5 ms·

Doesn't seem to be up =\

by joncfoo 1y ago

GSGBen 1y ago
Whoops, should be back up now. I'll have to check logs later to see why it went down.
- eyjafjallajokul 1y ago
  You're going to need a bigger host to support HN traffic :)
  - 201984 1y ago
    What is it about HN that overwhelms small servers like this? It was a small static page so I wouldn't think it'd be that much load on the server itself, even for an OrangePi like this one. Too many simultaneous connections for his router maybe? Or too much bandwidth for his internet connection?
    - binaryturtle 1y ago
      If they are behind a NAT/ stateful firewall there is just so much connections it will handle at once. I think OpenWRT has like 16K max by default, f.ex. So for less than 16K requests by different users/IPs… each is kept for about 1 minute I think… it quickly will go down, I guess. :) cat /proc/sys/net/netfilter/nf_conntrack_max Should give some details.
      - 201984 1y ago
        Do you know if using the DMZ feature on most routers instead of port forwarding would get around this limit, or if there's any other way?
        binaryturtle 1y ago
        With OpenWRT we can increase the limit, if needed. But it's a delicate process you need to balance out carefully depending on your router. I doubled my slots and it works fine: It's done via /etc/sysctl.conf > net.netfilter.nf_conntrack_max=32768 Afterwards "sysctl -p" to apply/ reload the config file. But increasing blindly is a bad idea… it needs to be done with ip_conntrack_buckets in sync for proper balance (memory use, CPU usage). Best to read upon it. But just going from 16K to 32K shouldn't be any problem for most routers these days.
  - 1vuio0pswjnm7 1y ago
    I wish submitters would try using .onion sites for small static pages, for example as an alternative URL Fewer source IPs
GSGBen 1y ago
Found the issue - a use after free in send_response() if I close the session early due to an error. Was continuing to the next bit. Put a temp fix in place, will push a proper one later.
- GSGBen 1y ago
  Still seems to have an issue, but no output before the crash. Will have to do some more debugging. Thanks for the test HN! Source is here btw: https://github.com/GSGBen/unsafehttp/blob/main/src/main.c https://github.com/GSGBen/unsafehttp/blob/main/src/main.c
- Retr0id 1y ago
  hotfixing httpd UAFs is peak HN spirit :)

Doesn't seem to be up =\

GSGBen 1y ago

Whoops, should be back up now. I'll have to check logs later to see why it went down.

eyjafjallajokul 1y ago
You're going to need a bigger host to support HN traffic :)
- 201984 1y ago
  What is it about HN that overwhelms small servers like this? It was a small static page so I wouldn't think it'd be that much load on the server itself, even for an OrangePi like this one. Too many simultaneous connections for his router maybe? Or too much bandwidth for his internet connection?
  - binaryturtle 1y ago
    If they are behind a NAT/ stateful firewall there is just so much connections it will handle at once. I think OpenWRT has like 16K max by default, f.ex. So for less than 16K requests by different users/IPs… each is kept for about 1 minute I think… it quickly will go down, I guess. :) cat /proc/sys/net/netfilter/nf_conntrack_max Should give some details.
    - 201984 1y ago
      Do you know if using the DMZ feature on most routers instead of port forwarding would get around this limit, or if there's any other way?
      - binaryturtle 1y ago
        With OpenWRT we can increase the limit, if needed. But it's a delicate process you need to balance out carefully depending on your router. I doubled my slots and it works fine: It's done via /etc/sysctl.conf > net.netfilter.nf_conntrack_max=32768 Afterwards "sysctl -p" to apply/ reload the config file. But increasing blindly is a bad idea… it needs to be done with ip_conntrack_buckets in sync for proper balance (memory use, CPU usage). Best to read upon it. But just going from 16K to 32K shouldn't be any problem for most routers these days.
- 1vuio0pswjnm7 1y ago
  I wish submitters would try using .onion sites for small static pages, for example as an alternative URL Fewer source IPs

GSGBen 1y ago

Found the issue - a use after free in send_response() if I close the session early due to an error. Was continuing to the next bit. Put a temp fix in place, will push a proper one later.

GSGBen 1y ago
Still seems to have an issue, but no output before the crash. Will have to do some more debugging. Thanks for the test HN! Source is here btw: https://github.com/GSGBen/unsafehttp/blob/main/src/main.c https://github.com/GSGBen/unsafehttp/blob/main/src/main.c
Retr0id 1y ago
hotfixing httpd UAFs is peak HN spirit :)