SPF: harden against crafted DNS responses

[exim.git] / test / runtest

diff --git a/test/runtest b/test/runtest
index 8e3a1f42caefe897fa24fa2bff3167963e8fb07c..e77a4afaed14ed3bc90d94b113c480c5d0014ad9 100755 (executable)
--- a/test/runtest
+++ b/test/runtest
@@ -369,6 +369,10 @@ my($is_mail) = $file =~ /mail/;
 
 $date = "\\d{2}-\\w{3}-\\d{4}\\s\\d{2}:\\d{2}:\\d{2}";
 
 
 $date = "\\d{2}-\\w{3}-\\d{4}\\s\\d{2}:\\d{2}:\\d{2}";
 

+# Debug time & pid
+
+$time_pid = "(?:\\d{2}:\\d{2}:\\d{2}\\s+\\d+\\s)";
+

 # Pattern for matching pids at start of stderr lines; initially something
 # that won't match.
 
 # Pattern for matching pids at start of stderr lines; initially something
 # that won't match.
 


@@ -428,6 +432,8 @@ RESET_AFTER_EXTRA_LINE_READ:
 
   # There are differences in error messages between OpenSSL versions
   s/SSL_CTX_set_cipher_list/SSL_connect/;
 
   # There are differences in error messages between OpenSSL versions
   s/SSL_CTX_set_cipher_list/SSL_connect/;

+  s/error=\Kauthority and subject key identifier mismatch/self signed certificate/;
+  s/error=\Kself-signed certificate/self signed certificate/;

 
   # One error test in expansions mentions base 62 or 36
   s/is not a base (36|62) number/is not a base 36\/62 number/;
 
   # One error test in expansions mentions base 62 or 36
   s/is not a base (36|62) number/is not a base 36\/62 number/;


@@ -788,7 +794,7 @@ RESET_AFTER_EXTRA_LINE_READ:
     }
 
   # Port in host address in spool file output from -Mvh
     }
 
   # Port in host address in spool file output from -Mvh

-  s/^(--?host_address) (.*)\.\d+/$1 $2.9999/;
+  s/^(--?host_address) (.*[:.])\d+$/$1 ${2}9999/;

 
   if ($dynamic_socket and $dynamic_socket->opened and my $port = $dynamic_socket->sockport) {
     s/^Connecting to 127\.0\.0\.1 port \K$port/<dynamic port>/;
 
   if ($dynamic_socket and $dynamic_socket->opened and my $port = $dynamic_socket->sockport) {
     s/^Connecting to 127\.0\.0\.1 port \K$port/<dynamic port>/;


@@ -902,9 +908,10 @@ RESET_AFTER_EXTRA_LINE_READ:
   # numbers, or handle specific bad conditions in different ways, leading to
   # different wording in the error messages, so we cannot compare them.
 
   # numbers, or handle specific bad conditions in different ways, leading to
   # different wording in the error messages, so we cannot compare them.
 

-#XXX This loses any trailing "deliving unencypted to" which is unfortunate
+#XXX This loses any trailing "delivering unencypted to" which is unfortunate

 #    but I can't work out how to deal with that.
   s/(TLS session: \(SSL_\w+\): error:)(.*)(?!: delivering)/$1 <<detail omitted>>/;
 #    but I can't work out how to deal with that.
   s/(TLS session: \(SSL_\w+\): error:)(.*)(?!: delivering)/$1 <<detail omitted>>/;

+  s/TLS error on connection from .*\K\(SSL_accept\): error:.*:unexpected eof while reading$/(tls lib accept fn): TCP connection closed by peer/;

   s/(TLS error on connection from .* \(SSL_\w+\): error:)(.*)/$1 <<detail omitted>>/;
   next if /SSL verify error: depth=0 error=certificate not trusted/;
 
   s/(TLS error on connection from .* \(SSL_\w+\): error:)(.*)/$1 <<detail omitted>>/;
   next if /SSL verify error: depth=0 error=certificate not trusted/;
 


@@ -960,6 +967,9 @@ RESET_AFTER_EXTRA_LINE_READ:
   # MIME boundaries in RFC3461 DSN messages
   s/\d{8,10}-eximdsn-\d+/NNNNNNNNNN-eximdsn-MMMMMMMMMM/;
 
   # MIME boundaries in RFC3461 DSN messages
   s/\d{8,10}-eximdsn-\d+/NNNNNNNNNN-eximdsn-MMMMMMMMMM/;
 

+  # Cyrus SASL library version differences (rejectlog)
+  s/Cyrus SASL permanent failure: \Kuser not found$/generic failure/;
+

   # ==========================================================
   # Some munging is specific to the specific file types
 
   # ==========================================================
   # Some munging is specific to the specific file types
 


@@ -1001,8 +1011,10 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /SSL verify error: depth=0 error=certificate not trusted/;
     s/SSL3_READ_BYTES/ssl3_read_bytes/i;
     s/CONNECT_CR_FINISHED/ssl3_read_bytes/i;
     next if /SSL verify error: depth=0 error=certificate not trusted/;
     s/SSL3_READ_BYTES/ssl3_read_bytes/i;
     s/CONNECT_CR_FINISHED/ssl3_read_bytes/i;

-    s/^\d+:error:\d+(?:E\d+)?(:SSL routines:ssl3_read_bytes:[^:]+:).*(:SSL alert number \d\d)$/pppp:error:dddddddd$1\[...\]$2/;
-    s/^error:[^:]*:(SSL routines:ssl3_read_bytes:(tls|ssl)v\d+ alert)/error:dddddddd:$1/;
+    s/^[[:xdigit:]]+:error:[[:xdigit:]]+(?:E[[:xdigit:]]+)?(:SSL routines:ssl3_read_bytes:[^:]+:).*(:SSL alert number \d\d)$/pppp:error:dddddddd$1\[...\]$2/;
+    s/^error:\K[^:]*:(SSL routines:ssl3_read_bytes:(tls|ssl)v\d+ alert)/dddddddd:$1/;
+    s/^error:\K[[:xdigit:]]+:SSL routines::(tlsv13 alert certificate required)$/dddddddd:SSL routines:ssl3_read_bytes:$1/;
+    s/^error:\K[[:xdigit:]]+:SSL routines::((tlsv1|sslv3) alert (unknown ca|certificate revoked))$/dddddddd:SSL routines:ssl3_read_bytes:$1/;

 
     # gnutls version variances
     next if /^Error in the pull function./;
 
     # gnutls version variances
     next if /^Error in the pull function./;


@@ -1071,6 +1083,9 @@ RESET_AFTER_EXTRA_LINE_READ:
     # drop gnutls version strings
     next if /GnuTLS compile-time version: \d+[\.\d]+$/;
     next if /GnuTLS runtime version: \d+[\.\d]+$/;
     # drop gnutls version strings
     next if /GnuTLS compile-time version: \d+[\.\d]+$/;
     next if /GnuTLS runtime version: \d+[\.\d]+$/;

+    # and unwanted debug
+    next if /^GnuTLS<2>: FIPS140-2 (context is not set|operation mode switched from initial to not-approved)$/;
+    next if /^GnuTLS<3>: ASSERT: sign.c\[_gnutls_sign_is_secure2\]:\d+$/;

 
     # drop openssl version strings
     next if /OpenSSL compile-time version: OpenSSL \d+[\.\da-z]+/;
 
     # drop openssl version strings
     next if /OpenSSL compile-time version: OpenSSL \d+[\.\da-z]+/;


@@ -1103,6 +1118,10 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /^GnuTLS<2>: Intel (AES|GCM) accelerator was detected/;
     next if /^Added \d{3} certificate authorities/;
     next if /^TLS: not preloading CRL for server/;
     next if /^GnuTLS<2>: Intel (AES|GCM) accelerator was detected/;
     next if /^Added \d{3} certificate authorities/;
     next if /^TLS: not preloading CRL for server/;

+    next if /^GnuTLS<3>: ASSERT: extensions.c\[_gnutls_get_extension/;
+    next if /^GnuTLS<3>: ASSERT: \.\.\/\.\.\/\.\.\/lib\/x509\//;
+    next if /^GnuTLS<2>: Initializing PKCS #11 modules/;
+

 
     # only kevent platforms (FreeBSD, OpenBSD) say this
     next if /^watch dir/;
 
     # only kevent platforms (FreeBSD, OpenBSD) say this
     next if /^watch dir/;


@@ -1117,28 +1136,28 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /^TLS: not preloading server certs$/;
 
     # drop lookups
     next if /^TLS: not preloading server certs$/;
 
     # drop lookups

-    next if /^(?:\d\d:\d\d:\d\d\ \d+\ )?(?: Lookups\ \(built-in\):
+    next if /^$time_pid?(?: Lookups\ \(built-in\):

                                        | Loading\ lookup\ modules\ from
                                        | Loaded\ \d+\ lookup\ modules
                                        | Total\ \d+\ lookups)/x;
 
     # drop compiler information
                                        | Loading\ lookup\ modules\ from
                                        | Loaded\ \d+\ lookup\ modules
                                        | Total\ \d+\ lookups)/x;
 
     # drop compiler information

-    next if /^(?:\d\d:\d\d:\d\d \d+ )?Compiler:/;
+    next if /^$time_pid?Compiler:/;

 
     # and the ugly bit
     # different libraries will have different numbers (possibly 0) of follow-up
     # lines, indenting with more data
 
     # and the ugly bit
     # different libraries will have different numbers (possibly 0) of follow-up
     # lines, indenting with more data

-    if (/^(?:\d\d:\d\d:\d\d \d+ )?Library version:/) {
+    if (/^$time_pid?Library version:/) {

       while (1) {
        $_ = <IN>;
       while (1) {
        $_ = <IN>;

-       next if /^(?:\d\d:\d\d:\d\d \d+ )?\s/;
+       next if /^$time_pid?\s/;

        goto RESET_AFTER_EXTRA_LINE_READ;
       }
     }
 
     # drop other build-time controls emitted for debugging
        goto RESET_AFTER_EXTRA_LINE_READ;
       }
     }
 
     # drop other build-time controls emitted for debugging

-    next if /^(?:\d\d:\d\d:\d\d \d+ )?WHITELIST_D_MACROS:/;
-    next if /^(?:\d\d:\d\d:\d\d \d+ )?TRUSTED_CONFIG_LIST:/;
+    next if /^$time_pid?WHITELIST_D_MACROS:/;
+    next if /^$time_pid?TRUSTED_CONFIG_LIST:/;

 
     # As of Exim 4.74, we log when a setgid fails; because we invoke Exim
     # with -be, privileges will have been dropped, so this will always
 
     # As of Exim 4.74, we log when a setgid fails; because we invoke Exim
     # with -be, privileges will have been dropped, so this will always


@@ -1286,7 +1305,7 @@ RESET_AFTER_EXTRA_LINE_READ:
       }
 
     # Different builds will have different lookup types included
       }
 
     # Different builds will have different lookup types included

-    s/^search_type \K\d+ \((\w+)\) quoting -1 \(none\)$/NN ($1) quoting -1 (none)/;
+    s/^\s*search_type \K\d+ \((\w+)\) quoting -1 \(none\)$/NN ($1) quoting -1 (none)/;

 
     # DISABLE_OCSP
     next if /in hosts_requ(est|ire)_ocsp\? (no|yes)/;
 
     # DISABLE_OCSP
     next if /in hosts_requ(est|ire)_ocsp\? (no|yes)/;


@@ -1410,10 +1429,10 @@ RESET_AFTER_EXTRA_LINE_READ:
 
     # Time-only, in debug output
     # we have to handle double lines from the DBOPEN, hence placed down here and /mg
 
     # Time-only, in debug output
     # we have to handle double lines from the DBOPEN, hence placed down here and /mg

-    s/^\d\d:\d\d:\d\d\s/01:01:01 /mg;
+    s/^\d\d:\d\d:\d\d\s+/01:01:01 /mg;

 
     # pid in debug lines
 
     # pid in debug lines

-    s/^(\d\d:\d\d:\d\d)(\s\d+\s)/"$1 " . new_value($2, "%s", \$next_pid) . " "/mgxe;
+    s/^(\d\d:\d\d:\d\d)(\s+\d+\s)/"$1 " . new_value($2, "%s", \$next_pid) . " "/mgxe;

     s/(?<!post-)[Pp]rocess\K(\s\d+ )/new_value($1, "%s", \$next_pid) . " "/gxe;
 
     # When Exim is checking the size of directories for maildir, it uses
     s/(?<!post-)[Pp]rocess\K(\s\d+ )/new_value($1, "%s", \$next_pid) . " "/gxe;
 
     # When Exim is checking the size of directories for maildir, it uses


@@ -1440,10 +1459,10 @@ RESET_AFTER_EXTRA_LINE_READ:
       # Skip some lines that Exim puts out at the start of debugging output
       # because they will be different in different binaries.
 
       # Skip some lines that Exim puts out at the start of debugging output
       # because they will be different in different binaries.
 

-      print MUNGED
-        unless (/^(?:\d\d:\d\d:\d\d\ \d+\ )?
+      next if /^$time_pid?

                  (?: Berkeley\ DB:\s
                    | Probably\ (?:Berkeley\ DB|ndbm|GDBM)
                  (?: Berkeley\ DB:\s
                    | Probably\ (?:Berkeley\ DB|ndbm|GDBM)

+                   | Using\ tdb

                    | Authenticators:
                    | Lookups(?:\(built-in\))?:
                    | Support\ for:
                    | Authenticators:
                    | Lookups(?:\(built-in\))?:
                    | Support\ for:


@@ -1456,10 +1475,9 @@ RESET_AFTER_EXTRA_LINE_READ:
                    | Configure\ owner
                    | Size\ of\ off_t:
                  )
                    | Configure\ owner
                    | Size\ of\ off_t:
                  )

-               /x
-               );
-
+               /x;

 
 

+      print MUNGED;

       }
 
     next;
       }
 
     next;


@@ -1929,12 +1947,6 @@ $munges =
     { 'mainlog'   => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/',
       'rejectlog' => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/'},
 
     { 'mainlog'   => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/',
       'rejectlog' => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/'},
 

-    'debuglog_stdout' =>
-    { 'stdout' => 's/^\d\d:\d\d:\d\d\s+\d+ //;
-                  s/Process \d+ is ready for new message/Process pppp is ready for new message/;
-                 s/^(?:daemon-accept forked for daemon-accept-delivery:|forked delivery process) \K\d+$/pppp/;'
-    },
-

     'timeout_errno' =>         # actual errno differs Solaris vs. Linux
     { 'mainlog' => 's/((?:host|message) deferral .* errno) <\d+> /$1 <EEE> /' },
 
     'timeout_errno' =>         # actual errno differs Solaris vs. Linux
     { 'mainlog' => 's/((?:host|message) deferral .* errno) <\d+> /$1 <EEE> /' },
 


@@ -2035,7 +2047,7 @@ if (! $message_skip)
 
   foreach $mail (@mails)
     {
 
   foreach $mail (@mails)
     {

-    next if $mail eq "test-mail/oncelog";
+    next if $mail =~ /^test-mail\/oncelog(.(dir|pag|db))?$/;

 
     $saved_mail = substr($mail, 10);               # Remove "test-mail/"
     $saved_mail =~ s/^$parm_caller(\/|$)/CALLER/;  # Convert caller name
 
     $saved_mail = substr($mail, 10);               # Remove "test-mail/"
     $saved_mail =~ s/^$parm_caller(\/|$)/CALLER/;  # Convert caller name


@@ -2413,6 +2425,17 @@ if (/^exigrep\s+(.*)/)
   }
 
 
   }
 
 

+# The "exiqgrep" command runs exiqgrep on the current spool
+
+if (/^exiqgrep(\s+.*)?/)
+  {
+  run_system("(./eximdir/exiqgrep -E ./eximdir/exim -C $parm_cwd/test-config" . ($1 || '') . ";" .
+    "echo exiqgrep exit code = \$?)" .
+    ">>test-stdout");
+  return 1;
+  }
+
+

 # The "eximstats" command runs eximstats on the current mainlog
 
 if (/^eximstats\s+(.*)/)
 # The "eximstats" command runs eximstats on the current mainlog
 
 if (/^eximstats\s+(.*)/)


@@ -3795,7 +3818,7 @@ if (defined $parm_lookups{dbm} && not cp("$parm_exim_dir/exim_dbmbuild", "eximdi
   $dbm_build_deleted = 1;
   }
 
   $dbm_build_deleted = 1;
   }
 

-foreach my $tool (qw(exim_dumpdb exim_lock exinext exigrep eximstats)) {
+foreach my $tool (qw(exim_dumpdb exim_lock exinext exigrep eximstats exiqgrep)) {

   cp("$parm_exim_dir/$tool" => "eximdir/$tool")
     or tests_exit(-1, "Failed to make a copy of $tool: $!");
 }
   cp("$parm_exim_dir/$tool" => "eximdir/$tool")
     or tests_exit(-1, "Failed to make a copy of $tool: $!");
 }


@@ -3803,7 +3826,7 @@ foreach my $tool (qw(exim_dumpdb exim_lock exinext exigrep eximstats)) {
 # Collect some version information
 print '-' x 78, "\n";
 print "Perl version for runtest: $]\n";
 # Collect some version information
 print '-' x 78, "\n";
 print "Perl version for runtest: $]\n";

-foreach (map { "./eximdir/$_" } qw(exigrep exinext eximstats)) {
+foreach (map { "./eximdir/$_" } qw(exigrep exinext eximstats exiqgrep)) {

   # fold (or unfold?) multiline output into a one-liner
   print join(', ', map { chomp; $_ } `$_ --version`), "\n";
 }
   # fold (or unfold?) multiline output into a one-liner
   print join(', ', map { chomp; $_ } `$_ --version`), "\n";
 }