Live data from Hacker News

Althttpd: Simple webserver in a single C file

sqlite.org

71–80 of 345 posts

Re: Althttpd: Simple webserver in a single C file

#71
post #22

Earlier quoted context omitted.

That seems like a high risk of http desync attacks, if you're only implementing a subset of http/1.1.

How would one attack a static page?

Why would you even need a reverse proxy for a static page? This isn't about that.

Re: Althttpd: Simple webserver in a single C file

#72
post #35

> A separate process is started for each incoming connection, and that process is wholly focused on serving that one connection. It makes you wonder just how "heavy" operating system processes actually are. We may not need to worry about the complexity of trying to multiple run async requests in a single process/thread in all cases.

So what was the point of the async/callback web programming revolution if processes were good enough?

The point was that you didn't have the ability to spawn new threads at all. async lets you pretend you have threads, at the cost of everything being run through a hidden event loop.

Re: Althttpd: Simple webserver in a single C file

#73
post #50

Earlier quoted context omitted.

Binary protocols aren't (or at least don't have to be) any more difficult and frequently are even easier to implement. Text protocols have difficult problems like escaping or detecting the end of particular field that are frequent source of mistakes. The issue is that many (especially scripting) languages treat binary data as second class. The only real issue is that inspecting the binary message visually is little b…

And capitalisation issues, and encodings… give me a binary protocol to parse any time. They’re normally comparatively well-defined, whereas text protocols are seldom properly defined and so have undefined behaviour left, right and centre, which inevitably leads to security bugs—or even if they are well-defined, they’re probably done in a way that makes your language’s string type unsuitable, and makes parsing more co…

Just use recordflux for binary parser proved absent of runtime errors... ;-)

Re: Althttpd: Simple webserver in a single C file

#75
post #35

> A separate process is started for each incoming connection, and that process is wholly focused on serving that one connection. It makes you wonder just how "heavy" operating system processes actually are. We may not need to worry about the complexity of trying to multiple run async requests in a single process/thread in all cases.

So what was the point of the async/callback web programming revolution if processes were good enough?

It's because they weren't good enough for the thousands of concurrent requests of C10k or the millions that came after it with C10m.

Granted, 10k concurrent requests is a problem for the 1% of websites, so processes were (and still are) good enough for the long tail of personal or small-scale websites.

Re: Althttpd: Simple webserver in a single C file

#76
post #13

Interesting but why? There’s a bazillion web servers out there, surely one of them can do the job? What have I missed?

> [Althttpd ...] has run the https://sqlite.org/ website since 2004 I don't know what the landscape was like in 2004 really, but probably at least an order of magnitude less than today's bazillion (whatever that would be!).

I don't think Nginx was out then, so I was using Apache HTTPD. Maybe Dwayne considered that too heavy for what he needed to serve up.

Re: Althttpd: Simple webserver in a single C file

#77
post #35

> A separate process is started for each incoming connection, and that process is wholly focused on serving that one connection. It makes you wonder just how "heavy" operating system processes actually are. We may not need to worry about the complexity of trying to multiple run async requests in a single process/thread in all cases.

Apache's thread-per-connection model used to run basically the entire internet until nginx came along and demonstrated 10k simultaneous connections on a single server.

If you only have around 100 concurrent confections, a separate thread per connection is entirely feasible. A whole new process is probably fine on Linux, but e.g. Windows takes pretty long to spawn a process

Re: Althttpd: Simple webserver in a single C file

#79
post #24

/* ** Test procedure for ParseRfc822Date */ void TestParseRfc822Date(void){ time_t t1, t2; for(t1=0; t1 There's only two billion integers, guess we can test them all. Well, substantially fewer than two billion with that skip. I wonder if that completes in a few seconds.

That was quite easy to cut and paste and compile:

    $ time ./althttpd-time-parse 
    Test completed in 10518961 us

    real    0m10,521s
    user    0m10,486s
    sys     0m0,004s
The "Test completed" line is from my main() "driver", I wanted to measure time inline too and the measurements seem to agree.

This is on a Dell Latitude featuring a Core i5-7300U at 2.6 GHz, running Ubuntu 20.10.

Re: Althttpd: Simple webserver in a single C file

#80
post #2

Here is the actual single C-code file: https://sqlite.org/althttpd/file?name=althttpd.c Something I absolutely love about text based protocols such as HTTP/1 is how easy you can implement it in any virtually programming language. Sure, the implementation is not top-of-the-notch, but it just damned works, it is portable, it is understandable by humans. That's something what's got lost with HTTP/2 and HTTP/3, respectiv…

Once you have to support HTTP/1.1 it's not really a text-based protocol, because support for chunked encoding is mandatory for clients. (Yes the chunk headers are technically text, but it's interspersed with arbitrary binary data. It's not something you can easily read in a text editor.)

I make most HTTP requests using netcat or similar tcp clients so I write filters that read from stdin. Reading text files with the chunk sizes in hex interspersed is generally easy. Sometimes I do not even bother to remove the chunk sizes. Where it becomes an issue is when it breaks URLs. Here is a simple chunked transfer decoder that reads from stdin and removes the chunk sizes.

   flex -8iCrfa 
Example

Yahoo! serves chunked pages

   printf 'GET / HTTP/1.1\r\nHost: us.yahoo.com\r\nConnection: close\r\n\r\n'|openssl s_client -connect us.yahoo.com:443 -ign_eof|./yy045
Post reply on HN