mirror of
https://github.com/bdnugget/kcgi.git
synced 2026-11-07 05:47:27 +00:00
491 lines
22 KiB
XML
491 lines
22 KiB
XML
<!DOCTYPE html>
|
|
<html lang="en" prefix="og: http://ogp.me/ns#">
|
|
<head>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<meta charset="utf-8" />
|
|
<title>kcgi | minimal CGI and FastCGI library for C/C++</title>
|
|
<link rel="alternate" href="atom.xml" type="application/atom+xml" title="kcgi version feed" />
|
|
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css" />
|
|
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Alegreya+Sans:400,400italic,500,700" />
|
|
<link rel="stylesheet" href="https://bsd.lv/css/style.css" />
|
|
<link rel="stylesheet" href="index.css" />
|
|
<meta property="og:title" content="kcgi: minimal CGI and FastCGI library for C/C++" />
|
|
<meta property="og:description"
|
|
content="A C/C++ library for security-oriented web applications." />
|
|
<meta property="og:url" content="https://kristaps.bsd.lv/kcgi/index.html" />
|
|
<meta property="og:type" content="website" />
|
|
<meta name="description"
|
|
content="A C/C++ library for security-oriented web applications." />
|
|
</head>
|
|
<body itemscope="itemscope" itemtype="http://schema.org/SoftwareApplication">
|
|
<header>
|
|
<section id="breadcrumbs" class="text">
|
|
<a href="https://www.bsd.lv">BSD.lv</a> tools for <a href="https://learnbchs.org">BCHS</a>:
|
|
<a href="https://kristaps.bsd.lv/kcgi">kcgi</a>,
|
|
<a href="https://kristaps.bsd.lv/sqlbox">sqlbox</a>,
|
|
<a href="https://kristaps.bsd.lv/openradtool">ort</a>
|
|
</section>
|
|
<section id="header" class="text">
|
|
<h1>
|
|
<a href="index.html" itemprop="name" class="nm">kcgi</a>
|
|
–
|
|
<span itemprop="description" class="nd">minimal CGI and FastCGI library for C/C++</span>
|
|
</h1>
|
|
<nav>
|
|
<span class="version">
|
|
Version
|
|
<nav data-sblg-nav="1" data-sblg-navtag="version"
|
|
data-sblg-navsz="1" data-sblg-navxml="1">
|
|
${sblg-titletext}
|
|
</nav>
|
|
</span>
|
|
<a title="Source code" itemprop="downloadURL" href="snapshots/kcgi.tgz">
|
|
<i class="fa fa-fw fa-gears"></i>
|
|
</a>
|
|
<a title="Source fingerprint" href="snapshots/kcgi.tgz.sha512">
|
|
<i class="fa fa-fw fa-lock"></i>
|
|
</a>
|
|
<a title="Source archive" href="snapshots">
|
|
<i class="fa fa-fw fa-archive"></i>
|
|
</a>
|
|
<a title="Source repository" href="https://www.github.com/kristapsdz/kcgi">
|
|
<i class="fa fa-fw fa-github"></i>
|
|
</a>
|
|
<a title="Version feed" href="atom.xml">
|
|
<i class="fa fa-fw fa-rss"></i>
|
|
</a>
|
|
<span id="build-status">
|
|
<a title="Build status"
|
|
href="https://kristaps.bsd.lv/cgi-bin/minci.cgi/index.html?project-name=kcgi">
|
|
<i class="fa fa-fw fa-tachometer"></i>
|
|
Build status
|
|
</a>
|
|
</span>
|
|
</nav>
|
|
</section>
|
|
</header>
|
|
<section class="text">
|
|
<p id="intro">
|
|
<span class="nm">kcgi</span> is an <a href="http://opensource.org/licenses/ISC" rel="license">open
|
|
source</a> CGI and FastCGI <span itemprop="applicationCategory">library for C/C++ web
|
|
applications</span>.
|
|
It is minimal, secure, and auditable.
|
|
</p>
|
|
<p>
|
|
To start, <a href="#install">install</a> the library.
|
|
Then read the <a href="#deploying">deployment</a> and <a href="#usage">usage</a> guides.
|
|
Use the <a href="https://github.com/kristapsdz/kcgi">GitHub</a> tracker for questions or comments,
|
|
or find contact information there for direct contact.
|
|
</p>
|
|
</section>
|
|
<figure id="sample">
|
|
<input type="radio" name="sample-show" value="0" id="show-nocomments" checked="checked" />
|
|
<input type="radio" name="sample-show" value="1" id="show-comments" />
|
|
<nav class="text">
|
|
<label id="label-nocomments" for="show-nocomments">
|
|
<i class="fa fa-fw fa-comments-o"></i> Hide source comments
|
|
</label>
|
|
<label id="label-comments" for="show-comments">
|
|
<i class="fa fa-fw fa-comments"></i> Show source comments
|
|
</label>
|
|
</nav>
|
|
<figcaption class="text">
|
|
The following echoes <q>Hello, World!</q> as an HTTP response to a CGI request.
|
|
</figcaption>
|
|
<pre id="nocomments" class="text prettyprint"><span class="cpp">#include</span> <span class="literal"><sys/types.h></span> /* size_t, ssize_t */
|
|
<span class="cpp">#include</span> <span class="literal"><stdarg.h></span> /* va_list */
|
|
<span class="cpp">#include</span> <span class="literal"><stddef.h></span> /* NULL */
|
|
<span class="cpp">#include</span> <span class="literal"><stdint.h></span> /* int64_t */
|
|
<span class="cpp">#include</span> <span class="literal"><<a href="kcgi.3.html">kcgi.h</a>></span>
|
|
|
|
<span class="ident">int</span> main(<span class="ident">void</span>) {
|
|
<span class="ident">struct</span> kreq r;
|
|
<span class="ident">const char</span> *page = <span class="literal">"index"</span>;
|
|
<span class="flow">if</span> (<a href="khttp_parse.3.html">khttp_parse</a>(&r, NULL, 0, &page, 1, 0) != KCGI_OK)
|
|
return 1;
|
|
<a href="khttp_head.3.html">khttp_head</a>(&r, kresps[KRESP_STATUS],
|
|
<span class="literal">"%s"</span>, khttps[KHTTP_200]);
|
|
khttp_head(&r, kresps[KRESP_CONTENT_TYPE],
|
|
<span class="literal">"%s"</span>, kmimetypes[KMIME_TEXT_PLAIN]);
|
|
<a href="khttp_body.3.html">khttp_body</a>(&r);
|
|
<a href="khttp_write.3.html">khttp_puts</a>(&r, <span class="literal">"Hello, world!"</span>);
|
|
<a href="khttp_free.3.html">khttp_free</a>(&r);
|
|
<span class="flow">return</span> 0;
|
|
}</pre>
|
|
<pre id="comments" class="text prettyprint"><span class="cpp">#include</span> <span class="literal"><sys/types.h></span> /* size_t, ssize_t */
|
|
<span class="cpp">#include</span> <span class="literal"><stdarg.h></span> /* va_list */
|
|
<span class="cpp">#include</span> <span class="literal"><stddef.h></span> /* NULL */
|
|
<span class="cpp">#include</span> <span class="literal"><stdint.h></span> /* int64_t */
|
|
<span class="cpp">#include</span> <span class="literal"><<a href="kcgi.3.html">kcgi.h</a>></span>
|
|
|
|
<span class="ident">int</span> main(<span class="ident">void</span>) {
|
|
<span class="ident">struct</span> kreq r;
|
|
<span class="ident">const char</span> *page = <span class="literal">"index"</span>;
|
|
|
|
/*
|
|
* Parse the HTTP environment.
|
|
* We only know a single page, "index", which is also
|
|
* the default page if none is supplied.
|
|
* (We don't validate any input fields.)
|
|
*/
|
|
|
|
<span class="flow">if</span> (<a href="khttp_parse.3.html">khttp_parse</a>(&r, NULL, 0, &page, 1, 0) != KCGI_OK)
|
|
return 1;
|
|
|
|
/*
|
|
* Ordinarily, here I'd switch on the method (OPTIONS, etc.,
|
|
* defined in the <q>method</q> variable) then switch on which
|
|
* page was requested (<q>page</q> variable).
|
|
* But for brevity's sake, just output a response: HTTP 200.
|
|
*/
|
|
|
|
<a href="khttp_head.3.html">khttp_head</a>(&r, kresps[KRESP_STATUS],
|
|
<span class="literal">"%s"</span>, khttps[KHTTP_200]);
|
|
|
|
/*
|
|
* Show content-type unilaterally as text/plain.
|
|
* This would usually be set from r.mime.
|
|
*/
|
|
|
|
khttp_head(&r, kresps[KRESP_CONTENT_TYPE],
|
|
<span class="literal">"%s"</span>, kmimetypes[KMIME_TEXT_PLAIN]);
|
|
|
|
/* No more HTTP headers: start the HTTP document body. */
|
|
|
|
<a href="khttp_body.3.html">khttp_body</a>(&r);
|
|
|
|
/*
|
|
* We can put any content below here: JSON, HTML, etc.
|
|
* Usually we'd switch on our MIME type.
|
|
* However, we're just going to put the literal string as noted…
|
|
*/
|
|
|
|
<a href="khttp_write.3.html">khttp_puts</a>(&r, <span class="literal">"Hello, world!"</span>);
|
|
|
|
/* Flush the document and free resources. */
|
|
|
|
<a href="khttp_free.3.html">khttp_free</a>(&r);
|
|
<span class="flow">return</span> 0;
|
|
}</pre>
|
|
</figure>
|
|
<section class="text">
|
|
<p>
|
|
For a fuller example, see <a href="sample.c.html">sample.c</a>, or jump to the <a href="#usage">Documentation</a> section.
|
|
(Want a C++ version? See <a href="samplepp.cc.html">samplepp.cc</a>.)
|
|
</p>
|
|
<p>
|
|
<i>kcgi</i> supports many features: auto-compression, handling of all HTTP input operations (query strings,
|
|
cookies, page bodies, multipart) with validation, authentication, configurable output caching, request
|
|
debugging, and so on.
|
|
Its strongest differentiating feature is using sandboxing and process separation for handling the untrusted
|
|
input path.
|
|
</p>
|
|
</section>
|
|
<section id="version">
|
|
<div class="text">
|
|
<h2>
|
|
current release
|
|
</h2>
|
|
<nav data-sblg-nav="1" data-sblg-navtag="version" data-sblg-navsz="1" data-sblg-navcontent="1">
|
|
<div>
|
|
<div class="title">
|
|
Version <span class="version">${sblg-title}</span>:
|
|
<time datetime="${sblg-date}">${sblg-date}</time>
|
|
</div>
|
|
<div class="content">${sblg-aside}</div>
|
|
</div>
|
|
</nav>
|
|
<p class="archive">
|
|
(<a href="archive.html">release archive</a>)
|
|
</p>
|
|
</div>
|
|
</section>
|
|
<section id="install" class="text">
|
|
<h2>
|
|
installation
|
|
</h2>
|
|
<p>
|
|
First, check if <span class="nm">kcgi</span> isn't already packaged for your system, such as
|
|
for <a href="https://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/www/kcgi/">OpenBSD</a>, <a
|
|
href="https://svnweb.freebsd.org/ports/head/www/kcgi/">FreeBSD</a>,
|
|
<a href="https://aur.archlinux.org/packages/kcgi/">Arch Linux</a>, and so on.
|
|
(If it is, make sure it's up to date!)
|
|
If so, install using that system.
|
|
</p>
|
|
<p>
|
|
If not, you'll need a modern <span itemprop="operatingSystem">UNIX</span> system.
|
|
To date, <span class="nm">kcgi</span> has been built and run on
|
|
GNU/<a href="https://www.linux.org" itemprop="operatingSystem">Linux</a> machines
|
|
(musl and glibc), BSD
|
|
(<a href="https://www.openbsd.org" itemprop="operatingSystem">OpenBSD</a>,
|
|
<a href="https://www.netbsd.org" itemprop="operatingSystem">NetBSD</a>,
|
|
<a href="https://www.freebsd.org" itemprop="operatingSystem">FreeBSD</a>),
|
|
<a href="https://www.oracle.com/solaris/solaris11" itemprop="operatingSystem">Solaris</a>,
|
|
<a href="https://omniosce.org" itemprop="operatingSystem">OmniOS</a>, and
|
|
<a href="https://www.apple.com/osx" itemprop="operatingSystem">Mac OS X</a>
|
|
(only Mojave and newer!) on i386, amd64, powerpc, arm64, and sparc64.
|
|
It has been deployed under <a href="https://httpd.apache.org/">Apache</a>, <a
|
|
href="https://nginx.org">nginx</a>, and OpenBSD's <a
|
|
href="https://man.openbsd.org/httpd.8">httpd(8)</a>
|
|
(the latter two natively over FastCGI and via the <code>slowcgi</code> wrapper).
|
|
The only hard dependency is BSD make (<code>bmake</code> on Linux).
|
|
If you're running the regression tests (see <a href="#testing">Testing</a>), you'll need <a
|
|
href="https://curl.haxx.se/libcurl/">libcurl</a>.
|
|
</p>
|
|
<p>
|
|
Download <a href="snapshots/kcgi.tgz">kcgi.tgz</a> and verify the archive with <a
|
|
href="snapshots/kcgi.tgz.sha512">kcgi.tgz.sha512</a>.
|
|
Configure with <code>./configure</code>, compile with <code>make</code> (or <code>bmake</code>
|
|
on Linux systems).
|
|
Finally, install the software using <code>make install</code>.
|
|
Optionally override default paths with a <code>configure.local</code> file (see the
|
|
<a href="https://github.com/kristapsdz/kcgi/blob/master/configure">configure</a> script
|
|
for details) prior to configuration.
|
|
</p>
|
|
<p>
|
|
If <span class="nm">kcgi</span> doesn't compile, please send me the <span class="file">config.log</span>
|
|
file and the output of the failed compilation.
|
|
Along with all of your operating system information of course.
|
|
</p>
|
|
<p>
|
|
To run bleeding-edge code between releases, the CVS repository is mirrored on
|
|
<a href="https://github.com/kristapsdz/kcgi">GitHub</a>. Installation instructions tracking the repository
|
|
version may be found on that page.
|
|
</p>
|
|
</section>
|
|
<section id="deploying" class="text">
|
|
<h2>
|
|
deployment
|
|
</h2>
|
|
<p>
|
|
To compile <span class="nm">kcgi</span> applications, use the package configuration.
|
|
Linking is similarly normative.
|
|
</p>
|
|
<pre class="prettyprint">% cc `pkg-config --cflags kcgi` -c yourprog.c
|
|
% cc yourprog.o `pkg-config --libs kcgi`</pre>
|
|
<p>
|
|
Well-deployed web servers, such as the default <a href="https://www.openbsd.org">OpenBSD</a> server, by
|
|
default are deployed within a <a
|
|
href="https://man.openbsd.org/chroot.2">chroot(2)</a>. If
|
|
this is the case, you'll need to statically link your binary.
|
|
</p>
|
|
<pre class="prettyprint">% cc -static yourprog.o `pkg-config --static --libs kcgi`</pre>
|
|
<p>
|
|
FastCGI applications may either be started directly by the web server (which is popular with <a
|
|
href="https://httpd.apache.org/">Apache</a>) or <q>externally</q> given a socket and <a
|
|
href="kfcgi.8.html">kfcgi(8)</a> (this method is normative for OpenBSD's <a
|
|
href="https://man.openbsd.org/httpd.8">httpd(8)</a> and
|
|
suggested for the security precautions taken by the wrapper).
|
|
</p>
|
|
</section>
|
|
<section id="usage" class="text">
|
|
<h2>
|
|
documentation
|
|
</h2>
|
|
<p>
|
|
The <span class="nm">kcgi</span> manpages, starting with <a href="kcgi.3.html">kcgi(3)</a>, are the
|
|
canonical source of documentation.
|
|
The following is a list of all manpages:
|
|
</p>
|
|
<nav id="mannav" data-sblg-nav="1" data-sblg-navtag="man" data-sblg-navcontent="1" data-sblg-navsort="title">
|
|
<a href="${sblg-stripbase}.html">${sblg-title}</a>
|
|
</nav>
|
|
<p>
|
|
If it's easier to start by example, you can use
|
|
<a href="https://github.com/kristapsdz/kcgi-framework">kcgi-framework</a> as an initial boilerplate to
|
|
start your project.
|
|
The following are introductory materials to the system.
|
|
</p>
|
|
<nav data-sblg-nav="1" data-sblg-navtag="tutorial" data-sblg-navcontent="1" data-sblg-navsort="rdate">
|
|
<h3><a href="${sblg-base}.html">${sblg-titletext}</a></h3>
|
|
${sblg-aside}
|
|
</nav>
|
|
<p>
|
|
In addition to these resources, the following conference sessions have referenced <span class="nm">kcgi</span>.
|
|
</p>
|
|
<ul>
|
|
<li>
|
|
Dzonsons, Kristaps. <i>Role-based Access Control in BCHS Web Applications</i>.
|
|
Proceedings of <a href="https://2018.asiabsdcon.org">AsiaBSDCon</a>, Tokyo, Japan, March 2018.
|
|
(<a href="https://kristaps.bsd.lv/absdcon2018">Slides</a>,
|
|
<a href="https://www.youtube.com/watch?v=FzF9e4jrnJ4">video</a>.)
|
|
<a href="https://kristaps.bsd.lv/absdcon2018/paper.pdf">paper</a>.)
|
|
</li>
|
|
<li>
|
|
Dzonsons, Kristaps. <i>Secure BSD Web Applications in C: Practical Strategies</i>.
|
|
Proceedings of <a href="https://2017.asiabsdcon.org">AsiaBSDCon</a>, Tokyo, Japan, March 2017.
|
|
(<a href="https://kristaps.bsd.lv/absdcon2017">Slides</a>.)
|
|
</li>
|
|
<li>
|
|
Dzonsons, Kristaps. <i>Secure BSD Web Application Development in C</i>.
|
|
Proceedings of <a href="https://2016.asiabsdcon.org">AsiaBSDCon</a>, Tokyo, Japan, March 2016.
|
|
(<a href="https://kristaps.bsd.lv/absdcon2016">Slides</a>.)
|
|
</li>
|
|
<li>
|
|
Dzonsons, Kristaps. <i>kcgi: securing CGI applications in C</i>.
|
|
Proceedings of <a href="https://2015.asiabsdcon.org">AsiaBSDCon</a>, Tokyo, Japan, March 2015.
|
|
(<a href="https://kristaps.bsd.lv/absdcon2015/talk.pdf">Slides</a>,
|
|
<a href="https://kristaps.bsd.lv/absdcon2015/paper.pdf">paper</a>.)
|
|
</li>
|
|
</ul>
|
|
<p>
|
|
And the following relate to extending standards:
|
|
</p>
|
|
<ul>
|
|
<li>
|
|
Dzonsons, Kristaps. <a href="extending01.html">FastCGI Extensions for Management Control</a>. March
|
|
2016.
|
|
</li>
|
|
</ul>
|
|
</section>
|
|
<section id="features" class="text">
|
|
<h2>
|
|
implementation details
|
|
</h2>
|
|
<p>
|
|
The bulk of <span class="nm">kcgi</span>'s CGI handling lies in <a
|
|
href="khttp_parse.3.html">khttp_parse(3)</a>, which fully parses the HTTP request.
|
|
Application developers must invoke this function before all others.
|
|
For FastCGI, this function is split between <a href="khttp_fcgi_init.3.html">khttp_fcgi_init(3)</a>, which
|
|
initialises context; and <a href="khttp_fcgi_parse.3.html">khttp_fcgi_parse(3)</a>, which receives new
|
|
parsed requests.
|
|
In either case, requests must be freed by <a href="khttp_free.3.html">khttp_free(3)</a>.
|
|
</p>
|
|
<p>
|
|
All functions isolate the parsing and validation of untrusted network data within a <i>sandboxed</i>
|
|
child process.
|
|
Sandboxes limit the environment available to a process, so exploitable errors in the parsing process (or
|
|
validation with third-party libraries) cannot touch the system environment.
|
|
This parsed data is returned to the parent process over a socket.
|
|
In the following, the <i>HTTP parser</i> and <i>input validator</i> manage a single HTTP request, while
|
|
<i>connection delegator</i> accepts new HTTP requests and passes them along.
|
|
</p>
|
|
<figure>
|
|
<img src="figure1.svg" alt="Implementation Details" />
|
|
<img src="figure4.svg" alt="Implementation Details" />
|
|
</figure>
|
|
<p>
|
|
This method of sandboxing the untrusted parsing process follows <a
|
|
href="http://www.openssh.org">OpenSSH</a>, and requires special handling for each operating
|
|
system:
|
|
</p>
|
|
<dl>
|
|
<dt>
|
|
<a href="http://man7.org/linux/man-pages/man2/seccomp.2.html">seccomp(2)</a>
|
|
(Linux)
|
|
</dt>
|
|
<dd>
|
|
This requires a fairly new kernel (≥Linux 3.5).
|
|
It is supplemented by <code>setrlimit(2)</code> limiting.
|
|
For the time being, this feature is only available for x86, x86_64, and arm architectures.
|
|
If you're using another one, please send me your <code>uname -m</code> and, if you know if it,
|
|
the correct <code>AUDIT_ARCH_xxx</code> found in <code>/usr/include/linux/audit.h</code>.
|
|
</dd>
|
|
<dt>
|
|
<a href="https://man.openbsd.org/pledge.2">pledge(2)</a>
|
|
(<a href="https://www.openbsd.org">OpenBSD</a>)
|
|
</dt>
|
|
<dd>
|
|
This will only work on OpenBSD >5.8.
|
|
</dd>
|
|
<dt>
|
|
<a href="https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man3/sandbox_init.3.html">sandbox_init(3)</a>
|
|
(<a href="https://www.apple.com/osx/">Apple OSX</a>)
|
|
</dt>
|
|
<dd>
|
|
This uses the sandboxing profile for <q>pure computation</q> as provided in Mac OS X Leopard and
|
|
later.
|
|
This is supplemented by resource limiting via <code>setrlimit(2)</code>.
|
|
</dd>
|
|
<dt>
|
|
<a href="https://www.freebsd.org/cgi/man.cgi?query=capsicum&sektion=4">capsicum(4)</a>
|
|
(<a href="https://www.freebsd.org">FreeBSD</a>)
|
|
</dt>
|
|
<dd>
|
|
Uses the capabilities facility on <a href="https://www.freebsd.org">FreeBSD</a> 10 and later.
|
|
This is supplemented by resource limiting with <code>setrlimit(2)</code>.
|
|
</dd>
|
|
</dl>
|
|
<p>
|
|
Since validation occurs within the sandbox, special care must be taken that validation routines don't
|
|
access the environment (e.g., by opening files, network connections, etc.), as the child
|
|
<strong>might</strong> be abruptly killed by the sandbox facility.
|
|
(Not all sandboxes do this.)
|
|
If required, this kind of validation can take place after the parse validation sequence.
|
|
</p>
|
|
<p>
|
|
The connection delegator is similar, but has different sandboxing rules, as it must manage an open
|
|
socket connection and respond to new requests.
|
|
</p>
|
|
</section>
|
|
<section class="text">
|
|
<h2 id="testing">
|
|
testing
|
|
</h2>
|
|
<p>
|
|
<span class="nm">kcgi</span> is shipped with a fully automated testing framework executed with
|
|
<code>make regress</code>.
|
|
To test your own applications, use the <a href="kcgiregress.3.html">kcgiregress(3)</a> library.
|
|
This framework acts as a mini-webserver, listening on a local port, translating an HTTP document into a
|
|
minimal CGI request, and passing the request to a <span class="nm">kcgi</span> CGI client.
|
|
For internal tests, test requests are constructed with <a
|
|
href="https://curl.haxx.se/libcurl/">libcurl</a>.
|
|
The binding local port is fixed: if you plan on running the regression suite, you may need to
|
|
tweak its access port.
|
|
</p>
|
|
<p>
|
|
Another testing framework exists for use with the <a href="http://lcamtuf.coredump.cx/afl/">American
|
|
fuzzy lop</a>.
|
|
To use this, you'll need to compile the <code>make afl</code> target with your compiler of choice, e.g.,
|
|
<code>make clean</code>, then <code>make afl CC=afl-gcc</code>.
|
|
Then run the <code>afl-fuzz</code> tool on the <code>afl-multipart</code>, <code>afl-plain</code>, and
|
|
<code>afl-urlencoded</code> binaries using the test cases (and dictionaries, for the first) provided.
|
|
</p>
|
|
</section>
|
|
<section class="text">
|
|
<h2>
|
|
performance
|
|
</h2>
|
|
<p>
|
|
Security comes at a price—but not a stiff price.
|
|
By design, <span class="nm">kcgi</span> incurs overhead in three ways: first, spawning a child to
|
|
process the untrusted network data; second, enacting the sandbox framework; and third, passing parsed
|
|
pairs back to the parent context.
|
|
In the case of running CGI scripts, <span class="nm">kcgi</span> performance is bound to the operating
|
|
system's ability to spawn and reap processes.
|
|
For FastCGI, the bottleneck becomes the transfer of data.
|
|
In the following graph, I graph the responsiveness of <span class="nm">kcgi</span> against the baseline
|
|
web-server performance.
|
|
</p>
|
|
<figure>
|
|
<img src="figure2.png" alt="Performance Graph" />
|
|
</figure>
|
|
<p>
|
|
This shows the empirical cumulative distribution of a statisically-significant number of page requests
|
|
as measured by <a href="https://httpd.apache.org/docs/2.2/programs/ab.html">ab(1)</a> with 10 concurrent
|
|
requests.
|
|
The <strong>CGI</strong> line is the CGI sample included in the source;
|
|
the <strong>FastCGI</strong> line is the FastCGI sample;
|
|
the <strong>CGI (simple)</strong> simply emits a 200 HTTP status and <q>Hello, World</q>; and
|
|
the <strong>static</strong> is a small static file on the web server.
|
|
The operating system is Mac OS X 10.7.5 <q>Air</q> laptop (1.86 GHz Intel Core 2 Duo, 2 GB RAM) with the
|
|
stock Apache.
|
|
The FastCGI server was started using the <a href="kfcgi.8.html">kfcgi(8)</a> defaults.
|
|
</p>
|
|
</section>
|
|
<footer>
|
|
<div>
|
|
© 2014–2020
|
|
<a rel="author" href="https://github.com/kristapsdz">Kristaps Dzonsons</a>
|
|
</div>
|
|
<div>
|
|
<a href="snapshots/kcgi.tgz"><i class="fa fa-fw fa-gears"></i></a>
|
|
<a href="snapshots/kcgi.tgz.sha512"><i class="fa fa-fw fa-lock"></i></a>
|
|
<a href="snapshots"><i class="fa fa-fw fa-archive"></i></a>
|
|
<a href="https://www.github.com/kristapsdz/kcgi"><i class="fa fa-fw fa-github"></i></a>
|
|
<span>Built with <a href="https://kristaps.bsd.lv/sblg">sblg</a> on <a href="https://www.openbsd.org">OpenBSD</a></span>
|
|
</div>
|
|
</footer>
|
|
</body>
|
|
</html>
|