News for hackers. Stuff that matters.
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by kstrauser on Wednesday April 15, 2015 @04:18PM (#9383785)
> I had no idea. Madness

They aren't the only ones who do this: https://www.freebsd.org/cgi/man.cgi?accf_http . All sorts of things are kernel-accelerated on modern operating systems, including lots of network operations. From that perspective, this is just one more and it could potentially have a huge benefit (like the same page served count on fewer hardware) for customers who need it.

Obviously it's critically important that MS get this right if they're going to offer it at all, but that's pretty much a tautology when talking about kernels and core OS functionality. Judge them on a bad implementation, not on any inherent badness in the idea.

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by floatboth on Wednesday April 15, 2015 @06:45PM (#9384762)
You haven't read the manpage, have you?

The idea is completely different.

accf_http is... here, just read the source: https://github.com/freebsd/freebsd/blob/master/sys/netinet/a... – if it sees something that looks like an HTTP request and delays returning to userspace until \r\n\r\n.

http.sys is an actual HTTP/1.x parser. That runs in ring 0.