skinkie
commented
5 years ago @mmmds could you elaborate where the relationship IPv6 structure comes into place?
Closed mmmds closed 5 years ago
skinkie
commented
5 years ago @mmmds could you elaborate where the relationship IPv6 structure comes into place?
mmmds
commented
5 years ago I've set breakpoint on socket.c:391 and examined flow on a second hit.
391 switch (addr->ai_family) {
392 case AF_INET:
393 memcpy (&SOCKET_SIN_ADDR(socket), &((struct sockaddr_in *) ai->ai_addr)->sin_addr, sizeof(struct in_addr));
394 break;
395 case AF_INET6:
396 memcpy (&SOCKET_SIN6_ADDR(socket), &((struct sockaddr_in6 *) ai->ai_addr) >sin6_addr, sizeof(struct in6_addr));
397 break;The application falls into case AF_INET6 and crashes on line 396. However, if I change
set var addr->ai_family=2the application falls into AF_INET case and it proceeds without a crash. By that I assume that ai holds struct sockaddr_in with 4 bytes allocated, but memcpy tries to read 16 bytes.
> print &((struct sockaddr_in *) ai->ai_addr)->sin_addr
$3 = (struct in_addr *) 0x60600001cdf4==23299==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600001cdf8 at pc 0x55555568e492 bp 0x7fffffffdaf0 sp 0x7fffffffdae0
READ of size 16 at 0x60600001cdf8 thread T0Extra information, in order to make this error work. /etc/hosts should contain:
127.0.0.1 localhost
::1 localhostIf either of one is defined, it will not trigger. Hence the approach where ipv6-localhost is defined (for example Ubuntu) will not have issues. It took some time to figure this out, better write about it.
skinkie
commented
5 years ago This might be a related issue.
CHEROKEE_TRACE=proxy /tmp/cherokee/sbin/cherokee-worker
Cherokee Web Server 1.2.104 (Nov 9 2019): Listening on port ALL:8000, TLS
disabled, IPv6 enabled, using epoll, 4096 fds system limit, max. 2041
connections, 20 threads, 102 connections per thread, standard scheduling
policy, tracing 'proxy'
handler_proxy.c:0901 ( cherokee_handler_proxy_init): Entering init 'get conn'
proxy_hosts.c:0453 (cherokee_handler_proxy_conn_init_socket): Initializing proxy socket
proxy_hosts.c:0493 (cherokee_handler_proxy_conn_init_socket): Proxy socket Initialized: IPv6, target: localhost, IP: ::1
handler_proxy.c:0939 ( cherokee_handler_proxy_init): Entering phase 'preconnect'
handler_proxy.c:0984 ( cherokee_handler_proxy_init): Entering phase 'connect': pconn=0x61100001a1c0
handler_proxy.c:0939 ( cherokee_handler_proxy_init): Entering phase 'preconnect'
proxy_hosts.c:0453 (cherokee_handler_proxy_conn_init_socket): Initializing proxy socket
=================================================================
==20662==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000211e0 at pc 0x561b7abe6bed bp 0x7f041cace840 sp 0x7f041cace830
READ of size 4 at 0x6060000211e0 thread T17
#0 0x561b7abe6bec in cherokee_ntop /home/skinkie/Sources/webserver/cherokee/util.c:2223
#1 0x561b7acbf72a in cherokee_handler_proxy_conn_init_socket /home/skinkie/Sources/webserver/cherokee/proxy_hosts.c:491
#2 0x561b7acb4f60 in cherokee_handler_proxy_init /home/skinkie/Sources/webserver/cherokee/handler_proxy.c:975
#3 0x561b7ad2abbd in cherokee_handler_init /home/skinkie/Sources/webserver/cherokee/handler.c:93
#4 0x561b7ad279bd in cherokee_connection_open_request /home/skinkie/Sources/webserver/cherokee/connection.c:2678
#5 0x561b7ac52b6b in process_active_connections /home/skinkie/Sources/webserver/cherokee/thread.c:1165
#6 0x561b7ac58800 in cherokee_thread_step_MULTI_THREAD /home/skinkie/Sources/webserver/cherokee/thread.c:2086
#7 0x561b7ac4c589 in thread_routine /home/skinkie/Sources/webserver/cherokee/thread.c:99
#8 0x7f0452344016 in start_thread (/lib64/libpthread.so.0+0x8016)
#9 0x7f0451bffafe in clone (/lib64/libc.so.6+0x106afe)@mmmds one of the other things that your message has put me on the wrong foot is that your actual request does not confirm the HTTP standard. It should have been CRLF, not just LF.
echo -e "GET /test8/test.html HTTP/1.0\r\nUser-Agent: python\r\n\r\n" | nc 10.9.0.2 8000
A socket structure is incorrectly used as ipv6 while connecting to a proxy server.
PoC
ASAN
Setup:
mkdir /var/www/test{1..20}; for i inseq 1 20; do echo test > test$i/test.html; donefound by: Mateusz Kocielski, Michał Dardas from LogicalTrust