Fix base64d() buffer size (CVE-2018-6789)

[exim.git] / test / README

diff --git a/test/README b/test/README
index 4f43b0b1a582e1d57f7975d74c142c8b41d8dca0..c08b63b0d994d93b54d87a1b7e77f8c16ab4dc53 100644 (file)
--- a/test/README
+++ b/test/README
@@ -3,8 +3,8 @@ EXPORTABLE EXIM TEST SUITE
 
 This document last updated for:
 
 
 This document last updated for:
 

-Test Suite Version: 4.67
-Date: 20 February 2007
+Test Suite Version: 4.87
+Date: 30 January 2016

 
 
 BACKGROUND
 
 
 BACKGROUND


@@ -73,12 +73,13 @@ In order to run this test suite, the following requirements must be met:
 
       Defaults:exim-build     timestamp_timeout=480,!tty_tickets
 
 
       Defaults:exim-build     timestamp_timeout=480,!tty_tickets
 

-(3) The login under which you run the tests must be in the exim group so that
-    it has access to logs, spool files, etc. The login should not be one of the
-    names "userx", "usery", "userz", or a few other simple ones such as "abcd"
-    and "xyz" and single letters that are used in the tests. The test suite
-    expects the login to have a gecos name; I think it will now run if the
-    gecos field is empty but there may be anomalies.
+(3) The login under which you run the tests must have the exim group as a
+    secondary so that it has access to logs, spool files, etc.  However, it
+    should have a different primary group (eg. "users" vs. "eximgroup"). The
+    login should not be one of the names "userx", "usery", "userz", or a few
+    other simple ones such as "abcd" and "xyz" and single letters that are used
+    in the tests. The test suite expects the login to have a gecos name; I think
+    it will now run if the gecos field is empty but there may be anomalies.

     The login must not contain a dash or an equal sign. (Otherwise some tests
     about local_from_{suffix,prefix} will fail.)
 
     The login must not contain a dash or an equal sign. (Otherwise some tests
     about local_from_{suffix,prefix} will fail.)
 


@@ -114,17 +115,18 @@ In order to run this test suite, the following requirements must be met:
     is also an IPv6 address, additional tests are run when the Exim binary
     contains IPv6 support. There are checks in the scripts for a running IPv4
     interface; when one is not found, some tests are skipped (with a warning
     is also an IPv6 address, additional tests are run when the Exim binary
     contains IPv6 support. There are checks in the scripts for a running IPv4
     interface; when one is not found, some tests are skipped (with a warning

-    message).
+    message).  The local net may not be in 10.0/8 as that is used by the suite.

 
 (9) Exim must be built with TRUSTED_CONFIG_LIST support, so that the test
     configs can be placed into it.  A suitable file location is .../exim/test/trusted_configs
     with content .../exim/test/test-config [fill out the ... to make full
     paths].  This file should be owner/group matching CONFIGURE_OWNER/GROUP,
 
 (9) Exim must be built with TRUSTED_CONFIG_LIST support, so that the test
     configs can be placed into it.  A suitable file location is .../exim/test/trusted_configs
     with content .../exim/test/test-config [fill out the ... to make full
     paths].  This file should be owner/group matching CONFIGURE_OWNER/GROUP,

-    or root/root.  The config files in .../exim/test/confs/ should be owner/group the same.
-    DISABLE_D_OPTION must not be used. If ALT_CONFIG_PREFIX is used, it
+    or root/root, and it has to be accessible for the login, under which
+    you run the tests.  The config files in .../exim/test/confs/ should be
+    owner/group the same.  DISABLE_D_OPTION must not be used. If ALT_CONFIG_PREFIX is used, it

     must contain the directory of the test-suite.  WHITELIST_D_MACROS should contain:
     must contain the directory of the test-suite.  WHITELIST_D_MACROS should contain:

-    
-     DIR:EXIM_PATH:AA:ACL:ACLRCPT:ACL_MAIL:ACL_PREDATA:ACL_RCPT:AFFIX:ALLOW:ARG1:ARG2:AUTHF:AUTHS:AUTH_ID_DOMAIN:BAD:BANNER:BB:BR:BRB:CERT:COM:COMMAND_USER:CONNECTCOND:CONTROL:CREQCIP:CREQMAC:CRL:CSS:D6:DATA:DCF:DDF:DEFAULTDWC:DELAY:DETAILS:DRATELIMIT:DYNAMIC_OPTION:ELI:ERROR_DETAILS:ERT:FAKE:FALLBACK:FILTER:FILTER_PREPEND_HOME:FORBID:FORBID_SMTP_CODE:FUSER:HAI:HAP:HARDLIMIT:HEADER_LINE_MAXSIZE:HEADER_MAXSIZE:HELO_MSG:HL:HOSTS:HOSTS_AVOID_TLS:HOSTS_MAX_TRY:HVH:IFACE:IGNORE_QUOTA:INC:INSERT:IP1:IP2:LAST:LDAPSERVERS:LENCHECK:LIMIT:LIST:LOG_SELECTOR:LS:MAXNM:MESSAGE_LOGS:MSIZE:NOTDAEMON:ONCE:ONLY:OPT:OPTION:ORDER:PAH:PEX:PORT:PTBC:QDG:QOLL:QUOTA:QUOTA_FILECOUNT:QWM:RCPT_MSG:REMEMBER:REQUIRE:RETRY:RETRY1:RETRY2:RETURN:RETURN_ERROR_DETAILS:REWRITE:ROUTE_DATA:RRATELIMIT:RT:S:SELECTOR:SELF:SERVER:SERVERS:SREQCIP:SREQMAC:SRV:STD:STRICT:SUB:SUBMISSION_OPTIONS:TIMEOUTDEFER:TIMES:TRUSTED:TRYCLEAR:UL:USE_SENDER:UTF8:VALUE:WMF:X:Y
+
+     DIR:EXIM_PATH:AA:ACL:ACLRCPT:ACL_MAIL:ACL_PREDATA:ACL_RCPT:AFFIX:ALLOW:ARG1:ARG2:AUTHF:AUTHS:AUTH_ID_DOMAIN:BAD:BANNER:BB:BR:BRB:CERT:COM:COMMAND_USER:CONNECTCOND:CONTROL:CREQCIP:CREQMAC:CRL:CSS:D6:DATA:DCF:DDF:DEFAULTDWC:DELAY:DETAILS:DRATELIMIT:DYNAMIC_OPTION:ELI:ERROR_DETAILS:ERT:FAKE:FALLBACK:FILTER:FILTER_PREPEND_HOME:FORBID:FORBID_SMTP_CODE:FUSER:HAI:HAP:HARDLIMIT:HEADER_LINE_MAXSIZE:HEADER_MAXSIZE:HELO_MSG:HL:HOSTS:HOSTS_AVOID_TLS:HOSTS_MAX_TRY:HVH:IFACE:IGNORE_QUOTA:INC:INSERT:IP1:IP2:LAST:LDAPSERVERS:LENCHECK:LIMIT:LIST:LOG_SELECTOR:MAXNM:MESSAGE_LOGS:MSIZE:NOTDAEMON:ONCE:ONLY:OPT:OPTION:ORDER:PAH:PEX:PORT:PTBC:QDG:QOLL:QUOTA:QUOTA_FILECOUNT:QWM:RCPT_MSG:REMEMBER:REQUIRE:RETRY:RETRY1:RETRY2:RETURN:RETURN_ERROR_DETAILS:REWRITE:ROUTE_DATA:RRATELIMIT:SELECTOR:SELF:SERVER:SERVERS:SREQCIP:SREQMAC:SRV:STRICT:SUB:SUBMISSION_OPTIONS:TIMEOUTDEFER:TIMES:TRUSTED:TRYCLEAR:UL:USE_SENDER:UTF8:VALUE:WMF

 
 (10) Exim must *not* be built with USE_READLINE, as the test-suite's automation
      assumes the simpler I/O model.
 
 (10) Exim must *not* be built with USE_READLINE, as the test-suite's automation
      assumes the simpler I/O model.


@@ -149,8 +151,8 @@ RUNNING THE TEST SUITE
 
 (2) cd into the exim-testsuite-x.xx directory.
 
 
 (2) cd into the exim-testsuite-x.xx directory.
 

-(3) Run "autoconf" then "./configure" and then "make". This builds a few
-    auxiliary programs that are written in C.
+(3) Run "./configure" and then "make". This builds a few auxiliary programs that
+    are written in C.

 
 (4) echo $PWD/test-config >> your_TRUSTED_CONFIG_LIST_filename
     Typically that is .../exim/test/trusted_configs
 
 (4) echo $PWD/test-config >> your_TRUSTED_CONFIG_LIST_filename
     Typically that is .../exim/test/trusted_configs


@@ -213,10 +215,12 @@ THE RUNTEST SCRIPT
 ------------------
 
 If you do not supply any arguments to ./runtest, it searches for an Exim
 ------------------
 
 If you do not supply any arguments to ./runtest, it searches for an Exim

-source tree at the same level as the test suite directory. It then looks for an
-Exim binary in a "build" directory of that source tree. If there are several
-Exim source trees, it chooses the latest version of Exim. Consider the
-following example:
+source tree at the same level as the test suite directory. A source tree
+is a source tree, if it contains a build-* directory.
+
+It then looks for an Exim binary in a "build" directory of that source
+tree. If there are several Exim source trees, it chooses the latest
+version of Exim. Consider the following example:

 
   $ ls -F /source/exim
   exim-4.60/  exim-4.62/  exim-testsuite-x.xx/
 
   $ ls -F /source/exim
   exim-4.60/  exim-4.62/  exim-testsuite-x.xx/


@@ -260,6 +264,21 @@ There are some options for the ./runtest script itself:
             (If it turns out that most people prefer to use diff, I'll change
             the default.)
 
             (If it turns out that most people prefer to use diff, I'll change
             the default.)
 

+  -FLAVOR <flavor>
+  -FLAVOUR <flavour>
+            This allows "overrides" for the test results. It's intended
+            use is to deal with distro specific differences in the test
+            output. The default flavour is "FOO" if autodetection fails.
+            (Autodetection is possible for known flavours only. Known
+            flavours are computed after file name extensions in stdout/*
+            and stderr/*.)
+
+            If during the test run differences between the current and
+            the expected output are found and no flavour file exists already,
+            you may update the "common" expected output or you may create a
+            flavour file. If  a flavour file already exists, any updates will go
+            into that flavour file!
+

   -KEEP     Normally, after a successful run, the test output files are
             deleted. This option prevents this. It is useful when running a
             single test, in order to look at the actual output before it is
   -KEEP     Normally, after a successful run, the test output files are
             deleted. This option prevents this. It is useful when running a
             single test, in order to look at the actual output before it is


@@ -279,6 +298,9 @@ There are some options for the ./runtest script itself:
             maintainer after making a change to the code that affects a lot of
             tests (for example, the wording of a message).
 
             maintainer after making a change to the code that affects a lot of
             tests (for example, the wording of a message).
 

+  -SLOW     For very slow hosts that appear to have Heisenbugs, delay before
+            comparing output files from a testcase
+

 The options for ./runtest must be given first (but after the name of the
 binary, if present). Any further options, that is, items on the command line
 that start with a hyphen, are passed to the Exim binary when it is run as part
 The options for ./runtest must be given first (but after the name of the
 binary, if present). Any further options, that is, items on the command line
 that start with a hyphen, are passed to the Exim binary when it is run as part


@@ -397,7 +419,7 @@ after doing any further comparisons that may be necessary.
 
 Other circumstances give rise to other prompts. If a test generates output for
 which there is no saved data, the prompt (after a message stating which file is
 
 Other circumstances give rise to other prompts. If a test generates output for
 which there is no saved data, the prompt (after a message stating which file is

-unexpectely not empty) is:
+unexpectedly not empty) is:

 
   Continue, Show, or Quit? [Q]
 
 
   Continue, Show, or Quit? [Q]
 


@@ -536,6 +558,7 @@ here:
   PORT_D         is replaced by a port number for normal daemon use
   PORT_N         is replaced by a port number that should never respond
   PORT_S         is replaced by a port number for normal bin/server use
   PORT_D         is replaced by a port number for normal daemon use
   PORT_N         is replaced by a port number that should never respond
   PORT_S         is replaced by a port number for normal bin/server use

+  PORT_DYNAMIC   is replaced by a port number allocated dynamically

   TESTNUM        is replaced by the current test number
   V4NET          is replaced by an IPv4 network number for testing
   V6NET          is replaced by an IPv6 network number for testing
   TESTNUM        is replaced by the current test number
   V4NET          is replaced by an IPv4 network number for testing
   V6NET          is replaced by an IPv6 network number for testing


@@ -546,6 +569,10 @@ testing purposes, and for testing Exim with -bh. The only requirement is that
 they are networks that can never be used for an IP address of a real host. I've
 chosen two multicast networks for the moment.
 
 they are networks that can never be used for an IP address of a real host. I've
 chosen two multicast networks for the moment.
 

+PORT_DYNAMIC is allocated by hunting for a free port (starting at port
+1024) a listener can bind to. This is done by runtest, for simulating
+inetd operations.
+

 If the host has no IPv6 address, "<no IPv6 address found>" is substituted but
 that does not matter because no IPv6 tests will be run. A similar substitution
 is made if there is no IPv4 address, and again, tests that actually require a
 If the host has no IPv6 address, "<no IPv6 address found>" is substituted but
 that does not matter because no IPv6 tests will be run. A similar substitution
 is made if there is no IPv4 address, and again, tests that actually require a


@@ -661,7 +688,7 @@ just one command:
 
 The expected return code in this case is 1, and the data lines are passed to
 Exim on its standard input. Both the command line and the data lines have the
 
 The expected return code in this case is 1, and the data lines are passed to
 Exim on its standard input. Both the command line and the data lines have the

-standard substitions applied to them. Thus, HOSTNAME in the example above will
+standard substitutions applied to them. Thus, HOSTNAME in the example above will

 be replaced by the local host's name. Long commands can be continued over
 several lines by using \ as a continuation character. This does *not* apply to
 data lines.
 be replaced by the local host's name. Long commands can be continued over
 several lines by using \ as a continuation character. This does *not* apply to
 data lines.


@@ -754,7 +781,7 @@ found, the entire script is skipped, and a comment is output.
   need_largefiles
 
 This command must be at the head of a script. If the Exim binary does not
   need_largefiles
 
 This command must be at the head of a script. If the Exim binary does not

-suppport large files (off_t is <= 4), the entire script is skipped, and a
+support large files (off_t is <= 4), the entire script is skipped, and a

 comment is output.
 
 
 comment is output.
 
 


@@ -827,6 +854,12 @@ terminated by four asterisks. Even if no data is required for the particular
 usage, the asterisks must be given.
 
 
 usage, the asterisks must be given.
 
 

+  background
+
+This command takes one script line and runs it in the background,
+in parallel with following commands.  For external daemons, eg. redis-server.
+
+

   catwrite <file name> [nxm[=start-of-line-text]]*
 
 This command operates like the "write" command, which is described below,
   catwrite <file name> [nxm[=start-of-line-text]]*
 
 This command operates like the "write" command, which is described below,


@@ -854,7 +887,7 @@ When OpenSSL is available on the host, an alternative version of the client
 program is compiled, one that supports TLS using OpenSSL. The additional
 arguments specify a certificate and key file when required for the connection.
 There are two additional options: -tls-on-connect, that causes the client to
 program is compiled, one that supports TLS using OpenSSL. The additional
 arguments specify a certificate and key file when required for the connection.
 There are two additional options: -tls-on-connect, that causes the client to

-initiate TLS negociation immediately on connection; -ocsp that causes the TLS
+initiate TLS negotiation immediately on connection; -ocsp that causes the TLS

 negotiation to include a certificate-status request.  The latter takes a
 filename argument, the CA info for verifying the stapled response.
 
 negotiation to include a certificate-status request.  The latter takes a
 filename argument, the CA info for verifying the stapled response.
 


@@ -908,7 +941,9 @@ input, details of which are given below. A number of options are implemented:
   -d       causes the server to output debugging information
 
   -t <sec> sets a timeout (default 5) for when the server is
   -d       causes the server to output debugging information
 
   -t <sec> sets a timeout (default 5) for when the server is

-           awaiting an incoming connection
+           awaiting an incoming connection. If negative, the
+          absolute value is used and a timeout results in a
+          nonfailure exit code

 
   -noipv4  causes the server not to set up an IPv4 socket
 
 
   -noipv4  causes the server not to set up an IPv4 socket
 


@@ -991,14 +1026,25 @@ Lines in client scripts are of two kinds:
 (2) If a line starts with three plus signs followed by a space, the rest of the
     line specifies a number of seconds to sleep for before proceeding.
 
 (2) If a line starts with three plus signs followed by a space, the rest of the
     line specifies a number of seconds to sleep for before proceeding.
 

-(3) Otherwise, the line is an input line line that is sent to the server. Any
+(3) If a line begins with three '>' characters and a space, the rest of the
+    line is input to be sent to the server.  Backslash escaping is done as
+    described below, but no trailing "\r\n" is sent.
+
+(4) If a line begin with three '<' characters and a space, the rest of the
+    line is a filename; the content of the file is inserted intto the script
+    at this point.
+
+(5) Otherwise, the line is an input line line that is sent to the server. Any

     occurrences of \r and \n in the line are turned into carriage return and
     linefeed, respectively. This is used for testing PIPELINING.
     occurrences of \r and \n in the line are turned into carriage return and
     linefeed, respectively. This is used for testing PIPELINING.

+    Any sequences of \x followed by two hex digits are converted to the equvalent
+    byte value.  Any other character following a \ is sent verbatim.
+    The line is sent with a trailing "\r\n".

 
 Here is a simple example:
 
   client 127.0.0.1 PORT_D
 
 Here is a simple example:
 
   client 127.0.0.1 PORT_D

-  ??? 250
+  ??? 220

   EHLO xxx
   ??? 250-
   ??? 250
   EHLO xxx
   ??? 250-
   ??? 250


@@ -1097,7 +1143,7 @@ indicating that they are specific to that one test. A few fixed files (for
 example, some TLS certificates) are used by more than one test, and so their
 names are not of this form.
 
 example, some TLS certificates) are used by more than one test, and so their
 names are not of this form.
 

-There are also some auxilary DNS zone files, which are described in the next
+There are also some auxiliary DNS zone files, which are described in the next

 section.
 
 
 section.
 
 


@@ -1144,9 +1190,6 @@ fake zone files.  These are:
                     data block. The addresses that are generated are in the
                     10.250.0.0/16 network.
 
                     data block. The addresses that are generated are in the
                     10.250.0.0/16 network.
 

-The domain names that are handled directly by Exim, without being passed to
-fakens, are:
-

   test.again.dns    This always provokes a TRY_AGAIN response, for testing the
                     handling of temporary DNS error. If the full domain name
                     starts with digits, a delay of that many seconds occurs.
   test.again.dns    This always provokes a TRY_AGAIN response, for testing the
                     handling of temporary DNS error. If the full domain name
                     starts with digits, a delay of that many seconds occurs.


@@ -1154,10 +1197,6 @@ fakens, are:
   test.fail.dns     This always provokes a NO_RECOVERY response, for testing
                     DNS server failures.
 
   test.fail.dns     This always provokes a NO_RECOVERY response, for testing
                     DNS server failures.
 

-This special handling could now be done in the fakens program, but while the
-old test suite is still being used it has to be done in Exim itself, so for the
-moment it remains there.
-

 The use of gethostbyname() and its IPv6 friends is also subverted when Exim is
 running in the test harness. The test code handles a few special names
 directly; for all the others it uses DNS lookups, which are then handled as
 The use of gethostbyname() and its IPv6 friends is also subverted when Exim is
 running in the test harness. The test code handles a few special names
 directly; for all the others it uses DNS lookups, which are then handled as