Feature/http test

docs/test/compliant.md

@@ -111,4 +111,9 @@ Strict cryptographic standards apply to all inbound and outbound traffic via web
 ### Inbound Connections (Device as a Server / Web Interface)
 * The device's embedded web server must support connections via **TLS 1.2** and/or **TLS 1.3**.
 * **TLS 1.0 and TLS 1.1 must be explicitly disabled** within the web server configuration.
-* The TLS certificate presented by the web server must be valid and signed by a trusted (or test-environment designated) Certificate Authority (CA).
+* The TLS certificate presented by the web server must be valid and signed by a trusted (or test-environment designated) Certificate Authority (CA).
+
+### HTTP Server Compliance (RFC 9110)
+* Basic Method Support: Verification that the server successfully processes standard **GET** and **HEAD** methods, returning a **200 OK** status.
+* **HEAD** Response Semantics: Ensuring that the response body for a **HEAD** request is strictly empty, and critical headers **(Content-Length, Content-Type)** precisely match the **GET** response.
+* Unsupported Method Handling: Verification of correct server response to arbitrary or invalid methods, expecting a status code of **405 Method Not Allowed or 501 Not Implemented**.

modules/test/tls/README.md

@@ -19,4 +19,5 @@ Within the ```python/src``` directory, the below tests are executed.
 | security.tls.v1_2_client | Device uses TLS with connection to an external service on port 443 (or any other port which could be running the webserver-HTTPS) | The packet indicates a TLS connection with at least TLS v1.2 and support for ECDH and ECDSA ciphers | Required if Applicable |
 | security.tls.v1_3_server | Check the device web server TLS 1.3 and the certificate is valid | TLS 1.3 certificate is issued to the web browser client when accessed | Informational |
 | security.tls.v1_3_client | Device uses TLS with connection to an external service on port 443 (or any other port which could be running the webserver-HTTPS) | The packet indicates a TLS connection with at least TLS 1.3 using AEAD-based ciphers | Informational |
+| security.http.server | Automated RFC 9110 compliance validation of the device's HTTP/HTTPS server | The server responds with status 200 OK for both GET and HEAD methods with an empty HEAD body and matching critical headers, returns 405 or 501 for unsupported methods | Informational |
 

modules/test/tls/conf/module_config.json

@@ -58,6 +58,17 @@
           "Disable connections to unsecure services",
           "Ensure any URLs connected to are secure (https)"
         ]
+      },
+      {
+        "name": "security.http.server",
+        "test_description": "Automated RFC 9110 compliance validation of the device's HTTP/HTTPS server",
+        "expected_behavior": "The server responds with status 200 OK for both GET and HEAD methods with an empty HEAD body and matching critical headers, returns 405 or 501 for unsupported methods",
+        "recommendations": [
+          "Implement the GET and HEAD methods on the web server",
+          "Ensure that the HEAD response is empty",
+          "Ensure that the GET and HEAD response headers (Content-Length, Content-Type) match",
+          "Ensure that unsupported requests return a 405 or 501 status code"
+        ]
       }
     ]
   }

modules/test/tls/python/src/http_scan.py

@@ -20,6 +20,11 @@
 LOGGER = None
 requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
 
+_MSG_HTTP_NOT_DETECTED = 'No HTTP server detected on the device.'
+_MSG_HTTP_COMPLIANT = 'Device HTTP server is COMPLIANT with the RFC 9110'
+_MSG_HTTP_NON = 'Device HTTP server is NON-COMPLIANT with the RFC 9110'
+_MSG_HTTP_ERROR = 'Error checking HTTP server.'
+
 
 class HTTPScan():
   """Helper class to scan for all HTTP/HTTPS services for a device"""
@@ -128,3 +133,131 @@ def scan_for_http_services(self, ip_address):
       for port, service_type in results.items():
         LOGGER.info(f'Port {port}: {service_type}')
     return results
+
+  def _http_make_request(
+      self, method: str,
+      url: str,
+      timeout: int = 20
+  ) -> requests.Response | None:
+    """Sends HTTP request and handles exceptions uniformly.
+
+    Returns:
+        requests.Response | None
+    """
+
+    try:
+      resp = requests.request(
+          method=method,
+          url=url,
+          timeout=timeout,
+          verify=False  # nosec B501
+      )
+      return resp
+    except requests.exceptions.Timeout as e:
+      msg = f'Timeout during {method.upper()} request to {url}'
+      LOGGER.error(f'{msg}: {e}')
+      return None
+    except requests.exceptions.ConnectionError as e:
+      msg = f'Connection refused during {method.upper()} request to {url}'
+      LOGGER.error(f'{msg}: {e}')
+      return None
+
+  def http_server_compliance(self, ip:str) -> tuple[str, str, list[str]]:
+    """Checks HTTP server comliance to RFC 9110."""
+    result_state = 'Feature Not Detected'
+    result_message = _MSG_HTTP_NOT_DETECTED
+    result_details = []
+    try:
+      ports = self.scan_all_ports(ip)
+      if not ports:
+        msg = f'No HTTP/HTTPS ports found on {ip}'
+        LOGGER.info(msg)
+        return result_state, result_message, result_details
+      if '443' in ports:
+        url = f'https://{ip}'
+      else:
+        url = f'http://{ip}'
+      LOGGER.info(f'Checking HTTP methods on {url}')
+      try:
+        get_resp = self._http_make_request('GET', url)
+        if get_resp is None:
+          get_ok = False
+        else:
+          get_ok = get_resp.status_code == 200
+        head_resp = self._http_make_request('HEAD', url)
+        if head_resp is None:
+          head_ok = False
+        else:
+          head_ok = head_resp.status_code == 200
+        method_resp = self._http_make_request('foobar', url)
+      except requests.exceptions.RequestException as e:
+        LOGGER.error(f'Error checking HTTP methods on {url}: {e}')
+        return 'Error', _MSG_HTTP_ERROR, []
+      if not get_ok or not head_ok:
+        LOGGER.info(f'HTTP GET/HEAD method is not supported on {url}')
+        result_state = 'Non-Compliant'
+        result_message = _MSG_HTTP_NON
+        if not get_ok:
+          result_details.append('Server does not support GET method')
+        else:
+          result_details.append('Server supports GET method')
+        if not head_ok:
+          result_details.append('Server does not support HEAD method')
+        else:
+          result_details.append('Server supports HEAD method')
+      elif get_ok and head_ok:
+        LOGGER.info(f'HTTP GET and HEAD methods are supported on {url}')
+        result_state = 'Compliant'
+        result_message = _MSG_HTTP_COMPLIANT
+        result_details.extend([
+          'Server supports GET method',
+          'Server supports HEAD method'
+        ])
+      if head_resp is not None and get_resp is not None:
+        head_body_len = len(head_resp.content)
+        head_body_empty = head_body_len == 0
+        headers_match = True
+        header_not_match = ''
+        for header in ('Content-Length', 'Content-Type'):
+          if header in get_resp.headers or header in head_resp.headers:
+            if get_resp.headers.get(header) != head_resp.headers.get(header):
+              headers_match = False
+              header_not_match = header
+              break
+        if not head_body_empty or not headers_match:
+          result_state = 'Non-Compliant'
+          result_message = _MSG_HTTP_NON
+          if not head_body_empty:
+            LOGGER.info('HEAD response body is not empty')
+            result_details.append('HEAD response body is not empty')
+          elif not headers_match:
+            msg = f'{header_not_match} does not match between GET and HEAD'
+            LOGGER.info(msg)
+            result_details.append(f'Header {header_not_match} does not match')
+        else:
+          LOGGER.info('HEAD response body is empty.')
+          LOGGER.info('Headers match between GET and HEAD methods.')
+          result_details.extend([
+            'HEAD response body is empty',
+            'Headers match between GET and HEAD methods'
+          ])
+      if method_resp is None:
+        result_state = 'Non-Compliant'
+        result_message = _MSG_HTTP_NON
+        msg = 'Device server does not return 501 or 405 for unsupported methods'
+        LOGGER.info(msg)
+        result_details.append(msg)
+      elif method_resp.status_code in (405, 501):
+        msg = 'Device server returns 501 or 405 for unsupported methods'
+        LOGGER.info(msg)
+        result_details.append(msg)
+      else:
+        result_state = 'Non-Compliant'
+        result_message = _MSG_HTTP_NON
+        msg = 'Device server does not return 501 or 405 for unsupported methods'
+        LOGGER.info(msg)
+        result_details.append(msg)
+    except Exception as e:
+      LOGGER.error(f'Unexpected error {e}')
+
+    return result_state, result_message, result_details

modules/test/tls/python/src/tls_module.py

@@ -556,6 +556,12 @@ def _security_tls_v1_3_client(self):
                                      '1.3',
                                      unsupported_versions=['1.0', '1.1'])
 
+  def _security_http_server(self):
+    LOGGER.info('Running HTTP server test')
+    return self._http_scan.http_server_compliance(
+      self._device_ipv4_addr
+    )
+
   def _validate_tls_client(self,
                            client_mac,
                            tls_version,

modules/ui/karma.conf.js

@@ -11,6 +11,12 @@ module.exports = function (config) {
       require('karma-jasmine-html-reporter'),
       require('karma-coverage'),
     ],
+    customLaunchers: {
+      ChromeHeadlessCI: {
+        base: 'ChromeHeadless',
+        flags: ['--no-sandbox', '--disable-setuid-sandbox'],
+      },
+    },
     client: {
       jasmine: {
         // you can add configuration options for Jasmine here

modules/ui/package.json

@@ -9,7 +9,7 @@
     "test": "ng test",
     "test:coverage": "ng test --code-coverage",
     "test-headless": "ng test --browsers=ChromeHeadless --watch=false",
-    "test-ci": "ng test --no-watch --no-progress --code-coverage --browsers=ChromeHeadless",
+    "test-ci": "ng test --no-watch --no-progress --code-coverage --browsers=ChromeHeadlessCI",
     "docker": "docker rm -f test-run-ui && docker rmi test-run-ui && docker build -t test-run-ui . &&  docker run -d -p 80:80 --name test-run-ui test-run-ui",
     "lint": "ng lint",
     "lint:fix": "ng lint --fix",

resources/test_packs/pilot/config.json

@@ -176,6 +176,10 @@
       {
         "name": "security.tls.v1_3_client",
         "required_result": "Informational"
+      },
+      {
+        "name": "security.http.server",
+        "required_result": "Informational"
       }
     ]
   }

resources/test_packs/pilot/report_templates/summary.jinja

@@ -13,6 +13,11 @@
         <div class="summary-item-space"></div>
         <div class="summary-item-label"><h4>MAC Address</h4></div>
         <div class="summary-item-value">{{ device['mac_addr'] }}</div>
+        {% if device['kernel'] %}
+          <div class="summary-item-space"></div>
+          <div class="summary-item-label"><h4>Kernel</h4></div>
+          <div class="summary-item-value kernel-value">{{ device['kernel'] }}</div>
+        {% endif %}
       </div>
     </div>
       <div class="summary-device-modules">

resources/test_packs/qualification/config.json

@@ -176,6 +176,10 @@
         {
           "name": "security.tls.v1_3_client",
           "required_result": "Informational"
+        },
+        {
+          "name": "security.http.server",
+          "required_result": "Informational"
         }
       ]
 }

resources/test_packs/qualification/report_templates/summary.jinja

@@ -13,6 +13,11 @@
       <div class="summary-item-space"></div>
       <div class="summary-item-label"><h4>MAC Address</h4></div>
       <div class="summary-item-value">{{ device['mac_addr'] }}</div>
+      {% if device['kernel'] %}
+        <div class="summary-item-space"></div>
+        <div class="summary-item-label"><h4>Kernel</h4></div>
+        <div class="summary-item-value kernel-value">{{ device['kernel'] }}</div>
+      {% endif %}
     </div>
   </div>
     <div class="summary-device-modules">