From 766b8309a6343b475acdf1664e33db3f8e2a69a4 Mon Sep 17 00:00:00 2001 From: williamthome Date: Thu, 15 Oct 2026 01:14:55 -0300 Subject: [PATCH 1/3] Add the Roadrunner (Erlang) server --- README.md | 2 +- docs/content/servers/roadrunner.md | 167 ++++++++++++++++++ src/Servers/RoadrunnerServer/Dockerfile | 10 ++ src/Servers/RoadrunnerServer/probe.json | 1 + src/Servers/RoadrunnerServer/rebar.config | 18 ++ src/Servers/RoadrunnerServer/rebar.lock | 11 ++ .../src/roadrunner_probe.app.src | 8 + .../src/roadrunner_probe_app.erl | 23 +++ .../src/roadrunner_probe_handler.erl | 35 ++++ web/assets/grid.js | 2 +- 10 files changed, 275 insertions(+), 2 deletions(-) create mode 100644 docs/content/servers/roadrunner.md create mode 100644 src/Servers/RoadrunnerServer/Dockerfile create mode 100644 src/Servers/RoadrunnerServer/probe.json create mode 100644 src/Servers/RoadrunnerServer/rebar.config create mode 100644 src/Servers/RoadrunnerServer/rebar.lock create mode 100644 src/Servers/RoadrunnerServer/src/roadrunner_probe.app.src create mode 100644 src/Servers/RoadrunnerServer/src/roadrunner_probe_app.erl create mode 100644 src/Servers/RoadrunnerServer/src/roadrunner_probe_handler.erl diff --git a/README.md b/README.md index 5661bf3..07462fb 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Http11Probe is a compliance and security tester for HTTP/1.1 servers. It throws malformed, ambiguous, and oversized requests at a server over raw TCP sockets and checks how it responds against what RFC 9110 and RFC 9112 actually require. These are the awkward cases like bare LF line endings, obsolete line folding, CL/TE request smuggling, chunk-framing tricks, oversized headers, and NUL bytes, where a strict parser and a lenient one start to disagree. -The same 215 tests run against 42 reference servers written in 12 languages, from Nginx, Apache, and Envoy to Kestrel, Gin, Actix, and the built-in servers in Node, Bun, and Deno. Every result is scored against the MUST/SHOULD/MAY wording in the spec and marked **Pass**, **Fail**, or **Warn**. A Warn just means the RFC allows both the strict and the lenient behavior, so neither one is wrong. +The same 215 tests run against 47 reference servers written in 14 languages, from Nginx, Apache, and Envoy to Kestrel, Gin, Actix, and the built-in servers in Node, Bun, and Deno. Every result is scored against the MUST/SHOULD/MAY wording in the spec and marked **Pass**, **Fail**, or **Warn**. A Warn just means the RFC allows both the strict and the lenient behavior, so neither one is wrong. You'll find the full documentation, a per-test glossary with RFC citations, and the live results matrix for every server at [http-probe.com](https://www.http-probe.com/). diff --git a/docs/content/servers/roadrunner.md b/docs/content/servers/roadrunner.md new file mode 100644 index 0000000..8a86fcb --- /dev/null +++ b/docs/content/servers/roadrunner.md @@ -0,0 +1,167 @@ +--- +title: "Roadrunner" +description: "Roadrunner (Erlang) tested against RFC 9110/9112 for HTTP/1.1 compliance, request smuggling resistance, and malformed input handling." +toc: true +breadcrumbs: false +--- + +**Language:** Erlang · [View source on GitHub](https://github.com/MDA2AV/Http11Probe/tree/main/src/Servers/RoadrunnerServer) + +[Roadrunner](https://github.com/arizona-framework/roadrunner) is a pure-Erlang HTTP/1.1, HTTP/2, HTTP/3 and WebSocket server from the Arizona framework. This entry runs roadrunner 0.10.1 from Hex as an OTP release: one HTTP/1.1 listener on port 8080 with roadrunner's default options, and a handler that serves `/echo`, `/cookie`, and a catch-all for every other path. HEAD needs no route of its own, since roadrunner answers it like GET without the body. + +## Dockerfile + +```dockerfile +FROM erlang:29.0-alpine AS build +WORKDIR /src +COPY src/Servers/RoadrunnerServer/rebar.config src/Servers/RoadrunnerServer/rebar.lock ./ +COPY src/Servers/RoadrunnerServer/src ./src +RUN rebar3 as prod release + +FROM alpine:3.23 +RUN apk add --no-cache libstdc++ ncurses-libs openssl +COPY --from=build /src/_build/prod/rel/roadrunner_probe /app +ENTRYPOINT ["/app/bin/roadrunner_probe", "foreground"] +``` + +## Source + +**`rebar.config`** + +```erlang +{erl_opts, [debug_info]}. + +{deps, [ + {roadrunner, "0.10.1"} +]}. + +{relx, [ + {release, {roadrunner_probe, "0.1.0"}, [roadrunner_probe]}, + {dev_mode, false}, + {include_erts, true}, + {extended_start_script, true} +]}. + +{profiles, [ + {prod, [ + {relx, [{mode, prod}]} + ]} +]}. +``` + +**`roadrunner_probe.app.src`** + +```erlang +{application, roadrunner_probe, [ + {description, "Http11Probe entry for the Roadrunner HTTP server"}, + {vsn, "0.1.0"}, + {registered, []}, + {mod, {roadrunner_probe_app, []}}, + {applications, [kernel, stdlib, roadrunner]}, + {env, []} +]}. +``` + +**`roadrunner_probe_app.erl`** + +```erlang +-module(roadrunner_probe_app). +-behaviour(application). +-behaviour(supervisor). + +-export([start/2, stop/1]). +-export([init/1]). + +%% Starts one HTTP/1.1 listener on port 8080 with roadrunner's defaults. +%% The listener runs under roadrunner's own supervisor; this empty +%% supervisor is only the application's top process. +start(_StartType, _StartArgs) -> + {ok, Sup} = supervisor:start_link(?MODULE, []), + {ok, _} = roadrunner:start_listener(probe, #{ + port => 8080, + routes => roadrunner_probe_handler:routes() + }), + {ok, Sup}. + +stop(_State) -> + ok. + +init([]) -> + {ok, {#{}, []}}. +``` + +**`roadrunner_probe_handler.erl`** + +```erlang +-module(roadrunner_probe_handler). +-behaviour(roadrunner_handler). + +-export([routes/0]). +-export([handle/1]). + +%% `/` and every other path share one catch-all handler. HEAD needs no +%% clause of its own: roadrunner answers it like GET without the body. +routes() -> + [ + {~"/echo", ?MODULE, echo}, + {~"/cookie", ?MODULE, cookie}, + {~"/", ?MODULE, root}, + {~"/*path", ?MODULE, root} + ]. + +handle(Req) -> + handle(roadrunner_req:state(Req), Req). + +%% Every header roadrunner parsed, one `Name: Value` per line. +handle(echo, Req) -> + Lines = [[Name, ~": ", Value, ~"\n"] || {Name, Value} <- roadrunner_req:headers(Req)], + {roadrunner_resp:text(200, Lines), Req}; +%% Every cookie roadrunner parsed, one `name=value` per line. +handle(cookie, Req) -> + Lines = [[Name, ~"=", Value, ~"\n"] || {Name, Value} <- roadrunner_req:parse_cookies(Req)], + {roadrunner_resp:text(200, Lines), Req}; +handle(root, Req) -> + case roadrunner_req:method(Req) of + ~"POST" -> + {ok, Body, Req2} = roadrunner_req:read_body(Req), + {roadrunner_resp:text(200, Body), Req2}; + _ -> + {roadrunner_resp:text(200, ~"OK"), Req} + end. +``` + +## Test Results + +

Loading results...

+ +### Compliance + +
+ +### Smuggling + +
+ +### Malformed Input + +
+ +### Caching + +
+ +### Cookies + +
+ + + + diff --git a/src/Servers/RoadrunnerServer/Dockerfile b/src/Servers/RoadrunnerServer/Dockerfile new file mode 100644 index 0000000..8746e71 --- /dev/null +++ b/src/Servers/RoadrunnerServer/Dockerfile @@ -0,0 +1,10 @@ +FROM erlang:29.0-alpine AS build +WORKDIR /src +COPY src/Servers/RoadrunnerServer/rebar.config src/Servers/RoadrunnerServer/rebar.lock ./ +COPY src/Servers/RoadrunnerServer/src ./src +RUN rebar3 as prod release + +FROM alpine:3.23 +RUN apk add --no-cache libstdc++ ncurses-libs openssl +COPY --from=build /src/_build/prod/rel/roadrunner_probe /app +ENTRYPOINT ["/app/bin/roadrunner_probe", "foreground"] diff --git a/src/Servers/RoadrunnerServer/probe.json b/src/Servers/RoadrunnerServer/probe.json new file mode 100644 index 0000000..18e4abd --- /dev/null +++ b/src/Servers/RoadrunnerServer/probe.json @@ -0,0 +1 @@ +{"name": "Roadrunner", "language": "Erlang", "repository": "https://github.com/arizona-framework/roadrunner"} diff --git a/src/Servers/RoadrunnerServer/rebar.config b/src/Servers/RoadrunnerServer/rebar.config new file mode 100644 index 0000000..72f22d2 --- /dev/null +++ b/src/Servers/RoadrunnerServer/rebar.config @@ -0,0 +1,18 @@ +{erl_opts, [debug_info]}. + +{deps, [ + {roadrunner, "0.10.1"} +]}. + +{relx, [ + {release, {roadrunner_probe, "0.1.0"}, [roadrunner_probe]}, + {dev_mode, false}, + {include_erts, true}, + {extended_start_script, true} +]}. + +{profiles, [ + {prod, [ + {relx, [{mode, prod}]} + ]} +]}. diff --git a/src/Servers/RoadrunnerServer/rebar.lock b/src/Servers/RoadrunnerServer/rebar.lock new file mode 100644 index 0000000..ce25daf --- /dev/null +++ b/src/Servers/RoadrunnerServer/rebar.lock @@ -0,0 +1,11 @@ +{"1.2.0", +[{<<"roadrunner">>,{pkg,<<"roadrunner">>,<<"0.10.1">>},0}, + {<<"telemetry">>,{pkg,<<"telemetry">>,<<"1.4.2">>},1}]}. +[ +{pkg_hash,[ + {<<"roadrunner">>, <<"81B9757CC13CD1D3F66BD647F784D74B16EDE503F0DADFC9F8543B485761E775">>}, + {<<"telemetry">>, <<"A0CB522801DFFB1C49FE6E30561BADFFC7B6D0E180DB1300DF759FAA22062855">>}]}, +{pkg_hash_ext,[ + {<<"roadrunner">>, <<"7E0FCE0C29004522116440D7B14D8C7CD5ED0A9EAFE6123A5A9E60E7205EC260">>}, + {<<"telemetry">>, <<"928F6495066506077862C0D1646609EED891A4326BEE3126BA54B60AF61FEBB1">>}]} +]. diff --git a/src/Servers/RoadrunnerServer/src/roadrunner_probe.app.src b/src/Servers/RoadrunnerServer/src/roadrunner_probe.app.src new file mode 100644 index 0000000..d5e1504 --- /dev/null +++ b/src/Servers/RoadrunnerServer/src/roadrunner_probe.app.src @@ -0,0 +1,8 @@ +{application, roadrunner_probe, [ + {description, "Http11Probe entry for the Roadrunner HTTP server"}, + {vsn, "0.1.0"}, + {registered, []}, + {mod, {roadrunner_probe_app, []}}, + {applications, [kernel, stdlib, roadrunner]}, + {env, []} +]}. diff --git a/src/Servers/RoadrunnerServer/src/roadrunner_probe_app.erl b/src/Servers/RoadrunnerServer/src/roadrunner_probe_app.erl new file mode 100644 index 0000000..33bb62d --- /dev/null +++ b/src/Servers/RoadrunnerServer/src/roadrunner_probe_app.erl @@ -0,0 +1,23 @@ +-module(roadrunner_probe_app). +-behaviour(application). +-behaviour(supervisor). + +-export([start/2, stop/1]). +-export([init/1]). + +%% Starts one HTTP/1.1 listener on port 8080 with roadrunner's defaults. +%% The listener runs under roadrunner's own supervisor; this empty +%% supervisor is only the application's top process. +start(_StartType, _StartArgs) -> + {ok, Sup} = supervisor:start_link(?MODULE, []), + {ok, _} = roadrunner:start_listener(probe, #{ + port => 8080, + routes => roadrunner_probe_handler:routes() + }), + {ok, Sup}. + +stop(_State) -> + ok. + +init([]) -> + {ok, {#{}, []}}. diff --git a/src/Servers/RoadrunnerServer/src/roadrunner_probe_handler.erl b/src/Servers/RoadrunnerServer/src/roadrunner_probe_handler.erl new file mode 100644 index 0000000..e31ca29 --- /dev/null +++ b/src/Servers/RoadrunnerServer/src/roadrunner_probe_handler.erl @@ -0,0 +1,35 @@ +-module(roadrunner_probe_handler). +-behaviour(roadrunner_handler). + +-export([routes/0]). +-export([handle/1]). + +%% `/` and every other path share one catch-all handler. HEAD needs no +%% clause of its own: roadrunner answers it like GET without the body. +routes() -> + [ + {~"/echo", ?MODULE, echo}, + {~"/cookie", ?MODULE, cookie}, + {~"/", ?MODULE, root}, + {~"/*path", ?MODULE, root} + ]. + +handle(Req) -> + handle(roadrunner_req:state(Req), Req). + +%% Every header roadrunner parsed, one `Name: Value` per line. +handle(echo, Req) -> + Lines = [[Name, ~": ", Value, ~"\n"] || {Name, Value} <- roadrunner_req:headers(Req)], + {roadrunner_resp:text(200, Lines), Req}; +%% Every cookie roadrunner parsed, one `name=value` per line. +handle(cookie, Req) -> + Lines = [[Name, ~"=", Value, ~"\n"] || {Name, Value} <- roadrunner_req:parse_cookies(Req)], + {roadrunner_resp:text(200, Lines), Req}; +handle(root, Req) -> + case roadrunner_req:method(Req) of + ~"POST" -> + {ok, Body, Req2} = roadrunner_req:read_body(Req), + {roadrunner_resp:text(200, Body), Req2}; + _ -> + {roadrunner_resp:text(200, ~"OK"), Req} + end. diff --git a/web/assets/grid.js b/web/assets/grid.js index 961ea38..f4a0ffa 100644 --- a/web/assets/grid.js +++ b/web/assets/grid.js @@ -19,7 +19,7 @@ Reference:["LLM's Choice"], Infrastructure:["Nginx","Apache","HAProxy","Envoy","Caddy","Traefik","Pingora","Lighttpd","H2O"], Flagship:["Kestrel","Spring Boot","Tomcat","Jetty","Quarkus","Node","Express","Deno","Bun","Uvicorn","Gunicorn","Flask","Puma","Gin","Actix","Hyper"], - Emerging:["FastHTTP","Ntex","Sisk","ServiceStack","GenHTTP","Workerman","Trillium"], + Emerging:["FastHTTP","Ntex","Sisk","ServiceStack","GenHTTP","Workerman","Trillium","Roadrunner"], Experimental:["Swerver","Horse","Glyph11","Effinitive","SimpleW","NetCoreServer","EmbedIO","FastEndpoints","FastPySGI","GenHTTP 11","PHP"], }; const TIER_ORDER=["Reference","Flagship","Infrastructure","Emerging","Experimental","Other"]; From de04f6838f03988b2ffd8596611a4dbfbdda487c Mon Sep 17 00:00:00 2001 From: williamthome Date: Thu, 15 Oct 2026 01:20:46 -0300 Subject: [PATCH 2/3] Run the Roadrunner server as nobody --- docs/content/servers/roadrunner.md | 1 + src/Servers/RoadrunnerServer/Dockerfile | 1 + 2 files changed, 2 insertions(+) diff --git a/docs/content/servers/roadrunner.md b/docs/content/servers/roadrunner.md index 8a86fcb..6ae5b3c 100644 --- a/docs/content/servers/roadrunner.md +++ b/docs/content/servers/roadrunner.md @@ -21,6 +21,7 @@ RUN rebar3 as prod release FROM alpine:3.23 RUN apk add --no-cache libstdc++ ncurses-libs openssl COPY --from=build /src/_build/prod/rel/roadrunner_probe /app +USER nobody ENTRYPOINT ["/app/bin/roadrunner_probe", "foreground"] ``` diff --git a/src/Servers/RoadrunnerServer/Dockerfile b/src/Servers/RoadrunnerServer/Dockerfile index 8746e71..0a9b2b1 100644 --- a/src/Servers/RoadrunnerServer/Dockerfile +++ b/src/Servers/RoadrunnerServer/Dockerfile @@ -7,4 +7,5 @@ RUN rebar3 as prod release FROM alpine:3.23 RUN apk add --no-cache libstdc++ ncurses-libs openssl COPY --from=build /src/_build/prod/rel/roadrunner_probe /app +USER nobody ENTRYPOINT ["/app/bin/roadrunner_probe", "foreground"] From ecf2ce99a6284eaf1a8f8b226984b4bfd5949980 Mon Sep 17 00:00:00 2001 From: williamthome Date: Thu, 15 Oct 2026 13:36:53 -0300 Subject: [PATCH 3/3] Update the Roadrunner entry to 0.10.2 --- docs/content/servers/roadrunner.md | 4 ++-- src/Servers/RoadrunnerServer/rebar.config | 2 +- src/Servers/RoadrunnerServer/rebar.lock | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/content/servers/roadrunner.md b/docs/content/servers/roadrunner.md index 6ae5b3c..fd39a45 100644 --- a/docs/content/servers/roadrunner.md +++ b/docs/content/servers/roadrunner.md @@ -7,7 +7,7 @@ breadcrumbs: false **Language:** Erlang · [View source on GitHub](https://github.com/MDA2AV/Http11Probe/tree/main/src/Servers/RoadrunnerServer) -[Roadrunner](https://github.com/arizona-framework/roadrunner) is a pure-Erlang HTTP/1.1, HTTP/2, HTTP/3 and WebSocket server from the Arizona framework. This entry runs roadrunner 0.10.1 from Hex as an OTP release: one HTTP/1.1 listener on port 8080 with roadrunner's default options, and a handler that serves `/echo`, `/cookie`, and a catch-all for every other path. HEAD needs no route of its own, since roadrunner answers it like GET without the body. +[Roadrunner](https://github.com/arizona-framework/roadrunner) is a pure-Erlang HTTP/1.1, HTTP/2, HTTP/3 and WebSocket server from the Arizona framework. This entry runs roadrunner 0.10.2 from Hex as an OTP release: one HTTP/1.1 listener on port 8080 with roadrunner's default options, and a handler that serves `/echo`, `/cookie`, and a catch-all for every other path. HEAD needs no route of its own, since roadrunner answers it like GET without the body. ## Dockerfile @@ -33,7 +33,7 @@ ENTRYPOINT ["/app/bin/roadrunner_probe", "foreground"] {erl_opts, [debug_info]}. {deps, [ - {roadrunner, "0.10.1"} + {roadrunner, "0.10.2"} ]}. {relx, [ diff --git a/src/Servers/RoadrunnerServer/rebar.config b/src/Servers/RoadrunnerServer/rebar.config index 72f22d2..a52526e 100644 --- a/src/Servers/RoadrunnerServer/rebar.config +++ b/src/Servers/RoadrunnerServer/rebar.config @@ -1,7 +1,7 @@ {erl_opts, [debug_info]}. {deps, [ - {roadrunner, "0.10.1"} + {roadrunner, "0.10.2"} ]}. {relx, [ diff --git a/src/Servers/RoadrunnerServer/rebar.lock b/src/Servers/RoadrunnerServer/rebar.lock index ce25daf..e2acef5 100644 --- a/src/Servers/RoadrunnerServer/rebar.lock +++ b/src/Servers/RoadrunnerServer/rebar.lock @@ -1,11 +1,11 @@ {"1.2.0", -[{<<"roadrunner">>,{pkg,<<"roadrunner">>,<<"0.10.1">>},0}, +[{<<"roadrunner">>,{pkg,<<"roadrunner">>,<<"0.10.2">>},0}, {<<"telemetry">>,{pkg,<<"telemetry">>,<<"1.4.2">>},1}]}. [ {pkg_hash,[ - {<<"roadrunner">>, <<"81B9757CC13CD1D3F66BD647F784D74B16EDE503F0DADFC9F8543B485761E775">>}, + {<<"roadrunner">>, <<"9203479DB306FD881A52246BA24BFE515C5C3B89DB1A62DF3CDD3452176FD51E">>}, {<<"telemetry">>, <<"A0CB522801DFFB1C49FE6E30561BADFFC7B6D0E180DB1300DF759FAA22062855">>}]}, {pkg_hash_ext,[ - {<<"roadrunner">>, <<"7E0FCE0C29004522116440D7B14D8C7CD5ED0A9EAFE6123A5A9E60E7205EC260">>}, + {<<"roadrunner">>, <<"19B1B3DC0F6FF3CCFFBBB0F80E780A49D7BDC0D82EEE66610EA777DE319D1C19">>}, {<<"telemetry">>, <<"928F6495066506077862C0D1646609EED891A4326BEE3126BA54B60AF61FEBB1">>}]} ].