fekberg/gohttp

This is a simple, work-in progress web server written in C for Linux.

GoHttp

GoHttp is a simple web server written in C for educational purposes. This web server runs on GNU/Linux.

NOT FOR PRODUCTION USE!

What is implemented?

This web server is far from complete and the purpose of it is to be very light weight to give an idea of where to start when wanting to understand web servers and C.

It supports GET and HEAD so you can use it to receive any files that correspond with the mime types in mime.types.

I want to add support for POST, can I contribute?

Sure! If you want to send a pull request please do! Keep in mind though that this is for educational purposes so keep the code clean and understandable - no golfing!

How do I run it?

1. Download the source
2. Compile the source using GCC
3. Run

Command line arguments

You can start the web server with the following command line arguments:

-p port number
-d run as daemon
-l log file

What about configuration?

You can open httpd.conf and change the following:

wwwroot /home/frw/public_html/
port 7000

Credit

If it weren't for the course in Advance UNIX Programming that I took at Blekinge Institute of Technology I would never have written this. It all originated from a question on StackOverflow from 2009 where I asked for information on how to write a simple web server in C.

gohttp's Issues

Cannot find wait.h on Mac

When I try to compile the app I get an error saying "Cannot find file wait.h" when compiling on Mac OSX Mavericks.

To fix this, I had to change wait.h to sys/wait.h which allows it to compile correctly. I am not sure if this is just a Mac issue or not but I will leave it up to you to decide if you want to make the change!

Stack Buffer Overflow when requesting excessively long URL when compiled with ASAN.

Screen -S Server
./GoHTTP
CTRL-A, D
Screen -S Crash
python -c "print 'A' * 50000" > file
curl 127.0.0.1:4000/$(cat file)
CTRL-A, D
Screen -R Server

==9330==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffcea552b20 at pc 0x7fcfe397420b bp 0x
7ffcea552850 sp 0x7ffcea551ff8
READ of size 519 at 0x7ffcea552b20 thread T0
#0 0x7fcfe397420a in __interceptor_strlen (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x7020a)
#1 0x4022c1 in scan (/root/GoHttp/GoHTTP+0x4022c1)
#2 0x4033c5 in getRequestType (/root/GoHttp/GoHTTP+0x4033c5)
#3 0x403599 in receive (/root/GoHttp/GoHTTP+0x403599)
#4 0x4037da in handle (/root/GoHttp/GoHTTP+0x4037da)
#5 0x403881 in acceptConnection (/root/GoHttp/GoHTTP+0x403881)
#6 0x4038db in start (/root/GoHttp/GoHTTP+0x4038db)
#7 0x40406d in main (/root/GoHttp/GoHTTP+0x40406d)
#8 0x7fcfe284d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#9 0x401808 in _start (/root/GoHttp/GoHTTP+0x401808)

Address 0x7ffcea552b20 is located in stack of thread T0 at offset 544 in frame
#0 0x4034a0 in receive (/root/GoHttp/GoHTTP+0x4034a0)

This frame has 1 object(s):
[32, 544) 'buffer' <== Memory access at offset 544 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions are supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ??:0 __interceptor_strlen
Shadow bytes around the buggy address:
0x10001d4a2510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10001d4a2520: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00
0x10001d4a2530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10001d4a2540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10001d4a2550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10001d4a2560: 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 00 00 00 00
0x10001d4a2570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10001d4a2580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10001d4a2590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10001d4a25a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10001d4a25b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==9330==ABORTING

How does `socket` differ from `connecting_socket` at 523 and 527?

https://github.com/fekberg/GoHttp/blob/master/GoHttp.c#L523
https://github.com/fekberg/GoHttp/blob/master/GoHttp.c#L527

socket and connecting_socket have the same value here, right?

Heap Buffer Overflow when appending certain size string to URL file extension when compiled with ASAN.

Screen -S Server
./GoHTTP
CTRL-A, D

Screen -S Crash
curl 127.0.0.1:4000/hi.htmlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
CTRL-A, D

ASAN Details:
==9376==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000efbb at pc 0x000000402e44 bp 0x7
ffd9e6f3a70 sp 0x7ffd9e6f3a60
WRITE of size 1 at 0x60200000efbb thread T0
#0 0x402e43 in GetExtension (/root/GoHttp/GoHTTP+0x402e43)
#1 0x40307f in handleHttpGET (/root/GoHttp/GoHTTP+0x40307f)
#2 0x4035b7 in receive (/root/GoHttp/GoHTTP+0x4035b7)
#3 0x4037da in handle (/root/GoHttp/GoHTTP+0x4037da)
#4 0x403881 in acceptConnection (/root/GoHttp/GoHTTP+0x403881)
#5 0x4038db in start (/root/GoHttp/GoHTTP+0x4038db)
#6 0x40406d in main (/root/GoHttp/GoHTTP+0x40406d)
#7 0x7f022305a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#8 0x401808 in _start (/root/GoHttp/GoHTTP+0x401808)

0x60200000efbb is located 1 bytes to the right of 10-byte region [0x60200000efb0,0x60200000efba)
allocated by thread T0 here:
#0 0x7f02241a9602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x402f2c in handleHttpGET (/root/GoHttp/GoHTTP+0x402f2c)
#2 0x4035b7 in receive (/root/GoHttp/GoHTTP+0x4035b7)
#3 0x4037da in handle (/root/GoHttp/GoHTTP+0x4037da)
#4 0x403881 in acceptConnection (/root/GoHttp/GoHTTP+0x403881)
#5 0x4038db in start (/root/GoHttp/GoHTTP+0x4038db)
#6 0x40406d in main (/root/GoHttp/GoHTTP+0x40406d)
#7 0x7f022305a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 GetExtension
Shadow bytes around the buggy address:
0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9df0: fa fa fa fa fa fa 00[02]fa fa 05 fa fa fa 00 02
0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==9376==ABORTING

Forking doesn't work

Forking the process to allow multiple requests at once doesn't work. If you spam it the webserver just crashes.

Heap Use-After-Free Notification when compiling with ASAN on Ubuntu 16 GCC 5.4

Steps to reproduce:

Compile GoHTTP Server (GCC and ASAN flags/LIBS).

Screen -S server
cd GoHTTP
./GoHTTP
CTRL-A, D (Detach from session)
Screen -S Request
curl 127.0.0.1:$runningport/hi.html
CTRL-A, D
Screen -R server

Dump:
==9215==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000009dc0 at pc 0x7ff1c4d5620b bp 0x7f
fe6d5acce0 sp 0x7ffe6d5ac488
READ of size 2 at 0x611000009dc0 thread T0
#0 0x7ff1c4d5620a in __interceptor_strlen (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x7020a)
#1 0x401d9c in sendHeader (/root/GoHttp/GoHTTP+0x401d9c)
#2 0x4032bc in handleHttpGET (/root/GoHttp/GoHTTP+0x4032bc)
#3 0x4035b7 in receive (/root/GoHttp/GoHTTP+0x4035b7)
#4 0x4037da in handle (/root/GoHttp/GoHTTP+0x4037da)
#5 0x403881 in acceptConnection (/root/GoHttp/GoHTTP+0x403881)
#6 0x4038db in start (/root/GoHttp/GoHTTP+0x4038db)
#7 0x40406d in main (/root/GoHttp/GoHTTP+0x40406d)
#8 0x7ff1c3c2f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#9 0x401808 in _start (/root/GoHttp/GoHTTP+0x401808)

0x611000009dc0 is located 0 bytes inside of 200-byte region [0x611000009dc0,0x611000009e88)
freed by thread T0 here:
#0 0x7ff1c4d7e2ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
#1 0x40289d in checkMime (/root/GoHttp/GoHTTP+0x40289d)
#2 0x4030f2 in handleHttpGET (/root/GoHttp/GoHTTP+0x4030f2)
#3 0x4035b7 in receive (/root/GoHttp/GoHTTP+0x4035b7)
#4 0x4037da in handle (/root/GoHttp/GoHTTP+0x4037da)
#5 0x403881 in acceptConnection (/root/GoHttp/GoHTTP+0x403881)
#6 0x4038db in start (/root/GoHttp/GoHTTP+0x4038db)
#7 0x40406d in main (/root/GoHttp/GoHTTP+0x40406d)
#8 0x7ff1c3c2f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here:
#0 0x7ff1c4d7e602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x402f3a in handleHttpGET (/root/GoHttp/GoHTTP+0x402f3a)
#2 0x4035b7 in receive (/root/GoHttp/GoHTTP+0x4035b7)
#3 0x4037da in handle (/root/GoHttp/GoHTTP+0x4037da)
#4 0x403881 in acceptConnection (/root/GoHttp/GoHTTP+0x403881)
#5 0x4038db in start (/root/GoHttp/GoHTTP+0x4038db)
#6 0x40406d in main (/root/GoHttp/GoHTTP+0x40406d)
#7 0x7ff1c3c2f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-use-after-free ??:0 __interceptor_strlen
Shadow bytes around the buggy address:
0x0c227fff9360: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c227fff9370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff9380: 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff9390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c227fff93a0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
=>0x0c227fff93b0: fa fa fa fa fa fa fa fa[fd]fd fd fd fd fd fd fd
0x0c227fff93c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c227fff93d0: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff93e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

uname -ar
Linux 4.4.0-148-generic #174-Ubuntu SMP Tue May 7 12:20:14 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
root@:~/GoHttp# cat httpd.conf
wwwroot /home/frw/public_html/
port 4000

Unable to open file

If you press and hold F5 and "stress" the server, the file you request will sometimes be unavailable.

Scan doesn't return length of output

Scan returns the length of the string from 0 to the end of the output. If this is unintended behavior, I would suggest returning i - start instead of i.

Write an introduction blog post

Write a blog post about the web server and how everything in it works so far. Explain the basics of HTTP and the parsing that is done and how the files are delivered to the client.

Fix/Find buffer overflows

There's potential buffer overflows. Fix them ASAP.

stack-buffer-overflow 619 characters in User-Agent string causes stack-overflow.

root@0xGotcha:~/fuzzing/GoHttp# curl -A "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" localhost:7000

root@0xGotcha:~/fuzzing/GoHttp# ./GoHttp 
Settings:
Port:			7000
Server root:		/home/frw/public_html/
Configuration file:	httpd.conf
Logfile:		.log
Deamon:			0
=================================================================
==1666==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff1110bd40 at pc 0x000000487f40 bp 0x7fff1110bae0 sp 0x7fff1110b290
READ of size 513 at 0x7fff1110bd40 thread T0
    #0 0x487f3f  (/root/fuzzing/GoHttp/GoHttp+0x487f3f)
    #1 0x51718b  (/root/fuzzing/GoHttp/GoHttp+0x51718b)
    #2 0x517412  (/root/fuzzing/GoHttp/GoHttp+0x517412)
    #3 0x517972  (/root/fuzzing/GoHttp/GoHttp+0x517972)
    #4 0x517c21  (/root/fuzzing/GoHttp/GoHttp+0x517c21)
    #5 0x517cbc  (/root/fuzzing/GoHttp/GoHttp+0x517cbc)
    #6 0x518656  (/root/fuzzing/GoHttp/GoHttp+0x518656)
    #7 0x7fc656ca009a  (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
    #8 0x41d439  (/root/fuzzing/GoHttp/GoHttp+0x41d439)

Address 0x7fff1110bd40 is located in stack of thread T0 at offset 544 in frame
    #0 0x51728f  (/root/fuzzing/GoHttp/GoHttp+0x51728f)

  This frame has 1 object(s):
    [32, 544) 'buffer' (line 522) <== Memory access at offset 544 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/root/fuzzing/GoHttp/GoHttp+0x487f3f) 
Shadow bytes around the buggy address:
  0x100062219750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100062219760: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00
  0x100062219770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100062219780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100062219790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1000622197a0: 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3
  0x1000622197b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000622197c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000622197d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000622197e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000622197f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1666==ABORTING

Clean up and refactor the code

The code needs to be refactored, the method names and variables should correspond with the C standard.