diff --git a/README.md b/README.md index 5661bf3..07462fb 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Http11Probe is a compliance and security tester for HTTP/1.1 servers. It throws malformed, ambiguous, and oversized requests at a server over raw TCP sockets and checks how it responds against what RFC 9110 and RFC 9112 actually require. These are the awkward cases like bare LF line endings, obsolete line folding, CL/TE request smuggling, chunk-framing tricks, oversized headers, and NUL bytes, where a strict parser and a lenient one start to disagree. -The same 215 tests run against 42 reference servers written in 12 languages, from Nginx, Apache, and Envoy to Kestrel, Gin, Actix, and the built-in servers in Node, Bun, and Deno. Every result is scored against the MUST/SHOULD/MAY wording in the spec and marked **Pass**, **Fail**, or **Warn**. A Warn just means the RFC allows both the strict and the lenient behavior, so neither one is wrong. +The same 215 tests run against 47 reference servers written in 14 languages, from Nginx, Apache, and Envoy to Kestrel, Gin, Actix, and the built-in servers in Node, Bun, and Deno. Every result is scored against the MUST/SHOULD/MAY wording in the spec and marked **Pass**, **Fail**, or **Warn**. A Warn just means the RFC allows both the strict and the lenient behavior, so neither one is wrong. You'll find the full documentation, a per-test glossary with RFC citations, and the live results matrix for every server at [http-probe.com](https://www.http-probe.com/). diff --git a/docs/content/servers/roadrunner.md b/docs/content/servers/roadrunner.md new file mode 100644 index 0000000..fd39a45 --- /dev/null +++ b/docs/content/servers/roadrunner.md @@ -0,0 +1,168 @@ +--- +title: "Roadrunner" +description: "Roadrunner (Erlang) tested against RFC 9110/9112 for HTTP/1.1 compliance, request smuggling resistance, and malformed input handling." +toc: true +breadcrumbs: false +--- + +**Language:** Erlang ยท [View source on GitHub](https://github.com/MDA2AV/Http11Probe/tree/main/src/Servers/RoadrunnerServer) + +[Roadrunner](https://github.com/arizona-framework/roadrunner) is a pure-Erlang HTTP/1.1, HTTP/2, HTTP/3 and WebSocket server from the Arizona framework. This entry runs roadrunner 0.10.2 from Hex as an OTP release: one HTTP/1.1 listener on port 8080 with roadrunner's default options, and a handler that serves `/echo`, `/cookie`, and a catch-all for every other path. HEAD needs no route of its own, since roadrunner answers it like GET without the body. + +## Dockerfile + +```dockerfile +FROM erlang:29.0-alpine AS build +WORKDIR /src +COPY src/Servers/RoadrunnerServer/rebar.config src/Servers/RoadrunnerServer/rebar.lock ./ +COPY src/Servers/RoadrunnerServer/src ./src +RUN rebar3 as prod release + +FROM alpine:3.23 +RUN apk add --no-cache libstdc++ ncurses-libs openssl +COPY --from=build /src/_build/prod/rel/roadrunner_probe /app +USER nobody +ENTRYPOINT ["/app/bin/roadrunner_probe", "foreground"] +``` + +## Source + +**`rebar.config`** + +```erlang +{erl_opts, [debug_info]}. + +{deps, [ + {roadrunner, "0.10.2"} +]}. + +{relx, [ + {release, {roadrunner_probe, "0.1.0"}, [roadrunner_probe]}, + {dev_mode, false}, + {include_erts, true}, + {extended_start_script, true} +]}. + +{profiles, [ + {prod, [ + {relx, [{mode, prod}]} + ]} +]}. +``` + +**`roadrunner_probe.app.src`** + +```erlang +{application, roadrunner_probe, [ + {description, "Http11Probe entry for the Roadrunner HTTP server"}, + {vsn, "0.1.0"}, + {registered, []}, + {mod, {roadrunner_probe_app, []}}, + {applications, [kernel, stdlib, roadrunner]}, + {env, []} +]}. +``` + +**`roadrunner_probe_app.erl`** + +```erlang +-module(roadrunner_probe_app). +-behaviour(application). +-behaviour(supervisor). + +-export([start/2, stop/1]). +-export([init/1]). + +%% Starts one HTTP/1.1 listener on port 8080 with roadrunner's defaults. +%% The listener runs under roadrunner's own supervisor; this empty +%% supervisor is only the application's top process. +start(_StartType, _StartArgs) -> + {ok, Sup} = supervisor:start_link(?MODULE, []), + {ok, _} = roadrunner:start_listener(probe, #{ + port => 8080, + routes => roadrunner_probe_handler:routes() + }), + {ok, Sup}. + +stop(_State) -> + ok. + +init([]) -> + {ok, {#{}, []}}. +``` + +**`roadrunner_probe_handler.erl`** + +```erlang +-module(roadrunner_probe_handler). +-behaviour(roadrunner_handler). + +-export([routes/0]). +-export([handle/1]). + +%% `/` and every other path share one catch-all handler. HEAD needs no +%% clause of its own: roadrunner answers it like GET without the body. +routes() -> + [ + {~"/echo", ?MODULE, echo}, + {~"/cookie", ?MODULE, cookie}, + {~"/", ?MODULE, root}, + {~"/*path", ?MODULE, root} + ]. + +handle(Req) -> + handle(roadrunner_req:state(Req), Req). + +%% Every header roadrunner parsed, one `Name: Value` per line. +handle(echo, Req) -> + Lines = [[Name, ~": ", Value, ~"\n"] || {Name, Value} <- roadrunner_req:headers(Req)], + {roadrunner_resp:text(200, Lines), Req}; +%% Every cookie roadrunner parsed, one `name=value` per line. +handle(cookie, Req) -> + Lines = [[Name, ~"=", Value, ~"\n"] || {Name, Value} <- roadrunner_req:parse_cookies(Req)], + {roadrunner_resp:text(200, Lines), Req}; +handle(root, Req) -> + case roadrunner_req:method(Req) of + ~"POST" -> + {ok, Body, Req2} = roadrunner_req:read_body(Req), + {roadrunner_resp:text(200, Body), Req2}; + _ -> + {roadrunner_resp:text(200, ~"OK"), Req} + end. +``` + +## Test Results + +

Loading results...

+ +### Compliance + +
+ +### Smuggling + +
+ +### Malformed Input + +
+ +### Caching + +
+ +### Cookies + +
+ + + + diff --git a/src/Servers/RoadrunnerServer/Dockerfile b/src/Servers/RoadrunnerServer/Dockerfile new file mode 100644 index 0000000..0a9b2b1 --- /dev/null +++ b/src/Servers/RoadrunnerServer/Dockerfile @@ -0,0 +1,11 @@ +FROM erlang:29.0-alpine AS build +WORKDIR /src +COPY src/Servers/RoadrunnerServer/rebar.config src/Servers/RoadrunnerServer/rebar.lock ./ +COPY src/Servers/RoadrunnerServer/src ./src +RUN rebar3 as prod release + +FROM alpine:3.23 +RUN apk add --no-cache libstdc++ ncurses-libs openssl +COPY --from=build /src/_build/prod/rel/roadrunner_probe /app +USER nobody +ENTRYPOINT ["/app/bin/roadrunner_probe", "foreground"] diff --git a/src/Servers/RoadrunnerServer/probe.json b/src/Servers/RoadrunnerServer/probe.json new file mode 100644 index 0000000..18e4abd --- /dev/null +++ b/src/Servers/RoadrunnerServer/probe.json @@ -0,0 +1 @@ +{"name": "Roadrunner", "language": "Erlang", "repository": "https://github.com/arizona-framework/roadrunner"} diff --git a/src/Servers/RoadrunnerServer/rebar.config b/src/Servers/RoadrunnerServer/rebar.config new file mode 100644 index 0000000..a52526e --- /dev/null +++ b/src/Servers/RoadrunnerServer/rebar.config @@ -0,0 +1,18 @@ +{erl_opts, [debug_info]}. + +{deps, [ + {roadrunner, "0.10.2"} +]}. + +{relx, [ + {release, {roadrunner_probe, "0.1.0"}, [roadrunner_probe]}, + {dev_mode, false}, + {include_erts, true}, + {extended_start_script, true} +]}. + +{profiles, [ + {prod, [ + {relx, [{mode, prod}]} + ]} +]}. diff --git a/src/Servers/RoadrunnerServer/rebar.lock b/src/Servers/RoadrunnerServer/rebar.lock new file mode 100644 index 0000000..e2acef5 --- /dev/null +++ b/src/Servers/RoadrunnerServer/rebar.lock @@ -0,0 +1,11 @@ +{"1.2.0", +[{<<"roadrunner">>,{pkg,<<"roadrunner">>,<<"0.10.2">>},0}, + {<<"telemetry">>,{pkg,<<"telemetry">>,<<"1.4.2">>},1}]}. +[ +{pkg_hash,[ + {<<"roadrunner">>, <<"9203479DB306FD881A52246BA24BFE515C5C3B89DB1A62DF3CDD3452176FD51E">>}, + {<<"telemetry">>, <<"A0CB522801DFFB1C49FE6E30561BADFFC7B6D0E180DB1300DF759FAA22062855">>}]}, +{pkg_hash_ext,[ + {<<"roadrunner">>, <<"19B1B3DC0F6FF3CCFFBBB0F80E780A49D7BDC0D82EEE66610EA777DE319D1C19">>}, + {<<"telemetry">>, <<"928F6495066506077862C0D1646609EED891A4326BEE3126BA54B60AF61FEBB1">>}]} +]. diff --git a/src/Servers/RoadrunnerServer/src/roadrunner_probe.app.src b/src/Servers/RoadrunnerServer/src/roadrunner_probe.app.src new file mode 100644 index 0000000..d5e1504 --- /dev/null +++ b/src/Servers/RoadrunnerServer/src/roadrunner_probe.app.src @@ -0,0 +1,8 @@ +{application, roadrunner_probe, [ + {description, "Http11Probe entry for the Roadrunner HTTP server"}, + {vsn, "0.1.0"}, + {registered, []}, + {mod, {roadrunner_probe_app, []}}, + {applications, [kernel, stdlib, roadrunner]}, + {env, []} +]}. diff --git a/src/Servers/RoadrunnerServer/src/roadrunner_probe_app.erl b/src/Servers/RoadrunnerServer/src/roadrunner_probe_app.erl new file mode 100644 index 0000000..33bb62d --- /dev/null +++ b/src/Servers/RoadrunnerServer/src/roadrunner_probe_app.erl @@ -0,0 +1,23 @@ +-module(roadrunner_probe_app). +-behaviour(application). +-behaviour(supervisor). + +-export([start/2, stop/1]). +-export([init/1]). + +%% Starts one HTTP/1.1 listener on port 8080 with roadrunner's defaults. +%% The listener runs under roadrunner's own supervisor; this empty +%% supervisor is only the application's top process. +start(_StartType, _StartArgs) -> + {ok, Sup} = supervisor:start_link(?MODULE, []), + {ok, _} = roadrunner:start_listener(probe, #{ + port => 8080, + routes => roadrunner_probe_handler:routes() + }), + {ok, Sup}. + +stop(_State) -> + ok. + +init([]) -> + {ok, {#{}, []}}. diff --git a/src/Servers/RoadrunnerServer/src/roadrunner_probe_handler.erl b/src/Servers/RoadrunnerServer/src/roadrunner_probe_handler.erl new file mode 100644 index 0000000..e31ca29 --- /dev/null +++ b/src/Servers/RoadrunnerServer/src/roadrunner_probe_handler.erl @@ -0,0 +1,35 @@ +-module(roadrunner_probe_handler). +-behaviour(roadrunner_handler). + +-export([routes/0]). +-export([handle/1]). + +%% `/` and every other path share one catch-all handler. HEAD needs no +%% clause of its own: roadrunner answers it like GET without the body. +routes() -> + [ + {~"/echo", ?MODULE, echo}, + {~"/cookie", ?MODULE, cookie}, + {~"/", ?MODULE, root}, + {~"/*path", ?MODULE, root} + ]. + +handle(Req) -> + handle(roadrunner_req:state(Req), Req). + +%% Every header roadrunner parsed, one `Name: Value` per line. +handle(echo, Req) -> + Lines = [[Name, ~": ", Value, ~"\n"] || {Name, Value} <- roadrunner_req:headers(Req)], + {roadrunner_resp:text(200, Lines), Req}; +%% Every cookie roadrunner parsed, one `name=value` per line. +handle(cookie, Req) -> + Lines = [[Name, ~"=", Value, ~"\n"] || {Name, Value} <- roadrunner_req:parse_cookies(Req)], + {roadrunner_resp:text(200, Lines), Req}; +handle(root, Req) -> + case roadrunner_req:method(Req) of + ~"POST" -> + {ok, Body, Req2} = roadrunner_req:read_body(Req), + {roadrunner_resp:text(200, Body), Req2}; + _ -> + {roadrunner_resp:text(200, ~"OK"), Req} + end. diff --git a/web/assets/grid.js b/web/assets/grid.js index 961ea38..f4a0ffa 100644 --- a/web/assets/grid.js +++ b/web/assets/grid.js @@ -19,7 +19,7 @@ Reference:["LLM's Choice"], Infrastructure:["Nginx","Apache","HAProxy","Envoy","Caddy","Traefik","Pingora","Lighttpd","H2O"], Flagship:["Kestrel","Spring Boot","Tomcat","Jetty","Quarkus","Node","Express","Deno","Bun","Uvicorn","Gunicorn","Flask","Puma","Gin","Actix","Hyper"], - Emerging:["FastHTTP","Ntex","Sisk","ServiceStack","GenHTTP","Workerman","Trillium"], + Emerging:["FastHTTP","Ntex","Sisk","ServiceStack","GenHTTP","Workerman","Trillium","Roadrunner"], Experimental:["Swerver","Horse","Glyph11","Effinitive","SimpleW","NetCoreServer","EmbedIO","FastEndpoints","FastPySGI","GenHTTP 11","PHP"], }; const TIER_ORDER=["Reference","Flagship","Infrastructure","Emerging","Experimental","Other"];