3 ms·
Yes, http.sys is an http server implemented in the Windows Kernel it’s the http server IIS and all other http based windows services use and has an API for 3rd
by dogma1138 8y ago
Yes, http.sys is an http server implemented in the Windows Kernel it’s the http server IIS and all other http based windows services use and has an API for 3rd party servers.
https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/introduction-to-iis-architecture#hypertext-transfer-protocol-stack-httpsys https://docs.microsoft.com/en-us/iis/get-started/introductio...
The point being that there are advantages to implementing a kernel or hybrid mode HTTP server and Microsoft has done it on Windows some other implementations exist but other than MF/Big Unix I’ve never seen them in actual use.
I don’t think there is much of a point of implementing an HTTP client library in the kernel tho since the performance should be an issue really on the client side.
- mentat 8y agoThe history of IIS vulnerabilities with in kernel execution and the time it takes to get comprehensive patching seem like pretty substantial disadvantages.
- dogma1138 8y agoI don’t necessarily disagree that there are disadvantages as well that said I got by far more often root on boxes due to core server or application level vulns on Linux machines than system on Windows boxes through an IIS vuln (app vulns are still a problem as well as running your worker services as privileged users but that isn’t related to http.sys) since those are more often than not patched.