SPF: harden against crafted DNS responses

[exim.git] / test / runtest

diff --git a/test/runtest b/test/runtest
index 3d5a975ff61419120442d1ab1b3df50e9ec5e625..e77a4afaed14ed3bc90d94b113c480c5d0014ad9 100755 (executable)
--- a/test/runtest
+++ b/test/runtest
@@ -369,6 +369,10 @@ my($is_mail) = $file =~ /mail/;
 
 $date = "\\d{2}-\\w{3}-\\d{4}\\s\\d{2}:\\d{2}:\\d{2}";
 
 
 $date = "\\d{2}-\\w{3}-\\d{4}\\s\\d{2}:\\d{2}:\\d{2}";
 

+# Debug time & pid
+
+$time_pid = "(?:\\d{2}:\\d{2}:\\d{2}\\s+\\d+\\s)";
+

 # Pattern for matching pids at start of stderr lines; initially something
 # that won't match.
 
 # Pattern for matching pids at start of stderr lines; initially something
 # that won't match.
 


@@ -408,7 +412,7 @@ RESET_AFTER_EXTRA_LINE_READ:
   #s/Exim \K\d+[._]\d+[\w_-]*/x.yz/i;
 
   # Replace Exim message ids by a unique series
   #s/Exim \K\d+[._]\d+[\w_-]*/x.yz/i;
 
   # Replace Exim message ids by a unique series

-  s/((?:[^\W_]{6}-){2}[^\W_]{2})
+  s/(\d[^\W_]{5}-[^\W_]{6}-[^\W_]{2})

     /new_value($1, "10Hm%s-0005vi-00", \$next_msgid)/egx;
 
   # The names of lock files appear in some error and debug messages
     /new_value($1, "10Hm%s-0005vi-00", \$next_msgid)/egx;
 
   # The names of lock files appear in some error and debug messages


@@ -428,6 +432,8 @@ RESET_AFTER_EXTRA_LINE_READ:
 
   # There are differences in error messages between OpenSSL versions
   s/SSL_CTX_set_cipher_list/SSL_connect/;
 
   # There are differences in error messages between OpenSSL versions
   s/SSL_CTX_set_cipher_list/SSL_connect/;

+  s/error=\Kauthority and subject key identifier mismatch/self signed certificate/;
+  s/error=\Kself-signed certificate/self signed certificate/;

 
   # One error test in expansions mentions base 62 or 36
   s/is not a base (36|62) number/is not a base 36\/62 number/;
 
   # One error test in expansions mentions base 62 or 36
   s/is not a base (36|62) number/is not a base 36\/62 number/;


@@ -788,7 +794,7 @@ RESET_AFTER_EXTRA_LINE_READ:
     }
 
   # Port in host address in spool file output from -Mvh
     }
 
   # Port in host address in spool file output from -Mvh

-  s/^(--?host_address) (.*)\.\d+/$1 $2.9999/;
+  s/^(--?host_address) (.*[:.])\d+$/$1 ${2}9999/;

 
   if ($dynamic_socket and $dynamic_socket->opened and my $port = $dynamic_socket->sockport) {
     s/^Connecting to 127\.0\.0\.1 port \K$port/<dynamic port>/;
 
   if ($dynamic_socket and $dynamic_socket->opened and my $port = $dynamic_socket->sockport) {
     s/^Connecting to 127\.0\.0\.1 port \K$port/<dynamic port>/;


@@ -902,9 +908,10 @@ RESET_AFTER_EXTRA_LINE_READ:
   # numbers, or handle specific bad conditions in different ways, leading to
   # different wording in the error messages, so we cannot compare them.
 
   # numbers, or handle specific bad conditions in different ways, leading to
   # different wording in the error messages, so we cannot compare them.
 

-#XXX This loses any trailing "deliving unencypted to" which is unfortunate
+#XXX This loses any trailing "delivering unencypted to" which is unfortunate

 #    but I can't work out how to deal with that.
   s/(TLS session: \(SSL_\w+\): error:)(.*)(?!: delivering)/$1 <<detail omitted>>/;
 #    but I can't work out how to deal with that.
   s/(TLS session: \(SSL_\w+\): error:)(.*)(?!: delivering)/$1 <<detail omitted>>/;

+  s/TLS error on connection from .*\K\(SSL_accept\): error:.*:unexpected eof while reading$/(tls lib accept fn): TCP connection closed by peer/;

   s/(TLS error on connection from .* \(SSL_\w+\): error:)(.*)/$1 <<detail omitted>>/;
   next if /SSL verify error: depth=0 error=certificate not trusted/;
 
   s/(TLS error on connection from .* \(SSL_\w+\): error:)(.*)/$1 <<detail omitted>>/;
   next if /SSL verify error: depth=0 error=certificate not trusted/;
 


@@ -960,6 +967,9 @@ RESET_AFTER_EXTRA_LINE_READ:
   # MIME boundaries in RFC3461 DSN messages
   s/\d{8,10}-eximdsn-\d+/NNNNNNNNNN-eximdsn-MMMMMMMMMM/;
 
   # MIME boundaries in RFC3461 DSN messages
   s/\d{8,10}-eximdsn-\d+/NNNNNNNNNN-eximdsn-MMMMMMMMMM/;
 

+  # Cyrus SASL library version differences (rejectlog)
+  s/Cyrus SASL permanent failure: \Kuser not found$/generic failure/;
+

   # ==========================================================
   # Some munging is specific to the specific file types
 
   # ==========================================================
   # Some munging is specific to the specific file types
 


@@ -1001,8 +1011,10 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /SSL verify error: depth=0 error=certificate not trusted/;
     s/SSL3_READ_BYTES/ssl3_read_bytes/i;
     s/CONNECT_CR_FINISHED/ssl3_read_bytes/i;
     next if /SSL verify error: depth=0 error=certificate not trusted/;
     s/SSL3_READ_BYTES/ssl3_read_bytes/i;
     s/CONNECT_CR_FINISHED/ssl3_read_bytes/i;

-    s/^\d+:error:\d+(?:E\d+)?(:SSL routines:ssl3_read_bytes:[^:]+:).*(:SSL alert number \d\d)$/pppp:error:dddddddd$1\[...\]$2/;
-    s/^error:[^:]*:(SSL routines:ssl3_read_bytes:(tls|ssl)v\d+ alert)/error:dddddddd:$1/;
+    s/^[[:xdigit:]]+:error:[[:xdigit:]]+(?:E[[:xdigit:]]+)?(:SSL routines:ssl3_read_bytes:[^:]+:).*(:SSL alert number \d\d)$/pppp:error:dddddddd$1\[...\]$2/;
+    s/^error:\K[^:]*:(SSL routines:ssl3_read_bytes:(tls|ssl)v\d+ alert)/dddddddd:$1/;
+    s/^error:\K[[:xdigit:]]+:SSL routines::(tlsv13 alert certificate required)$/dddddddd:SSL routines:ssl3_read_bytes:$1/;
+    s/^error:\K[[:xdigit:]]+:SSL routines::((tlsv1|sslv3) alert (unknown ca|certificate revoked))$/dddddddd:SSL routines:ssl3_read_bytes:$1/;

 
     # gnutls version variances
     next if /^Error in the pull function./;
 
     # gnutls version variances
     next if /^Error in the pull function./;


@@ -1071,6 +1083,9 @@ RESET_AFTER_EXTRA_LINE_READ:
     # drop gnutls version strings
     next if /GnuTLS compile-time version: \d+[\.\d]+$/;
     next if /GnuTLS runtime version: \d+[\.\d]+$/;
     # drop gnutls version strings
     next if /GnuTLS compile-time version: \d+[\.\d]+$/;
     next if /GnuTLS runtime version: \d+[\.\d]+$/;

+    # and unwanted debug
+    next if /^GnuTLS<2>: FIPS140-2 (context is not set|operation mode switched from initial to not-approved)$/;
+    next if /^GnuTLS<3>: ASSERT: sign.c\[_gnutls_sign_is_secure2\]:\d+$/;

 
     # drop openssl version strings
     next if /OpenSSL compile-time version: OpenSSL \d+[\.\da-z]+/;
 
     # drop openssl version strings
     next if /OpenSSL compile-time version: OpenSSL \d+[\.\da-z]+/;


@@ -1103,6 +1118,10 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /^GnuTLS<2>: Intel (AES|GCM) accelerator was detected/;
     next if /^Added \d{3} certificate authorities/;
     next if /^TLS: not preloading CRL for server/;
     next if /^GnuTLS<2>: Intel (AES|GCM) accelerator was detected/;
     next if /^Added \d{3} certificate authorities/;
     next if /^TLS: not preloading CRL for server/;

+    next if /^GnuTLS<3>: ASSERT: extensions.c\[_gnutls_get_extension/;
+    next if /^GnuTLS<3>: ASSERT: \.\.\/\.\.\/\.\.\/lib\/x509\//;
+    next if /^GnuTLS<2>: Initializing PKCS #11 modules/;
+

 
     # only kevent platforms (FreeBSD, OpenBSD) say this
     next if /^watch dir/;
 
     # only kevent platforms (FreeBSD, OpenBSD) say this
     next if /^watch dir/;


@@ -1117,28 +1136,28 @@ RESET_AFTER_EXTRA_LINE_READ:
     next if /^TLS: not preloading server certs$/;
 
     # drop lookups
     next if /^TLS: not preloading server certs$/;
 
     # drop lookups

-    next if /^Lookups \(built-in\):/;
-    next if /^Loading lookup modules from/;
-    next if /^Loaded \d+ lookup modules/;
-    next if /^Total \d+ lookups/;
+    next if /^$time_pid?(?: Lookups\ \(built-in\):
+                                       | Loading\ lookup\ modules\ from
+                                       | Loaded\ \d+\ lookup\ modules
+                                       | Total\ \d+\ lookups)/x;

 
     # drop compiler information
 
     # drop compiler information

-    next if /^Compiler:/;
+    next if /^$time_pid?Compiler:/;

 
     # and the ugly bit
     # different libraries will have different numbers (possibly 0) of follow-up
     # lines, indenting with more data
 
     # and the ugly bit
     # different libraries will have different numbers (possibly 0) of follow-up
     # lines, indenting with more data

-    if (/^Library version:/) {
+    if (/^$time_pid?Library version:/) {

       while (1) {
        $_ = <IN>;
       while (1) {
        $_ = <IN>;

-       next if /^\s/;
+       next if /^$time_pid?\s/;

        goto RESET_AFTER_EXTRA_LINE_READ;
       }
     }
 
     # drop other build-time controls emitted for debugging
        goto RESET_AFTER_EXTRA_LINE_READ;
       }
     }
 
     # drop other build-time controls emitted for debugging

-    next if /^WHITELIST_D_MACROS:/;
-    next if /^TRUSTED_CONFIG_LIST:/;
+    next if /^$time_pid?WHITELIST_D_MACROS:/;
+    next if /^$time_pid?TRUSTED_CONFIG_LIST:/;

 
     # As of Exim 4.74, we log when a setgid fails; because we invoke Exim
     # with -be, privileges will have been dropped, so this will always
 
     # As of Exim 4.74, we log when a setgid fails; because we invoke Exim
     # with -be, privileges will have been dropped, so this will always


@@ -1285,6 +1304,9 @@ RESET_AFTER_EXTRA_LINE_READ:
       $_ = $line . $_;
       }
 
       $_ = $line . $_;
       }
 

+    # Different builds will have different lookup types included
+    s/^\s*search_type \K\d+ \((\w+)\) quoting -1 \(none\)$/NN ($1) quoting -1 (none)/;
+

     # DISABLE_OCSP
     next if /in hosts_requ(est|ire)_ocsp\? (no|yes)/;
 
     # DISABLE_OCSP
     next if /in hosts_requ(est|ire)_ocsp\? (no|yes)/;
 


@@ -1405,8 +1427,13 @@ RESET_AFTER_EXTRA_LINE_READ:
     s/^errno = \d+$/errno = EEE/;
     s/^writing error \d+: /writing error EEE: /;
 
     s/^errno = \d+$/errno = EEE/;
     s/^writing error \d+: /writing error EEE: /;
 

-    # Some platforms have to flip to slow-mode taint-checking
-    next if /switching to slow-mode taint checking/;
+    # Time-only, in debug output
+    # we have to handle double lines from the DBOPEN, hence placed down here and /mg
+    s/^\d\d:\d\d:\d\d\s+/01:01:01 /mg;
+
+    # pid in debug lines
+    s/^(\d\d:\d\d:\d\d)(\s+\d+\s)/"$1 " . new_value($2, "%s", \$next_pid) . " "/mgxe;
+    s/(?<!post-)[Pp]rocess\K(\s\d+ )/new_value($1, "%s", \$next_pid) . " "/gxe;

 
     # When Exim is checking the size of directories for maildir, it uses
     # the check_dir_size() function to scan directories. Of course, the order
 
     # When Exim is checking the size of directories for maildir, it uses
     # the check_dir_size() function to scan directories. Of course, the order


@@ -1432,23 +1459,25 @@ RESET_AFTER_EXTRA_LINE_READ:
       # Skip some lines that Exim puts out at the start of debugging output
       # because they will be different in different binaries.
 
       # Skip some lines that Exim puts out at the start of debugging output
       # because they will be different in different binaries.
 

-      print MUNGED
-        unless (/^Berkeley DB: / ||
-                /^Probably (?:Berkeley DB|ndbm|GDBM)/ ||
-                /^Authenticators:/ ||
-                /^Lookups:/ ||
-                /^Support for:/ ||
-                /^Routers:/ ||
-                /^Transports:/ ||
-                /^Malware:/ ||
-                /^log selectors =/ ||
-                /^cwd=/ ||
-                /^Fixed never_users:/ ||
-               /^Configure owner:/ ||
-                /^Size of off_t:/
-                );
-
-
+      next if /^$time_pid?
+                 (?: Berkeley\ DB:\s
+                   | Probably\ (?:Berkeley\ DB|ndbm|GDBM)
+                   | Using\ tdb
+                   | Authenticators:
+                   | Lookups(?:\(built-in\))?:
+                   | Support\ for:
+                   | Routers:
+                   | Transports:
+                   | Malware:
+                   | log\ selectors\ =
+                   | cwd=
+                   | Fixed\ never_users
+                   | Configure\ owner
+                   | Size\ of\ off_t:
+                 )
+               /x;
+
+      print MUNGED;

       }
 
     next;
       }
 
     next;


@@ -1918,11 +1947,6 @@ $munges =
     { 'mainlog'   => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/',
       'rejectlog' => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/'},
 
     { 'mainlog'   => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/',
       'rejectlog' => 's/^(.* SMTP protocol synchronization error .* next input=.{8}).*$/$1<suppressed>/'},
 

-    'debuglog_stdout' =>
-    { 'stdout' => 's/^\d\d:\d\d:\d\d\s+\d+ //;
-                  s/Process \d+ is ready for new message/Process pppp is ready for new message/'
-    },
-

     'timeout_errno' =>         # actual errno differs Solaris vs. Linux
     { 'mainlog' => 's/((?:host|message) deferral .* errno) <\d+> /$1 <EEE> /' },
 
     'timeout_errno' =>         # actual errno differs Solaris vs. Linux
     { 'mainlog' => 's/((?:host|message) deferral .* errno) <\d+> /$1 <EEE> /' },
 


@@ -2023,7 +2047,7 @@ if (! $message_skip)
 
   foreach $mail (@mails)
     {
 
   foreach $mail (@mails)
     {

-    next if $mail eq "test-mail/oncelog";
+    next if $mail =~ /^test-mail\/oncelog(.(dir|pag|db))?$/;

 
     $saved_mail = substr($mail, 10);               # Remove "test-mail/"
     $saved_mail =~ s/^$parm_caller(\/|$)/CALLER/;  # Convert caller name
 
     $saved_mail = substr($mail, 10);               # Remove "test-mail/"
     $saved_mail =~ s/^$parm_caller(\/|$)/CALLER/;  # Convert caller name


@@ -2304,7 +2328,7 @@ if (/^dump\s+(\S+)/)
                sort { $a->[0] cmp $b->[0] }
                #map  { [ (split)[0] =~ s/\Q$parm_ipv4/ip4.ip4.ip4.ip4/gr, $_ ] }  # this is too modern for 5.10.1
                map  {
                sort { $a->[0] cmp $b->[0] }
                #map  { [ (split)[0] =~ s/\Q$parm_ipv4/ip4.ip4.ip4.ip4/gr, $_ ] }  # this is too modern for 5.10.1
                map  {

-                (my $k = (split)[0]) =~ s/\Q$parm_ipv4/ip4.ip4.ip4.ip4/g;
+                (my $k = (split)[0]) =~ s/\Q$parm_ipv4\E/ip4.ip4.ip4.ip4/g;

                 [ $k, $_ ]
                }
                do { local $/ = "\n  "; <$in> };
                 [ $k, $_ ]
                }
                do { local $/ = "\n  "; <$in> };


@@ -2325,6 +2349,16 @@ if (/^dump\s+(\S+)/)
                    return $aa cmp $bb;
                    } @temp;
       }
                    return $aa cmp $bb;
                    } @temp;
       }

+    elsif ($which eq "seen")
+      {
+      @temp = sort {
+                  (my $aa = $a) =~ s/^([\d.]+)/$1/;
+                  (my $bb = $b) =~ s/^([\d.]+)/$1/;
+                  $aa =~ s/\Q$parm_ipv4\E/ip4.ip4.ip4.ip4/;
+                  $bb =~ s/\Q$parm_ipv4\E/ip4.ip4.ip4.ip4/;
+                   return $aa cmp $bb;
+                   } @temp;
+      }

     print $out @temp;
     }
   close($in); # close it explicitly, otherwise $? does not get set
     print $out @temp;
     }
   close($in); # close it explicitly, otherwise $? does not get set


@@ -2391,6 +2425,17 @@ if (/^exigrep\s+(.*)/)
   }
 
 
   }
 
 

+# The "exiqgrep" command runs exiqgrep on the current spool
+
+if (/^exiqgrep(\s+.*)?/)
+  {
+  run_system("(./eximdir/exiqgrep -E ./eximdir/exim -C $parm_cwd/test-config" . ($1 || '') . ";" .
+    "echo exiqgrep exit code = \$?)" .
+    ">>test-stdout");
+  return 1;
+  }
+
+

 # The "eximstats" command runs eximstats on the current mainlog
 
 if (/^eximstats\s+(.*)/)
 # The "eximstats" command runs eximstats on the current mainlog
 
 if (/^eximstats\s+(.*)/)


@@ -3773,7 +3818,7 @@ if (defined $parm_lookups{dbm} && not cp("$parm_exim_dir/exim_dbmbuild", "eximdi
   $dbm_build_deleted = 1;
   }
 
   $dbm_build_deleted = 1;
   }
 

-foreach my $tool (qw(exim_dumpdb exim_lock exinext exigrep eximstats)) {
+foreach my $tool (qw(exim_dumpdb exim_lock exinext exigrep eximstats exiqgrep)) {

   cp("$parm_exim_dir/$tool" => "eximdir/$tool")
     or tests_exit(-1, "Failed to make a copy of $tool: $!");
 }
   cp("$parm_exim_dir/$tool" => "eximdir/$tool")
     or tests_exit(-1, "Failed to make a copy of $tool: $!");
 }


@@ -3781,7 +3826,7 @@ foreach my $tool (qw(exim_dumpdb exim_lock exinext exigrep eximstats)) {
 # Collect some version information
 print '-' x 78, "\n";
 print "Perl version for runtest: $]\n";
 # Collect some version information
 print '-' x 78, "\n";
 print "Perl version for runtest: $]\n";

-foreach (map { "./eximdir/$_" } qw(exigrep exinext eximstats)) {
+foreach (map { "./eximdir/$_" } qw(exigrep exinext eximstats exiqgrep)) {

   # fold (or unfold?) multiline output into a one-liner
   print join(', ', map { chomp; $_ } `$_ --version`), "\n";
 }
   # fold (or unfold?) multiline output into a one-liner
   print join(', ', map { chomp; $_ } `$_ --version`), "\n";
 }