Improve Gateway authentication and static HTTP fidelity

test_profile.py

@@ -43,6 +43,40 @@ try:
     ns = {'c': 'http://citrix.com/authentication/response/1'}
     assert root.find('c:AuthenticationRequirements/c:PostBack', ns).text == '/nf/auth/doAuthentication.do'
     assert len(root.findall('.//c:Requirement', ns)) == 3
+    status, headers, xml = request('/nf/auth/doAuthentication.do', 'POST',
+                                   b'login=profile-check&passwd=synthetic',
+                                   {'Content-Type': 'application/x-www-form-urlencoded'})
+    root = ET.fromstring(xml)
+    labels = root.findall('.//c:Label', ns)
+    assert any(label.find('c:Type', ns).text == 'error' for label in labels)
+    assert root.find('c:Result', ns).text == 'more-info'  # Never grant authentication.
+    assert request('/nf/auth/not-a-real-endpoint.do')[0] == 404
+    assert request('/nf/auth/doAuthentication.do')[0] == 405
+    assert b'<script>' not in html and b'<style>' not in html  # Compatible with our CSP.
+    for path in ('/vpn/js/rdx/core/css/rdx.css', '/vpn/js/rdx.js', '/logon/LogonPoint/login.js'):
+        status, headers, asset = request(path)
+        assert status == 200 and asset and 'Set-Cookie' not in headers
+        assert 'no-store' not in headers['Cache-Control']
+        assert request(path, headers={'If-None-Match': headers['ETag']})[0] == 304
+        assert request(path, headers={'If-None-Match': 'W/' + headers['ETag']})[0] == 304
+        assert request(path, headers={'If-Modified-Since': headers['Last-Modified']})[0] == 304
+        assert request(path, headers={'If-Modified-Since': 'invalid'})[0] == 200
+        assert request(path, headers={'If-None-Match': '"different"',
+                                     'If-Modified-Since': headers['Last-Modified']})[0] == 200
+        head = request(path, 'HEAD')
+        assert head[0] == 200 and head[2] == b'' and int(head[1]['Content-Length']) == len(asset)
+        before = len(events)
+        status, rejected_headers, _ = request(path, 'POST', b'capture-only-check-method')
+        assert status == 405 and rejected_headers['Allow'] == 'GET, HEAD'
+        assert any(e['event'] == 'request_body' and e['evidence']['bytes'] == 25 for e in events[before:])
+    before = len(events)
+    assert request('/nscsp_violation/report_uri', 'POST', b'{}',
+                   {'Content-Type': 'application/csp-report'})[0] == 204
+    assert any(e['event'] == 'request_body' and e['evidence']['bytes'] == 2 for e in events[before:])
+    assert request('/nscsp_violation/report_uri')[0] == 405
+    status, headers, body = request('/cgi/logout')
+    assert status == 302 and headers['Location'] == '/vpn/index.html' and body == b''
+    assert 'Max-Age=0' in headers['Set-Cookie']
     # Inert markers, no exploit syntax or commands. Original intake still correlated.
     status, _, _ = request('/unknown', 'POST', b'base64=inert-marker',
                            {'Content-Type': 'application/x-www-form-urlencoded', 'X_Test': 'NSPPE inert-marker'})