+-------------------------------+
|                               |
|   Son hServer   v. 0.9.0.241  |
|                               |
+-------------------------------+
     a small home WWW server

           FREEWARE

System requirements
-------------------
80386 CPU or higher.
OS Windows 95/98/ME or Windows NT/2000/XP
or newer.
Windows Sockets 2 or newer.
For functioning as Internet server
an Internet connection [of course] is
required (on test time not necessary).

Purpose
-------
  Son hServer is intended for work as WWW
(HTTP) Internet or intranet server. It can
also be used to test websites on a local
machine before uploading to remote server.
  Son hServer is a web server with simpli-
fied control. It's made generally for use
under Win9x family systems (Windows 95/98/
ME). Under NT family systems (Windows NT/
2000/XP) before running please stop IIS
service.

Features
--------
  Son hServer serves client requests on a
standard HTTP port (80). Main web document
types, multimedia, VRML models, archives
and other files are supported. When recei-
ving request on directory names without
terminating forward slash (/) the redirect
to right address is generated.
HTTP/1.1 protocol is supported (minimal
instruction set).
 Connection filtering in dependence of
client IP is possible. Server side program
calls are compatible with CGI/1.1.
  Files with "hidden" and "system" attribu-
tes are not client-accessible.
  Two or more commas following each other
in file paths are interpreted as one comma
(e.g. /file..ext will be processed as
/file.ext)
  INTERFACE is multilingual (yet english
and russian). Real-time monitoring of con-
nections, requests and errors statistics is
possible. Customizable event logging (save
in log file).
  NOT SUPPORETED: ISAPI; SSI and web bots;
conditional requests; user authentication;
remote administration; HTTP methods PUT,
DELETE, TRACE, CONNECT.


    ********************************
    ***       USER'S GUIDE       ***
    ********************************

1. Server start and termination

  Server begins working immediately after
program start. Any option changes (see
"Options..." button) are applied immedia-
tely after clicking "OK" button in "Ser-
ver options" dialog. Launching windows
("About program", "Server options")
doesn't stop server workit's continuing
to serve requests.
  Server stops when closing program win-
dow. If You don't like seeing working
server on your desktop please minimize it
into taskbar but do not close.

2. Site viewing

  If active Internet connection exists
then You can view your site from any
inet-connected machine by typing follow-
ing URL in web browser:
 http://YOUR_IP/
where YOUR_IP is your current IP address
(to see it launch "Run program" system
window and there enter winipcfg). If You
have a registered domain then view site
as usually: URL with Your domain.
  In intranets situation is analogous to
described above.
  If NO active Internet or intranet con-
nection exist then use following address
in web browser:
 http://localhost/
Be aware that it works only when server
is running.

3. Recommendations on logging

  Logging options are located in "Server
options" window on "Logs" tab. Program
writes log file in its dir, it's named
hserver.log
  I would recommend not to set without
necessarity checkbox "client request
headers" in "Save in log file informa-
tion on:" group. It's because this pro-
duces very large log files.
  Log file "growing" speed can also be
decreased by unchecking "requested
files (paths)" and (for popular sites)
"connections" checkboxes. However, all
is under administrator's will :)

4. How to begin

  First check the server: run it, then
open web browser and enter address
 localhost
Be glad looking at disk C contents in
hypertext form :) This is for You to
be assured that server truely works.
  Create anywhere a folder (e.g.
C:\WWWRoot) where should be placed
Your site. Even more better is to use
separate disk volume for this purpose.
  Then in server click "Options..."
button and instead of "C:" enter your
created folder's path in "Server root
path" field. Now nobody from Net can
access Your disk C because access is
limited to Yours specified root folder
(and its subfolders).
EXAMPLE:
  Let's advise, You've created folder
  C:\MyShared\HTTPfiles
  and specified it as a server root
  Now file C:\Windows\notepad.exe
  is inaccessible to site visitors;
  file C:\Secrets\My coctail.doc
  is also inaccessible for them,
  as files C:\Windows\Me.pwl
  C:\MyShared\LocalNet\gamelist.txt
  and C:\MyShared\nicegirl.avi
  File C:\MyShared\HTTPfiles\wow.htm
  is accessible under URL
  http://YOURIPORDOMAIN/wow.htm
  File C:\MyShared\HTTPfiles\pict.gif
  is accessible under URL
  http://YOURIPORDOMAIN/pict.gif
The server root is not required to
be on disk C. You may specify root
in any part of file system, even on
CD-ROM or other machine in a local
network.
  Another recommendation: uncheck
in options a checkbox "Show catalog
contents when no index file exist"
(except, maybe, sites-WebBBSs). BUT
do it only after you're assured the
server works.

5. Comments on performance

  The minimal CPU signed in require-
ments is 80386. However for Internet
server Pentium or higher is better.
For organisation inner intranet i486
can be enough but I would recommend
at least early Pentium or compatible
(K5 et al.)
  Generally request serving speed
depends from connection speed. For
big (very big!) speeds with many
requests it may depend from file
system speed. So do not damn Core i3
when you have 28k modem and it is
one in all local network :)
  If page load time is abnormally
large try to uncheck "remote hosts"
in "Save in log file information on:"
options group. If this doesn`t help
think on choosing more speedy
provider.

6. Recommendations on security

  RFC recommends not to set up the
option for sending "Server:" header.
It`s hard to find program with no
defects, and even if defect is not a
hole it can bring some problems. One
of such problems I consider most
important: it is so-called "denial of
service" (DoS) when clients overload
the server with their requests.
  Even if "Server:" header may be
free of danger, there`s possibility
for some person, when has info on
server program type, to find attack
measures that are effective against
only this software.
  For stopping DoS attacks the IP
filtering can be used (look at
"IP filtering" tab in options dialog).
This refuses any connection that
attempted from IP address that
belongs to some IP range (also called
"banned IPs"). Read about setting
IP filtering options below.
  If You encounter too much requests
going from some IP (hundreds or
thousands per second or even less-
limit depends of Your site structure)
and this stupidly repeats- then You
can block this IP. Sometimes attacks
come from different IPs in one
subnet. In this case learn with WhoIs
what`s the range of his provider`s
IPs and then block those all (more
on WhoIs read in APPENDIX C).

7. Tuning IP filters

  IP ranges can be entered in one of
two forms:
  1) Global range, i.e. two IPs
   separated by hyphen. Range will
   include all that (after recalculate
   to numeric addresses) is placed
   between these addresses (or is
   equal to any of these). EXAMPLE:
     124.15.0.0-125.70.255.255
     includes "124.189.4.17"
     as well as "125.1.4.48"
   This is [I think] best form cause
   WhoIs usually outputs provider IP
   ranges like this.
  2) Address masks. Masks can contain
   an asterisk * symbol.
   EXAMPLE:
     214.17.*.*
     includes "214.17.5.28"
     as well as "214.17.171.5"
     and others, beginning at "21.17."
   More exotic masks are also
   implemented- the range for value of
   any field can be specified. E. G.:
     216.21-26.*.7-8
     includes "216.25.50.7",
     as well as "216.22.155.8",
     but DOESN`T include 216.20.50.7
     and DOESN`T include 216.25.50.4
  Do not enter space, letters or
something like into address [range]
prompt. Only digits, points and
hyphens are valid.

8. Setting up Web-BBS view

  As Web-BBS I mean "downloads"-site
where server option "Show catalog
contents when no index file exist"
is on. The page display style can be
set in options by specifying URL of
CSS file where You place style sheets
for page elements.
  The elements available: BODY, H1,
TABLE, THEAD, TH, TR, TD, A
Classes also available:
TD.fname  -column with file names
           and [go_to/download] links;
TD.fsize  -column with file sizes.
  URL of Your CSS file can be given
in following forms:
-relatively to server root, i.e. URL
 that begins with / (forward slash);
 this is a good choice when You want
 all dirs to be displayed in the
 SAME manner;
-relative to current dir, i.e. usually
 just a file name (and extension) with
 no any slashes; in this case You can
 give each dir unique display style;
 but css-file must be placed in EVERY
 site dir where no index file exist;
-absolute path with machine (server)
 name specified; it`s not a good
 choice and is useful when You (due
 to a some reason) keep css-file on
 another server.
  I provided some css-files in app
distributive as examples on custom-
izing dir list design. You can check
these in action:
 Copy bbs1.css file into server root
 dir, then enter /bbs1.css in
 "Stylesheet (CSS) file URL for
 index-pages:" text field. Run the
 browser and look.
  Certainly, You may replace bbs1.css
file with Your own one (in server
root, not in program dir:) ).

9. CGI applications  CGI scripts

  CGI programs can be run from
special "CGI dir" (see options). All
scripts/applications OUTSIDE this dir
ARE NOT BEING EXECUTED.
  Sometimes it`s better to specify
separate folder for such a dir,
especially when You debug a site
intended for upload to some web
hosting. Then there`s a reason in
making dir structure look like one
of target hosting. E.g. server root
may be in
C:\MySite\WWW
and CGI dir - in
C:\MySite\cgi
  File lists for "CGI dir" and its
subdirs are not shown - independently
of index-file existence or server
options.
  CGI program can be either app-
lication or script.
  CGI applications are EXECUTABLE
files (with extension exe). These can
be called:
1) by URL containing file path and
   name WITHOUT extension;
2) by URL containing file path and
   name WITH extension.
First choice is preferable cause
specifying .exe extension in URL may
result in problems with some browsers
in offline mode and so on.
EXAMPLE:
   If You have CGI dir in
   C:\MySite\cgi
   and its "Internet" name is
   /cgi-bin/
   then program C:\MySite\cgi\hi.exe
   will be accessible as CGI app
   under URL: /cgi-bin/hi
  CGI applications can be written on
C (C++, C#), Pascal, any other program-
ming language that allows creating
executable modules (even on Assembler).
But before running program its source
must be compiled to produce executable
file.
  CGI scripts are INTERPRETED programs
(e.g. on Python, Perl or other
INTERPRETED language). Script doesn`t
need compilation. In order for such
program to work You need:
-  to have appropriate language
 interpreter on Your machine;
-  to set up (in server options) files
 with appropriate extensions to be
 associations with correspondent
 interpreter.
EXAMPLE:
 * To be able to run Perl scripts
 specify extension pl and exe-file perl
 (with full path if it`s placed not in
 folder present in PATH variable).
Sorry, but "Son hServer" is yet unable
to automatically determine interpreter
for scripts with UNIX-like syntax (such
as Perl).
Therefore interpreter specified in
server associations will always be run,
not one that specified at first
script`s line.
  Execution time for any CGI applicat-
ion/script is limited by server to 20
seconds. If execution doesnt terminate
in this time the server breaks program
and reports an error to client.

***      END OF USER'S GUIDE       ***
**************************************


OK, I understand that user's guide is
scarce. But interface is intuitive un-
derstandable; old friend Experiment
will help non-experienced users.


       *** APPENDIX A ***
 List of recognisable file extensions
 and their server-associated content-
 types

Files with extensions not present in
this list are being transmitted by
server with content-type
application/octet-stream

    htm  html  shtm  sht  shtml  dhtm  dht  dhtml
        xhtm  xht  xhtml  phtm  pht  phtml
       text/html
    xml  xsl
       text/xml
    txt  ans  rus  nfo  me  log
       text/plain
    js
       text/javascript
    vbs
       text/vbscript
    gif
       image/gif
    jpg  jpe  jfif  jpeg
       image/jpeg
    png
       image/png
    tiff  tif
       image/tiff
    xbm
       image/x-xbitmap
    art
       image/x-jg
    bmp
       image/bmp
    ivf
       video/x-ivf
    qt  mov
       video/quicktime
    avi
       video/avi
    enc  mpg  m1v  mpa  mpe  mpeg  mpv2
       video/mpeg
    asf  lsf  asr  asx  lsx
       video/x-ms-asf
    vdo
       video/vdo
    aiff  aif  aifc
       audio/aiff
    au  snd
       audio/basic
    wav
       audio/wav
    hta
       application/hta
    rar
       application/x-rar-compressed
    doc  wiz  dot
       application/msword
    xls  xlb
       application/vnd.ms-excel
    ppt  pps  pwz  ppa  pot
       application/vnd.ms-powerpoint
    pdf
       application/pdf
    fdf
       application/vnd.fdf
    cab
       application/x-compressed
    iii
       application/x-iphone
    ins  isp
       application/x-internet-signup
    mhtml  mht  eml  nws
       message/rfc822
    pfx  p12
       application/x-pkcs12
    prf
       application/pics-rules
    ra  rm  rmm  ram
       audio/x-pn-realaudio
    rts
       application/x-rtsl
    spl  swf
       application/futuresplash
    wrz  vrml  wrl
       model/vrml
    it  xm  s3m  stm  mod  dsm  med  ult
        mm  669  mp3  mp2  mp1
       audio/mpeg
    m3u  pls
       audio/x-mpegurl
    zip
       application/x-zip-compressed
    p10
       application/pkcs10
    cat
       application/vnd.ms-pki.seccat
    pko
       application/vnd.ms-pki.pko
    p7r
       application/x-pkcs7-certreqresp
    p7s
       application/pkcs7-signature
    exe
       application/x-msdownload
    crt  der  cer
       application/pkix-cert
    spc  p7b
       application/x-pkcs7-certificates
    uls
       text/iuls
    p7m  p7c
       application/pkcs7-mime
    stl
       application/vnd.ms-pki.stl
    crl
       application/pkix-crl
    wsc  sct
       text/scriptlet
    323
       text/h323
    rmi  mid  midi
       audio/mid
    vcf
       text/x-vcard
    cdf
       application/x-cdf
    sst
       application/vnd.ms-pki.certstore
    htt
       text/webviewhtml
    css
       text/css

Please report author of any mistakes
in list or incorrect content-type
assigning by server.


      *** APPENDIX B ***
 How to rule own website on own
 home server

The subject is to descript a site on
OWN SERVER which means machine located
e.g. in Your home and acting as Inter-
net server. As a server software You
choose, of cource,
Son hServer :)
  As You know, a provider is needed
for any Net connect. If You're going
to "keep" a server then choose such a
provider which gives reasonable speed
and 24-hours connect.
  Then, You're to get constant IP
address. This is paid service too,
but not too much. Consult a provider
of taxes and machine configuring.
  Then, when You have a connect and
a constant IP, You may want to get
a domain name. It is because not all
users like addresses consisting of
pure digits. There are free domain
services such as www.da.ru and like.
As a rule, free service needs visi-
ting their site regularly with pe-
riod of some months and prolong-
ing Your registration.
  The paid 3rd-level or 2nd-level
domain is more prestigious.
But in fact domain is not required,
there may be sufficient only
constant IP.


      *** APPENDIX C ***
    Public WhoIs services

  If You don`t have special WhoIs
software You can visit public web
sites that provide such a service.
  Try the address
http://www.ripe.net/perl/whois
or search for "whois" in any search
engine.


      *** APPENDIX D ***
  Remark on IP filtering for
  programmers

  At present IP version 4 addresses
are being processed (as used in common
practice). Source code contains [as a
comment] some code that allows IP
version 6 symbolic addresses filtering.
But this is yet "reserved" cause I am
in very doubt whether TServerSocket
permits working with IP v 6. You are
free using this code as You wish.


      *** WHAT`S NEW ***

- Version 0.9.0.241 from 02/13/2015 -

1.  Now any CGI-application (CGI-
    script) sees DOCUMENT_ROOT envi-
    ronment variable. So server is
    compatible with more scripts.
2.  Some minor mistakes in english
    ReadMe (english.txt) are cor-
    rected.

- Version 0.8.0.232 from 12/12/2014 -

1.  Now you can send "Location"
    header and will result in
    redirecting client browser
    on server side.

- Version 0.7.0.228 from 12/02/2011 -

1.  Now You can use PHP or Perl
    scripts as folder index
    (index.php*/.pl*/.cgi*).

- Version 0.6.0.225 from 11/26/2011 -

1.  Now supports PHP. For more info
    look at "php" subfolder.

- Version 0.5.0.208 from 10/20/2011 -

1.  Now content-type for *.css
    files is to be set correctly.
2.  Now CGI-scripts are to really
    work even under WinXP (before
    they didn`t wat). Let us add
    PHP as CGI association.

- Version 0.4.0.165 from 09/23/2003 -

1.  Corrected HTTP headers parsing
    code that in v 0.3- could cause
    problems when server worked for
    too long time or when it was
    receiving "POST" requests.
2.  Implemented CGI applications
    support (limited- see user`s
    guide).
3.  Limit on HTTP request headers
    size has been enlarged to 8000
    bytes (for the case of big
    Cookies etc.)
4.  Now server responds to all HTTP
    errors with HTTP status codes.
    Old style (text messages) can be
    set by unchecking "Report all
    HTTP errors as status codes"
    option.
5.  Implemented new features for
    compatibility with popular
    server applications and web
    hostings. "Compatibility" tab
    made in options.

- Version 0.3.0.133 from 08/11/2003 -

1.  Bugs fixed with "Access
    violation..." message that could
    sometimes pop up onscreen.
2.  Not only client IP but also
    client host (machine name) can
    be logged. This can be turned on
    in options.
3.  Connection filtering depending
    of client IP address implemented
    (connection denial in purpose
    of preventing attacks etc.)
    IP ranges can be entered in
    intuitively understood form (for
    more info consult user`s manual).
    Feature is off by default.
4.  Now not only socket errors are
    included in statistics but also
    program errors at all. Errors
    are being registered in log file,
    verbose info (if possible) is
    provided. This feature is at most
    for those who recompile or change
    "Son hServer`s" source.
5.  "Send 'Server:' HTTP header"
    option added. Off by default.
6.  Formatting of index-pages (that
    appear when exploring addresses
    of dirs with no index file and
    "Show catalog contents when
    no index file exist" option is
    on) made better. Now it`s
    possible to use customizable
    user style sheets for such
    pages.
7.  On index-page (see previous
    topic) generated for dir by the
    server now link to itselt (.)
    doesn`t appear; and uplink (..)
    doesn`t appear in server root.

- Version 0.2.0.95 from 03/01/2003 -

1.  Returns file date information
    (Last-Modified header).
2.  In logs in addition to requested
    file's path writes HTTP method
    specified in request.
3.  Stops execution of requests
    with incorrectly given protocol
    or method, with too big requset
    size (headers > 3000 bytes,
    entity > 2000 bytes). Purpose
    is to prevent simplest DoS
    attacks. This restriction
    doesnt affect download file
    sizes.
4.  Program minimizes window into
    system tray of taskbar. A new
    "Hide in system tray when start"
    option.
5.  Eliminated a v. 0.1 hole which
    allowed with ".." sequence
    getting access to folders
    outside a server root (on the
    same volume). Excuse me for this
    stupid bug.

- Version 0.1.0.72 from 01/22/2003 -

First version.


      *** PROGRAM AUTHOR ***

Son hServer program author
  Mikhail Shmelev
  Russia, 2003-2015

Author's website
  http://super-m.savesoul.ru/

Author's e-mail
  super-m@ya.ru

In case of detecting bugs in this
program please inform me. Do not
forget program has just beginned
to live and this may result in
doing something as you not wanted.
Features set is to be enlarged;
look for updates.

The program source (CBuilder 4) can
be downloaded from:
http://super-m.savesoul.ru/source/hs_s.zip