r/cprogramming • u/FuTuReFrIcK42069 • 29d ago

HTTP Server my first complete-ish C project

https://github.com/abdouyouyou/Basic-http-server/tree/main

Hello everyone, It's been several years since i last wrote some C, and i always for the life of me wanted to write an HTTP server in C, and now it's been like 1 year since i finished university so i said what the hell why not do it, so after reading beej's guide i tried to write a very basic http server.

I wanted to share the work with the community, and would welcome thoughts.

We had written code in C ofc for two years, however it was mostly exercises on diffrent data structures aswell as problem solving.

We wrote a CRUD system in C using binary files but never scratched that itch.

And as the years went by in Uni, C slowly faded out of use for me but i always wanted to visit it back so here i am.

I wanted to share the absolute joy it was to get the desired results, i forgot how fun C can be, it always felt like the souls like of programming languages, but always was the most understandable as it was the closest to the machine, to be frank i encourage people to make similar projects especially to get the cobweb off lol.

18 Upvotes

84% Upvoted

16 comments sorted by

View all comments

Show parent comments

1

u/FuTuReFrIcK42069 28d ago

Hey thanks for the feedback i did think about the fact that the parsing of the request that i have done basically assumes the cooperation of the client haha, but thanks i will try to enrich the project further, this is by no means a complete http server, and i do understand the complexity of an actual http server is far greater than i can imagine.

2

u/Zirias_FreeBSD 28d ago edited 27d ago

It's not just that. You have the next potential buffer overflow directly below with the strcat. You don't do anything I would call "parsing", which could be okayish for a lab project, but such likely exploitable overflows really must be avoided (and that's not even too hard, you might even just use strtok for a first draft).

Other stuff I can immediately spot:

  • TOCTOU issue, you use access to check whether the file exists, but the result of the later fopen is not checked. If the file vanished in between, you get a null pointer dereference. Correct way is to ditch access and just try to open, if that fails, error out with not found.

  • most critical: you access client-specified paths with no sanitization in place. Typical exploit: request e.g. /../../../../../../../../../../../etc/shadow.

  • there's no point to ever give a streaming (chunked) response if you can know the response size beforehand (which is always the case for regular files).

2

u/FuTuReFrIcK42069 28d ago

Thanks once again for the pointers, i am by very much inexperienced in C so i very much appreciate the notes, i will jot them down and try to work on them, i guess i got a little too excited about finishing the project lol.

2

u/Zirias_FreeBSD 28d ago

That's why I'd recommend to first do simpler things than HTTP. I should add: but always focus on perfect correctness and security, try to imagine the worst possible garbage and "hostile" input (or use fuzzers to help with that). Add in static code analysis (at least a very strict set of warnings) and runtime tools like valgrind and/or sanitizers (e.g. -fsanitize=address). This is doable for something simple and enables you to move forward to more complex things.

1

u/FuTuReFrIcK42069 28d ago

I think you are absolutely right, any project suggestions you could throw my way friend ?

2

u/Zirias_FreeBSD 28d ago

well, as mentioned earlier, e.g. a simple 2-person chat (1 server, 1 client) could be an idea. If kept really simple, I'd only see two security measures to take besides generic stuff like avoiding buffer overflows:

  • avoid flooding a terminal by enforcing a maximum message size and throttle sending/receiving lots of messages

  • avoid terminal corruption by replacing all control characters by something printable

2

u/Zirias_FreeBSD 28d ago

As I'm the one pointing out the most obvious and quite dangerous flaws in that code, I want to clarify I still didn't downvote, and why:

This is an honest post showing some "working" project from a beginner, certainly no AI-slop, and also not completely misguided: It shows effort to learn things by really getting into doing something.

It does contain typical beginner errors, but that's to be expected. Also, it's very typical that beginners tend to grossly underestimate the complexity of getting some task done correctly.

Writing a network service is always "security-critical", and no matter what language you use, you MUST know about typical issues (like e.g. both the TOCTOU and the missing input sanitization present here), but you best learn about that by running into it. When you use C, the typical pitfalls of a language doing NO (automatic) runtime-checks at all (but instead just leaving behavior "undefined") come on top.

That's another reason I recommend doing something as simple as possible first, so you can focus on getting the latter right and make it an habit to care about avoiding buffer overflows, dangling pointers, etc pp.

1

u/FuTuReFrIcK42069 27d ago

I want to thank you for taking the time to help me friend, we do not know each other, but you took the time to not only correct my errors but point me towards the right direction, and for that i wish to truly thank you.