zardus / preeny

Some helpful preload libraries for pwning stuff.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

You might want to fill the addr struct passed to accept

junxzm1990 opened this issue · comments

The standard accept function will fill the "addr struct" (passed as argument) with the address of the peer socket. This is not done by the "accept" in desock.c. Some applications will not continue executing until the "addr struct" is filled. For instance, the latest version of nginx will check the address of the peer socket (I tried it with select mode but not sure about other modes).

Good catch. Do you have a fixed implementation you could PR, by any chance?

I think you can fill the "addr struct" with a fake address (e.g. INADDR_ANY) and set the "socklen_t * addrlen" correspondingly. That's what I did.

Could you push your code as a PR?

I am still "borrowing" the preeny code. When all set, I will PR.

Awesome, thanks :-)

7 months and still no PR :p

Running into the same issue with nginx.

There are some other interesting issues that might be worth looking into. While I'm having the same issue with addr not being set, I'm finding that eventually it does get set after about a minute... I'm not sure if something in the code is causing it to fall back to original_accept, but I'll try to investigate more.

Just to prove I'm not crazy here, occasionally the addr_text.len != 0 check passes and I see this in my nginx logs: unix: - - [04/Apr/2016:04:24:02 +0000] "GET / HTTP/1.0" 200 612 "-" "-". The addr_text.data was set to unix