test-server/attack.sh

   1 #!/bin/bash
   2 #
   3 # attack the test server and try to make it fall over
   4 #
   5 SERVER=127.0.0.1
   6 PORT=7681
   7 LOG=/tmp/lwslog
   8
   9 A=`which libwebsockets-test-server`
  10 INSTALLED=`dirname $A`
  11
  12 CPID=
  13 LEN=0
  14
  15 function check {
  16         kill -0 $CPID
  17         if [ $? -ne 0 ] ; then
  18                 echo "(killed it) *******"
  19                 exit 1
  20         fi
  21         dd if=$LOG bs=1 skip=$LEN 2>/dev/null
  22
  23         if [ "$1" = "default" ] ; then
  24                 diff /tmp/lwscap $INSTALLED/../share/libwebsockets-test-server/test.html > /dev/null
  25                 if [ $? -ne 0 ] ; then
  26                         echo "FAIL: got something other than test.html back"
  27                         exit 1
  28                 fi
  29         fi
  30         if [ "$1" = "defaultplusforbidden" ] ; then
  31         cat $INSTALLED/../share/libwebsockets-test-server/test.html > /tmp/plusforb
  32         echo -e -n "HTTP/1.1 403 Forbidden\x0d\x0aserver: libwebsockets\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 38\x0d\x0a\x0d\x0a<html><body><h1>403</h1></body></html>" >> /tmp/plusforb
  33                 diff /tmp/lwscap /tmp/plusforb > /dev/null
  34                 if [ $? -ne 0 ] ; then
  35                         echo "FAIL: got something other than test.html back"
  36                         exit 1
  37                 fi
  38         fi
  39
  40         if [ "$1" = "forbidden" ] ; then
  41                 if [ -z "`grep '<h1>403</h1>' /tmp/lwscap`" ] ; then
  42                         echo "FAIL: should have told forbidden (test server has no dirs)"
  43                         exit 1
  44                 fi
  45         fi
  46
  47         if [ "$1" = "rejected" ] ; then
  48                 if [ -z "`grep '<h1>406</h1>' /tmp/lwscap`" ] ; then
  49                         echo "FAIL: should have told forbidden (test server has no dirs)"
  50                         exit 1
  51                 fi
  52         fi
  53
  54
  55         if [ "$1" = "media" ] ; then
  56                 if [ -z "`grep '<h1>415</h1>' /tmp/lwscap`" ] ; then
  57                         echo "FAIL: should have told unknown media type"
  58                         exit 1
  59                 fi
  60         fi
  61
  62         if [ "$1" == "0" ] ; then
  63                 a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep "get\ \ =" | tr -s ' ' | cut -d' ' -f4-`"
  64                 if [ "$a" != "$2" ] ; then
  65                         echo "URL path '$a' not $2"
  66                         exit 1
  67                 fi
  68         fi
  69
  70         if [ "$1" == "1" ] ; then
  71                 a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep URI\ Arg\ 1\: | tr -s ' ' | cut -d' ' -f5-`"
  72                 if [ "$a" != "$2" ] ; then
  73                         echo "Arg 1 '$a' not $2"
  74                         exit 1
  75                 fi
  76         fi
  77
  78         if [ "$1" == "2" ] ; then
  79                 a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep URI\ Arg\ 2\: | tr -s ' ' | cut -d' ' -f5-`"
  80                 if [ "$a" != "$2" ] ; then
  81                         echo "Arg 2 '$a' not $2"
  82                         exit 1
  83                 fi
  84         fi
  85         if [ "$1" == "3" ] ; then
  86                 a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep URI\ Arg\ 3\: | tr -s ' ' | cut -d' ' -f5-`"
  87                 if [ "$a" != "$2" ] ; then
  88                         echo "Arg 3 '$a' not $2"
  89                         exit 1
  90                 fi
  91         fi
  92
  93         if [ -z "$1" ] ; then
  94                 LEN=`stat $LOG -c %s`
  95         fi
  96 }
  97
  98
  99 rm -rf $LOG
 100 killall libwebsockets-test-server 2>/dev/null
 101 libwebsockets-test-server -d15 2>> $LOG &
 102 CPID=$!
 103
 104 while [ -z "`grep Listening $LOG`" ] ; do
 105         sleep 0.5s
 106 done
 107 check
 108
 109 echo
 110 echo "---- /cgi-bin/settingsjs?UPDATE_SETTINGS=1&Root_Channels_1_Channel_name_http_post=%3F&Root_Channels_1_Channel_location_http_post=%3F"
 111 rm -f /tmp/lwscap
 112 echo -e "GET /cgi-bin/settingsjs?UPDATE_SETTINGS=1&Root_Channels_1_Channel_name_http_post=%3F&Root_Channels_1_Channel_location_http_post=%3F HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 113 check 1 "UPDATE_SETTINGS=1"
 114 check 2 "Root_Channels_1_Channel_name_http_post=?"
 115 check 3 "Root_Channels_1_Channel_location_http_post=?"
 116 check
 117
 118 echo
 119 echo "---- ? processing (/cgi-bin/settings.js?key1=value1)"
 120 rm -f /tmp/lwscap
 121 echo -e "GET /cgi-bin/settings.js?key1=value1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 122 check 1 "key1=value1"
 123 check
 124
 125 echo
 126 echo "---- ? processing (/t%3dest?key1%3d2=value1)"
 127 rm -f /tmp/lwscap
 128 echo -e "GET /t%3dest?key1%3d2=value1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 129 check 0 "/t=est"
 130 check 1 "key1_2=value1"
 131 check
 132
 133 echo
 134 echo "---- ? processing (%2f%2e%2e%2f%2e./test.html?arg=1)"
 135 rm -f /tmp/lwscap
 136 echo -e "GET %2f%2e%2e%2f%2e./test.html?arg=1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 137 check 1 "arg=1"
 138 check
 139
 140 echo
 141 echo "---- ? processing (%2f%2e%2e%2f%2e./test.html?arg=/../.)"
 142 rm -f /tmp/lwscap
 143 echo -e "GET %2f%2e%2e%2f%2e./test.html?arg=/../. HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 144 check 1 "arg=/../."
 145 check
 146
 147 echo
 148 echo "---- spam enough crap to not be GET"
 149 echo "not GET" | nc $SERVER $PORT
 150 check
 151
 152 echo
 153 echo "---- spam more than the name buffer of crap"
 154 dd if=/dev/urandom bs=1 count=80 2>/dev/null | nc -i1s $SERVER $PORT
 155 check
 156
 157 echo
 158 echo "---- spam 10MB of crap"
 159 dd if=/dev/urandom bs=1 count=655360 | nc -i1s $SERVER $PORT
 160 check
 161
 162 echo
 163 echo "---- malformed URI"
 164 echo "GET nonsense................................................................................................................" \
 165         | nc -i1s $SERVER $PORT
 166 check
 167
 168 echo
 169 echo "---- missing URI"
 170 echo -e "GET HTTP/1.1\x0d\x0a\x0d\x0a" | nc -i1s $SERVER $PORT >/tmp/lwscap
 171 check
 172
 173 echo
 174 echo "---- repeated method"
 175 echo -e "GET blah HTTP/1.1\x0d\x0aGET blah HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT >/tmp/lwscap
 176 check
 177
 178 echo
 179 echo "---- crazy header name part"
 180 echo -e "GET blah HTTP/1.1\x0d\x0a................................................................................................................" \
 181         "......................................................................................................................." \
 182         "......................................................................................................................." \
 183         "......................................................................................................................." \
 184         "......................................................................................................................." \
 185         "......................................................................................................................." \
 186         "......................................................................................................................." \
 187         "......................................................................................................................." \
 188         "......................................................................................................................." \
 189         "......................................................................................................................." \
 190         "......................................................................................................................." \
 191         "......................................................................................................................." \
 192         "......................................................................................................................." \
 193         "......................................................................................................................." \
 194         "......................................................................................................................." \
 195         "......................................................................................................................." \
 196         "......................................................................................................................." \
 197  | nc -i1s $SERVER $PORT
 198 check
 199
 200 echo
 201 echo "---- excessive uri content"
 202 echo -e "GET ................................................................................................................" \
 203         "......................................................................................................................." \
 204         "......................................................................................................................." \
 205         "......................................................................................................................." \
 206         "......................................................................................................................." \
 207         "......................................................................................................................." \
 208         "......................................................................................................................." \
 209         "......................................................................................................................." \
 210         "......................................................................................................................." \
 211         "......................................................................................................................." \
 212         "......................................................................................................................." \
 213         "......................................................................................................................." \
 214         "......................................................................................................................." \
 215         "......................................................................................................................." \
 216         "......................................................................................................................." \
 217         "......................................................................................................................." \
 218         "......................................................................................................................." \
 219  | nc -i1s $SERVER $PORT
 220 check
 221
 222 echo
 223 echo "---- good request but http payload coming too (should be ignored and test.html served)"
 224 echo -e "GET /test.html HTTP/1.1\x0d\x0a\x0d\x0aILLEGAL-PAYLOAD........................................" \
 225         "......................................................................................................................." \
 226         "......................................................................................................................." \
 227         "......................................................................................................................." \
 228         "......................................................................................................................." \
 229         "......................................................................................................................." \
 230         "......................................................................................................................." \
 231         "......................................................................................................................." \
 232         "......................................................................................................................." \
 233         "......................................................................................................................." \
 234         "......................................................................................................................." \
 235         "......................................................................................................................." \
 236         "......................................................................................................................." \
 237         "......................................................................................................................." \
 238         "......................................................................................................................." \
 239         "......................................................................................................................." \
 240          | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 241 check defaultplusforbidden
 242 check
 243
 244 echo
 245 echo "---- nonexistent file"
 246 rm -f /tmp/lwscap
 247 echo -e "GET /nope HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 248 check media
 249 check
 250
 251 echo
 252 echo "---- relative uri path"
 253 rm -f /tmp/lwscap
 254 echo -e "GET nope HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 255 check forbidden
 256 check
 257
 258 echo
 259 echo "---- directory attack 1 (/../../../../etc/passwd should be /etc/passswd)"
 260 rm -f /tmp/lwscap
 261 echo -e "GET /../../../../etc/passwd HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 262 check rejected
 263 check
 264
 265 echo
 266 echo "---- directory attack 2 (/../ should be /)"
 267 rm -f /tmp/lwscap
 268 echo -e -n "GET /../ HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 269 check default
 270 check
 271
 272 echo
 273 echo "---- directory attack 3 (/./ should be /)"
 274 rm -f /tmp/lwscap
 275 echo -e -n "GET /./ HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 276 check default
 277 check
 278
 279 echo
 280 echo "---- directory attack 4 (/blah/.. should be /)"
 281 rm -f /tmp/lwscap
 282 echo -e -n "GET /blah/.. HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 283 check default
 284 check
 285
 286 echo
 287 echo "---- directory attack 5 (/blah/../ should be /)"
 288 rm -f /tmp/lwscap
 289 echo -e -n "GET /blah/../ HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 290 check default
 291 check
 292
 293 echo
 294 echo "---- directory attack 6 (/blah/../. should be /)"
 295 rm -f /tmp/lwscap
 296 echo -e -n "GET /blah/../. HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 297 check default
 298 check
 299
 300 echo
 301 echo "---- directory attack 7 (/%2e%2e%2f../../../etc/passwd should be /etc/passswd)"
 302 rm -f /tmp/lwscap
 303 echo -e -n "GET /%2e%2e%2f../../../etc/passwd HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 304 check rejected
 305 check
 306
 307 echo
 308 echo "---- directory attack 8 (%2f%2e%2e%2f%2e./.%2e/.%2e%2fetc/passwd should be /etc/passswd)"
 309 rm -f /tmp/lwscap
 310 echo -e -n "GET %2f%2e%2e%2f%2e./.%2e/.%2e%2fetc/passwd HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 311 check rejected
 312 check
 313
 314 echo
 315 echo "---- http/1.1 pipelining"
 316 rm -f /tmp/lwscap
 317 wget -O/tmp/lwsdump http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html 2>&1 | grep "Downloaded: 8 files" > /tmp/lwscap
 318 good=`cat $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html | md5sum | cut -d' ' -f1`
 319 if [ "$good" != "`md5sum /tmp/lwsdump | cut -d' ' -f 1`" ] ; then
 320         echo "FAIL: mismatched content good=$good received=`md5sum /tmp/lwsdump`"
 321         exit 1
 322 fi
 323
 324 echo
 325 echo "---- mass testing uri variations"
 326
 327 rm -f /tmp/results
 328
 329 for i in \
 330 /..../ \
 331 /.../. \
 332 /...// \
 333 /.../a \
 334 /.../w \
 335 /.../? \
 336 /.../% \
 337 /../.. \
 338 /.././ \
 339 /../.a \
 340 /../.w \
 341 /../.. \
 342 /../.% \
 343 /..//. \
 344 /../// \
 345 /..//a \
 346 /..//w \
 347 /..//? \
 348 /..//% \
 349 /../a. \
 350 /../a/ \
 351 /../aa \
 352 /../aw \
 353 /../a? \
 354 /../a% \
 355 /../w. \
 356 /../w/ \
 357 /../wa \
 358 /../ww \
 359 /../w? \
 360 /../w% \
 361 /../?. \
 362 /../?/ \
 363 /../?a \
 364 /../?w \
 365 /../?? \
 366 /../?% \
 367 /../%. \
 368 /../%/ \
 369 /../%a \
 370 /../%w \
 371 /../%? \
 372 /../%% \
 373 /./... \
 374 /./../ \
 375 /./..a \
 376 /./..w \
 377 /./..? \
 378 /./..% \
 379 /.//.. \
 380 /.a../ \
 381 /.a/.. \
 382 /.w../ \
 383 /.w/.. \
 384 /.?../ \
 385 /../.. \
 386 /.%../ \
 387 /.%/.. \
 388 //.... \
 389 //.../ \
 390 //...a \
 391 //...w \
 392 //...? \
 393 //...% \
 394 //../. \
 395 //..// \
 396 //../a \
 397 //../w \
 398 //../? \
 399 //../% \
 400 //..a. \
 401 //..a/ \
 402 //..aa \
 403 //..aw \
 404 //..a? \
 405 //..a% \
 406 //..w. \
 407 //..w/ \
 408 //..wa \
 409 //..ww \
 410 //..w? \
 411 //..w% \
 412 //..?. \
 413 //..?/ \
 414 //..?a \
 415 //..?w \
 416 //..?? \
 417 //..?% \
 418 //..%. \
 419 //..%/ \
 420 //..%a \
 421 //..%w \
 422 //..%? \
 423 //..%% \
 424 //./.. \
 425 ///... \
 426 ///../ \
 427 ///..a \
 428 ///..w \
 429 ///..? \
 430 ///..% \
 431 ////.. \
 432 //a../ \
 433 //a/.. \
 434 //w../ \
 435 //w/.. \
 436 //?../ \
 437 //?/.. \
 438 //%../ \
 439 //%/.. \
 440 /a.../ \
 441 /a../. \
 442 /a..// \
 443 /a../a \
 444 /a../w \
 445 /a../? \
 446 /a../% \
 447 /a./.. \
 448 /a/... \
 449 /a/../ \
 450 /a/..a \
 451 /a/..w \
 452 /a/..? \
 453 /a/..% \
 454 /a//.. \
 455 /aa../ \
 456 /aa/.. \
 457 /aw../ \
 458 /aw/.. \
 459 /a?../ \
 460 /a?/.. \
 461 /a%../ \
 462 /a%/.. \
 463 /w.../ \
 464 /w../. \
 465 /w..// \
 466 /w../a \
 467 /w../w \
 468 /w../? \
 469 /w../% \
 470 /w./.. \
 471 /w/... \
 472 /w/../ \
 473 /w/..a \
 474 /w/..w \
 475 /w/..? \
 476 /w/..% \
 477 /w//.. \
 478 /wa../ \
 479 /wa/.. \
 480 /ww../ \
 481 /ww/.. \
 482 /w?../ \
 483 /w?/.. \
 484 /w%../ \
 485 /w%/.. \
 486 /?.../ \
 487 /?../. \
 488 /?..// \
 489 /?../a \
 490 /?../w \
 491 /?../? \
 492 /?../% \
 493 /?./.. \
 494 /?/... \
 495 /?/../ \
 496 /?/..a \
 497 /?/..w \
 498 /?/..? \
 499 /?/..% \
 500 /?//.. \
 501 /?a../ \
 502 /?a/.. \
 503 /?w../ \
 504 /?w/.. \
 505 /??../ \
 506 /??/.. \
 507 /?%../ \
 508 /?%/.. \
 509 /%.../ \
 510 /%../. \
 511 /%..// \
 512 /%../a \
 513 /%../w \
 514 /%../? \
 515 /%../% \
 516 /%./.. \
 517 /%/... \
 518 /%/../ \
 519 /%/..a \
 520 /%/..w \
 521 /%/..? \
 522 /%/..% \
 523 /%//.. \
 524 /%a../ \
 525 /%a/.. \
 526 /%w../ \
 527 /%w/.. \
 528 /%?../ \
 529 /%?/.. \
 530 /%%../ \
 531 /%%/.. \
 532 /a/w/../a \
 533 /path/to/dir/../other/dir \
 534 ; do
 535
 536 R=`rm -f /tmp/lwscap ; echo -n -e "GET $i HTTP/1.0\r\n\r\n" | nc localhost 7681 2>/dev/null >/tmp/lwscap; head -n1 /tmp/lwscap| cut -d' ' -f2`
 537
 538 cat /tmp/lwscap | head -n1
 539 echo ==== $R
 540
 541
 542 if [ "$R" != "403" ]; then
 543         U=`cat $LOG | grep lws_http_serve | tail -n 1 | cut -d':' -f3 | cut -d' ' -f2`
 544         echo $U
 545         echo "- \"$i\" -> $R \"$U\"" >>/tmp/results
 546 else
 547         echo "- \"$i\" -> $R" >>/tmp/results
 548 fi
 549 done
 550
 551 cat <<EOF >/tmp/lwsresult1
 552 - "/..../" -> 406 "/..../"
 553 - "/.../." -> 406 "/.../"
 554 - "/...//" -> 406 "/.../"
 555 - "/.../a" -> 406 "/.../a"
 556 - "/.../w" -> 406 "/.../w"
 557 - "/.../?" -> 406 "/.../"
 558 - "/.../%" -> 403
 559 - "/../.." -> 200 "/"
 560 - "/.././" -> 200 "/"
 561 - "/../.a" -> 415 "/.a"
 562 - "/../.w" -> 415 "/.w"
 563 - "/../.." -> 200 "/"
 564 - "/../.%" -> 403
 565 - "/..//." -> 200 "/"
 566 - "/..///" -> 200 "/"
 567 - "/..//a" -> 415 "/a"
 568 - "/..//w" -> 415 "/w"
 569 - "/..//1" -> 415 "/1"
 570 - "/..//%" -> 403
 571 - "/../a." -> 415 "/a."
 572 - "/../a/" -> 406 "/a/"
 573 - "/../aa" -> 415 "/aa"
 574 - "/../aw" -> 415 "/aw"
 575 - "/../a?" -> 415 "/a"
 576 - "/../a%" -> 403
 577 - "/../w." -> 415 "/w."
 578 - "/../w/" -> 406 "/w/"
 579 - "/../wa" -> 415 "/wa"
 580 - "/../ww" -> 415 "/ww"
 581 - "/../w?" -> 415 "/w"
 582 - "/../w%" -> 403
 583 - "/../?." -> 200 "/"
 584 - "/../?/" -> 200 "/"
 585 - "/../?a" -> 200 "/"
 586 - "/../?w" -> 200 "/"
 587 - "/../??" -> 200 "/"
 588 - "/../?%" -> 403
 589 - "/../%." -> 403
 590 - "/../%/" -> 403
 591 - "/../%a" -> 403
 592 - "/../%w" -> 403
 593 - "/../%?" -> 403
 594 - "/../%%" -> 403
 595 - "/./..." -> 415 "/..."
 596 - "/./../" -> 200 "/"
 597 - "/./..a" -> 415 "/..a"
 598 - "/./..w" -> 415 "/..w"
 599 - "/./..?" -> 200 "/"
 600 - "/./..%" -> 403
 601 - "/.//.." -> 200 "/"
 602 - "/.a../" -> 406 "/.a../"
 603 - "/.a/.." -> 200 "/"
 604 - "/.w../" -> 406 "/.w../"
 605 - "/.w/.." -> 200 "/"
 606 - "/.?../" -> 415 "/."
 607 - "/../.." -> 200 "/"
 608 - "/.%../" -> 403
 609 - "/.%/.." -> 403
 610 - "//...." -> 415 "/...."
 611 - "//.../" -> 406 "/.../"
 612 - "//...a" -> 415 "/...a"
 613 - "//...w" -> 415 "/...w"
 614 - "//...?" -> 415 "/..."
 615 - "//...%" -> 403
 616 - "//../." -> 200 "/"
 617 - "//..//" -> 200 "/"
 618 - "//../a" -> 415 "/a"
 619 - "//../w" -> 415 "/w"
 620 - "//../1" -> 415 "/1"
 621 - "//../%" -> 403
 622 - "//..a." -> 415 "/..a."
 623 - "//..a/" -> 406 "/..a/"
 624 - "//..aa" -> 415 "/..aa"
 625 - "//..aw" -> 415 "/..aw"
 626 - "//..a?" -> 415 "/..a"
 627 - "//..a%" -> 403
 628 - "//..w." -> 415 "/..w."
 629 - "//..w/" -> 406 "/..w/"
 630 - "//..wa" -> 415 "/..wa"
 631 - "//..ww" -> 415 "/..ww"
 632 - "//..w?" -> 415 "/..w"
 633 - "//..w%" -> 403
 634 - "//..?." -> 200 "/"
 635 - "//..?/" -> 200 "/"
 636 - "//..?a" -> 415 "/a"
 637 - "//..?w" -> 415 "/w"
 638 - "//..??" -> 200 "/"
 639 - "//..?%" -> 403
 640 - "//..%." -> 403
 641 - "//..%/" -> 403
 642 - "//..%a" -> 403
 643 - "//..%w" -> 403
 644 - "//..%?" -> 403
 645 - "//..%%" -> 403
 646 - "//./.." -> 200 "/"
 647 - "///..." -> 415 "/..."
 648 - "///../" -> 200 "/"
 649 - "///..a" -> 415 "/..a"
 650 - "///..w" -> 415 "/..w"
 651 - "///..?" -> 200 "/"
 652 - "///..%" -> 403
 653 - "////.." -> 200 "/"
 654 - "//a../" -> 406 "/a../"
 655 - "//a/.." -> 200 "/"
 656 - "//w../" -> 406 "/w../"
 657 - "//w/.." -> 200 "/"
 658 - "//?../" -> 200 "/"
 659 - "//?/.." -> 200 "/"
 660 - "//%../" -> 403
 661 - "//%/.." -> 403
 662 - "/a.../" -> 406 "/a.../"
 663 - "/a../." -> 406 "/a../"
 664 - "/a..//" -> 406 "/a../"
 665 - "/a../a" -> 406 "/a../a"
 666 - "/a../w" -> 406 "/a../w"
 667 - "/a../?" -> 406 "/a../"
 668 - "/a../%" -> 403
 669 - "/a./.." -> 200 "/"
 670 - "/a/..." -> 406 "/a/..."
 671 - "/a/../" -> 200 "/"
 672 - "/a/..a" -> 406 "/a/..a"
 673 - "/a/..w" -> 406 "/a/..w"
 674 - "/a/..?" -> 200 "/"
 675 - "/a/..%" -> 403
 676 - "/a//.." -> 200 "/"
 677 - "/aa../" -> 406 "/aa../"
 678 - "/aa/.." -> 200 "/"
 679 - "/aw../" -> 406 "/aw../"
 680 - "/aw/.." -> 200 "/"
 681 - "/a?../" -> 415 "/a"
 682 - "/a?/.." -> 415 "/a"
 683 - "/a%../" -> 403
 684 - "/a%/.." -> 403
 685 - "/w.../" -> 406 "/w.../"
 686 - "/w../." -> 406 "/w../"
 687 - "/w..//" -> 406 "/w../"
 688 - "/w../a" -> 406 "/w../a"
 689 - "/w../w" -> 406 "/w../w"
 690 - "/w../?" -> 406 "/w../"
 691 - "/w../%" -> 403
 692 - "/w./.." -> 200 "/"
 693 - "/w/..." -> 406 "/w/..."
 694 - "/w/../" -> 200 "/"
 695 - "/w/..a" -> 406 "/w/..a"
 696 - "/w/..w" -> 406 "/w/..w"
 697 - "/w/..?" -> 200 "/"
 698 - "/w/..%" -> 403
 699 - "/w//.." -> 200 "/"
 700 - "/wa../" -> 406 "/wa../"
 701 - "/wa/.." -> 200 "/"
 702 - "/ww../" -> 406 "/ww../"
 703 - "/ww/.." -> 200 "/"
 704 - "/w?../" -> 415 "/w"
 705 - "/w?/.." -> 415 "/w"
 706 - "/w%../" -> 403
 707 - "/w%/.." -> 403
 708 - "/?.../" -> 200 "/"
 709 - "/?../." -> 200 "/"
 710 - "/?..//" -> 200 "/"
 711 - "/?../a" -> 200 "/"
 712 - "/?../w" -> 200 "/"
 713 - "/?../?" -> 200 "/"
 714 - "/?../%" -> 403
 715 - "/?./.." -> 200 "/"
 716 - "/?/..." -> 200 "/"
 717 - "/?/../" -> 200 "/"
 718 - "/?/..a" -> 200 "/"
 719 - "/?/..w" -> 200 "/"
 720 - "/?/..?" -> 200 "/"
 721 - "/?/..%" -> 403
 722 - "/?//.." -> 200 "/"
 723 - "/?a../" -> 200 "/"
 724 - "/?a/.." -> 200 "/"
 725 - "/?w../" -> 200 "/"
 726 - "/?w/.." -> 200 "/"
 727 - "/??../" -> 200 "/"
 728 - "/??/.." -> 200 "/"
 729 - "/?%../" -> 403
 730 - "/?%/.." -> 403
 731 - "/%.../" -> 403
 732 - "/%../." -> 403
 733 - "/%..//" -> 403
 734 - "/%../a" -> 403
 735 - "/%../w" -> 403
 736 - "/%../?" -> 403
 737 - "/%../%" -> 403
 738 - "/%./.." -> 403
 739 - "/%/..." -> 403
 740 - "/%/../" -> 403
 741 - "/%/..a" -> 403
 742 - "/%/..w" -> 403
 743 - "/%/..?" -> 403
 744 - "/%/..%" -> 403
 745 - "/%//.." -> 403
 746 - "/%a../" -> 403
 747 - "/%a/.." -> 403
 748 - "/%w../" -> 403
 749 - "/%w/.." -> 403
 750 - "/%?../" -> 403
 751 - "/%?/.." -> 403
 752 - "/%%../" -> 403
 753 - "/%%/.." -> 403
 754 - "/a/w/../a" -> 406 "/a/a"
 755 - "/path/to/dir/../other/dir" -> 406 "/path/to/other/dir"
 756 EOF
 757
 758 if [ "`md5sum /tmp/results | cut -d' ' -f 1`" != "`md5sum /tmp/lwsresult1 | cut -d' ' -f1`" ] ; then
 759         echo "Differences..."
 760         diff -urN /tmp/results /tmp/lwsresult1
 761         exit 1
 762 else
 763         echo "OK"
 764 fi
 765
 766
 767 echo
 768 echo "--- survived OK ---"
 769 kill -2 $CPID
 770
 771 exit 0
 772
 773