netdev - iproute2 ss outputs duplicate tcp sockets info on kernel 3.10.105

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <591121b4.213b9f0a.5aed.b3a8@mx.google.com>
Date:   Mon, 08 May 2017 18:56:04 -0700 (PDT)
From:   Li Er <phoooyb@...il.com>
To:     netdev@...r.kernel.org
Subject: iproute2 ss outputs duplicate tcp sockets info on kernel 3.10.105

i'm using v4.11.0 release of iproute2 and kernel 3.10.105, simply
running

        $ ss
        Netid  State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port
        tcp    CLOSE-WAIT 434    0      10.0.0.1:47931                65.49.18.136:https
        tcp    CLOSE-WAIT 432    0      10.0.0.1:47932                65.49.18.136:https
        tcp    CLOSE-WAIT 434    0      10.0.0.1:47931                65.49.18.136:https
        tcp    CLOSE-WAIT 432    0      10.0.0.1:47932                65.49.18.136:https

as you can see, there's one duplicate entry of each  tcp  socket,
however,  if  i  explicitly  specify  tcp socket by adding the -t
switch,

        $ ss -t
        State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port
        CLOSE-WAIT 434    0      10.0.0.1:47931                65.49.18.136:https
        CLOSE-WAIT 432    0      10.0.0.1:47932                65.49.18.136:https

the duplication is gone.

this problem also occurs on  git  master,  but  not  on  iproute2
v4.3.0,  so  i  did  a  git bisect and found out the commit which
caused this is 9f66764e308e9c645b3fb2d1cfbb7fb207eb5de1,  and  by
revert this commit on git master, i.e. removing

                                        err = rtnl_dump_done(rth, h);
                                        if (err < 0)
                                                return -1;

these 3 lines of code of lib/libnetlink.c, the problem is gone.

since  i'm not familiar with the source code, i doubt this is the
right way to solve the problem, what's your suggestions? thanks.