I wrote own http server. Are there any free software, test packages or toolset to validate whether it complies fully or partially with HTTP 1.0 (rfc 1945). And moreover it'd great if this software could estimate http performance and check for potential security issues. The same is wanted from this software in respect of FTP compliance validation.
closed as off-topic by masegaloeh, mdpc, Andrew Schulman, kasperd, Xavier Lucas Mar 28 '15 at 13:42
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Requests for product, service, or learning material recommendations are off-topic because they attract low quality, opinionated and spam answers, and the answers become obsolete quickly. Instead, describe the business problem you are working on, the research you have done, and the steps taken so far to solve it." – masegaloeh, mdpc, Andrew Schulman, Xavier Lucas
Lots of questions here. While I'm sure lots of people will tell you their tool does everything if only you will buy it, there are very few tools available which make a reasonable attempt at any one of these.
For the security side of things, assuming that you are only interested in serving of static content, there is a list of useful software here.
For capacity testing you could use ab which ships with apache. You might also consider scripting more complex interactions using loadrunner ($$$) or http::Recorder and www::mechanize
Most of the large software packages available as source code come with automatic testing scripts (usually a target in the Makefile, e.g. 'make test') but the Apache build instructions don't mention this - might be worth downloading the src and configuring it to see if it does have test scripts included which could be adapted.
As for performance testing/monitoring - IME there's nothing currently available which is any good (and I include Oracle's Grid Control, BMC Patrol, Google Analytics and a large number of other products in the 'not any good' category). Personally I'm using a home-grown solution which relies on very detailled logging of URL generation (have a look at mod_log_config %D option and mod_log_firstbyte).
One area I've not studied in great depth is passive monitoring - there are tools like vantage agentless but these are very, VERY expensive. PastMon may meet your requirements (its good and its free) but you're going to need some specialist and expensive hardware to run it on if you expect to measure what happens when your webserver reaches saturation.
You could use apachebench for the performance testing.
This is really a programming issue, but as you have a bounty on the question it will stay here, at least for now.
There are a lot of Firefox add-ons designed for testing and debugging, so have a search through those see what you think is suitable for you. For security issues there are a lot of different scripts around but I should warn you that of those I've tried the results have been inconsistent and even contradictory, so I'm of two minds about their value.
The single largest issue seen in any software is buffer overflows. They can be a real pain to find at times, because they can be anywhere in the code, and often won't show up under automated testing. When I first started programming for Windows I wrote a program in which a buffer overflow went undetected for more that two years, even though the program was in daily use by several thousand users.
You could try some of this: