SECURITY: fix Qualys CVE-2020-PFPZA

[exim.git] / test / runtest

diff --git a/test/runtest b/test/runtest
index 6e9255b333ec88882d06673477d7a21a51b3964c..8f49b26d3592b3392a648425186c1783a3fd1921 100755 (executable)
--- a/test/runtest
+++ b/test/runtest
@@ -29,10 +29,11 @@ use File::Basename;
 use Pod::Usage;
 use Getopt::Long;
 use FindBin qw'$RealBin';
 use Pod::Usage;
 use Getopt::Long;
 use FindBin qw'$RealBin';

+use File::Copy;

 
 use lib "$RealBin/lib";
 use Exim::Runtest;
 
 use lib "$RealBin/lib";
 use Exim::Runtest;

-use Exim::Utils qw(uniq numerically);
+use Exim::Utils qw(uniq numerically cp);

 
 use if $ENV{DEBUG} && scalar($ENV{DEBUG} =~ /\bruntest\b/) => 'Smart::Comments' => '####';
 use if $ENV{DEBUG} && scalar($ENV{DEBUG} =~ /\bruntest\b/) => 'Data::Dumper';
 
 use if $ENV{DEBUG} && scalar($ENV{DEBUG} =~ /\bruntest\b/) => 'Smart::Comments' => '####';
 use if $ENV{DEBUG} && scalar($ENV{DEBUG} =~ /\bruntest\b/) => 'Data::Dumper';


@@ -64,7 +65,7 @@ my $force_continue = 0;
 my $force_update = 0;
 my $log_failed_filename = 'failed-summary.log';
 my $log_summary_filename = 'run-summary.log';
 my $force_update = 0;
 my $log_failed_filename = 'failed-summary.log';
 my $log_summary_filename = 'run-summary.log';

-my $more = 'less -XF';
+my @more = qw'less -XF';

 my $optargs = '';
 my $save_output = 0;
 my $server_opts = '';
 my $optargs = '';
 my $save_output = 0;
 my $server_opts = '';


@@ -404,7 +405,7 @@ RESET_AFTER_EXTRA_LINE_READ:
 
   # Replace the Exim version number (may appear in various places)
   # patchexim should have fixed this for us
 
   # Replace the Exim version number (may appear in various places)
   # patchexim should have fixed this for us

-  #s/(Exim) \d+\.\d+[\w_-]*/$1 x.yz/i;
+  #s/Exim \K\d+[._]\d+[\w_-]*/x.yz/i;

 
   # Replace Exim message ids by a unique series
   s/((?:[^\W_]{6}-){2}[^\W_]{2})
 
   # Replace Exim message ids by a unique series
   s/((?:[^\W_]{6}-){2}[^\W_]{2})


@@ -552,15 +553,19 @@ RESET_AFTER_EXTRA_LINE_READ:
   # the older (comment) style, keeping only the Auth element
   # (discarding kex, cipher, mac).  For TLS 1.3 there is no kex
   # element (and no _WITH); insert a spurious "RSA".
   # the older (comment) style, keeping only the Auth element
   # (discarding kex, cipher, mac).  For TLS 1.3 there is no kex
   # element (and no _WITH); insert a spurious "RSA".

+  # Also in $tls_X_cipher_std reporting.

 
 

-  s/^\s+by .+ with .+ \K tls TLS_.*?([^_]+)_WITH.+$/(TLS1.x:ke-$1-AES256-SHAnnn:xxx)/;
-  s/^\s+by .+ with .+ \K tls TLS_.+$/(TLS1.x:ke-RSA-AES256-SHAnnn:xxx)/;
+  s/^\s+by \S+ with .+ \K \(TLS1(?:\.[0-3])?\) tls TLS_.*?([^_]+)_WITH.+$/(TLS1.x:ke-$1-AES256-SHAnnn:xxx)/;
+  s/^\s+by \S+ with .+ \K \(TLS1(?:\.[0-3])?\) tls TLS_.+$/(TLS1.x:ke-RSA-AES256-SHAnnn:xxx)/;
+
+  s/ cipher_ TLS_.*?([^_]+)_WITH.+$/ cipher_ TLS1.x:ke_$1_WITH_ci_mac/;
+  s/ cipher_ TLS_.*$/ cipher_ TLS1.x:ke_RSA_WITH_ci_mac/;

 
   # Test machines might have various different TLS library versions supporting
   # different protocols; can't rely upon TLS 1.2's AES256-GCM-SHA384, so we
   # treat the standard algorithms the same.
   #
 
   # Test machines might have various different TLS library versions supporting
   # different protocols; can't rely upon TLS 1.2's AES256-GCM-SHA384, so we
   # treat the standard algorithms the same.
   #

-  # TLSversion : KeyExchange? - Authentication/Signature - C_iph_er - MAC : ???
+  # TLSversion : KeyExchange? - Authentication/Signature - C_iph_er - MAC : bits

   #
   # So far, have seen:
   #   TLSv1:AES128-GCM-SHA256:128
   #
   # So far, have seen:
   #   TLSv1:AES128-GCM-SHA256:128


@@ -578,7 +583,7 @@ RESET_AFTER_EXTRA_LINE_READ:
   #
   # Retain the authentication algorith field as we want to test that.
 
   #
   # Retain the authentication algorith field as we want to test that.
 

-  s/( (?: (?:\b|\s) [\(=] ) | \s )TLSv1(\.[123])?:/$1TLS1.x:/xg;
+  s/( (?: (?:\b|\s) [\(=] ) | \s )TLS1(\.[123])?:/$1TLS1.x:/xg;

   s/(?<!ke-)((EC)?DHE-)?(RSA|ECDSA)-AES(128|256)-(GCM-SHA(256|384)|SHA)(?!:)/ke-$3-AES256-SHAnnn/g;
   s/(?<!ke-)((EC)?DHE-)?(RSA|ECDSA)-AES(128|256)-(GCM-SHA(256|384)|SHA):(128|256)/ke-$3-AES256-SHAnnn:xxx/g;
 
   s/(?<!ke-)((EC)?DHE-)?(RSA|ECDSA)-AES(128|256)-(GCM-SHA(256|384)|SHA)(?!:)/ke-$3-AES256-SHAnnn/g;
   s/(?<!ke-)((EC)?DHE-)?(RSA|ECDSA)-AES(128|256)-(GCM-SHA(256|384)|SHA):(128|256)/ke-$3-AES256-SHAnnn:xxx/g;
 


@@ -633,10 +638,11 @@ RESET_AFTER_EXTRA_LINE_READ:
   #   DHE-RSA-AES256-SHA
   # picking latter as canonical simply because regex easier that way.
   s/\bDHE_RSA_AES_128_CBC_SHA1:128/RSA-AES256-SHA1:256/g;
   #   DHE-RSA-AES256-SHA
   # picking latter as canonical simply because regex easier that way.
   s/\bDHE_RSA_AES_128_CBC_SHA1:128/RSA-AES256-SHA1:256/g;

-  s/TLS1.[0123](-PKIX)?:                                               # TLS version
+  s/TLS1.[x0123](-PKIX)?:                                              # TLS version

     ((EC)?DHE(_((?<psk>PSK)_)?((?<auth>RSA|ECDSA)_)?
                                (SECP(256|521)R1|X25519))?__?)?         # key-exchange
     ((?<auth>RSA|ECDSA)((_PSS_RSAE)?_SHA(512|256))?__?)?               # authentication
     ((EC)?DHE(_((?<psk>PSK)_)?((?<auth>RSA|ECDSA)_)?
                                (SECP(256|521)R1|X25519))?__?)?         # key-exchange
     ((?<auth>RSA|ECDSA)((_PSS_RSAE)?_SHA(512|256))?__?)?               # authentication

+    (?<with>WITH_)?                                                    # stdname-with

     AES_(256|128)_(CBC|GCM)                                            # cipher
     (__?AEAD)?                                                         # pseudo-MAC
     (__?SHA(1|256|384))?                                               # PRF
     AES_(256|128)_(CBC|GCM)                                            # cipher
     (__?AEAD)?                                                         # pseudo-MAC
     (__?SHA(1|256|384))?                                               # PRF


@@ -644,10 +650,15 @@ RESET_AFTER_EXTRA_LINE_READ:
     /"TLS1.x:ke-"
        . (defined($+{psk}) ? $+{psk} : "")
        . (defined($+{auth}) ? $+{auth} : "")
     /"TLS1.x:ke-"
        . (defined($+{psk}) ? $+{psk} : "")
        . (defined($+{auth}) ? $+{auth} : "")

+       . (defined($+{with}) ? $+{with} : "")

        . "-AES256-SHAnnn:xxx"/gex;
   s/TLS1.2:RSA__CAMELLIA_256_GCM(_SHA384)?:256/TLS1.2:RSA_CAMELLIA_256_GCM-SHAnnn:256/g;
   s/\b(ECDHE-(RSA|ECDSA)-AES256-SHA|DHE-RSA-AES256-SHA256)\b/ke-$2-AES256-SHAnnn/g;
 
        . "-AES256-SHAnnn:xxx"/gex;
   s/TLS1.2:RSA__CAMELLIA_256_GCM(_SHA384)?:256/TLS1.2:RSA_CAMELLIA_256_GCM-SHAnnn:256/g;
   s/\b(ECDHE-(RSA|ECDSA)-AES256-SHA|DHE-RSA-AES256-SHA256)\b/ke-$2-AES256-SHAnnn/g;
 

+  # Separate reporting of TLS version
+  s/ver:    TLS1(\.[0-3])?$/ver:    TLS1.x/;
+  s/ \(TLS1(\.[0-3])?\) / (TLS1.x) /;
+

   # GnuTLS library error message changes
   s/(No certificate was found|Certificate is required)/The peer did not send any certificate/g;
 #(dodgy test?)  s/\(certificate verification failed\): invalid/\(gnutls_handshake\): The peer did not send any certificate./g;
   # GnuTLS library error message changes
   s/(No certificate was found|Certificate is required)/The peer did not send any certificate/g;
 #(dodgy test?)  s/\(certificate verification failed\): invalid/\(gnutls_handshake\): The peer did not send any certificate./g;


@@ -728,18 +739,17 @@ RESET_AFTER_EXTRA_LINE_READ:
 
   s/\bgid=\d+/gid=gggg/;
   s/\begid=\d+/egid=gggg/;
 
   s/\bgid=\d+/gid=gggg/;
   s/\begid=\d+/egid=gggg/;

-  s/\b(pid=|PID: )\d+/$1pppp/;
+  s/\b(pid=|pid |PID: )\d+/$1pppp/;

   s/\buid=\d+/uid=uuuu/;
   s/\beuid=\d+/euid=uuuu/;
   s/set_process_info:\s+\d+/set_process_info: pppp/;
   s/\buid=\d+/uid=uuuu/;
   s/\beuid=\d+/euid=uuuu/;
   s/set_process_info:\s+\d+/set_process_info: pppp/;

-  s/queue run pid \d+/queue run pid ppppp/;

   s/process \d+ running as transport filter/process pppp running as transport filter/;
   s/process \d+ writing to transport filter/process pppp writing to transport filter/;
   s/reading pipe for subprocess \d+/reading pipe for subprocess pppp/;
   s/remote delivery process \d+ ended/remote delivery process pppp ended/;
 
   # Pid in temp file in appendfile transport
   s/process \d+ running as transport filter/process pppp running as transport filter/;
   s/process \d+ writing to transport filter/process pppp writing to transport filter/;
   s/reading pipe for subprocess \d+/reading pipe for subprocess pppp/;
   s/remote delivery process \d+ ended/remote delivery process pppp ended/;
 
   # Pid in temp file in appendfile transport

-  s"test-mail/temp\.\d+\."test-mail/temp.pppp.";
+  s"test-mail/(subdir/)?temp\K\.\d+\.".pppp.";

 
   # Optional pid in log lines
   s/^(\d{4}-\d\d-\d\d\s\d\d:\d\d:\d\d)(\.\d{3}|)(\s[+-]\d{4}|)(\s\[\d+\])/
 
   # Optional pid in log lines
   s/^(\d{4}-\d\d-\d\d\s\d\d:\d\d:\d\d)(\.\d{3}|)(\s[+-]\d{4}|)(\s\[\d+\])/


@@ -770,7 +780,7 @@ RESET_AFTER_EXTRA_LINE_READ:
 
   # This handles "connection from" and the like, when the port is given
   if (!/listening for SMTP on/ && !/Connecting to/ && !/=>/ && !/->/
 
   # This handles "connection from" and the like, when the port is given
   if (!/listening for SMTP on/ && !/Connecting to/ && !/=>/ && !/->/

-      && !/\*>/ && !/Connection refused/)
+      && !/\*>/&& !/==/  && !/\*\*/ && !/Connection refused/ && !/in response to/)

     {
     s/\[([a-z\d:]+|\d+(?:\.\d+){3})\]:(\d+)/"[".$1."]:".new_value($2,"%s",\$next_port)/ie;
     }
     {
     s/\[([a-z\d:]+|\d+(?:\.\d+){3})\]:(\d+)/"[".$1."]:".new_value($2,"%s",\$next_port)/ie;
     }


@@ -790,6 +800,12 @@ RESET_AFTER_EXTRA_LINE_READ:
   # Also, the length of space at the end of the host line is dependent
   # on the length of the longest line, so strip it also on otherwise
   # un-rewritten lines like localhost
   # Also, the length of space at the end of the host line is dependent
   # on the length of the longest line, so strip it also on otherwise
   # un-rewritten lines like localhost

+  #
+  # host 127.0.0.1     [127.0.0.1]
+  # host 10.0.0.1      [10.0.0.1]-
+  #
+  # host 127.0.0.1     [127.0.0.1]--
+  # host 169.16.16.16  [169.16.16.10]

 
   s/^\s+host\s(\S+)\s+(\S+)/  host $1 $2/;
   s/^\s+(host\s\S+\s\S+)\s+(port=.*)/  host $1 $2/;
 
   s/^\s+host\s(\S+)\s+(\S+)/  host $1 $2/;
   s/^\s+(host\s\S+\s\S+)\s+(port=.*)/  host $1 $2/;


@@ -801,7 +817,7 @@ RESET_AFTER_EXTRA_LINE_READ:
   s/(^|\W)\K\Q$parm_ipv6_stripped\E/ip6:ip6:ip6:ip6:ip6:ip6:ip6:ip6/g;
   s/\b\Q$parm_ipv4r\E\b/ip4-reverse/g;
   s/(^|\W)\K\Q$parm_ipv6r\E/ip6-reverse/g;
   s/(^|\W)\K\Q$parm_ipv6_stripped\E/ip6:ip6:ip6:ip6:ip6:ip6:ip6:ip6/g;
   s/\b\Q$parm_ipv4r\E\b/ip4-reverse/g;
   s/(^|\W)\K\Q$parm_ipv6r\E/ip6-reverse/g;

-  s/^(\s+host\s\S+\s+\[\S+\]) +$/$1 /;
+  s/^\s+host\s\S+\s+\[\S+\]\K +$//;     # strip, not collapse the trailing whitespace

 
 
   # ======== Test network IP addresses ========
 
 
   # ======== Test network IP addresses ========


@@ -811,11 +827,10 @@ RESET_AFTER_EXTRA_LINE_READ:
 
   # ======== IP error numbers and messages ========
   # These vary between operating systems
 
   # ======== IP error numbers and messages ========
   # These vary between operating systems

-  s/Can't assign requested address/Network Error/;
-  s/Cannot assign requested address/Network Error/;
+  s/Can(no|')t assign requested address/Network Error/;

   s/Operation timed out/Connection timed out/;
   s/Address family not supported by protocol family/Network Error/;
   s/Operation timed out/Connection timed out/;
   s/Address family not supported by protocol family/Network Error/;

-  s/Network is unreachable/Network Error/;
+  s/Network( is)? unreachable/Network Error/;

   s/Invalid argument/Network Error/;
 
   s/\(\d+\): Network/(dd): Network/;
   s/Invalid argument/Network Error/;
 
   s/\(\d+\): Network/(dd): Network/;


@@ -877,7 +892,7 @@ RESET_AFTER_EXTRA_LINE_READ:
   # The sizes of filter files may vary because of the substitution of local
   # filenames, logins, etc.
 
   # The sizes of filter files may vary because of the substitution of local
   # filenames, logins, etc.
 

-  s/^\d+(?= bytes read from )/ssss/;
+  s/^\d+(?= (\(tainted\) )?bytes read from )/ssss/;

 
 
   # ======== OpenSSL error messages ========
 
 
   # ======== OpenSSL error messages ========


@@ -901,7 +916,7 @@ RESET_AFTER_EXTRA_LINE_READ:
   s/renamed tmp\/\d+\.[^.]+\.(\S+) as new\/\d+\.[^.]+\.(\S+)/renamed tmp\/MAILDIR.$1 as new\/MAILDIR.$1/;
 
   # Maildir file names in general
   s/renamed tmp\/\d+\.[^.]+\.(\S+) as new\/\d+\.[^.]+\.(\S+)/renamed tmp\/MAILDIR.$1 as new\/MAILDIR.$1/;
 
   # Maildir file names in general

-  s/\b\d+\.H\d+P\d+\b/dddddddddd.HddddddPddddd/;
+  s/\b\d+\.M\d+P\d+\b/dddddddddd.HddddddPddddd/;

 
   # Maildirsize data
   while (/^\d+S,\d+C\s*$/)
 
   # Maildirsize data
   while (/^\d+S,\d+C\s*$/)


@@ -919,7 +934,7 @@ RESET_AFTER_EXTRA_LINE_READ:
 
   # SRS timestamps and signatures vary by hostname and from run to run
 
 
   # SRS timestamps and signatures vary by hostname and from run to run
 

-  s/SRS0=....=..=[^=]+=[^@]+\@test.ex/SRS0=ZZZZ=YY=the.local.host.name=CALLER\@test.ex/;
+  s/(?i)SRS0=....=.[^=]?=([^=]+)=([^@]+)\@([^ ]+)/SRS0=ZZZZ=YY=$1=$2\@$3/g;

 
 
   # ======== Output from the "fd" program about open descriptors ========
 
 
   # ======== Output from the "fd" program about open descriptors ========


@@ -927,9 +942,7 @@ RESET_AFTER_EXTRA_LINE_READ:
   # at least we'll still be checking the number of open fd's.
 
   s/max fd = \d+/max fd = dddd/;
   # at least we'll still be checking the number of open fd's.
 
   s/max fd = \d+/max fd = dddd/;

-  s/status=0 RDONLY/STATUS/g;
-  s/status=1 WRONLY/STATUS/g;
-  s/status=2 RDWR/STATUS/g;
+  s/status=[0-9a-f]+ (?:RDONLY|WRONLY|RDWR)/STATUS/g;

 
 
   # ======== Contents of spool files ========
 
 
   # ======== Contents of spool files ========


@@ -938,12 +951,6 @@ RESET_AFTER_EXTRA_LINE_READ:
   s/^\d\d\d(?=[PFS*])/ddd/;
 
 
   s/^\d\d\d(?=[PFS*])/ddd/;
 
 

-  # ========= Exim lookups ==================
-  # Lookups have a char which depends on the number of lookup types compiled in,
-  # in stderr output.  Replace with a "0".  Recognising this while avoiding
-  # other output is fragile; perhaps the debug output should be revised instead.
-  s%(?<!sqlite)(?<!lsearch\*@)(?<!lsearch\*)(?<!lsearch)[0-?]TESTSUITE/aux-fixed/%0TESTSUITE/aux-fixed/%g;
-

   # ==========================================================
   # MIME boundaries in RFC3461 DSN messages
   s/\d{8,10}-eximdsn-\d+/NNNNNNNNNN-eximdsn-MMMMMMMMMM/;
   # ==========================================================
   # MIME boundaries in RFC3461 DSN messages
   s/\d{8,10}-eximdsn-\d+/NNNNNNNNNN-eximdsn-MMMMMMMMMM/;


@@ -1000,7 +1007,8 @@ RESET_AFTER_EXTRA_LINE_READ:
     s/conversion: german.xn--strae-oqa.de/conversion: german.straße.de/;
 
     # subsecond timstamp info in reported header-files
     s/conversion: german.xn--strae-oqa.de/conversion: german.straße.de/;
 
     # subsecond timstamp info in reported header-files

-    s/^(-received_time_usec \.)\d{6}$/$1uuuuuu/;
+    s/^-received_time_usec \.\K\d{6}$/uuuuuu/;
+    s/^-received_time_complete \K\d+\.\d{6}$/tttt.uuuuuu/;

 
     # Postgres server takes varible time to shut down; lives in various places
     s/^waiting for server to shut down\.+ done$/waiting for server to shut down.... done/;
 
     # Postgres server takes varible time to shut down; lives in various places
     s/^waiting for server to shut down\.+ done$/waiting for server to shut down.... done/;


@@ -1012,9 +1020,15 @@ RESET_AFTER_EXTRA_LINE_READ:
     # ARC is not always supported by the build
     next if /^arc_sign =/;
 
     # ARC is not always supported by the build
     next if /^arc_sign =/;
 

+    # LIMITS is not always supported by the build
+    next if /^limits_advertise_hosts =/;
+

     # TLS resumption is not always supported by the build
     next if /^tls_resumption_hosts =/;
     next if /^-tls_resumption/;
     # TLS resumption is not always supported by the build
     next if /^tls_resumption_hosts =/;
     next if /^-tls_resumption/;

+
+    # gsasl library version may not support some methods
+    s/250-AUTH ANONYMOUS PLAIN SCRAM-SHA-1\K SCRAM-SHA-256//;

     }
 
   # ======== stderr ========
     }
 
   # ======== stderr ========


@@ -1030,15 +1044,25 @@ RESET_AFTER_EXTRA_LINE_READ:
     s/(?<=^>>>>>>>>>>>>>>>> Exim pid=)\d+(?= terminating)/pppp/;
     s/^(proxy-proc \w{5}-pid) \d+$/$1 pppp/;
     s/^(?:\s*\d+ )(exec .* -oPX)$/pppp $1/;
     s/(?<=^>>>>>>>>>>>>>>>> Exim pid=)\d+(?= terminating)/pppp/;
     s/^(proxy-proc \w{5}-pid) \d+$/$1 pppp/;
     s/^(?:\s*\d+ )(exec .* -oPX)$/pppp $1/;

+    next if /(?:postfork: | fork(?:ing|ed) for )/;

 
     # IP address lookups use gethostbyname() when IPv6 is not supported,
     # and gethostbyname2() or getipnodebyname() when it is.
 
     s/\b(gethostbyname2?|\bgetipnodebyname)(\(af=inet\))?/get[host|ipnode]byname[2]/;
 
 
     # IP address lookups use gethostbyname() when IPv6 is not supported,
     # and gethostbyname2() or getipnodebyname() when it is.
 
     s/\b(gethostbyname2?|\bgetipnodebyname)(\(af=inet\))?/get[host|ipnode]byname[2]/;
 

+    # Extra lookups done when ipv6 is supported
+    next if /^host_fake_gethostbyname\(af=inet6\) returned 1 \(HOST_NOT_FOUND\)$/;
+

     # we don't care what TZ enviroment the testhost was running
     next if /^Reset TZ to/;
 
     # we don't care what TZ enviroment the testhost was running
     next if /^Reset TZ to/;
 

+    # ========= Exim lookups ==================
+    # Lookups have a char which depends on the number of lookup types compiled in,
+    # in stderr output.  Replace with a "0".  Recognising this while avoiding
+    # other output is fragile; perhaps the debug output should be revised instead.
+    s%^\s+(:?closing )?\K[0-?]TESTSUITE/aux-fixed/%0TESTSUITE/aux-fixed/%g;
+

     # drop gnutls version strings
     next if /GnuTLS compile-time version: \d+[\.\d]+$/;
     next if /GnuTLS runtime version: \d+[\.\d]+$/;
     # drop gnutls version strings
     next if /GnuTLS compile-time version: \d+[\.\d]+$/;
     next if /GnuTLS runtime version: \d+[\.\d]+$/;


@@ -1049,6 +1073,38 @@ RESET_AFTER_EXTRA_LINE_READ:
 
     # this is timing-dependent
     next if /^OpenSSL: creating STEK$/;
 
     # this is timing-dependent
     next if /^OpenSSL: creating STEK$/;

+    next if /^selfsign cert rotate$/;
+
+    # TLS preload
+    # only OpenSSL speaks of these
+    next if /^TLS: (preloading (DH params|ECDH curve|CA bundle) for server|generating selfsigned server cert)/;
+    next if /^Diffie-Hellman initialized from default/;
+    next if /^ECDH OpenSSL (< )?[\d.+]+: temp key parameter settings:/;
+    next if /^ECDH: .*'prime256v1'/;
+    next if /^tls_verify_certificates: system$/;
+    next if /^tls_set_watch: .*\/cert.pem/;
+    next if /^Generating 2048 bit RSA key/;
+
+    # TLS preload
+    # only GnuTLS speaks of these
+    next if /^GnuTLS global init required$/;
+    next if /^TLS: basic cred init, server/;
+    next if /^TLS: preloading cipher list for server: NULL$/;
+    s/^GnuTLS using default session cipher\/priority "NORMAL"$/TLS: not preloading cipher list for server/;
+    next if /^GnuTLS<2>: added \d+ protocols, \d+ ciphersuites, \d+ sig algos and \d+ groups into priority list$/;
+    next if /^GnuTLS<2>: (Disabling X.509 extensions|signing structure using RSA-SHA256)/;
+    next if /^GnuTLS.*(wrap_nettle_mpi_print|gnutls_subject_alt_names_get|get_alt_name)/;
+
+    # only kevent platforms (FreeBSD, OpenBSD) say this
+    next if /^watch dir/;
+    next if /^watch file .*\/usr\/local/;
+    next if /^watch file .*\/etc\/ssl/;
+
+    # TLS preload
+    # there happen in different orders for OpenSSL/GnuTLS/noTLS
+    next if /^TLS: generating selfsigned server cert/;
+    next if /^TLS: not preloading (CA bundle|cipher list) for server$/;
+    next if /^TLS: not preloading server certs$/;

 
     # drop lookups
     next if /^Lookups \(built-in\):/;
 
     # drop lookups
     next if /^Lookups \(built-in\):/;


@@ -1101,6 +1157,8 @@ RESET_AFTER_EXTRA_LINE_READ:
     # drop pdkim debugging header
     next if /^DKIM( <<<<<<<<<<<<<<<<<<<<<<<<<<<<<+|: no signatures)$/;
 
     # drop pdkim debugging header
     next if /^DKIM( <<<<<<<<<<<<<<<<<<<<<<<<<<<<<+|: no signatures)$/;
 

+    # Some platforms have TIOCOUTome do not
+    next if /\d+ bytes remain in socket output buffer$/;

     # Various other IPv6 lines must be omitted too
 
     next if /using host_fake_gethostbyname for \S+ \(IPv6\)/;
     # Various other IPv6 lines must be omitted too
 
     next if /using host_fake_gethostbyname for \S+ \(IPv6\)/;


@@ -1108,6 +1166,7 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /DNS lookup of \S+ \(AAAA\) using fakens/;
     next if / in dns_ipv4_lookup?/;
     next if / writing neg-cache entry for .*AAAA/;
     next if /DNS lookup of \S+ \(AAAA\) using fakens/;
     next if / in dns_ipv4_lookup?/;
     next if / writing neg-cache entry for .*AAAA/;

+    next if /^faking res_search\(AAAA\) response length as 65535/;

 
     if (/DNS lookup of \S+ \(AAAA\) gave NO_DATA/)
       {
 
     if (/DNS lookup of \S+ \(AAAA\) gave NO_DATA/)
       {


@@ -1115,6 +1174,17 @@ RESET_AFTER_EXTRA_LINE_READ:
       next;
       }
 
       next;
       }
 

+    # Non-TLS bulds have a different Recieved: header expansion
+    s/^((.*)\t}}}}by \$primary_hostname \$\{if def:received_protocol \{with \$received_protocol }})\(Exim \$version_number\)$/$1\${if def:tls_in_cipher_std { tls \$tls_in_cipher_std\n$2\t}}(Exim \$version_number)/;
+    s/^((\s*).*considering: with \$received_protocol }})\(Exim \$version_number\)$/$1\${if def:tls_in_cipher_std { tls \$tls_in_cipher_std\n$2\t}}(Exim \$version_number)/;
+    if (/condition: def:tls_in_cipher_std$/)
+      {
+      $_= <IN>; $_= <IN>; $_= <IN>; $_= <IN>;
+      $_= <IN>; $_= <IN>; $_= <IN>; $_= <IN>;
+      $_= <IN>; $_= <IN>; $_= <IN>; next;
+      }
+
+

     # Skip tls_advertise_hosts and hosts_require_tls checks when the options
     # are unset, because tls ain't always there.
 
     # Skip tls_advertise_hosts and hosts_require_tls checks when the options
     # are unset, because tls ain't always there.
 


@@ -1172,16 +1242,37 @@ RESET_AFTER_EXTRA_LINE_READ:
     # Platform-dependent error strings
     s/Operation timed out/Connection timed out/;
 
     # Platform-dependent error strings
     s/Operation timed out/Connection timed out/;
 

+    # Platform differences on disconnect
+    s/unexpected disconnection while reading SMTP command from \[127.0.0.1\] \K\(error: Connection reset by peer\) //;
+

     # Platform-dependent resolver option bits
     s/^ (?:writing|update) neg-cache entry for [^,]+-\K[0-9a-f]+, ttl/xxxx, ttl/;
 
     # timing variance, run-to-run
     s/^time on queue = \K1s/0s/;
 
     # Platform-dependent resolver option bits
     s/^ (?:writing|update) neg-cache entry for [^,]+-\K[0-9a-f]+, ttl/xxxx, ttl/;
 
     # timing variance, run-to-run
     s/^time on queue = \K1s/0s/;
 

+    # content-scan: file order can vary in directory
+    s%unspool_mbox\(\): unlinking 'TESTSUITE/spool/scan/[^/]*/\K[^\']*%FFFFFFFFF%;
+

     # Skip hosts_require_dane checks when the options
     # are unset, because dane ain't always there.
     next if /in\shosts_require_dane\?\sno\s\(option\sunset\)/x;
 
     # Skip hosts_require_dane checks when the options
     # are unset, because dane ain't always there.
     next if /in\shosts_require_dane\?\sno\s\(option\sunset\)/x;
 

+    # daemon notifier socket
+    s/^(\s*\d+|ppppp) (creating notifier socket)$/ppppp $2/;
+    s/^ \@(.*exim_daemon_notify)$/ $1/;
+    s/^(\s*\d+|ppppp)  \@?(.*exim_daemon_notify)$/ppppp  $2/;
+    next if /unlinking notifier socket/;
+
+    # daemon notifier socket
+    # Timing variance over runs.  Collapse repeated memssages.
+    if (/notify triggered queue run/)
+      {
+      my $line = $_;
+      while (/notify triggered queue run/) { $_ = <IN>; }
+      $_ = $line . $_;
+      }
+

     # DISABLE_OCSP
     next if /in hosts_requ(est|ire)_ocsp\? (no|yes)/;
 
     # DISABLE_OCSP
     next if /in hosts_requ(est|ire)_ocsp\? (no|yes)/;
 


@@ -1197,6 +1288,9 @@ RESET_AFTER_EXTRA_LINE_READ:
     # Experimental_REQUIRETLS
     next if / in tls_advertise_requiretls?\? no \(end of list\)/;
 
     # Experimental_REQUIRETLS
     next if / in tls_advertise_requiretls?\? no \(end of list\)/;
 

+    # Experimental_LIMITS
+    next if / in limits_advertise_hosts?\? no \(matched "!\*"\)/;
+

     # TCP Fast Open
     next if /^(ppppp )?setsockopt FASTOPEN: Network Error/;
 
     # TCP Fast Open
     next if /^(ppppp )?setsockopt FASTOPEN: Network Error/;
 


@@ -1204,7 +1298,7 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /\w+ in keep_environment\? (yes|no)/;
 
     # Sizes vary with test hostname
     next if /\w+ in keep_environment\? (yes|no)/;
 
     # Sizes vary with test hostname

-    s/^cmd buf flush \d+ bytes$/cmd buf flush ddd bytes/;
+    s/^cmd buf flush \d+ bytes/cmd buf flush ddd bytes/;

 
     # Spool filesystem free space changes on different systems.
     s/^((?:spool|log) directory space =) -?\d+K (inodes =)\s*-?\d+/$1 nnnnnK $2 nnnnn/;
 
     # Spool filesystem free space changes on different systems.
     s/^((?:spool|log) directory space =) -?\d+K (inodes =)\s*-?\d+/$1 nnnnnK $2 nnnnn/;


@@ -1235,11 +1329,12 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /^DKIM \[[^[]+\] (Header hash|b) computed:/;
 
     # Not all platforms support TCP Fast Open, and the compile omits the check
     next if /^DKIM \[[^[]+\] (Header hash|b) computed:/;
 
     # Not all platforms support TCP Fast Open, and the compile omits the check

-    if (s/\S+ in hosts_try_fastopen\? (no \(option unset\)|yes \(matched "\*"\))\n$//)
+    if (s/\S+ in hosts_try_fastopen\? (no \(option unset\)|no \(end of list\)|yes \(matched "\*"\))\n$//)

       {
       {

+      chomp;

       $_ .= <IN>;
       s/ \.\.\. >>> / ... /;
       $_ .= <IN>;
       s/ \.\.\. >>> / ... /;

-      if (s/ non-TFO mode connection attempt to 224.0.0.0, 0 data\b$//) { $_ .= <IN>; }
+      if (s/ non-TFO mode connection attempt to 224.0.0.0, 0 data\b$//) { chomp; $_ .= <IN>; }

       s/Address family not supported by protocol family/Network Error/;
       s/Network is unreachable/Network Error/;
       }
       s/Address family not supported by protocol family/Network Error/;
       s/Network is unreachable/Network Error/;
       }


@@ -1282,6 +1377,9 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /^Waiting for MySQL server to answer/;
     next if /mysqladmin: CREATE DATABASE failed; .* database exists/;
 
     next if /^Waiting for MySQL server to answer/;
     next if /mysqladmin: CREATE DATABASE failed; .* database exists/;
 

+    # Postgres version-dependent differences
+    s/^initdb: warning: (enabling "trust" authentication for local connections)$/\nWARNING: $1/;
+

     # Not all builds include DMARC
     next if /^DMARC: no (dmarc_tld_file|sender_host_address)$/ ;
 
     # Not all builds include DMARC
     next if /^DMARC: no (dmarc_tld_file|sender_host_address)$/ ;
 


@@ -1291,6 +1389,13 @@ RESET_AFTER_EXTRA_LINE_READ:
     # Platform differences in errno strings
     s/  SMTP\(Operation timed out\)<</  SMTP(Connection timed out)<</;
 
     # Platform differences in errno strings
     s/  SMTP\(Operation timed out\)<</  SMTP(Connection timed out)<</;
 

+    # Platform differences for errno values (eg. Hurd)
+    s/^errno = \d+$/errno = EEE/;
+    s/^writing error \d+: /writing error EEE: /;
+
+    # Some platforms have to flip to slow-mode taint-checking
+    next if /switching to slow-mode taint checking/;
+

     # When Exim is checking the size of directories for maildir, it uses
     # the check_dir_size() function to scan directories. Of course, the order
     # of the files that are obtained using readdir() varies from system to
     # When Exim is checking the size of directories for maildir, it uses
     # the check_dir_size() function to scan directories. Of course, the order
     # of the files that are obtained using readdir() varies from system to


@@ -1349,7 +1454,7 @@ RESET_AFTER_EXTRA_LINE_READ:
 
     # openssl version variances
     s/(TLS error on connection [^:]*: error:)[0-9A-F]{8}(:system library):(?:fopen|func\(4095\)):(No such file or directory)$/$1xxxxxxxx$2:fopen:$3/;
 
     # openssl version variances
     s/(TLS error on connection [^:]*: error:)[0-9A-F]{8}(:system library):(?:fopen|func\(4095\)):(No such file or directory)$/$1xxxxxxxx$2:fopen:$3/;

-    s/(DANE attempt failed.*error:)[0-9A-F]{8}(:SSL routines:)(ssl3_get_server_certificate|tls_process_server_certificate|CONNECT_CR_CERT)(?=:certificate verify failed$)/$1xxxxxxxx$2ssl3_get_server_certificate/;
+    s/(DANE attempt failed.*error:)[0-9A-F]{8}(:SSL routines:)(?:(?i)ssl3_get_server_certificate|tls_process_server_certificate|CONNECT_CR_CERT)(?=:certificate verify failed$)/$1xxxxxxxx$2ssl3_get_server_certificate/;

     s/(DKIM: validation error: )error:[0-9A-F]{8}:rsa routines:(?:(?i)int_rsa_verify|CRYPTO_internal):(?:bad signature|algorithm mismatch)$/$1Public key signature verification has failed./;
     s/ARC: AMS signing: privkey PEM-block import: error:\K[0-9A-F]{8}:(PEM routines):get_name:(no start line)/0906D06C:$1:PEM_read_bio:$2/;
 
     s/(DKIM: validation error: )error:[0-9A-F]{8}:rsa routines:(?:(?i)int_rsa_verify|CRYPTO_internal):(?:bad signature|algorithm mismatch)$/$1Public key signature verification has failed./;
     s/ARC: AMS signing: privkey PEM-block import: error:\K[0-9A-F]{8}:(PEM routines):get_name:(no start line)/0906D06C:$1:PEM_read_bio:$2/;
 


@@ -1375,6 +1480,9 @@ RESET_AFTER_EXTRA_LINE_READ:
       my ($prefix, $t_diff) = ($1, $3 - $2);
       s/DKIM: d=.* t=[0-9]* x=[0-9]* /${prefix} t=T x=T+${t_diff} /;
       }
       my ($prefix, $t_diff) = ($1, $3 - $2);
       s/DKIM: d=.* t=[0-9]* x=[0-9]* /${prefix} t=T x=T+${t_diff} /;
       }

+    # GnuTLS reports a different keysize vs. OpenSSL, for ed25519 keys
+    s/signer: [^ ]* bits:\K 256/ 253/;
+    s/public key too short:\K 256 bits/ 253 bits/;

 
     # port numbers
     s/(?:\[[^\]]*\]:|port )\K$parm_port_d/PORT_D/;
 
     # port numbers
     s/(?:\[[^\]]*\]:|port )\K$parm_port_d/PORT_D/;


@@ -1385,6 +1493,16 @@ RESET_AFTER_EXTRA_LINE_READ:
     s/(?:\[[^\]]*\]:|port )\K$parm_port_n/PORT_N/;
     s/I=\[[^\]]*\]:\K\d+/ppppp/;
 
     s/(?:\[[^\]]*\]:|port )\K$parm_port_n/PORT_N/;
     s/I=\[[^\]]*\]:\K\d+/ppppp/;
 

+    # Platform differences for errno values (eg. Hurd).  Leave 0 and negative numbers alone.
+    s/R=\w+ T=\w+ defer\K \([1-9]\d*\): / (EEE): /;
+
+    # Platform differences in errno strings
+    s/Arg list too long/Argument list too long/;
+
+    # OpenSSL vs. GnuTLS
+    s/session: \K\((SSL_connect|gnutls_handshake)\): timed out/(tls lib connect fn): timed out/;
+    s/TLS error on connection from .*\K\((SSL_accept|gnutls_handshake)\): timed out/(tls lib accept fn): timed out/;
+    s/TLS error on connection from .*\K(SSL_accept: TCP connection closed by peer|\(gnutls_handshake\): The TLS connection was non-properly terminated.)/(tls lib accept fn): TCP connection closed by peer/;

     }
 
   # ======== mail ========
     }
 
   # ======== mail ========


@@ -1526,7 +1644,7 @@ if (! -e $sf_current)
       log_failure($log_failed_filename, $testno, $rf);
       log_test($log_summary_filename, $testno, 'F') if ($force_continue);
     }
       log_failure($log_failed_filename, $testno, $rf);
       log_test($log_summary_filename, $testno, 'F') if ($force_continue);
     }

-    return 1 if /^c$/i && $rf !~ /paniclog/ && $rsf !~ /paniclog/;
+    return 1 if /^c$/i && $rf !~ /paniclog/ && (!defined $rsf || $rsf !~ /paniclog/);

     last if (/^[sc]$/);
     }
 
     last if (/^[sc]$/);
     }
 


@@ -1537,7 +1655,7 @@ if (! -e $sf_current)
       print "\n";
       print "------------ $f -----------\n"
         if (defined $rf && -s $rf && defined $rsf && -s $rsf);
       print "\n";
       print "------------ $f -----------\n"
         if (defined $rf && -s $rf && defined $rsf && -s $rsf);

-      system("$more '$f'");
+      system @more => $f;

       }
     }
 
       }
     }
 


@@ -1619,26 +1737,25 @@ if (-e $sf_current)
         }
       }
 
         }
       }
 

-    open(MUNGED, '>', $mf) || tests_exit(-1, "Failed to open $mf: $!");
-    for ($i = 0; $i < @munged; $i++)
-      { print MUNGED $munged[$i]; }
-    close(MUNGED);
+    open(my $fh, '>', $mf) or tests_exit(-1, "Failed to open $mf: $!");
+    print $fh @munged;

     }
 
   # Deal with log sorting
 
   if ($sortfile)
     {
     }
 
   # Deal with log sorting
 
   if ($sortfile)
     {

-    my(@munged, $i, $j);

 
 

-    open(MUNGED, $mf) || tests_exit(-1, "Failed to open $mf: $!");
-    @munged = <MUNGED>;
-    close(MUNGED);
+    my @munged = do {
+      open(my $fh, '<', $mf) or tests_exit(-1, "Failed to open $mf: $!");
+      <$fh>;
+    };

 
 

-    for ($i = 0; $i < @munged; $i++)
+    for (my $i = 0; $i < @munged; $i++)

       {
       if ($munged[$i] =~ /^[-\d]{10}\s[:\d]{8}\s[-A-Za-z\d]{16}\s[-=*]>/)
         {
       {
       if ($munged[$i] =~ /^[-\d]{10}\s[:\d]{8}\s[-A-Za-z\d]{16}\s[-=*]>/)
         {

+        my $j;

         for ($j = $i + 1; $j < @munged; $j++)
           {
           last if $munged[$j] !~
         for ($j = $i + 1; $j < @munged; $j++)
           {
           last if $munged[$j] !~


@@ -1650,11 +1767,9 @@ if (-e $sf_current)
         }
       }
 
         }
       }
 

-    open(MUNGED, ">$mf") || tests_exit(-1, "Failed to open $mf: $!");
-    print MUNGED "**NOTE: The delivery lines in this file have been sorted.\n";
-    for ($i = 0; $i < @munged; $i++)
-      { print MUNGED $munged[$i]; }
-    close(MUNGED);
+    open(my $fh, '>', $mf) or tests_exit(-1, "Failed to open $mf: $!");
+    print $fh "**NOTE: The delivery lines in this file have been sorted.\n";
+    print $fh @munged;

     }
 
   # Do the comparison
     }
 
   # Do the comparison


@@ -1664,7 +1779,7 @@ if (-e $sf_current)
   # Handle comparison failure
 
   print "** Comparison of $mf with $sf_current failed";
   # Handle comparison failure
 
   print "** Comparison of $mf with $sf_current failed";

-  system("$more test-cf");
+  system @more => 'test-cf';

 
   print "\n";
   for (;;)
 
   print "\n";
   for (;;)


@@ -1688,15 +1803,14 @@ if (-e $sf_current)
 if (-s $mf)
   {
     my $sf = /^u/i ? $sf_current : $sf_flavour;
 if (-s $mf)
   {
     my $sf = /^u/i ? $sf_current : $sf_flavour;

-    tests_exit(-1, "Failed to cp $mf $sf") if system("cp '$mf' '$sf'") != 0;
+    copy($mf, $sf) or tests_exit(-1, "Failed to copy $mf $sf");

   }
 else
   {
     # if we deal with a flavour file, we can't delete it, because next time the generic
     # file would be used again
     if ($sf_current eq $sf_flavour) {
   }
 else
   {
     # if we deal with a flavour file, we can't delete it, because next time the generic
     # file would be used again
     if ($sf_current eq $sf_flavour) {

-      open(FOO, ">$sf_current");
-      close(FOO);
+      open(my $fh, '>', $sf_current);

     }
     else {
       tests_exit(-1, "Failed to unlink $sf_current") if !unlink($sf_current);
     }
     else {
       tests_exit(-1, "Failed to unlink $sf_current") if !unlink($sf_current);


@@ -1759,13 +1873,10 @@ $munges =
                      s! DN="[^,"]*\K,!/!;
                     ',
       'rejectlog' => 's/ X=TLS\S+ / X=TLS_proto_and_cipher /',
                      s! DN="[^,"]*\K,!/!;
                     ',
       'rejectlog' => 's/ X=TLS\S+ / X=TLS_proto_and_cipher /',

-      'mail'      => 's/^\s+by .+ with .+ \K tls TLS_.+$/(TLS_proto_and_cipher)/;
-                     s/ \(TLS[^)]*\)/ (TLS_proto_and_cipher)/;
-                    ',

     },
 
     'debug_pid' =>
     },
 
     'debug_pid' =>

-    { 'stderr' => 's/(^\s{0,4}|(?<=Process )|(?<=child ))\d{1,5}/ppppp/g' },
+    { 'stderr' => 's/(^\s{0,4}|(?<=Process )|(?<=child ))\d+/ppppp/g' },

 
     'optional_dsn_info' =>
     { 'mail' => '/^(X-(Remote-MTA-(smtp-greeting|helo-response)|Exim-Diagnostic|(body|message)-linecount):|Remote-MTA: X-ip;)/'
 
     'optional_dsn_info' =>
     { 'mail' => '/^(X-(Remote-MTA-(smtp-greeting|helo-response)|Exim-Diagnostic|(body|message)-linecount):|Remote-MTA: X-ip;)/'


@@ -1799,7 +1910,7 @@ $munges =
     },
 
     'timeout_errno' =>         # actual errno differs Solaris vs. Linux
     },
 
     'timeout_errno' =>         # actual errno differs Solaris vs. Linux

-    { 'mainlog' => 's/(host deferral .* errno) <\d+> /$1 <EEE> /' },
+    { 'mainlog' => 's/((?:host|message) deferral .* errno) <\d+> /$1 <EEE> /' },

 
     'peer_terminated_conn' =>  # actual error differs FreedBSD vs. Linux
     { 'stderr' => 's/^(  SMTP\()Connection reset by peer(\)<<)$/$1closed$2/' },
 
     'peer_terminated_conn' =>  # actual error differs FreedBSD vs. Linux
     { 'stderr' => 's/^(  SMTP\()Connection reset by peer(\)<<)$/$1closed$2/' },


@@ -2055,7 +2166,7 @@ if ($debug)
   $prcmd =~ s/; /;\n>> /;
   print ">> $prcmd\n";
   }
   $prcmd =~ s/; /;\n>> /;
   print ">> $prcmd\n";
   }

-system("$cmd");
+system($cmd);

 }
 
 
 }
 
 


@@ -2161,34 +2272,37 @@ if (/^dbmbuild\s+(\S+)\s+(\S+)/)
 
 if (/^dump\s+(\S+)/)
   {
 
 if (/^dump\s+(\S+)/)
   {

-  my($which) = $1;
-  my(@temp);
+  my $which  = $1;

   print ">> ./eximdir/exim_dumpdb $parm_cwd/spool $which\n" if $debug;
   print ">> ./eximdir/exim_dumpdb $parm_cwd/spool $which\n" if $debug;

-  open(IN, "./eximdir/exim_dumpdb $parm_cwd/spool $which |");
-  open(OUT, ">>test-stdout");
-  print OUT "+++++++++++++++++++++++++++\n";
+  open(my $in, "-|", './eximdir/exim_dumpdb', "$parm_cwd/spool", $which) or die "Can't run exim_dumpdb: $!";
+  open(my $out, ">>test-stdout");
+  print $out "+++++++++++++++++++++++++++\n";

 
   if ($which eq "retry")
     {
 
   if ($which eq "retry")
     {

-    $/ = "\n  ";
-    @temp = <IN>;
-    $/ = "\n";
-
-    @temp = sort {
-                   my($aa) = split(' ', $a);
-                   my($bb) = split(' ', $b);
-                   return $aa cmp $bb;
-                 } @temp;
-
+    # the sort key is the first part of the retry db dump line, but for
+    # sorting we (temporarly) replace the own hosts ipv4 with a munged
+    # version, which matches the munging that is done later
+    # Why? We must ensure sure, that 127.0.0.1 always sorts first
+    # map-sort-map: Schwartz's transformation
+    # test 0099
+    my @temp = map  { $_->[1] }
+               sort { $a->[0] cmp $b->[0] }
+               #map  { [ (split)[0] =~ s/\Q$parm_ipv4/ip4.ip4.ip4.ip4/gr, $_ ] }  # this is too modern for 5.10.1
+               map  {
+                (my $k = (split)[0]) =~ s/\Q$parm_ipv4/ip4.ip4.ip4.ip4/g;
+                [ $k, $_ ]
+               }
+               do { local $/ = "\n  "; <$in> };

     foreach $item (@temp)
       {
       $item =~ s/^\s*(.*)\n(.*)\n?\s*$/$1\n$2/m;
     foreach $item (@temp)
       {
       $item =~ s/^\s*(.*)\n(.*)\n?\s*$/$1\n$2/m;

-      print OUT "  $item\n";
+      print $out "  $item\n";

       }
     }
   else
     {
       }
     }
   else
     {

-    @temp = <IN>;
+    my @temp = <$in>;

     if ($which eq "callout")
       {
       @temp = sort {
     if ($which eq "callout")
       {
       @temp = sort {


@@ -2197,11 +2311,9 @@ if (/^dump\s+(\S+)/)
                    return $aa cmp $bb;
                    } @temp;
       }
                    return $aa cmp $bb;
                    } @temp;
       }

-    print OUT @temp;
+    print $out @temp;

     }
     }

-
-  close(IN);
-  close(OUT);
+  close($in); # close it explicitly, otherwise $? does not get set

   return 1;
   }
 
   return 1;
   }
 


@@ -2291,8 +2403,7 @@ if (/^gnutls/)
 
 
 # The "killdaemon" command should ultimately follow the starting of any Exim
 
 
 # The "killdaemon" command should ultimately follow the starting of any Exim

-# daemon with the -bd option. We kill with SIGINT rather than SIGTERM to stop
-# it outputting "Terminated" to the terminal when not in the background.
+# daemon with the -bd option.

 
 if (/^killdaemon/)
   {
 
 if (/^killdaemon/)
   {


@@ -2304,14 +2415,14 @@ if (/^killdaemon/)
     print ">> killdaemon: recovered pid $pid\n" if $debug;
     if ($pid)
       {
     print ">> killdaemon: recovered pid $pid\n" if $debug;
     if ($pid)
       {

-      run_system("sudo /bin/kill -INT $pid");
+      run_system("sudo /bin/kill -TERM $pid");

       wait;
       }
     } else {
     $pid = `cat $parm_cwd/spool/exim-daemon.*`;
     if ($pid)
       {
       wait;
       }
     } else {
     $pid = `cat $parm_cwd/spool/exim-daemon.*`;
     if ($pid)
       {

-      run_system("sudo /bin/kill -INT $pid");
+      run_system("sudo /bin/kill -TERM $pid");

       close DAEMONCMD;                                   # Waits for process
       }
     }
       close DAEMONCMD;                                   # Waits for process
       }
     }


@@ -2544,9 +2655,24 @@ elsif (/^((?i:[A-Z\d_]+=\S+\s+)+)?(\d+)?\s*(sudo(?:\s+-u\s+(\w+))?\s+)?exim(_\S+
 
   if ($args =~ /\$msg/)
     {
 
   if ($args =~ /\$msg/)
     {

-    my @listcmd  = ("$parm_cwd/eximdir/exim", '-bp',
+    my($queuespec);
+    if ($args =~ /-qG\w+/) { $queuespec = $&; }
+
+    my @listcmd;
+
+    if (defined $queuespec)
+      {
+      @listcmd  = ("$parm_cwd/eximdir/exim", '-bp',
+                  $queuespec,
+                   "-DEXIM_PATH=$parm_cwd/eximdir/exim",
+                   -C => "$parm_cwd/test-config");
+      }
+    else
+      {
+      @listcmd  = ("$parm_cwd/eximdir/exim", '-bp',

                    "-DEXIM_PATH=$parm_cwd/eximdir/exim",
                    -C => "$parm_cwd/test-config");
                    "-DEXIM_PATH=$parm_cwd/eximdir/exim",
                    -C => "$parm_cwd/test-config");

+      }

     print ">> Getting queue list from:\n>>    @listcmd\n" if $debug;
     # We need the message ids sorted in ascending order.
     # Message id is: <timestamp>-<pid>-<fractional-time>. On some systems (*BSD) the
     print ">> Getting queue list from:\n>>    @listcmd\n" if $debug;
     # We need the message ids sorted in ascending order.
     # Message id is: <timestamp>-<pid>-<fractional-time>. On some systems (*BSD) the


@@ -2698,8 +2824,9 @@ else { tests_exit(-1, "Command unrecognized in line $lineno: $_"); }
 
 
 # Run the command, with stdin connected to a pipe, and write the stdin data
 
 
 # Run the command, with stdin connected to a pipe, and write the stdin data

-# to it, with appropriate substitutions. If a line ends with \NONL\, chop off
-# the terminating newline (and the \NONL\). If the command contains
+# to it, with appropriate substitutions. If a starts with '>>> ', process it
+# via Perl's string eval().
+# If the command contains

 # -DSERVER=server add "-server" to the command, where it will adjoin the name
 # for the stderr file. See comment above about the use of -DSERVER.
 
 # -DSERVER=server add "-server" to the command, where it will adjoin the name
 # for the stderr file. See comment above about the use of -DSERVER.
 


@@ -2708,12 +2835,29 @@ print ">> |${cmd}${stderrsuffix}\n" if ($debug);
 open CMD, "|${cmd}${stderrsuffix}" || tests_exit(1, "Failed to run $cmd");
 
 CMD->autoflush(1);
 open CMD, "|${cmd}${stderrsuffix}" || tests_exit(1, "Failed to run $cmd");
 
 CMD->autoflush(1);

-while (<SCRIPT>)
+LINE: while (<SCRIPT>)

   {
   $lineno++;
   last if /^\*{4}\s*$/;
   do_substitute($testno);
   {
   $lineno++;
   last if /^\*{4}\s*$/;
   do_substitute($testno);

-  if (/^(.*)\\NONL\\\s*$/) { print CMD $1; } else { print CMD; }
+  if (my ($cmd, $line) = /^(:\S+?:)(.*)/) {
+    $_ = $line;
+      {
+      $cmd eq ':eval:' and do {
+        $_ = eval "\"$_\"";
+        last;
+      };
+      $cmd eq ':noeol:' and do {
+        s/[\r\n]*$//;
+        last;
+      };
+      $cmd eq ':sleep:' and do {
+        sleep $_;
+        next LINE;
+      };
+    }
+  }
+  print CMD;

   }
 
 # For timeout tests, wait before closing the pipe; we expect a
   }
 
 # For timeout tests, wait before closing the pipe; we expect a


@@ -2771,7 +2915,7 @@ umask 022;
 #       Check for the "less" command             #
 ##################################################
 
 #       Check for the "less" command             #
 ##################################################
 

-$more = 'more' if system('which less >/dev/null 2>&1') != 0;
+@more = 'more' if system('which less >/dev/null 2>&1') != 0;

 
 
 
 
 
 


@@ -2796,7 +2940,7 @@ Getopt::Long::Configure qw(no_getopt_compat);
 GetOptions(
     'debug'    => sub { $debug          = 1; $cr   = "\n" },
     'diff'     => sub { $cf             = 'diff -u' },
 GetOptions(
     'debug'    => sub { $debug          = 1; $cr   = "\n" },
     'diff'     => sub { $cf             = 'diff -u' },

-    'continue' => sub { $force_continue = 1; $more = 'cat' },
+    'continue' => sub { $force_continue = 1; @more = 'cat' },

     'update'   => \$force_update,
     'ipv4!'    => \$have_ipv4,
     'ipv6!'    => \$have_ipv6,
     'update'   => \$force_update,
     'ipv4!'    => \$have_ipv4,
     'ipv6!'    => \$have_ipv6,


@@ -2805,6 +2949,7 @@ GetOptions(
     'valgrind' => \$valgrind,
     'range=s{2}'       => \my @range_wanted,
     'test=i@'          => \my @tests_wanted,
     'valgrind' => \$valgrind,
     'range=s{2}'       => \my @range_wanted,
     'test=i@'          => \my @tests_wanted,

+    'fail-any!'        => \my $fail_any,

     'flavor|flavour=s' => \$flavour,
     'help'             => sub { pod2usage(-exit => 0) },
     'man'              => sub {
     'flavor|flavour=s' => \$flavour,
     'help'             => sub { pod2usage(-exit => 0) },
     'man'              => sub {


@@ -2913,7 +3058,7 @@ my $eximinfo = "$parm_exim -d -C $parm_cwd/test-config -DDIR=$parm_cwd -bP exim_
 chomp(my @eximinfo = `$eximinfo 2>&1`);
 die "$0: Can't run $eximinfo\n" if $? == -1;
 
 chomp(my @eximinfo = `$eximinfo 2>&1`);
 die "$0: Can't run $eximinfo\n" if $? == -1;
 

-warn 'Got ' . $?>>8 . " from $eximinfo\n" if $?;
+warn 'Got ' . ($?>>8) . " from $eximinfo\n" if $?;

 foreach (@eximinfo)
   {
   if (my ($version) = /^Exim version (\S+)/) {
 foreach (@eximinfo)
   {
   if (my ($version) = /^Exim version (\S+)/) {


@@ -2982,7 +3127,7 @@ if (defined $parm_trusted_config_list)
   open(TCL, $parm_trusted_config_list) or die "Can't open $parm_trusted_config_list: $!\n";
   my $test_config = getcwd() . '/test-config';
   die "Can't find '$test_config' in TRUSTED_CONFIG_LIST $parm_trusted_config_list."
   open(TCL, $parm_trusted_config_list) or die "Can't open $parm_trusted_config_list: $!\n";
   my $test_config = getcwd() . '/test-config';
   die "Can't find '$test_config' in TRUSTED_CONFIG_LIST $parm_trusted_config_list."

-  if not grep { /^\Q$test_config\E$/ } <TCL>;
+    if not grep { /^\Q$test_config\E$/ } <TCL>;

   }
 else
   {
   }
 else
   {


@@ -3421,16 +3566,17 @@ while (not ($parm_ipv4 and $parm_ipv6) and defined($_ = <IFCONFIG>))
   {
   if (/^(?:[0-9]+: )?([a-z0-9]+): /) { $ifname = $1; }
 
   {
   if (/^(?:[0-9]+: )?([a-z0-9]+): /) { $ifname = $1; }
 

-  if (not $parm_ipv4 and /^\s*inet(?:\saddr)?:?\s?(\d+\.\d+\.\d+\.\d+)(?:\/\d+)?\s/i)
+  if (not $parm_ipv4 and /^\s*inet(?:\saddr(?:ess))?:?\s*(\d+\.\d+\.\d+\.\d+)(?:\/\d+)?\s/i)

     {
     {

-    # It would ne nice to be able to vary the /16 used for manyhome; we could take
+    # It would be nice to be able to vary the /16 used for manyhome; we could take

     # an option to runtest used here - but we'd also have to pass it on to fakens.
     # Possibly an environment variable?
     next if $1 eq '0.0.0.0' or $1 =~ /^(?:127|10\.250)\./;
     $parm_ipv4 = $1;
     }
 
     # an option to runtest used here - but we'd also have to pass it on to fakens.
     # Possibly an environment variable?
     next if $1 eq '0.0.0.0' or $1 =~ /^(?:127|10\.250)\./;
     $parm_ipv4 = $1;
     }
 

-  if (not $parm_ipv6 and /^\s*inet6(?:\saddr)?:?\s?([abcdef\d:]+)(?:%[^ \/]+)?(?:\/\d+)?/i)
+  if (   (not $parm_ipv6 or $parm_ipv6 =~ /%/)
+     and /^\s*inet6(?:\saddr(?:ess))?:?\s*([abcdef\d:]+)(?:%[^ \/]+)?(?:\/\d+)?/i)

     {
     next if $1 eq '::' or $1 eq '::1' or $1 =~ /^ff00/i or $1 =~ /^fe80::1/i;
     $parm_ipv6 = $1;
     {
     next if $1 eq '::' or $1 eq '::1' or $1 =~ /^ff00/i or $1 =~ /^fe80::1/i;
     $parm_ipv6 = $1;


@@ -3607,37 +3753,16 @@ system("sudo cp eximdir/exim eximdir/exim_exim;" .
 ($parm_exim_dir) = $parm_exim =~ m?^(.*)/exim?;
 
 $dbm_build_deleted = 0;
 ($parm_exim_dir) = $parm_exim =~ m?^(.*)/exim?;
 
 $dbm_build_deleted = 0;

-if (defined $parm_lookups{dbm} &&
-    system("cp $parm_exim_dir/exim_dbmbuild eximdir") != 0)
+if (defined $parm_lookups{dbm} && not cp("$parm_exim_dir/exim_dbmbuild", "eximdir/exim_dbmbuild"))

   {
   delete $parm_lookups{dbm};
   $dbm_build_deleted = 1;
   }
 
   {
   delete $parm_lookups{dbm};
   $dbm_build_deleted = 1;
   }
 

-if (system("cp $parm_exim_dir/exim_dumpdb eximdir") != 0)
-  {
-  tests_exit(-1, "Failed to make a copy of exim_dumpdb: $!");
-  }
-
-if (system("cp $parm_exim_dir/exim_lock eximdir") != 0)
-  {
-  tests_exit(-1, "Failed to make a copy of exim_lock: $!");
-  }
-
-if (system("cp $parm_exim_dir/exinext eximdir") != 0)
-  {
-  tests_exit(-1, "Failed to make a copy of exinext: $!");
-  }
-
-if (system("cp $parm_exim_dir/exigrep eximdir") != 0)
-  {
-  tests_exit(-1, "Failed to make a copy of exigrep: $!");
-  }
-
-if (system("cp $parm_exim_dir/eximstats eximdir") != 0)
-  {
-  tests_exit(-1, "Failed to make a copy of eximstats: $!");
-  }
+foreach my $tool (qw(exim_dumpdb exim_lock exinext exigrep eximstats)) {
+  cp("$parm_exim_dir/$tool" => "eximdir/$tool")
+    or tests_exit(-1, "Failed to make a copy of $tool: $!");
+}

 
 # Collect some version information
 print '-' x 78, "\n";
 
 # Collect some version information
 print '-' x 78, "\n";


@@ -3799,6 +3924,10 @@ DIR: for (my $i = 0; $i < @test_dirs; $i++)
        }
        unlink("$parm_cwd/test-config");
         }
        }
        unlink("$parm_cwd/test-config");
         }

+      elsif (/^ipv6-non-linklocal/)
+       {
+       if ($parm_ipv6 =~ /%/) { $wantthis = 0; last; }
+       }

       else
         {
         tests_exit(-1, "Unknown line in \"scripts/$testdir/REQUIRES\": \"$_\"");
       else
         {
         tests_exit(-1, "Unknown line in \"scripts/$testdir/REQUIRES\": \"$_\"");


@@ -3939,7 +4068,7 @@ if ($have_ipv4 && $parm_ipv4 ne "127.0.0.1")
       tests_exit(-1, "Failed  to open $parm_cwd/dnszones/db.ip4.$components[0]: $!");
     print OUT "$components[3].$components[2].$components[1]  PTR  $parm_hostname.\n\n";
     close(OUT);
       tests_exit(-1, "Failed  to open $parm_cwd/dnszones/db.ip4.$components[0]: $!");
     print OUT "$components[3].$components[2].$components[1]  PTR  $parm_hostname.\n\n";
     close(OUT);

-    } 
+    }

   else
     {
     open(OUT, ">$parm_cwd/dnszones/db.ip4.$components[0]") ||
   else
     {
     open(OUT, ">$parm_cwd/dnszones/db.ip4.$components[0]") ||


@@ -4026,6 +4155,7 @@ if (not $force_continue) {
 }
 
 
 }
 
 

+my $failures = 0;

 foreach $test (@test_list)
   {
   state $lasttestdir = '';
 foreach $test (@test_list)
   {
   state $lasttestdir = '';


@@ -4072,15 +4202,15 @@ foreach $test (@test_list)
   # the test-mail directory for appendfile deliveries.
 
   system "sudo /bin/rm -rf spool test-*";
   # the test-mail directory for appendfile deliveries.
 
   system "sudo /bin/rm -rf spool test-*";

-  system "mkdir test-mail 2>/dev/null";
+  mkdir "test-mail";

 
   # A privileged Exim will normally make its own spool directory, but some of
   # the tests run in unprivileged modes that don't always work if the spool
   # directory isn't already there. What is more, we want anybody to be able
   # to read it in order to find the daemon's pid.
 
 
   # A privileged Exim will normally make its own spool directory, but some of
   # the tests run in unprivileged modes that don't always work if the spool
   # directory isn't already there. What is more, we want anybody to be able
   # to read it in order to find the daemon's pid.
 

-  system "mkdir spool; " .
-         "sudo chown $parm_eximuser:$parm_eximgroup spool; " .
+  mkdir "spool";
+  system "sudo chown $parm_eximuser:$parm_eximgroup spool; " .

          "sudo chmod 0755 spool";
 
   # Empty the cache that keeps track of things like message id mappings, and
          "sudo chmod 0755 spool";
 
   # Empty the cache that keeps track of things like message id mappings, and


@@ -4259,10 +4389,12 @@ foreach $test (@test_list)
         print "\nshow stdErr, show stdOut, Retry, Continue (without file comparison), or Quit? [Q] ";
         $_ = $force_continue ? "c" : <T>;
         tests_exit(1) if /^q?$/i;
         print "\nshow stdErr, show stdOut, Retry, Continue (without file comparison), or Quit? [Q] ";
         $_ = $force_continue ? "c" : <T>;
         tests_exit(1) if /^q?$/i;

-       if (/^c$/ && $force_continue) {
-         log_failure($log_failed_filename, $testno, "exit code unexpected");
-         log_test($log_summary_filename, $testno, 'F')
-       }
+        if (/^c$/ && $force_continue)
+          {
+          log_failure($log_failed_filename, $testno, "exit code unexpected");
+          log_test($log_summary_filename, $testno, 'F');
+          $failures++;
+          }

         if ($force_continue)
           {
           print "\nstdout tail:\n";
         if ($force_continue)
           {
           print "\nstdout tail:\n";


@@ -4291,11 +4423,11 @@ foreach $test (@test_list)
         last if /^[rc]$/i;
         if (/^e$/i)
           {
         last if /^[rc]$/i;
         if (/^e$/i)
           {

-          system("$more test-stderr");
+          system @more => 'test-stderr';

           }
         elsif (/^o$/i)
           {
           }
         elsif (/^o$/i)
           {

-          system("$more test-stdout");
+          system @more => 'test-stdout';

           }
         }
 
           }
         }
 


@@ -4315,7 +4447,7 @@ foreach $test (@test_list)
         {
         if (($? & 0xff) == 0)
           { printf("Server return code %d for test %d starting line %d", $?/256,
         {
         if (($? & 0xff) == 0)
           { printf("Server return code %d for test %d starting line %d", $?/256,

-               $testno, $subtest_startline); }
+                $testno, $subtest_startline); }

         elsif (($? & 0xff00) == 0)
           { printf("Server killed by signal %d", $? & 255); }
         else
         elsif (($? & 0xff00) == 0)
           { printf("Server killed by signal %d", $? & 255); }
         else


@@ -4326,10 +4458,12 @@ foreach $test (@test_list)
           print "\nShow server stdout, Retry, Continue, or Quit? [Q] ";
           $_ = $force_continue ? "c" : <T>;
           tests_exit(1) if /^q?$/i;
           print "\nShow server stdout, Retry, Continue, or Quit? [Q] ";
           $_ = $force_continue ? "c" : <T>;
           tests_exit(1) if /^q?$/i;

-         if (/^c$/ && $force_continue) {
-           log_failure($log_failed_filename, $testno, "exit code unexpected");
-           log_test($log_summary_filename, $testno, 'F')
-         }
+          if (/^c$/ && $force_continue)
+            {
+            log_failure($log_failed_filename, $testno, "exit code unexpected");
+            log_test($log_summary_filename, $testno, 'F');
+            $failures++;
+            }

           print "... continue forced\n" if $force_continue;
           last if /^[rc]$/i;
 
           print "... continue forced\n" if $force_continue;
           last if /^[rc]$/i;
 


@@ -4364,7 +4498,14 @@ foreach $test (@test_list)
     {
     sleep 1 if $slow;
     my $rc = check_output($TEST_STATE->{munge});
     {
     sleep 1 if $slow;
     my $rc = check_output($TEST_STATE->{munge});

-    log_test($log_summary_filename, $testno, 'P') if ($rc == 0);
+    if ($rc == 0)
+      {
+      log_test($log_summary_filename, $testno, 'P');
+      }
+    else
+      {
+      $failures++;
+      }

     if ($rc < 2)
       {
       print ("  Script completed\n");
     if ($rc < 2)
       {
       print ("  Script completed\n");


@@ -4383,7 +4524,7 @@ foreach $test (@test_list)
 ##################################################
 
 tests_exit(-1, "No runnable tests selected") if not @test_list;
 ##################################################
 
 tests_exit(-1, "No runnable tests selected") if not @test_list;

-tests_exit(0);
+tests_exit($fail_any ? $failures : 0);

 
 __END__
 
 
 __END__