1#!/usr/bin/env perl 2# This script is used to test Civetweb web server 3 4use IO::Socket; 5use File::Path; 6use Cwd; 7use strict; 8use warnings; 9#use diagnostics; 10 11sub on_windows { $^O =~ /win32/i; } 12 13my $port = 23456; 14my $pid = undef; 15my $num_requests; 16my $dir_separator = on_windows() ? '\\' : '/'; 17my $copy_cmd = on_windows() ? 'copy' : 'cp'; 18my $test_dir_uri = "test_dir"; 19my $root = 'test'; 20my $test_dir = $root . $dir_separator. $test_dir_uri; 21my $config = 'civetweb.conf'; 22my $exe_ext = on_windows() ? '.exe' : ''; 23my $civetweb_exe = '.' . $dir_separator . 'civetweb' . $exe_ext; 24my $embed_exe = '.' . $dir_separator . 'embed' . $exe_ext; 25my $unit_test_exe = '.' . $dir_separator . 'unit_test' . $exe_ext; 26my $exit_code = 0; 27 28my @files_to_delete = ('debug.log', 'access.log', $config, "$root/a/put.txt", 29 "$root/a+.txt", "$root/.htpasswd", "$root/binary_file", "$root/a", 30 "$root/myperl", $embed_exe, $unit_test_exe); 31 32END { 33 unlink @files_to_delete; 34 kill_spawned_child(); 35 File::Path::rmtree($test_dir); 36 exit $exit_code; 37} 38 39sub fail { 40 print "FAILED: @_\n"; 41 $exit_code = 1; 42 exit 1; 43} 44 45sub get_num_of_log_entries { 46 open FD, "access.log" or return 0; 47 my @lines = (<FD>); 48 close FD; 49 return scalar @lines; 50} 51 52# Send the request to the 127.0.0.1:$port and return the reply 53sub req { 54 my ($request, $inc, $timeout) = @_; 55 my $sock = IO::Socket::INET->new(Proto => 6, 56 PeerAddr => '127.0.0.1', PeerPort => $port); 57 fail("Cannot connect to http://127.0.0.1:$port : $!") unless $sock; 58 $sock->autoflush(1); 59 foreach my $byte (split //, $request) { 60 last unless print $sock $byte; 61 select undef, undef, undef, .001 if length($request) < 256; 62 } 63 my ($out, $buf) = ('', ''); 64 eval { 65 alarm $timeout if $timeout; 66 $out .= $buf while (sysread($sock, $buf, 1024) > 0); 67 alarm 0 if $timeout; 68 }; 69 close $sock; 70 71 $num_requests += defined($inc) ? $inc : 1; 72 my $num_logs = get_num_of_log_entries(); 73 74 unless ($num_requests == $num_logs) { 75 fail("Request has not been logged: [$request], output: [$out]"); 76 } 77 78 return $out; 79} 80 81# Send the request. Compare with the expected reply. Fail if no match 82sub o { 83 my ($request, $expected_reply, $message, $num_logs) = @_; 84 print "==> $message ... "; 85 my $reply = req($request, $num_logs); 86 if ($reply =~ /$expected_reply/s) { 87 print "OK\n"; 88 } else { 89#fail("Requested: [$request]\nExpected: [$expected_reply], got: [$reply]"); 90 fail("Expected: [$expected_reply], got: [$reply]"); 91 } 92} 93 94# Spawn a server listening on specified port 95sub spawn { 96 my ($cmdline) = @_; 97 print 'Executing: ', @_, "\n"; 98 if (on_windows()) { 99 my @args = split /\s+/, $cmdline; 100 my $executable = $args[0]; 101 Win32::Spawn($executable, $cmdline, $pid); 102 die "Cannot spawn @_: $!" unless $pid; 103 } else { 104 unless ($pid = fork()) { 105 exec $cmdline; 106 die "cannot exec [$cmdline]: $!\n"; 107 } 108 } 109 sleep 1; 110} 111 112sub write_file { 113 open FD, ">$_[0]" or fail "Cannot open $_[0]: $!"; 114 binmode FD; 115 print FD $_[1]; 116 close FD; 117} 118 119sub read_file { 120 open FD, $_[0] or fail "Cannot open $_[0]: $!"; 121 my @lines = <FD>; 122 close FD; 123 return join '', @lines; 124} 125 126sub kill_spawned_child { 127 if (defined($pid)) { 128 kill(9, $pid); 129 waitpid($pid, 0); 130 } 131} 132 133####################################################### ENTRY POINT 134 135unlink @files_to_delete; 136$SIG{PIPE} = 'IGNORE'; 137$SIG{ALRM} = sub { die "timeout\n" }; 138#local $| =1; 139 140# Make sure we export only symbols that start with "mg_", and keep local 141# symbols static. 142if ($^O =~ /darwin|bsd|linux/) { 143 my $out = `(cc -c src/civetweb.c && nm src/civetweb.o) | grep ' T '`; 144 foreach (split /\n/, $out) { 145 /T\s+_?mg_.+/ or fail("Exported symbol $_") 146 } 147} 148 149if (scalar(@ARGV) > 0 and $ARGV[0] eq 'unit') { 150 do_unit_test(); 151 exit 0; 152} 153 154# Make sure we load config file if no options are given. 155# Command line options override config files settings 156write_file($config, "access_log_file access.log\n" . 157 "listening_ports 127.0.0.1:12345\n"); 158spawn("$civetweb_exe -listening_ports 127.0.0.1:$port"); 159o("GET /test/hello.txt HTTP/1.0\n\n", 'HTTP/1.1 200 OK', 'Loading config file'); 160unlink $config; 161kill_spawned_child(); 162 163# Spawn the server on port $port 164my $cmd = "$civetweb_exe ". 165 "-listening_ports 127.0.0.1:$port ". 166 "-access_log_file access.log ". 167 "-error_log_file debug.log ". 168 "-cgi_environment CGI_FOO=foo,CGI_BAR=bar,CGI_BAZ=baz " . 169 "-extra_mime_types .bar=foo/bar,.tar.gz=blah,.baz=foo " . 170 '-put_delete_auth_file test/passfile ' . 171 '-access_control_list -0.0.0.0/0,+127.0.0.1 ' . 172 "-document_root $root ". 173 "-hide_files_patterns **exploit.PL ". 174 "-enable_keep_alive yes ". 175 "-url_rewrite_patterns /aiased=/etc/,/ta=$test_dir"; 176$cmd .= ' -cgi_interpreter perl' if on_windows(); 177spawn($cmd); 178 179o("GET /hello.txt HTTP/1.1\nConnection: close\nRange: bytes=3-50\r\n\r\n", 180 'Content-Length: 15\s', 'Range past the file end'); 181 182o("GET /hello.txt HTTP/1.1\n\n GET /hello.txt HTTP/1.0\n\n", 183 'HTTP/1.1 200.+keep-alive.+HTTP/1.1 200.+close', 184 'Request pipelining', 2); 185 186my $x = 'x=' . 'A' x (200 * 1024); 187my $len = length($x); 188o("POST /env.cgi HTTP/1.0\r\nContent-Length: $len\r\n\r\n$x", 189 '^HTTP/1.1 200 OK', 'Long POST'); 190 191# Try to overflow: Send very long request 192req('POST ' . '/..' x 100 . 'ABCD' x 3000 . "\n\n", 0); # don't log this one 193 194o("GET /hello.txt HTTP/1.0\n\n", 'HTTP/1.1 200 OK', 'GET regular file'); 195o("GET /hello.txt HTTP/1.0\nContent-Length: -2147483648\n\n", 196 'HTTP/1.1 200 OK', 'Negative content length'); 197o("GET /hello.txt HTTP/1.0\n\n", 'Content-Length: 17\s', 198 'GET regular file Content-Length'); 199o("GET /%68%65%6c%6c%6f%2e%74%78%74 HTTP/1.0\n\n", 200 'HTTP/1.1 200 OK', 'URL-decoding'); 201 202# Break CGI reading after 1 second. We must get full output. 203# Since CGI script does sleep, we sleep as well and increase request count 204# manually. 205my $slow_cgi_reply; 206print "==> Slow CGI output ... "; 207fail('Slow CGI output forward reply=', $slow_cgi_reply) unless 208 ($slow_cgi_reply = req("GET /timeout.cgi HTTP/1.0\r\n\r\n", 0, 1)) =~ /Some data/s; 209print "OK\n"; 210sleep 3; 211$num_requests++; 212 213# '+' in URI must not be URL-decoded to space 214write_file("$root/a+.txt", ''); 215o("GET /a+.txt HTTP/1.0\n\n", 'HTTP/1.1 200 OK', 'URL-decoding, + in URI'); 216 217# Test HTTP version parsing 218o("GET / HTTPX/1.0\r\n\r\n", '^HTTP/1.1 500', 'Bad HTTP Version', 0); 219o("GET / HTTP/x.1\r\n\r\n", '^HTTP/1.1 505', 'Bad HTTP maj Version', 0); 220o("GET / HTTP/1.1z\r\n\r\n", '^HTTP/1.1 505', 'Bad HTTP min Version', 0); 221o("GET / HTTP/02.0\r\n\r\n", '^HTTP/1.1 505', 'HTTP Version >1.1', 0); 222 223# File with leading single dot 224o("GET /.leading.dot.txt HTTP/1.0\n\n", 'abc123', 'Leading dot 1'); 225o("GET /...leading.dot.txt HTTP/1.0\n\n", 'abc123', 'Leading dot 2'); 226o("GET /../\\\\/.//...leading.dot.txt HTTP/1.0\n\n", 'abc123', 'Leading dot 3') 227 if on_windows(); 228o("GET .. HTTP/1.0\n\n", '400 Bad Request', 'Leading dot 4', 0); 229 230mkdir $test_dir unless -d $test_dir; 231o("GET /$test_dir_uri/not_exist HTTP/1.0\n\n", 232 'HTTP/1.1 404', 'PATH_INFO loop problem'); 233o("GET /$test_dir_uri HTTP/1.0\n\n", 'HTTP/1.1 301', 'Directory redirection'); 234o("GET /$test_dir_uri/ HTTP/1.0\n\n", 'Modified', 'Directory listing'); 235write_file("$test_dir/index.html", "tralala"); 236o("GET /$test_dir_uri/ HTTP/1.0\n\n", 'tralala', 'Index substitution'); 237o("GET / HTTP/1.0\n\n", 'embed.c', 'Directory listing - file name'); 238o("GET /ta/ HTTP/1.0\n\n", 'Modified', 'Aliases'); 239o("GET /not-exist HTTP/1.0\r\n\n", 'HTTP/1.1 404', 'Not existent file'); 240mkdir $test_dir . $dir_separator . 'x'; 241my $path = $test_dir . $dir_separator . 'x' . $dir_separator . 'index.cgi'; 242write_file($path, read_file($root . $dir_separator . 'env.cgi')); 243chmod(0755, $path); 244o("GET /$test_dir_uri/x/ HTTP/1.0\n\n", "Content-Type: text/html\r\n\r\n", 245 'index.cgi execution'); 246 247my $cwd = getcwd(); 248o("GET /$test_dir_uri/x/ HTTP/1.0\n\n", 249 "SCRIPT_FILENAME=$cwd/test/test_dir/x/index.cgi", 'SCRIPT_FILENAME'); 250o("GET /ta/x/ HTTP/1.0\n\n", "SCRIPT_NAME=/ta/x/index.cgi", 251 'Aliases SCRIPT_NAME'); 252o("GET /hello.txt HTTP/1.1\nConnection: close\n\n", 'Connection: close', 253 'No keep-alive'); 254 255$path = $test_dir . $dir_separator . 'x' . $dir_separator . 'a.cgi'; 256system("ln -s `which perl` $root/myperl") == 0 or fail("Can't symlink perl"); 257write_file($path, "#!../../myperl\n" . 258 "print \"Content-Type: text/plain\\n\\nhi\";"); 259chmod(0755, $path); 260o("GET /$test_dir_uri/x/a.cgi HTTP/1.0\n\n", "hi", 'Relative CGI interp path'); 261o("GET * HTTP/1.0\n\n", "^HTTP/1.1 404", '* URI'); 262 263my $mime_types = { 264 html => 'text/html', 265 htm => 'text/html', 266 txt => 'text/plain', 267 unknown_extension => 'text/plain', 268 js => 'application/x-javascript', 269 css => 'text/css', 270 jpg => 'image/jpeg', 271 c => 'text/plain', 272 'tar.gz' => 'blah', 273 bar => 'foo/bar', 274 baz => 'foo', 275}; 276 277foreach my $key (keys %$mime_types) { 278 my $filename = "_mime_file_test.$key"; 279 write_file("$root/$filename", ''); 280 o("GET /$filename HTTP/1.0\n\n", 281 "Content-Type: $mime_types->{$key}", ".$key mime type"); 282 unlink "$root/$filename"; 283} 284 285# Get binary file and check the integrity 286my $binary_file = 'binary_file'; 287my $f2 = ''; 288foreach (0..123456) { $f2 .= chr(int(rand() * 255)); } 289write_file("$root/$binary_file", $f2); 290my $f1 = req("GET /$binary_file HTTP/1.0\r\n\n"); 291while ($f1 =~ /^.*\r\n/) { $f1 =~ s/^.*\r\n// } 292$f1 eq $f2 or fail("Integrity check for downloaded binary file"); 293 294my $range_request = "GET /hello.txt HTTP/1.1\nConnection: close\n". 295"Range: bytes=3-5\r\n\r\n"; 296o($range_request, '206 Partial Content', 'Range: 206 status code'); 297o($range_request, 'Content-Length: 3\s', 'Range: Content-Length'); 298o($range_request, 'Content-Range: bytes 3-5/17', 'Range: Content-Range'); 299o($range_request, '\nple$', 'Range: body content'); 300 301# Test directory sorting. Sleep between file creation for 1.1 seconds, 302# to make sure modification time are different. 303mkdir "$test_dir/sort"; 304write_file("$test_dir/sort/11", 'xx'); 305select undef, undef, undef, 1.1; 306write_file("$test_dir/sort/aa", 'xxxx'); 307select undef, undef, undef, 1.1; 308write_file("$test_dir/sort/bb", 'xxx'); 309select undef, undef, undef, 1.1; 310write_file("$test_dir/sort/22", 'x'); 311 312o("GET /$test_dir_uri/sort/?n HTTP/1.0\n\n", 313 '200 OK.+>11<.+>22<.+>aa<.+>bb<', 314 'Directory listing (name, ascending)'); 315o("GET /$test_dir_uri/sort/?nd HTTP/1.0\n\n", 316 '200 OK.+>bb<.+>aa<.+>22<.+>11<', 317 'Directory listing (name, descending)'); 318o("GET /$test_dir_uri/sort/?s HTTP/1.0\n\n", 319 '200 OK.+>22<.+>11<.+>bb<.+>aa<', 320 'Directory listing (size, ascending)'); 321o("GET /$test_dir_uri/sort/?sd HTTP/1.0\n\n", 322 '200 OK.+>aa<.+>bb<.+>11<.+>22<', 323 'Directory listing (size, descending)'); 324o("GET /$test_dir_uri/sort/?d HTTP/1.0\n\n", 325 '200 OK.+>11<.+>aa<.+>bb<.+>22<', 326 'Directory listing (modification time, ascending)'); 327o("GET /$test_dir_uri/sort/?dd HTTP/1.0\n\n", 328 '200 OK.+>22<.+>bb<.+>aa<.+>11<', 329 'Directory listing (modification time, descending)'); 330 331unless (scalar(@ARGV) > 0 and $ARGV[0] eq "basic_tests") { 332 # Check that .htpasswd file existence trigger authorization 333 write_file("$root/.htpasswd", 'user with space, " and comma:mydomain.com:5deda12442309cbdcdffc6b2737a894f'); 334 o("GET /hello.txt HTTP/1.1\n\n", '401 Unauthorized', 335 '.htpasswd - triggering auth on file request'); 336 o("GET / HTTP/1.1\n\n", '401 Unauthorized', 337 '.htpasswd - triggering auth on directory request'); 338 339 # Test various funky things in an authentication header. 340 o("GET /hello.txt HTTP/1.0\nAuthorization: Digest eq== empty=\"\", empty2=, quoted=\"blah foo bar, baz\\\"\\\" more\\\"\", unterminatedquoted=\" doesn't stop\n\n", 341 '401 Unauthorized', 'weird auth values should not cause crashes'); 342 my $auth_header = "Digest username=\"user with space, \\\" and comma\", ". 343 "realm=\"mydomain.com\", nonce=\"1291376417\", uri=\"/\",". 344 "response=\"e8dec0c2a1a0c8a7e9a97b4b5ea6a6e6\", qop=auth, nc=00000001, cnonce=\"1a49b53a47a66e82\""; 345 o("GET /hello.txt HTTP/1.0\nAuthorization: $auth_header\n\n", 'HTTP/1.1 200 OK', 'GET regular file with auth'); 346 o("GET / HTTP/1.0\nAuthorization: $auth_header\n\n", '^(.(?!(.htpasswd)))*$', 347 '.htpasswd is hidden from the directory list'); 348 o("GET / HTTP/1.0\nAuthorization: $auth_header\n\n", '^(.(?!(exploit.pl)))*$', 349 'hidden file is hidden from the directory list'); 350 o("GET /.htpasswd HTTP/1.0\nAuthorization: $auth_header\n\n", 351 '^HTTP/1.1 404 ', '.htpasswd must not be shown'); 352 o("GET /exploit.pl HTTP/1.0\nAuthorization: $auth_header\n\n", 353 '^HTTP/1.1 404', 'hidden files must not be shown'); 354 unlink "$root/.htpasswd"; 355 356 357 o("GET /dir%20with%20spaces/hello.cgi HTTP/1.0\n\r\n", 358 'HTTP/1.1 200 OK.+hello', 'CGI script with spaces in path'); 359 o("GET /env.cgi HTTP/1.0\n\r\n", 'HTTP/1.1 200 OK', 'GET CGI file'); 360 o("GET /bad2.cgi HTTP/1.0\n\n", "HTTP/1.1 123 Please pass me to the client\r", 361 'CGI Status code text'); 362 o("GET /sh.cgi HTTP/1.0\n\r\n", 'shell script CGI', 363 'GET sh CGI file') unless on_windows(); 364 o("GET /env.cgi?var=HELLO HTTP/1.0\n\n", 'QUERY_STRING=var=HELLO', 365 'QUERY_STRING wrong'); 366 o("POST /env.cgi HTTP/1.0\r\nContent-Length: 9\r\n\r\nvar=HELLO", 367 'var=HELLO', 'CGI POST wrong'); 368 o("POST /env.cgi HTTP/1.0\r\nContent-Length: 9\r\n\r\nvar=HELLO", 369 '\x0aCONTENT_LENGTH=9', 'Content-Length not being passed to CGI'); 370 o("GET /env.cgi HTTP/1.0\nMy-HdR: abc\n\r\n", 371 'HTTP_MY_HDR=abc', 'HTTP_* env'); 372 o("GET /env.cgi HTTP/1.0\n\r\nSOME_TRAILING_DATA_HERE", 373 'HTTP/1.1 200 OK', 'GET CGI with trailing data'); 374 375 o("GET /env.cgi%20 HTTP/1.0\n\r\n", 376 'HTTP/1.1 404', 'CGI Win32 code disclosure (%20)'); 377 o("GET /env.cgi%ff HTTP/1.0\n\r\n", 378 'HTTP/1.1 404', 'CGI Win32 code disclosure (%ff)'); 379 o("GET /env.cgi%2e HTTP/1.0\n\r\n", 380 'HTTP/1.1 404', 'CGI Win32 code disclosure (%2e)'); 381 o("GET /env.cgi%2b HTTP/1.0\n\r\n", 382 'HTTP/1.1 404', 'CGI Win32 code disclosure (%2b)'); 383 o("GET /env.cgi HTTP/1.0\n\r\n", '\nHTTPS=off\n', 'CGI HTTPS'); 384 o("GET /env.cgi HTTP/1.0\n\r\n", '\nCGI_FOO=foo\n', '-cgi_env 1'); 385 o("GET /env.cgi HTTP/1.0\n\r\n", '\nCGI_BAR=bar\n', '-cgi_env 2'); 386 o("GET /env.cgi HTTP/1.0\n\r\n", '\nCGI_BAZ=baz\n', '-cgi_env 3'); 387 o("GET /env.cgi/a/b/98 HTTP/1.0\n\r\n", 'PATH_INFO=/a/b/98\n', 'PATH_INFO'); 388 o("GET /env.cgi/a/b/9 HTTP/1.0\n\r\n", 'PATH_INFO=/a/b/9\n', 'PATH_INFO'); 389 390 # Check that CGI's current directory is set to script's directory 391 my $copy_cmd = on_windows() ? 'copy' : 'cp'; 392 system("$copy_cmd $root" . $dir_separator . "env.cgi $test_dir" . 393 $dir_separator . 'env.cgi'); 394 o("GET /$test_dir_uri/env.cgi HTTP/1.0\n\n", 395 "CURRENT_DIR=.*$root/$test_dir_uri", "CGI chdir()"); 396 397 # SSI tests 398 o("GET /ssi1.shtml HTTP/1.0\n\n", 399 'ssi_begin.+CFLAGS.+ssi_end', 'SSI #include file='); 400 o("GET /ssi2.shtml HTTP/1.0\n\n", 401 'ssi_begin.+Unit test.+ssi_end', 'SSI #include virtual='); 402 my $ssi_exec = on_windows() ? 'ssi4.shtml' : 'ssi3.shtml'; 403 o("GET /$ssi_exec HTTP/1.0\n\n", 404 'ssi_begin.+Makefile.+ssi_end', 'SSI #exec'); 405 my $abs_path = on_windows() ? 'ssi6.shtml' : 'ssi5.shtml'; 406 my $word = on_windows() ? 'boot loader' : 'root'; 407 o("GET /$abs_path HTTP/1.0\n\n", 408 "ssi_begin.+$word.+ssi_end", 'SSI #include abspath'); 409 o("GET /ssi7.shtml HTTP/1.0\n\n", 410 'ssi_begin.+Unit test.+ssi_end', 'SSI #include "..."'); 411 o("GET /ssi8.shtml HTTP/1.0\n\n", 412 'ssi_begin.+CFLAGS.+ssi_end', 'SSI nested #includes'); 413 414 # Manipulate the passwords file 415 my $path = 'test_htpasswd'; 416 unlink $path; 417 system("$civetweb_exe -A $path a b c") == 0 418 or fail("Cannot add user in a passwd file"); 419 system("$civetweb_exe -A $path a b c2") == 0 420 or fail("Cannot edit user in a passwd file"); 421 my $content = read_file($path); 422 $content =~ /^b:a:\w+$/gs or fail("Bad content of the passwd file"); 423 unlink $path; 424 425 do_PUT_test(); 426 kill_spawned_child(); 427 do_unit_test(); 428} 429 430sub do_PUT_test { 431 # This only works because civetweb currently doesn't look at the nonce. 432 # It should really be rejected... 433 my $auth_header = "Authorization: Digest username=guest, ". 434 "realm=mydomain.com, nonce=1145872809, uri=/put.txt, ". 435 "response=896327350763836180c61d87578037d9, qop=auth, ". 436 "nc=00000002, cnonce=53eddd3be4e26a98\n"; 437 438 o("PUT /a/put.txt HTTP/1.0\nContent-Length: 7\n$auth_header\n1234567", 439 "HTTP/1.1 201 OK", 'PUT file, status 201'); 440 fail("PUT content mismatch") 441 unless read_file("$root/a/put.txt") eq '1234567'; 442 o("PUT /a/put.txt HTTP/1.0\nContent-Length: 4\n$auth_header\nabcd", 443 "HTTP/1.1 200 OK", 'PUT file, status 200'); 444 fail("PUT content mismatch") 445 unless read_file("$root/a/put.txt") eq 'abcd'; 446 o("PUT /a/put.txt HTTP/1.0\n$auth_header\nabcd", 447 "HTTP/1.1 411 Length Required", 'PUT 411 error'); 448 o("PUT /a/put.txt HTTP/1.0\nExpect: blah\nContent-Length: 1\n". 449 "$auth_header\nabcd", 450 "HTTP/1.1 417 Expectation Failed", 'PUT 417 error'); 451 o("PUT /a/put.txt HTTP/1.0\nExpect: 100-continue\nContent-Length: 4\n". 452 "$auth_header\nabcd", 453 "HTTP/1.1 100 Continue.+HTTP/1.1 200", 'PUT 100-Continue'); 454} 455 456sub do_unit_test { 457 my $target = on_windows() ? 'wi' : 'un'; 458 system("make $target") == 0 or fail("Unit test failed!"); 459} 460 461print "SUCCESS! All tests passed.\n"; 462
