Show HN: Building a web server in assembly to give my life (a lack of) meaning
ymawky is a syscall-only, no-libc web server written entirely in ARM64 assembly for MacOS, featuring path traversal protection and support for various HTTP methods.
This is ymawky (yuh maw kee), a web server written entirely in ARM64 assembly. ymawky is a syscall-only, no libc, fork-per-connection web server written by hand. While it is developed for MacOS, I've tried to make it as portable as possible -- however, it's likely you will still need to make some Significant tweaks to get this to run on Linux/other Unix systems. See Implementation Notes for more details.
Requires Xcode Command Line Tools. Install with xcode-select --install.
ymawky only runs on apple silicon (arm64).
Run make to build. Ensure there is a www/ directory next to the ymawky executable. That's the document root where ymawky searches for files. GET with an empty filename (GET /) will search for www/index.html, so you might want to make sure there's an index.html as well.
ymawky will try to serve static error pages when a client's request results in error, eg 404. The pages it searches for in err/(code).html, so ensure err/ exists alongisde ymawky and www/.
./ymawky to start running the web server on 127.0.0.1:8080. ./ymawky [port] to start running the web server on 127.0.0.1:[port]. ./ymawky [literally-any-character-other-than-0-9] to start running the web server on 127.0.0.1:8080 in debug mode. Debug mode disables forking, and makes ymawky only handle one request.
ymawky is a static-file web server. It doesn't support server-side code to generate content on-the-fly, or more advanced URL parsing. Supported HTTP methods: GET, PUT, DELETE, OPTIONS, HEAD.
Safety precautions ymawky takes:
- Rejects paths >= PATH_MAX (4096 bytes)
- Reject any paths that include path traversal --
/../.. - Confined to
www/. Any path requested getswww/prepended to it. - Rejects any path containing symlinks, with O_NOFOLLOW_ANY.
- PUT writes to a temporary file. Upon successfully receiving the whole file, this temporary file is then renamed to the requested filename.
- Must receive data within 10 seconds to prevent slowloris-like attacks.
MIME types are detected by analyzing the file extension, supporting a wide range of web, image, font, document, video, audio, and archive files.
Source: Hacker News
