hostname = myhost.test.ex
 
 acl_smtp_rcpt = accept
 
-log_selector = +tls_peerdn+smtp_connection+incoming_port
+log_selector = +tls_peerdn+smtp_connection+incoming_port+received_recipients
 
 queue_only
 queue_run_in_order
@@ -55,6 +55,7 @@ send_to_server:
   driver = smtp
   allow_localhost
   hosts = 127.0.0.1
+  hosts_noproxy_tls = :
   port = PORT_D
   tls_try_verify_hosts = :
 
diff --git a/test/log/2013 b/test/log/2013
index 21fad4866..79bc3f612 100644
--- a/test/log/2013
+++ b/test/log/2013
@@ -1,21 +1,27 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for userx@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for usery@test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for userz@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbB-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbC-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 SMTP connection from [127.0.0.1]:1111 (TCP/IP connection count = 1)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex for userx@test.ex
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaZ-0005vi-00@myhost.test.ex for userz@test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex for usery@test.ex
 1999-03-02 09:44:33 SMTP connection from localhost (myhost.test.ex) [127.0.0.1]:1111 closed by QUIT
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx <userx@test.ex> R=server T=local_delivery
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
-1999-03-02 09:44:33 10HmbA-0005vi-00 => usery <usery@test.ex> R=server T=local_delivery
+1999-03-02 09:44:33 10HmbA-0005vi-00 => userx <userx@test.ex> R=server T=local_delivery
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 => userz <userz@test.ex> R=server T=local_delivery
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbC-0005vi-00 => usery <usery@test.ex> R=server T=local_delivery
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/log/2113 b/test/log/2113
index 797989bee..08b08cc84 100644
--- a/test/log/2113
+++ b/test/log/2113
@@ -1,21 +1,27 @@
-1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for userx@test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for usery@test.ex
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss for userz@test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qqf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
-1999-03-02 09:44:33 10HmaY-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbB-0005vi-00"
+1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbC-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qqf
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
 1999-03-02 09:44:33 SMTP connection from [127.0.0.1]:1111 (TCP/IP connection count = 1)
-1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex
-1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaX-0005vi-00@myhost.test.ex for userx@test.ex
+1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaZ-0005vi-00@myhost.test.ex for userz@test.ex
+1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1]:1111 P=esmtps X=TLSv1:AES256-SHA:256 CV=no S=sss id=E10HmaY-0005vi-00@myhost.test.ex for usery@test.ex
 1999-03-02 09:44:33 SMTP connection from localhost (myhost.test.ex) [127.0.0.1]:1111 closed by QUIT
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaZ-0005vi-00 => userx <userx@test.ex> R=server T=local_delivery
-1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed
 1999-03-02 09:44:33 10HmbA-0005vi-00 => userx <userx@test.ex> R=server T=local_delivery
 1999-03-02 09:44:33 10HmbA-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbB-0005vi-00 => userz <userz@test.ex> R=server T=local_delivery
+1999-03-02 09:44:33 10HmbB-0005vi-00 Completed
+1999-03-02 09:44:33 10HmbC-0005vi-00 => usery <usery@test.ex> R=server T=local_delivery
+1999-03-02 09:44:33 10HmbC-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/mail/2013.userx b/test/mail/2013.userx
index a0615146b..0d421f497 100644
--- a/test/mail/2013.userx
+++ b/test/mail/2013.userx
@@ -3,7 +3,7 @@ Received: from localhost ([127.0.0.1]:1111 helo=myhost.test.ex)
 	by myhost.test.ex with esmtps (TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256)
 	(Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaZ-0005vi-00
+	id 10HmbA-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
diff --git a/test/mail/2013.usery b/test/mail/2013.usery
index a93a63d14..70e5f37fb 100644
--- a/test/mail/2013.usery
+++ b/test/mail/2013.usery
@@ -3,7 +3,7 @@ Received: from localhost ([127.0.0.1]:1111 helo=myhost.test.ex)
 	by myhost.test.ex with esmtps (TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256)
 	(Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbA-0005vi-00
+	id 10HmbC-0005vi-00
 	for usery@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
diff --git a/test/mail/2013.userz b/test/mail/2013.userz
new file mode 100644
index 000000000..f7b8e9c1d
--- /dev/null
+++ b/test/mail/2013.userz
@@ -0,0 +1,18 @@
+From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
+Received: from localhost ([127.0.0.1]:1111 helo=myhost.test.ex)
+	by myhost.test.ex with esmtps (TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256)
+	(Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbB-0005vi-00
+	for userz@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Received: from CALLER by myhost.test.ex with local (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaZ-0005vi-00
+	for userz@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+TLS: cipher=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 peerdn=
+
+Test message 3
+
diff --git a/test/mail/2113.userx b/test/mail/2113.userx
index 70f5e9e24..247218ae0 100644
--- a/test/mail/2113.userx
+++ b/test/mail/2113.userx
@@ -3,7 +3,7 @@ Received: from localhost ([127.0.0.1]:1111 helo=myhost.test.ex)
 	by myhost.test.ex with esmtps (TLSv1:AES256-SHA:256)
 	(Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaZ-0005vi-00
+	id 10HmbA-0005vi-00
 	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
 Received: from CALLER by myhost.test.ex with local (Exim x.yz)
 	(envelope-from <CALLER@myhost.test.ex>)
@@ -16,21 +16,3 @@ TLS: cipher=TLSv1:AES256-SHA:256 peerdn=
 
 Test message 1
 
-From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
-Received: from localhost ([127.0.0.1]:1111 helo=myhost.test.ex)
-	by myhost.test.ex with esmtps (TLSv1:AES256-SHA:256)
-	(Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmbA-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-Received: from CALLER by myhost.test.ex with local (Exim x.yz)
-	(envelope-from <CALLER@myhost.test.ex>)
-	id 10HmaY-0005vi-00
-	for userx@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
-Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
-From: CALLER_NAME <CALLER@myhost.test.ex>
-Date: Tue, 2 Mar 1999 09:44:33 +0000
-TLS: cipher=TLSv1:AES256-SHA:256 peerdn=
-
-Test message 2
-
diff --git a/test/mail/2113.usery b/test/mail/2113.usery
new file mode 100644
index 000000000..78402a324
--- /dev/null
+++ b/test/mail/2113.usery
@@ -0,0 +1,18 @@
+From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
+Received: from localhost ([127.0.0.1]:1111 helo=myhost.test.ex)
+	by myhost.test.ex with esmtps (TLSv1:AES256-SHA:256)
+	(Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbC-0005vi-00
+	for usery@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Received: from CALLER by myhost.test.ex with local (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaY-0005vi-00
+	for usery@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmaY-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+TLS: cipher=TLSv1:AES256-SHA:256 peerdn=
+
+Test message 2
+
diff --git a/test/mail/2113.userz b/test/mail/2113.userz
new file mode 100644
index 000000000..0d8210281
--- /dev/null
+++ b/test/mail/2113.userz
@@ -0,0 +1,18 @@
+From CALLER@myhost.test.ex Tue Mar 02 09:44:33 1999
+Received: from localhost ([127.0.0.1]:1111 helo=myhost.test.ex)
+	by myhost.test.ex with esmtps (TLSv1:AES256-SHA:256)
+	(Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmbB-0005vi-00
+	for userz@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Received: from CALLER by myhost.test.ex with local (Exim x.yz)
+	(envelope-from <CALLER@myhost.test.ex>)
+	id 10HmaZ-0005vi-00
+	for userz@test.ex; Tue, 2 Mar 1999 09:44:33 +0000
+Message-Id: <E10HmaZ-0005vi-00@myhost.test.ex>
+From: CALLER_NAME <CALLER@myhost.test.ex>
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+TLS: cipher=TLSv1:AES256-SHA:256 peerdn=
+
+Test message 3
+
diff --git a/test/scripts/2000-GnuTLS/2013 b/test/scripts/2000-GnuTLS/2013
index 24c2c58fc..0c2ccba35 100644
--- a/test/scripts/2000-GnuTLS/2013
+++ b/test/scripts/2000-GnuTLS/2013
@@ -8,6 +8,9 @@ Test message 1
 exim usery@test.ex
 Test message 2
 ****
+exim userz@test.ex
+Test message 3
+****
 exim -qqf -d-all+acl
 ****
 killdaemon
diff --git a/test/scripts/2100-OpenSSL/2113 b/test/scripts/2100-OpenSSL/2113
index be1f5e4b4..e483763a3 100644
--- a/test/scripts/2100-OpenSSL/2113
+++ b/test/scripts/2100-OpenSSL/2113
@@ -4,9 +4,12 @@ exim -DSERVER=server -bd -oX PORT_D
 exim userx@test.ex
 Test message 1
 ****
-exim userx@test.ex
+exim usery@test.ex
 Test message 2
 ****
+exim userz@test.ex
+Test message 3
+****
 exim -qqf -d-all+acl
 ****
 killdaemon
diff --git a/test/stderr/0143 b/test/stderr/0143
index 3092135fd..3de426629 100644
--- a/test/stderr/0143
+++ b/test/stderr/0143
@@ -17,7 +17,7 @@ my_smtp transport entered
 hostlist:
   127.0.0.1:-1
 checking status of 127.0.0.1
-127.0.0.1 [127.0.0.1]:1111/ip4.ip4.ip4.ip4 status = usable
+127.0.0.1 [127.0.0.1]:1111/ip4.ip4.ip4.ip4 retry-status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@domain.com)
 Connecting to 127.0.0.1 [127.0.0.1]:1224 from ip4.ip4.ip4.ip4 ... connected
   SMTP<< 220 ESMTP
diff --git a/test/stderr/0450 b/test/stderr/0450
index 24e66a152..3259e19c8 100644
--- a/test/stderr/0450
+++ b/test/stderr/0450
@@ -15,7 +15,7 @@ t1 transport entered
 using the transport's hosts: 127.0.0.1
 getting address for 127.0.0.1
 checking status of 127.0.0.1
-127.0.0.1 [127.0.0.1]:1111 status = usable
+127.0.0.1 [127.0.0.1]:1111 retry-status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@test.ex)
 Connecting to 127.0.0.1 [127.0.0.1]:1225 ... failed: Connection refused
 LOG: MAIN
@@ -43,7 +43,7 @@ getting address for 127.0.0.1
 checking status of 127.0.0.1
 no host retry record
 no message retry record
-127.0.0.1 [127.0.0.1]:1112 status = usable
+127.0.0.1 [127.0.0.1]:1112 retry-status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@test.ex)
 Connecting to 127.0.0.1 [127.0.0.1]:1226 ... failed: Connection refused
 LOG: MAIN
diff --git a/test/stderr/0476 b/test/stderr/0476
index 1ecd54d00..59ea69f58 100644
--- a/test/stderr/0476
+++ b/test/stderr/0476
@@ -15,7 +15,7 @@ t1 transport entered
 hostlist:
   127.0.0.1:-1
 checking status of 127.0.0.1
-127.0.0.1 [127.0.0.1]:1111 status = usable
+127.0.0.1 [127.0.0.1]:1111 retry-status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@test.ex)
 set_process_info: pppp delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@test.ex)
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... connected
@@ -74,7 +74,7 @@ t1 transport entered
 hostlist:
   127.0.0.1:-1
 checking status of 127.0.0.1
-127.0.0.1 [127.0.0.1]:1111 status = usable
+127.0.0.1 [127.0.0.1]:1111 retry-status = usable
 delivering 10HmaZ-0005vi-00 to 127.0.0.1 [127.0.0.1] (CALLER@the.local.host.name)
 set_process_info: pppp delivering 10HmaZ-0005vi-00 to 127.0.0.1 [127.0.0.1] (CALLER@the.local.host.name)
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... failed: Connection refused
@@ -110,7 +110,7 @@ hostlist:
   127.0.0.1:-1
 checking status of 127.0.0.1
 no message retry record
-127.0.0.1 [127.0.0.1]:1111 status = unusable
+127.0.0.1 [127.0.0.1]:1111 retry-status = unusable
 all IP addresses skipped or deferred at least one address
 updating wait-t1 database
 added to list for 127.0.0.1
diff --git a/test/stderr/0512 b/test/stderr/0512
index e107ff313..1cdf5f013 100644
--- a/test/stderr/0512
+++ b/test/stderr/0512
@@ -11,7 +11,7 @@ using the transport's hosts: 127.0.0.1 : 127.0.0.1 : 127.0.0.1 : 127.0.0.1
 getting address for 127.0.0.1
 checking status of 127.0.0.1
 no message retry record
-127.0.0.1 [127.0.0.1]:1111 status = usable
+127.0.0.1 [127.0.0.1]:1111 retry-status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@myhost.test.ex)
 hosts_max_try limit reached with this host
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... failed: Connection refused
@@ -22,7 +22,7 @@ temporary delivery error(s) override hosts_max_try (message older than host's re
 getting address for 127.0.0.1
 checking status of 127.0.0.1
 no message retry record
-127.0.0.1 [127.0.0.1]:1111 status = usable
+127.0.0.1 [127.0.0.1]:1111 retry-status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@myhost.test.ex)
 hosts_max_try limit reached with this host
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... failed: Connection refused
@@ -33,7 +33,7 @@ temporary delivery error(s) override hosts_max_try (message older than host's re
 getting address for 127.0.0.1
 checking status of 127.0.0.1
 no message retry record
-127.0.0.1 [127.0.0.1]:1111 status = usable
+127.0.0.1 [127.0.0.1]:1111 retry-status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@myhost.test.ex)
 hosts_max_try limit reached with this host
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... failed: Connection refused
@@ -44,7 +44,7 @@ temporary delivery error(s) override hosts_max_try (message older than host's re
 getting address for 127.0.0.1
 checking status of 127.0.0.1
 no message retry record
-127.0.0.1 [127.0.0.1]:1111 status = usable
+127.0.0.1 [127.0.0.1]:1111 retry-status = usable
 delivering 10HmaX-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@myhost.test.ex)
 hosts_max_try limit reached with this host
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... failed: Connection refused
@@ -94,7 +94,7 @@ using the transport's hosts: 127.0.0.1 : 127.0.0.1 : 127.0.0.1 : 127.0.0.1
 getting address for 127.0.0.1
 checking status of 127.0.0.1
 no message retry record
-127.0.0.1 [127.0.0.1]:1111 status = usable
+127.0.0.1 [127.0.0.1]:1111 retry-status = usable
 delivering 10HmaZ-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@myhost.test.ex)
 hosts_max_try limit reached with this host
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... failed: Connection refused
@@ -105,7 +105,7 @@ temporary delivery error(s) override hosts_max_try (message older than host's re
 getting address for 127.0.0.1
 checking status of 127.0.0.1
 no message retry record
-127.0.0.1 [127.0.0.1]:1111 status = usable
+127.0.0.1 [127.0.0.1]:1111 retry-status = usable
 delivering 10HmaZ-0005vi-00 to 127.0.0.1 [127.0.0.1] (userx@myhost.test.ex)
 hosts_max_try limit reached with this host
 Connecting to 127.0.0.1 [127.0.0.1]:1224 ... failed: Connection refused
diff --git a/test/stderr/2013 b/test/stderr/2013
index be80161c2..60b23885f 100644
--- a/test/stderr/2013
+++ b/test/stderr/2013
@@ -30,34 +30,33 @@ cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP<< 250 Accepted
   SMTP<< 354 Enter message, ending with "." on a line by itself
-  SMTP<< 250 OK id=10HmaZ-0005vi-00
-  SMTP>> EHLO myhost.test.ex
+  SMTP<< 250 OK id=10HmbA-0005vi-00
+LOG: MAIN
+  => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+LOG: MAIN
+  Completed
+Exim version x.yz ....
+configuration file is TESTSUITE/test-config
+trusted user
+admin user
+  SMTP>> MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
+  SMTP>> RCPT TO:<userz@test.ex>
+  SMTP>> DATA
 cmd buf flush ddd bytes
-  SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
-         250-SIZE 52428800
-         250-8BITMIME
-         250-PIPELINING
-         250-STARTTLS
-         250 HELP
+  SMTP<< 250 OK
+  SMTP<< 250 Accepted
+  SMTP<< 354 Enter message, ending with "." on a line by itself
+  SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP(close)>>
 LOG: MAIN
-  => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
+  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbB-0005vi-00"
 LOG: MAIN
   Completed
+>>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 Exim version x.yz ....
 configuration file is TESTSUITE/test-config
 trusted user
 admin user
-  SMTP>> STARTTLS
-cmd buf flush ddd bytes
-  SMTP<< 220 TLS go ahead
-  SMTP>> EHLO myhost.test.ex
-cmd buf flush ddd bytes
-  SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
-         250-SIZE 52428800
-         250-8BITMIME
-         250-PIPELINING
-         250 HELP
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
   SMTP>> RCPT TO:<usery@test.ex>
   SMTP>> DATA
@@ -65,12 +64,13 @@ cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP<< 250 Accepted
   SMTP<< 354 Enter message, ending with "." on a line by itself
-  SMTP<< 250 OK id=10HmbA-0005vi-00
+  SMTP<< 250 OK id=10HmbC-0005vi-00
   SMTP>> QUIT
 cmd buf flush ddd bytes
   SMTP(close)>>
+>>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
-  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLS1.x:xxxxRSA_AES_256_CBC_SHAnnn:256 CV=no DN="C=UK,O=The Exim Maintainers,OU=Test Suite,CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbC-0005vi-00"
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stderr/2113 b/test/stderr/2113
index 2db86789b..55cfc39dd 100644
--- a/test/stderr/2113
+++ b/test/stderr/2113
@@ -30,47 +30,47 @@ cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP<< 250 Accepted
   SMTP<< 354 Enter message, ending with "." on a line by itself
-  SMTP<< 250 OK id=10HmaZ-0005vi-00
-  SMTP>> EHLO myhost.test.ex
+  SMTP<< 250 OK id=10HmbA-0005vi-00
+LOG: MAIN
+  => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+LOG: MAIN
+  Completed
+Exim version x.yz ....
+configuration file is TESTSUITE/test-config
+trusted user
+admin user
+  SMTP>> MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
+  SMTP>> RCPT TO:<userz@test.ex>
+  SMTP>> DATA
 cmd buf flush ddd bytes
-  SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
-         250-SIZE 52428800
-         250-8BITMIME
-         250-PIPELINING
-         250-STARTTLS
-         250 HELP
+  SMTP<< 250 OK
+  SMTP<< 250 Accepted
+  SMTP<< 354 Enter message, ending with "." on a line by itself
+  SMTP<< 250 OK id=10HmbB-0005vi-00
   SMTP(close)>>
 LOG: MAIN
-  => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
+  => userz@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbB-0005vi-00"
 LOG: MAIN
   Completed
+>>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 Exim version x.yz ....
 configuration file is TESTSUITE/test-config
 trusted user
 admin user
-  SMTP>> STARTTLS
-cmd buf flush ddd bytes
-  SMTP<< 220 TLS go ahead
-  SMTP>> EHLO myhost.test.ex
-cmd buf flush ddd bytes
-  SMTP<< 250-myhost.test.ex Hello localhost [127.0.0.1]
-         250-SIZE 52428800
-         250-8BITMIME
-         250-PIPELINING
-         250 HELP
   SMTP>> MAIL FROM:<CALLER@myhost.test.ex> SIZE=ssss
-  SMTP>> RCPT TO:<userx@test.ex>
+  SMTP>> RCPT TO:<usery@test.ex>
   SMTP>> DATA
 cmd buf flush ddd bytes
   SMTP<< 250 OK
   SMTP<< 250 Accepted
   SMTP<< 354 Enter message, ending with "." on a line by itself
-  SMTP<< 250 OK id=10HmbA-0005vi-00
+  SMTP<< 250 OK id=10HmbC-0005vi-00
   SMTP>> QUIT
 cmd buf flush ddd bytes
   SMTP(close)>>
+>>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
 LOG: MAIN
-  => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* X=TLSv1:AES256-SHA:256 CV=no DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+  => usery@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1]* C="250 OK id=10HmbC-0005vi-00"
 LOG: MAIN
   Completed
 >>>>>>>>>>>>>>>> Exim pid=pppp terminating with rc=0 >>>>>>>>>>>>>>>>
diff --git a/test/stdout/0572 b/test/stdout/0572
index 96ab5611b..8b7a17a78 100644
--- a/test/stdout/0572
+++ b/test/stdout/0572
@@ -53,6 +53,7 @@ hosts_avoid_esmtp =
 hosts_avoid_pipelining = 
 hosts_max_try = 5
 hosts_max_try_hardlimit = 50
+hosts_noproxy_tls = *
 no_hosts_override
 no_hosts_randomize
 hosts_require_auth =