Re: anybody auditing/benchmarking jan kneschkes lighttpd?

On Mon, Jun 28, 2004 at 08:24:41PM +0200, Clemens Fischer wrote:
> * Frank:
> 
> > lighttpd:
> > [root@a00 gatling]# time ./httpbench -k -c 1000 -i 10 -s 5
> > http://127.0.0.1:80/README.httpbench
> >
> > real    0m0.946s
> > user    0m0.029s
> > sys     0m0.227s
> 
> interesting.  lighttpd is rather feature complete.  it even has fast-cgi.
> and it's only a bit slower than gatling.  what interests me most now is
> this:  is the code secure (enough) compared to fnord and gatling?

Hi,

(from the lighttpd side)

We have taken care of several issues while programming lighttpd. We not
expected to suffer from buffer overflows or format string errors as the
while set of C-string functions in wrapped into our own buffer_*
function set.

- sprintf() is only used in two places were it is assured that the
  buffer can't grow
- strcpy() is only used in two places directly where all length are
  check before copying
- in general all *printf() are not use in the main-path as they are too
  heavy wight
- the only heavy weight function that is use regulary is strftime()
  which is covered by the buffer handling

That's our protection at from the code-side, at runtime we have
chroot(), changing uid + gid and a tight HTTP-header parser which
implementes the rules of the RFC (convince yourself and take a look at
the requect.c, request_check_hostname() for parsing the Host: field
which caused alot problems with a few other OSS webservers leading to
path traversal and the like.

Another entry point for path traversal would be the insecure handling of
url-encoding URI handling which is can care of since the first release.
see response.c, line 908.

I hope that answers the question good enough for you.
 
>   clemens
 
    Jan
  
-- 
Jan Kneschke                                     http://jan.kneschke.de/
Perhaps you want to say 'thank you, jan':    http://jk.123.org/wishlist/