test-server/attack.sh

   1 #!/bin/bash
   2 #
   3 # attack the test server and try to make it fall over
   4 #
   5 SERVER=127.0.0.1
   6 PORT=7681
   7 LOG=/tmp/lwslog
   8
   9 A=`which libwebsockets-test-server`
  10 INSTALLED=`dirname $A`
  11
  12 CPID=
  13 LEN=0
  14
  15 function check {
  16         kill -0 $CPID
  17         if [ $? -ne 0 ] ; then
  18                 echo "(killed it) *******"
  19                 exit 1
  20         fi
  21         dd if=$LOG bs=1 skip=$LEN 2>/dev/null
  22
  23         if [ "$1" = "default" ] ; then
  24                 diff /tmp/lwscap $INSTALLED/../share/libwebsockets-test-server/test.html > /dev/null
  25                 if [ $? -ne 0 ] ; then
  26                         echo "FAIL: got something other than test.html back"
  27                         exit 1
  28                 fi
  29         fi
  30         if [ "$1" = "defaultplusforbidden" ] ; then
  31         cat $INSTALLED/../share/libwebsockets-test-server/test.html > /tmp/plusforb
  32         echo -e -n "HTTP/1.1 403 Forbidden\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 38\x0d\x0a\x0d\x0a<html><body><h1>403</h1></body></html>" >> /tmp/plusforb
  33                 diff /tmp/lwscap /tmp/plusforb > /dev/null
  34                 if [ $? -ne 0 ] ; then
  35                         echo "FAIL: got something other than test.html + forbidden back"
  36                         exit 1
  37                 fi
  38         fi
  39
  40         if [ "$1" = "forbidden" ] ; then
  41                 if [ -z "`grep '<h1>403</h1>' /tmp/lwscap`" ] ; then
  42                         echo "FAIL: should have told forbidden (test server has no dirs)"
  43                         exit 1
  44                 fi
  45         fi
  46
  47         if [ "$1" = "rejected" ] ; then
  48                 if [ -z "`grep '<h1>406</h1>' /tmp/lwscap`" ] ; then
  49                         echo "FAIL: should have told forbidden (test server has no dirs)"
  50                         exit 1
  51                 fi
  52         fi
  53
  54
  55         if [ "$1" = "media" ] ; then
  56                 if [ -z "`grep '<h1>415</h1>' /tmp/lwscap`" ] ; then
  57                         echo "FAIL: should have told unknown media type"
  58                         exit 1
  59                 fi
  60         fi
  61
  62         if [ "$1" == "0" ] ; then
  63                 a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep "get\ \ =" | tr -s ' ' | cut -d' ' -f4-`"
  64                 if [ "$a" != "$2" ] ; then
  65                         echo "URL path '$a' not $2"
  66                         exit 1
  67                 fi
  68         fi
  69
  70         if [ "$1" == "1" ] ; then
  71                 a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep URI\ Arg\ 1\: | tr -s ' ' | cut -d' ' -f5-`"
  72                 if [ "$a" != "$2" ] ; then
  73                         echo "Arg 1 '$a' not $2"
  74                         exit 1
  75                 fi
  76         fi
  77
  78         if [ "$1" == "2" ] ; then
  79                 a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep URI\ Arg\ 2\: | tr -s ' ' | cut -d' ' -f5-`"
  80                 if [ "$a" != "$2" ] ; then
  81                         echo "Arg 2 '$a' not $2"
  82                         exit 1
  83                 fi
  84         fi
  85         if [ "$1" == "3" ] ; then
  86                 a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep URI\ Arg\ 3\: | tr -s ' ' | cut -d' ' -f5-`"
  87                 if [ "$a" != "$2" ] ; then
  88                         echo "Arg 3 '$a' not $2"
  89                         exit 1
  90                 fi
  91         fi
  92
  93         if [ -z "$1" ] ; then
  94                 LEN=`stat $LOG -c %s`
  95         fi
  96 }
  97
  98
  99 rm -rf $LOG
 100 killall libwebsockets-test-server 2>/dev/null
 101 libwebsockets-test-server -d15 2>> $LOG &
 102 CPID=$!
 103
 104 echo "Started server on PID $CPID"
 105
 106 while [ -z "`grep ort\ 7681 $LOG`" ] ; do
 107         sleep 0.5s
 108 done
 109 check
 110
 111 echo
 112 echo "---- /cgi-bin/settingsjs?UPDATE_SETTINGS=1&Root_Channels_1_Channel_name_http_post=%3F&Root_Channels_1_Channel_location_http_post=%3F"
 113 rm -f /tmp/lwscap
 114 echo -e "GET /cgi-bin/settingsjs?UPDATE_SETTINGS=1&Root_Channels_1_Channel_name_http_post=%3F&Root_Channels_1_Channel_location_http_post=%3F HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 115 check 1 "UPDATE_SETTINGS=1"
 116 check 2 "Root_Channels_1_Channel_name_http_post=?"
 117 check 3 "Root_Channels_1_Channel_location_http_post=?"
 118 check
 119
 120 echo
 121 echo "---- ? processing (/cgi-bin/settings.js?key1=value1)"
 122 rm -f /tmp/lwscap
 123 echo -e "GET /cgi-bin/settings.js?key1=value1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 124 check 1 "key1=value1"
 125 check
 126
 127 echo
 128 echo "---- ? processing (/t%3dest?key1%3d2=value1)"
 129 rm -f /tmp/lwscap
 130 echo -e "GET /t%3dest?key1%3d2=value1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 131 check 0 "/t=est"
 132 check 1 "key1_2=value1"
 133 check
 134
 135 echo
 136 echo "---- ? processing (%2f%2e%2e%2f%2e./test.html?arg=1)"
 137 rm -f /tmp/lwscap
 138 echo -e "GET %2f%2e%2e%2f%2e./test.html?arg=1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 139 check 1 "arg=1"
 140 check
 141
 142 echo
 143 echo "---- ? processing (%2f%2e%2e%2f%2e./test.html?arg=/../.)"
 144 rm -f /tmp/lwscap
 145 echo -e "GET %2f%2e%2e%2f%2e./test.html?arg=/../. HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 146 check 1 "arg=/../."
 147 check
 148
 149 echo
 150 echo "---- spam enough crap to not be GET"
 151 echo "not GET" | nc $SERVER $PORT
 152 check
 153
 154 echo
 155 echo "---- spam more than the name buffer of crap"
 156 dd if=/dev/urandom bs=1 count=80 2>/dev/null | nc -i1s $SERVER $PORT
 157 check
 158
 159 echo
 160 echo "---- spam 10MB of crap"
 161 dd if=/dev/urandom bs=1 count=655360 | nc -i1s $SERVER $PORT
 162 check
 163
 164 echo
 165 echo "---- malformed URI"
 166 echo "GET nonsense................................................................................................................" \
 167         | nc -i1s $SERVER $PORT
 168 check
 169
 170 echo
 171 echo "---- missing URI"
 172 echo -e "GET HTTP/1.1\x0d\x0a\x0d\x0a" | nc -i1s $SERVER $PORT >/tmp/lwscap
 173 check
 174
 175 echo
 176 echo "---- repeated method"
 177 echo -e "GET blah HTTP/1.1\x0d\x0aGET blah HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT >/tmp/lwscap
 178 check
 179
 180 echo
 181 echo "---- crazy header name part"
 182 echo -e "GET blah HTTP/1.1\x0d\x0a................................................................................................................" \
 183         "......................................................................................................................." \
 184         "......................................................................................................................." \
 185         "......................................................................................................................." \
 186         "......................................................................................................................." \
 187         "......................................................................................................................." \
 188         "......................................................................................................................." \
 189         "......................................................................................................................." \
 190         "......................................................................................................................." \
 191         "......................................................................................................................." \
 192         "......................................................................................................................." \
 193         "......................................................................................................................." \
 194         "......................................................................................................................." \
 195         "......................................................................................................................." \
 196         "......................................................................................................................." \
 197         "......................................................................................................................." \
 198         "......................................................................................................................." \
 199  | nc -i1s $SERVER $PORT
 200 check
 201
 202 echo
 203 echo "---- excessive uri content"
 204 echo -e "GET ................................................................................................................" \
 205         "......................................................................................................................." \
 206         "......................................................................................................................." \
 207         "......................................................................................................................." \
 208         "......................................................................................................................." \
 209         "......................................................................................................................." \
 210         "......................................................................................................................." \
 211         "......................................................................................................................." \
 212         "......................................................................................................................." \
 213         "......................................................................................................................." \
 214         "......................................................................................................................." \
 215         "......................................................................................................................." \
 216         "......................................................................................................................." \
 217         "......................................................................................................................." \
 218         "......................................................................................................................." \
 219         "......................................................................................................................." \
 220         "......................................................................................................................." \
 221  | nc -i1s $SERVER $PORT
 222 check
 223
 224 echo
 225 echo "---- good request but http payload coming too (test.html served then forbidden)"
 226 echo -e "GET /test.html HTTP/1.1\x0d\x0a\x0d\x0aILLEGAL-PAYLOAD........................................" \
 227         "......................................................................................................................." \
 228         "......................................................................................................................." \
 229         "......................................................................................................................." \
 230         "......................................................................................................................." \
 231         "......................................................................................................................." \
 232         "......................................................................................................................." \
 233         "......................................................................................................................." \
 234         "......................................................................................................................." \
 235         "......................................................................................................................." \
 236         "......................................................................................................................." \
 237         "......................................................................................................................." \
 238         "......................................................................................................................." \
 239         "......................................................................................................................." \
 240         "......................................................................................................................." \
 241         "......................................................................................................................." \
 242          | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 243 check defaultplusforbidden
 244 check
 245
 246 echo
 247 echo "---- nonexistent file"
 248 rm -f /tmp/lwscap
 249 echo -e "GET /nope HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 250 check media
 251 check
 252
 253 echo
 254 echo "---- relative uri path"
 255 rm -f /tmp/lwscap
 256 echo -e "GET nope HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 257 check forbidden
 258 check
 259
 260 echo
 261 echo "---- directory attack 1 (/../../../../etc/passwd should be /etc/passswd)"
 262 rm -f /tmp/lwscap
 263 echo -e "GET /../../../../etc/passwd HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 264 check rejected
 265 check
 266
 267 echo
 268 echo "---- directory attack 2 (/../ should be /)"
 269 rm -f /tmp/lwscap
 270 echo -e -n "GET /../ HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 271 check default
 272 check
 273
 274 echo
 275 echo "---- directory attack 3 (/./ should be /)"
 276 rm -f /tmp/lwscap
 277 echo -e -n "GET /./ HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 278 check default
 279 check
 280
 281 echo
 282 echo "---- directory attack 4 (/blah/.. should be /)"
 283 rm -f /tmp/lwscap
 284 echo -e -n "GET /blah/.. HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 285 check default
 286 check
 287
 288 echo
 289 echo "---- directory attack 5 (/blah/../ should be /)"
 290 rm -f /tmp/lwscap
 291 echo -e -n "GET /blah/../ HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 292 check default
 293 check
 294
 295 echo
 296 echo "---- directory attack 6 (/blah/../. should be /)"
 297 rm -f /tmp/lwscap
 298 echo -e -n "GET /blah/../. HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 299 check default
 300 check
 301
 302 echo
 303 echo "---- directory attack 7 (/%2e%2e%2f../../../etc/passwd should be /etc/passswd)"
 304 rm -f /tmp/lwscap
 305 echo -e -n "GET /%2e%2e%2f../../../etc/passwd HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 306 check rejected
 307 check
 308
 309 echo
 310 echo "---- directory attack 8 (%2f%2e%2e%2f%2e./.%2e/.%2e%2fetc/passwd should be /etc/passswd)"
 311 rm -f /tmp/lwscap
 312 echo -e -n "GET %2f%2e%2e%2f%2e./.%2e/.%2e%2fetc/passwd HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
 313 check rejected
 314 check
 315
 316 echo
 317 echo "---- http/1.1 pipelining"
 318 rm -f /tmp/lwscap
 319 wget -O/tmp/lwsdump http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html http://localhost:7681/test.html 2>&1 | grep "Downloaded: 8 files" > /tmp/lwscap
 320 good=`cat $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html $INSTALLED/../share/libwebsockets-test-server/test.html | md5sum | cut -d' ' -f1`
 321 if [ "$good" != "`md5sum /tmp/lwsdump | cut -d' ' -f 1`" ] ; then
 322         echo "FAIL: mismatched content good=$good received=`md5sum /tmp/lwsdump`"
 323         exit 1
 324 fi
 325
 326 echo
 327 echo "---- mass testing uri variations"
 328
 329 rm -f /tmp/results
 330
 331 for i in \
 332 /..../ \
 333 /.../. \
 334 /...// \
 335 /.../a \
 336 /.../w \
 337 /.../? \
 338 /.../% \
 339 /../.. \
 340 /.././ \
 341 /../.a \
 342 /../.w \
 343 /../.. \
 344 /../.% \
 345 /..//. \
 346 /../// \
 347 /..//a \
 348 /..//w \
 349 /..//? \
 350 /..//% \
 351 /../a. \
 352 /../a/ \
 353 /../aa \
 354 /../aw \
 355 /../a? \
 356 /../a% \
 357 /../w. \
 358 /../w/ \
 359 /../wa \
 360 /../ww \
 361 /../w? \
 362 /../w% \
 363 /../?. \
 364 /../?/ \
 365 /../?a \
 366 /../?w \
 367 /../?? \
 368 /../?% \
 369 /../%. \
 370 /../%/ \
 371 /../%a \
 372 /../%w \
 373 /../%? \
 374 /../%% \
 375 /./... \
 376 /./../ \
 377 /./..a \
 378 /./..w \
 379 /./..? \
 380 /./..% \
 381 /.//.. \
 382 /.a../ \
 383 /.a/.. \
 384 /.w../ \
 385 /.w/.. \
 386 /.?../ \
 387 /../.. \
 388 /.%../ \
 389 /.%/.. \
 390 //.... \
 391 //.../ \
 392 //...a \
 393 //...w \
 394 //...? \
 395 //...% \
 396 //../. \
 397 //..// \
 398 //../a \
 399 //../w \
 400 //../? \
 401 //../% \
 402 //..a. \
 403 //..a/ \
 404 //..aa \
 405 //..aw \
 406 //..a? \
 407 //..a% \
 408 //..w. \
 409 //..w/ \
 410 //..wa \
 411 //..ww \
 412 //..w? \
 413 //..w% \
 414 //..?. \
 415 //..?/ \
 416 //..?a \
 417 //..?w \
 418 //..?? \
 419 //..?% \
 420 //..%. \
 421 //..%/ \
 422 //..%a \
 423 //..%w \
 424 //..%? \
 425 //..%% \
 426 //./.. \
 427 ///... \
 428 ///../ \
 429 ///..a \
 430 ///..w \
 431 ///..? \
 432 ///..% \
 433 ////.. \
 434 //a../ \
 435 //a/.. \
 436 //w../ \
 437 //w/.. \
 438 //?../ \
 439 //?/.. \
 440 //%../ \
 441 //%/.. \
 442 /a.../ \
 443 /a../. \
 444 /a..// \
 445 /a../a \
 446 /a../w \
 447 /a../? \
 448 /a../% \
 449 /a./.. \
 450 /a/... \
 451 /a/../ \
 452 /a/..a \
 453 /a/..w \
 454 /a/..? \
 455 /a/..% \
 456 /a//.. \
 457 /aa../ \
 458 /aa/.. \
 459 /aw../ \
 460 /aw/.. \
 461 /a?../ \
 462 /a?/.. \
 463 /a%../ \
 464 /a%/.. \
 465 /w.../ \
 466 /w../. \
 467 /w..// \
 468 /w../a \
 469 /w../w \
 470 /w../? \
 471 /w../% \
 472 /w./.. \
 473 /w/... \
 474 /w/../ \
 475 /w/..a \
 476 /w/..w \
 477 /w/..? \
 478 /w/..% \
 479 /w//.. \
 480 /wa../ \
 481 /wa/.. \
 482 /ww../ \
 483 /ww/.. \
 484 /w?../ \
 485 /w?/.. \
 486 /w%../ \
 487 /w%/.. \
 488 /?.../ \
 489 /?../. \
 490 /?..// \
 491 /?../a \
 492 /?../w \
 493 /?../? \
 494 /?../% \
 495 /?./.. \
 496 /?/... \
 497 /?/../ \
 498 /?/..a \
 499 /?/..w \
 500 /?/..? \
 501 /?/..% \
 502 /?//.. \
 503 /?a../ \
 504 /?a/.. \
 505 /?w../ \
 506 /?w/.. \
 507 /??../ \
 508 /??/.. \
 509 /?%../ \
 510 /?%/.. \
 511 /%.../ \
 512 /%../. \
 513 /%..// \
 514 /%../a \
 515 /%../w \
 516 /%../? \
 517 /%../% \
 518 /%./.. \
 519 /%/... \
 520 /%/../ \
 521 /%/..a \
 522 /%/..w \
 523 /%/..? \
 524 /%/..% \
 525 /%//.. \
 526 /%a../ \
 527 /%a/.. \
 528 /%w../ \
 529 /%w/.. \
 530 /%?../ \
 531 /%?/.. \
 532 /%%../ \
 533 /%%/.. \
 534 /a/w/../a \
 535 /path/to/dir/../other/dir \
 536 ; do
 537
 538 R=`rm -f /tmp/lwscap ; echo -n -e "GET $i HTTP/1.0\r\n\r\n" | nc localhost 7681 2>/dev/null >/tmp/lwscap; head -n1 /tmp/lwscap| cut -d' ' -f2`
 539
 540 cat /tmp/lwscap | head -n1
 541 echo ==== $R
 542
 543
 544 if [ "$R" != "403" ]; then
 545         U=`cat $LOG | grep lws_http_serve | tail -n 1 | cut -d':' -f3 | cut -d' ' -f2`
 546         echo $U
 547         echo "- \"$i\" -> $R \"$U\"" >>/tmp/results
 548 else
 549         echo "- \"$i\" -> $R" >>/tmp/results
 550 fi
 551 done
 552
 553 cat <<EOF >/tmp/lwsresult1
 554 - "/..../" -> 406 "/..../"
 555 - "/.../." -> 406 "/.../"
 556 - "/...//" -> 406 "/.../"
 557 - "/.../a" -> 406 "/.../a"
 558 - "/.../w" -> 406 "/.../w"
 559 - "/.../?" -> 406 "/.../"
 560 - "/.../%" -> 403
 561 - "/../.." -> 200 "/"
 562 - "/.././" -> 200 "/"
 563 - "/../.a" -> 415 "/.a"
 564 - "/../.w" -> 415 "/.w"
 565 - "/../.." -> 200 "/"
 566 - "/../.%" -> 403
 567 - "/..//." -> 200 "/"
 568 - "/..///" -> 200 "/"
 569 - "/..//a" -> 415 "/a"
 570 - "/..//w" -> 415 "/w"
 571 - "/..//1" -> 415 "/1"
 572 - "/..//%" -> 403
 573 - "/../a." -> 415 "/a."
 574 - "/../a/" -> 406 "/a/"
 575 - "/../aa" -> 415 "/aa"
 576 - "/../aw" -> 415 "/aw"
 577 - "/../a?" -> 415 "/a"
 578 - "/../a%" -> 403
 579 - "/../w." -> 415 "/w."
 580 - "/../w/" -> 406 "/w/"
 581 - "/../wa" -> 415 "/wa"
 582 - "/../ww" -> 415 "/ww"
 583 - "/../w?" -> 415 "/w"
 584 - "/../w%" -> 403
 585 - "/../?." -> 200 "/"
 586 - "/../?/" -> 200 "/"
 587 - "/../?a" -> 200 "/"
 588 - "/../?w" -> 200 "/"
 589 - "/../??" -> 200 "/"
 590 - "/../?%" -> 403
 591 - "/../%." -> 403
 592 - "/../%/" -> 403
 593 - "/../%a" -> 403
 594 - "/../%w" -> 403
 595 - "/../%?" -> 403
 596 - "/../%%" -> 403
 597 - "/./..." -> 415 "/..."
 598 - "/./../" -> 200 "/"
 599 - "/./..a" -> 415 "/..a"
 600 - "/./..w" -> 415 "/..w"
 601 - "/./..?" -> 200 "/"
 602 - "/./..%" -> 403
 603 - "/.//.." -> 200 "/"
 604 - "/.a../" -> 406 "/.a../"
 605 - "/.a/.." -> 200 "/"
 606 - "/.w../" -> 406 "/.w../"
 607 - "/.w/.." -> 200 "/"
 608 - "/.?../" -> 415 "/."
 609 - "/../.." -> 200 "/"
 610 - "/.%../" -> 403
 611 - "/.%/.." -> 403
 612 - "//...." -> 415 "/...."
 613 - "//.../" -> 406 "/.../"
 614 - "//...a" -> 415 "/...a"
 615 - "//...w" -> 415 "/...w"
 616 - "//...?" -> 415 "/..."
 617 - "//...%" -> 403
 618 - "//../." -> 200 "/"
 619 - "//..//" -> 200 "/"
 620 - "//../a" -> 415 "/a"
 621 - "//../w" -> 415 "/w"
 622 - "//../1" -> 415 "/1"
 623 - "//../%" -> 403
 624 - "//..a." -> 415 "/..a."
 625 - "//..a/" -> 406 "/..a/"
 626 - "//..aa" -> 415 "/..aa"
 627 - "//..aw" -> 415 "/..aw"
 628 - "//..a?" -> 415 "/..a"
 629 - "//..a%" -> 403
 630 - "//..w." -> 415 "/..w."
 631 - "//..w/" -> 406 "/..w/"
 632 - "//..wa" -> 415 "/..wa"
 633 - "//..ww" -> 415 "/..ww"
 634 - "//..w?" -> 415 "/..w"
 635 - "//..w%" -> 403
 636 - "//..?." -> 200 "/"
 637 - "//..?/" -> 200 "/"
 638 - "//..?a" -> 415 "/a"
 639 - "//..?w" -> 415 "/w"
 640 - "//..??" -> 200 "/"
 641 - "//..?%" -> 403
 642 - "//..%." -> 403
 643 - "//..%/" -> 403
 644 - "//..%a" -> 403
 645 - "//..%w" -> 403
 646 - "//..%?" -> 403
 647 - "//..%%" -> 403
 648 - "//./.." -> 200 "/"
 649 - "///..." -> 415 "/..."
 650 - "///../" -> 200 "/"
 651 - "///..a" -> 415 "/..a"
 652 - "///..w" -> 415 "/..w"
 653 - "///..?" -> 200 "/"
 654 - "///..%" -> 403
 655 - "////.." -> 200 "/"
 656 - "//a../" -> 406 "/a../"
 657 - "//a/.." -> 200 "/"
 658 - "//w../" -> 406 "/w../"
 659 - "//w/.." -> 200 "/"
 660 - "//?../" -> 200 "/"
 661 - "//?/.." -> 200 "/"
 662 - "//%../" -> 403
 663 - "//%/.." -> 403
 664 - "/a.../" -> 406 "/a.../"
 665 - "/a../." -> 406 "/a../"
 666 - "/a..//" -> 406 "/a../"
 667 - "/a../a" -> 406 "/a../a"
 668 - "/a../w" -> 406 "/a../w"
 669 - "/a../?" -> 406 "/a../"
 670 - "/a../%" -> 403
 671 - "/a./.." -> 200 "/"
 672 - "/a/..." -> 406 "/a/..."
 673 - "/a/../" -> 200 "/"
 674 - "/a/..a" -> 406 "/a/..a"
 675 - "/a/..w" -> 406 "/a/..w"
 676 - "/a/..?" -> 200 "/"
 677 - "/a/..%" -> 403
 678 - "/a//.." -> 200 "/"
 679 - "/aa../" -> 406 "/aa../"
 680 - "/aa/.." -> 200 "/"
 681 - "/aw../" -> 406 "/aw../"
 682 - "/aw/.." -> 200 "/"
 683 - "/a?../" -> 415 "/a"
 684 - "/a?/.." -> 415 "/a"
 685 - "/a%../" -> 403
 686 - "/a%/.." -> 403
 687 - "/w.../" -> 406 "/w.../"
 688 - "/w../." -> 406 "/w../"
 689 - "/w..//" -> 406 "/w../"
 690 - "/w../a" -> 406 "/w../a"
 691 - "/w../w" -> 406 "/w../w"
 692 - "/w../?" -> 406 "/w../"
 693 - "/w../%" -> 403
 694 - "/w./.." -> 200 "/"
 695 - "/w/..." -> 406 "/w/..."
 696 - "/w/../" -> 200 "/"
 697 - "/w/..a" -> 406 "/w/..a"
 698 - "/w/..w" -> 406 "/w/..w"
 699 - "/w/..?" -> 200 "/"
 700 - "/w/..%" -> 403
 701 - "/w//.." -> 200 "/"
 702 - "/wa../" -> 406 "/wa../"
 703 - "/wa/.." -> 200 "/"
 704 - "/ww../" -> 406 "/ww../"
 705 - "/ww/.." -> 200 "/"
 706 - "/w?../" -> 415 "/w"
 707 - "/w?/.." -> 415 "/w"
 708 - "/w%../" -> 403
 709 - "/w%/.." -> 403
 710 - "/?.../" -> 200 "/"
 711 - "/?../." -> 200 "/"
 712 - "/?..//" -> 200 "/"
 713 - "/?../a" -> 200 "/"
 714 - "/?../w" -> 200 "/"
 715 - "/?../?" -> 200 "/"
 716 - "/?../%" -> 403
 717 - "/?./.." -> 200 "/"
 718 - "/?/..." -> 200 "/"
 719 - "/?/../" -> 200 "/"
 720 - "/?/..a" -> 200 "/"
 721 - "/?/..w" -> 200 "/"
 722 - "/?/..?" -> 200 "/"
 723 - "/?/..%" -> 403
 724 - "/?//.." -> 200 "/"
 725 - "/?a../" -> 200 "/"
 726 - "/?a/.." -> 200 "/"
 727 - "/?w../" -> 200 "/"
 728 - "/?w/.." -> 200 "/"
 729 - "/??../" -> 200 "/"
 730 - "/??/.." -> 200 "/"
 731 - "/?%../" -> 403
 732 - "/?%/.." -> 403
 733 - "/%.../" -> 403
 734 - "/%../." -> 403
 735 - "/%..//" -> 403
 736 - "/%../a" -> 403
 737 - "/%../w" -> 403
 738 - "/%../?" -> 403
 739 - "/%../%" -> 403
 740 - "/%./.." -> 403
 741 - "/%/..." -> 403
 742 - "/%/../" -> 403
 743 - "/%/..a" -> 403
 744 - "/%/..w" -> 403
 745 - "/%/..?" -> 403
 746 - "/%/..%" -> 403
 747 - "/%//.." -> 403
 748 - "/%a../" -> 403
 749 - "/%a/.." -> 403
 750 - "/%w../" -> 403
 751 - "/%w/.." -> 403
 752 - "/%?../" -> 403
 753 - "/%?/.." -> 403
 754 - "/%%../" -> 403
 755 - "/%%/.." -> 403
 756 - "/a/w/../a" -> 406 "/a/a"
 757 - "/path/to/dir/../other/dir" -> 406 "/path/to/other/dir"
 758 EOF
 759
 760 if [ "`md5sum /tmp/results | cut -d' ' -f 1`" != "`md5sum /tmp/lwsresult1 | cut -d' ' -f1`" ] ; then
 761         echo "Differences..."
 762         diff -urN /tmp/results /tmp/lwsresult1
 763         exit 1
 764 else
 765         echo "OK"
 766 fi
 767
 768
 769 echo
 770 echo "--- survived OK ---"
 771 kill -2 $CPID
 772
 773 exit 0
 774
 775