7 ms·
Show HN: unsafehttp – tiny web server from scratch in C, running on an orange pi
Hey HN, I wanted to get more familiar with C programming, *nix socket programming and C compilation, so I wrote this "web" ""server"". It's running on a tiny SBC in my office, and there's as little as possible between you and it.
Happy for you to try and break it, hopefully with something more interesting than a DoS though :) Please let me know if you find any issues.
- JdeBP 1y agoYou are lucky that all of your sample files have dots in their names. (-:
- a1o 1y agoI don't understand this, could you explain?
- kjellsbells 1y agoaround line 663. there's a call to strrchr, checking for a period in the filename. then immediately after that, there's a strlen that uses the results. Which is fine, unless the first call returns NULL, because there was no period in the name, and then the program will crash.
- GSGBen 1y agoOof, thanks.
- JdeBP 1y agoMuch has been said about Daniel J. Bernstein eschewing the Standard C library in publicfile and other softwares. But Bernstein's str_rchr() function was designed to expressly avoid this well-known gotcha of the Standard C string functions. Here's str_rchr() which uses the offset of the terminating NUL as the returned sentinel value: * https://github.com/jdebp/djbwares/blob/trunk/source/str_rchr.c https://github.com/jdebp/djbwares/blob/trunk/source/str_rchr... And here's it being used (by publicfile's httpd and indeed other programs) to find the basename's extension in order to infer a content type: * https://github.com/jdebp/djbwares/blob/trunk/source/filetype.c https://github.com/jdebp/djbwares/blob/trunk/source/filetype... The extension is always a non-NULL string, that can always be passed to str_equal(). It is just sometimes a zero-length string. It's possible, but a bit clunky, to achieve the same effect with two successive calls to Standard C/C++ strrchr(), or strchr(), the second being: if (!result) result = std::strchr(s, '\0'); Here's me doing that in my own code: * https://github.com/jdebp/nosh/blob/c8d635c284b41b483067d5f58a01adc5ead5787a/source/setgid-fromenv.cpp#L52 https://github.com/jdebp/nosh/blob/c8d635c284b41b483067d5f58... One can get very lost in the weeds on the comparative merits on different instruction architectures of compiler intrinsics, explicit loop unrolling, whole program optimization, and whatnot. (-:
- joncfoo 1y agoDoesn't seem to be up =\
- GSGBen 1y agoFound the issue - a use after free in send_response() if I close the session early due to an error. Was continuing to the next bit. Put a temp fix in place, will push a proper one later.
- GSGBen 1y agoStill seems to have an issue, but no output before the crash. Will have to do some more debugging. Thanks for the test HN! Source is here btw: https://github.com/GSGBen/unsafehttp/blob/main/src/main.c https://github.com/GSGBen/unsafehttp/blob/main/src/main.c
- Retr0id 1y agohotfixing httpd UAFs is peak HN spirit :)
- GSGBen 1y agoWhoops, should be back up now. I'll have to check logs later to see why it went down.
- eyjafjallajokul 1y agoYou're going to need a bigger host to support HN traffic :)
- 201984 1y agoWhat is it about HN that overwhelms small servers like this? It was a small static page so I wouldn't think it'd be that much load on the server itself, even for an OrangePi like this one. Too many simultaneous connections for his router maybe? Or too much bandwidth for his internet connection?
- p0w3n3d 1y agoI would expect GitHub page. The server seems down
- 201984 1y agoIt had a link to the GitHub page while it was still up. https://github.com/GSGBen/unsafehttp https://github.com/GSGBen/unsafehttp
- MelvinButtsESQ 1y agoConsider it broke. You are getting hugged to death by HN. Throw Cloudlfare in front.
- GSGBen 1y agoShould be back up now with a very temporary workaround in place.
- contingencies 1y agoAre you near Sydney? I noted a possible link to the Central Coast. I will contribute a smaller device if you're game to host it. PS. You may be unaware that your shortened domain name 'benren' from your whois-available real name means "stupid person" in Mandarin. Only noted because there is a company registered with the same name since 1999. On the off chance it's yours, probably not the best marketing in a global world. Just throwing it out there.
- chuckadams 1y agoConsidering how much of even the English-speaking world is using a version control system named git…
- qskousen 1y agoAlmost everything is going to sound like something else in some other language, I don't know that there's much you can do about that. On the plus side, maybe the silly association will make the name stick in people's heads!
- nneonneo 1y agoIt could be self-deprecating! Plus, I would more readily read it as 本人 (this person/me/myself) - than as 笨人 (stupid person). Also, Pinyin is more susceptible to accidental interpretations than most writing systems due to ambiguity and tonality. For example, “mana” can be parsed into 32 different syllable-tone combinations (man/a or ma/na times 4x4 tone combinations for each syllable), and while most aren’t meaningful, that still gives you a ton of potential words to match against.
- Hydraulix989 1y agoI saw the title, and this is everything I have ever hoped for.
- throwaway1492 1y agoNice effort but this isn’t interesting at all. You skipped the most interesting part; parsing http. This is beejs networking tutorial with writing a file to a socket. Harsh? Maybe, but you’re posting this to a site with some of the most talented developers on planet. Real talk, sorry.
- roominator 1y agonah this is pretty cool
- bevr1337 1y agoShitty reply and this critique isn't helpful at all. You assumed the most interesting part; the thing you personally want. Harsh? Maybe, but you're posting this to a site with some of the most jaded developers on the planet. Not sorry.
- bevhill 1y agoI swear that the only thing that draws people to this industry is the desire to escape their home village. It certainly isn't the quality of conversation with like-minded tinkerers. It's just losers like you who think a big paycheck for playing with Jira means you're the smartest boy in the world. God help us.
- tom_ 1y agoParsing HTTP is entirely unnecessary. That's the web client's job.
- integralid 1y agoDo you mean parsing HTML? HTTP is the protocol they use to communicate, so both client and server must speak it. Or did I misunderstand you?
- tom_ 1y agoNo, brain fart on my part. You can use llhttp, which is pretty easy to use: https://github.com/nodejs/llhttp https://github.com/nodejs/llhttp
- lionkor 1y agoI've got a similar one, but with http 1.0 and partial 1.1 support, multi threaded, etc. in C https://GitHub.com/lionkor/http https://GitHub.com/lionkor/http
- GSGBen 1y agoNoice!
- rwmj 1y agoHere's one I wrote 25 years ago that was actually used in production for about a decade. For reasons, it ran on a server with 128MB of RAM and served a web/JS chat server for a large number of schools in England. http://git.annexia.org/?p=rws.git;a=tree http://git.annexia.org/?p=rws.git;a=tree
- nneonneo 1y agoIf you want to make it actually decently safe, one approach would be to make a list of all the syscalls you critically need after you have loaded all the content in memory (strace can help), then write a seccomp filter to block all the others. Since you don’t need filesystem interaction or pretty much anything except socket I/O, your syscall allowlist can be pretty short. This will ensure that even if an attacker manages to exploit a bug (like a UAF) they’ll be dropped into a sandbox with very little useful functionality.
- cenamus 1y agoOr (if on openbsd), the pledge and unveil syscalls. Pretty similar effect, but much easier
- mwcremer 1y agoReminds me of Jef Poskanzer’s micro_http: https://acme.com/software/micro_httpd/ https://acme.com/software/micro_httpd/
- SJC_Hacker 1y agoEasiest way to make it safe is 1) Run it in a container 2) Isolate it through a reverse proxy, probably nginx
- antonvs 1y ago3) Deploy on a cloud provider’s managed Kubernetes behind a WAF. Now it’s web scale!
- integralid 1y agoThis doesn't make it safe. It can still be exploited and used to join a botnet, as a proxy, to mine cryptocurrency, to spy on requests or redirect users to malicious websites or phish them, to host malware...
- SJC_Hacker 1y agoMaybe but at least the damage is isolated … can always just restart container Also I’m curious how a bonnet can get through a container … outgoing connections should be blocked by default
- nullify88 1y agoGood to see more tiny / small http servers. I'm not a fan of sticking Nginx in a container which maybe bigger than the assets its serving. A statically compiled httpd from busybox has been great for this reason but its good to see more options.
- nurettin 1y agoThis should be a rite of passage: Read a sizeable RFC and make a passable implementation.
- Joker_vD 1y ago// it doesn't seem to love piping or redirecting output without this, even // with the newlines above fflush(stdout); Ah, the full buffering mode. I believe it can be fixed by calling setvbuf(stdout, NULL, _IOLBF, BUFSIZ); once at the start. On the whole, it actually almost implements the minimally required amount of HTTP/1.1: I would suggest adding support for HEAD requests, it's just a single flag that you need to set in the try_parse_request_path(), and check in generate_response(). Also, probably check that the request path is followed by "HTTP/1." before sending the response? And I'd really recommend finishing reading out all of the request from the socket (that is, until you've seen "\r\n\r\n"), or you may run into the problem of your clients not being sent the complete response [0]. But other than that, yeah, it is an HTTP server. The HTTP protocol is decently well thought out so that you can be oblivious of most of the features you don't want to support. [0] https://blog.netherlabs.nl/articles/2009/01/18/the-ultimate-so_linger-page-or-why-is-my-tcp-not-reliable https://blog.netherlabs.nl/articles/2009/01/18/the-ultimate-... — the tl;dr is that if you do close() on a socket that still has the data from the client you haven't recv()d, the client will be sent an RST.
- GSGBen 1y agoAh yep, I read about the TCP RST problem in one of the RFC docs, then promptly forgot about it and never implemented anything to avoid it. Thankyou for the detailed notes.
- gurjeet 1y ago> RFC 9112 is a fantastic document that details the exact format of HTTP 1.1 requests, how servers should respond to those requests ... > This server follows almost none of that. This made me chuckle :-)
- sgbeal 1y agoThe comedy continues in the next paragraph: > Readers MUST NOT hold this against the project, and SHOULD use this as motivation to keep some of their own side projects fun and short. That's comedy gold, right there. (Tip: RFC-2119)
- rurban 1y agoI also have a tiny one, used in production with custom decompression and decryption for some IoT devices in the field, which push sensor updates to it. http 1.0 PUT only, multi-threaded and super efficient. One page only (about 50 lines or so). Pretty safe.
- deleted 1y ago[deleted]