13 files changed, 75 insertions, 38 deletions
diff --git a/tests/certs/generate b/tests/certs/generate
index de379a0..8e9c451 100755
--- a/tests/certs/generate
+++ b/tests/certs/generate
@@ -8,12 +8,20 @@ BASEDIR="$(dirname -- "$0")"
 OU="InterIMAP test suite"
 cd "$BASEDIR"
 
+OPENSSL_CONF="./openssl.cnf"
+export OPENSSL_CONF
+
 cadir="$(mktemp --tmpdir --directory)"
 trap 'rm -rf -- "$cadir"' EXIT INT TERM
+genpkey() {
+    local key="$1"
+    shift
+    openssl genpkey -out "$key" "$@" 2>&1
+}
 
 # generate CA (we intentionally throw away the private key and serial
 # file to avoid reuse)
-openssl genpkey -algorithm RSA -out "$cadir/ca.key"
+genpkey "$cadir/ca.key" -algorithm RSA
 openssl req -new -x509 -rand /dev/urandom -subj "/OU=$OU/CN=Fake Root CA" -key "$cadir/ca.key" -out ./ca.crt
 
 SERIAL=1
@@ -31,14 +39,14 @@ new() {
         printf "subjectAltName = %s\\n" "$3" >>"$cadir/new-ext.cnf"
     fi
     openssl x509 -req -in "$cadir/new.csr" -CA ./ca.crt -CAkey "$cadir/ca.key" \
-        -CAserial "$cadir/ca.srl" -CAcreateserial -extfile "$cadir/new-ext.cnf"
+        -CAserial "$cadir/ca.srl" -CAcreateserial -extfile "$cadir/new-ext.cnf" 2>&1
 }
 
-openssl genpkey -algorithm RSA -out ./dovecot.rsa.key
+genpkey ./dovecot.rsa.key -algorithm RSA
 new ./dovecot.rsa.key "localhost" "DNS:localhost,DNS:ip6-localhost,IP:127.0.0.1,IP:::1" >./dovecot.rsa.crt
 
-openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve -out ./dovecot.ecdsa.key
+genpkey ./dovecot.ecdsa.key -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -pkeyopt ec_param_enc:named_curve
 new ./dovecot.ecdsa.key "localhost" >./dovecot.ecdsa.crt
 
-openssl genpkey -algorithm RSA -out ./dovecot.rsa2.key
+genpkey ./dovecot.rsa2.key -algorithm RSA
 new ./dovecot.rsa2.key "imap.example.net" "DNS:imap.example.net,DNS:localhost" >./dovecot.rsa2.crt
diff --git a/tests/certs/openssl.cnf b/tests/certs/openssl.cnf
new file mode 100644
index 0000000..b1af7b8
--- /dev/null
+++ b/tests/certs/openssl.cnf
@@ -0,0 +1,4 @@
+[ req ]
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
diff --git a/tests/config/dovecot/ssl.conf b/tests/config/dovecot/ssl.conf
index 3fd99d5..1f3a698 100644
--- a/tests/config/dovecot/ssl.conf
+++ b/tests/config/dovecot/ssl.conf
@@ -2,4 +2,5 @@ ssl = required
 ssl_cert = <dovecot.rsa.crt
 ssl_key = <dovecot.rsa.key
 ssl_dh = <dhparams.pem
-ssl_min_protocol = TLSv1
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = DEFAULT@SECLEVEL=2
diff --git a/tests/db-exclusive-lock/t b/tests/db-exclusive-lock/t
index c2df4b5..837d21b 100644
--- a/tests/db-exclusive-lock/t
+++ b/tests/db-exclusive-lock/t
@@ -10,7 +10,7 @@ sleep .5
 # subsequent runs fail as we can't acquire the exclusive lock
 ! interimap || error
 
-grep -Fx "DBD::SQLite::db do failed: database is locked at ./interimap line 176." <"$STDERR" \
-    || error "Is \$DBH->do(\"PRAGMA locking_mode = EXCLUSIVE\"); at line 176?"
+grep -Ex "DBD::SQLite::db do failed: database is locked at (\S+/)?interimap line 181\." <"$STDERR" \
+    || error "Is \$DBH->do(\"PRAGMA locking_mode = EXCLUSIVE\"); at line 181?"
 
 # vim: set filetype=sh :
diff --git a/tests/db-no-create--watch/t b/tests/db-no-create--watch/t
index a8ea07e..37fc6cb 100644
--- a/tests/db-no-create--watch/t
+++ b/tests/db-no-create--watch/t
@@ -1,6 +1,6 @@
 ! interimap --watch=60 || error
 
-grep -Ex "DBI connect\(.*\) failed: unable to open database file at \./interimap line 172\." <"$STDERR" || error
+grep -Ex "DBI connect\(.*\) failed: unable to open database file at (\S+/)?interimap line 177\." <"$STDERR" || error
 test \! -e "$XDG_DATA_HOME/interimap/remote.db" || error
 
 # vim: set filetype=sh :
diff --git a/tests/list b/tests/interimap.list
index d1058ba..559daed 100644
--- a/tests/list
+++ b/tests/interimap.list
@@ -61,6 +61,3 @@ split-set   Split large sets to avoid extra-long command lines
     sync-live-crippled   local/remote simulation (crippled remote)
     sync-live-tls        local/remote simulation (TLS remote)
     sync-live-multi      local/remote1+remote2+remote3 simulation (3 local namespaces)
-
-. pullimap
-    ... pullimap
diff --git a/tests/pullimap.list b/tests/pullimap.list
new file mode 100644
index 0000000..f4304b9
--- /dev/null
+++ b/tests/pullimap.list
@@ -0,0 +1,2 @@
+. pullimap
+    ... pullimap
diff --git a/tests/pullimap/t b/tests/pullimap/t
index 0dfe634..58a19ca 100644
--- a/tests/pullimap/t
+++ b/tests/pullimap/t
@@ -6,6 +6,13 @@ step_start "\`pullimap --idle\` refuses to create the state file"
 ! pullimap --idle "remote" || error
 step_done
 
+step_start "\`pullimap\` creates statefile with mode 0600"
+pullimap "remote" || error
+if ! st="$(stat -c"%#a" -- "$XDG_DATA_HOME/pullimap/remote")" || [ "$st" != "0600" ]; then
+    error "$XDG_DATA_HOME/pullimap/remote has mode $st != 0600"
+fi
+step_done
+
 # compare mailboxes (can't compare the RFC 3501 TEXT as the LMTPd inconditionally
 # adds a Return-Path: header -- and also Delivered-To: and Received: to by default)
 list_mails_sha256() {
@@ -104,29 +111,31 @@ doveadm -u "remote" search mailbox "$MAILBOX" unseen >"$TMPDIR/unseen"
 step_done
 
 
-step_start "--idle (${TIMEOUT}s)"
+if [ $TIMEOUT -gt 0 ]; then
+    step_start "--idle (${TIMEOUT}s)"
 
-pullimap --idle "remote" & PID=$!
-trap "ptree_abort $PID" EXIT INT TERM
+    pullimap --idle "remote" & PID=$!
+    trap "ptree_abort $PID" EXIT INT TERM
 
-timer=$(( $(date +%s) + TIMEOUT ))
-while [ $(date +%s) -le $timer ]; do
-    n="$(shuf -n1 -i1-5)"
-    for (( i=0; i < n; i++)); do
-        sample_message | deliver -u "remote"  -- -m "$MAILBOX"
-    done
+    timer=$(( $(date +%s) + TIMEOUT ))
+    while [ $(date +%s) -le $timer ]; do
+        n="$(shuf -n1 -i1-5)"
+        for (( i=0; i < n; i++)); do
+            sample_message | deliver -u "remote"  -- -m "$MAILBOX"
+        done
 
-    s=$(shuf -n1 -i1-1500)
-    [ $s -ge 1000 ] && s="$(printf "1.%03d" $((s-1000)))" || s="$(printf "0.%03d" $s)"
-    sleep "$s"
-done
+        s=$(shuf -n1 -i1-1500)
+        [ $s -ge 1000 ] && s="$(printf "1.%03d" $((s-1000)))" || s="$(printf "0.%03d" $s)"
+        sleep "$s"
+    done
 
-sleep 5
-ptree_abort $PID
-trap - EXIT INT TERM
+    sleep 5
+    ptree_abort $PID
+    trap - EXIT INT TERM
 
-check
-step_done
+    check
+    step_done
+fi
 
 
 step_start "Purging"
diff --git a/tests/run b/tests/run
index 1eaad54..eed77df 100755
--- a/tests/run
+++ b/tests/run
@@ -38,6 +38,12 @@ fi
 # cleanup environment
 unset OPENSSL_CONF SSL_CERT_FILE SSL_CERT_DIR
 
+if [ -z "${INTERIMAP_PATH+x}" ]; then
+    INTERIMAP_PATH="./"
+elif [ -n "$INTERIMAP_PATH" ]; then
+    INTERIMAP_PATH="${INTERIMAP_PATH%/}/"
+fi
+
 ROOTDIR="$(mktemp --tmpdir="${TMPDIR:-/dev/shm}" --directory "$1.XXXXXXXXXX")"
 declare -a DOVECOT_SERVER=()
 trap cleanup EXIT INT TERM
@@ -206,26 +212,32 @@ prepare
 interimap() { _interimap_cmd "interimap" "$@"; }
 pullimap()  { _interimap_cmd "pullimap"  "$@"; }
 _interimap_cmd() {
-    declare -a ENVIRON=()
+    declare -a ENVIRON=() args=()
     local script="$1" rv=0
     shift
     environ_set "local"
     [ -z "${OPENSSL_CONF+x}" ]  || ENVIRON+=( OPENSSL_CONF="$OPENSSL_CONF" )
     [ -z "${SSL_CERT_FILE+x}" ] || ENVIRON+=( SSL_CERT_FILE="$SSL_CERT_FILE" )
     [ -z "${SSL_CERT_DIR+x}" ]  || ENVIRON+=( SSL_CERT_DIR="$SSL_CERT_DIR" )
-    env -i "${ENVIRON[@]}" perl -I./lib -T "./$script" "$@" 2>"$STDERR" || rv=$?
+    [ -z "${INTERIMAP_I:+x}" ] || args+=( perl -I"$INTERIMAP_I" -T )
+    args+=( "$INTERIMAP_PATH$script" "$@" )
+    #printf "I: Running \`%s\`\\n" "${args[*]}" >&3
+    env -i "${ENVIRON[@]}" "${args[@]}" 2>"$STDERR" || rv=$?
     cat <"$STDERR" >&2
     return $rv
 }
 interimap_init() {
     local u="${1-remote}"
-    local db="$XDG_DATA_HOME/interimap/$u.db"
+    local db="$XDG_DATA_HOME/interimap/$u.db" st
     local cfg="config${u#remote}"
 
     test \! -e "$db"          || error "Database already exists" 1
     interimap --config "$cfg" || error "Couldn't initialize interimap" 1
     test -f "$db"             || error "Database is still missing" 1
     grep -Fx "Creating new schema in database file $db" <"$STDERR" || error "DB wasn't created" 1
+    if ! st="$(stat -c"%#a" -- "$db")" || [ "$st" != "0600" ]; then
+        error "$db has mode $st != 0600" 1
+    fi
 }
 doveadm() {
     if [ $# -le 2 ] || [ "$1" != "-u" ]; then
@@ -449,7 +461,7 @@ passed() {
 # Run test in a sub-shell
 declare -a ENVIRON=()
 environ_set "local"
-export TMPDIR TESTDIR STDERR "${ENVIRON[@]}"
+export TMPDIR TESTDIR INTERIMAP_PATH INTERIMAP_I STDERR "${ENVIRON[@]}"
 export -f environ_set doveadm interimap interimap_init pullimap _interimap_cmd
 export -f sqlite3 sample_message deliver ptree_abort step_start step_done passed
 export -f check_mailbox_status check_mailbox_status_values check_mailbox_status2
diff --git a/tests/run-all b/tests/run-all
index d13f689..79e62d1 100755
--- a/tests/run-all
+++ b/tests/run-all
@@ -24,6 +24,7 @@ export PATH
 
 BASEDIR="$(dirname -- "$0")"
 RUN="$BASEDIR/run"
+list="$1"
 
 failed=0
 
@@ -54,7 +55,7 @@ while IFS="" read -r x; do
     fi
 
     INDENT="$indent" "$RUN" "$t" ${desc+"$desc"} || failed=$(( failed+1 ))
-done <"$BASEDIR/list"
+done <"$BASEDIR/$list"
 
 if [ $failed -eq 0 ]; then
     printf "All tests passed.\\n"
diff --git a/tests/tls-protocols/openssl.cnf b/tests/tls-protocols/openssl.cnf
index 980097d..3d9769d 100644
--- a/tests/tls-protocols/openssl.cnf
+++ b/tests/tls-protocols/openssl.cnf
@@ -11,4 +11,4 @@ system_default = system_default_sect
 
 [system_default_sect]
 MinProtocol = None
-CipherString = DEFAULT
+CipherString = DEFAULT@SECLEVEL=0
diff --git a/tests/tls-protocols/remote.conf b/tests/tls-protocols/remote.conf
index 6029749..96b3713 120000..100644
--- a/tests/tls-protocols/remote.conf
+++ b/tests/tls-protocols/remote.conf
@@ -1 +1,4 @@
-../tls/remote.conf
-\ No newline at end of file
+!include conf.d/imapd.conf
+!include conf.d/ssl.conf
+ssl_min_protocol = TLSv1
+ssl_cipher_list = DEFAULT@SECLEVEL=0
diff --git a/tests/tls-rsa+ecdsa/t b/tests/tls-rsa+ecdsa/t
index c9f5b96..fd2b1be 100644
--- a/tests/tls-rsa+ecdsa/t
+++ b/tests/tls-rsa+ecdsa/t
@@ -28,7 +28,7 @@ interimap_init
 check_mailbox_status "INBOX"
 
 interimap --debug || error
-# which peer certificate is used is up to libssl 
+# which peer certificate is used is up to libssl
 grep -Fx -e "remote: Peer certificate fingerprint: sha256\$$X509_SHA256" \
          -e "remote: Peer certificate fingerprint: sha256\$$X509_ALT_SHA256" \
          <"$STDERR" || error