netdev - Re: ss command not showing raw sockets? (regression)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 17 Aug 2021 14:37:53 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     David Ahern <dsahern@...il.com>
Cc:     Jonas Bechtel <post@...chtel.de>, netdev@...r.kernel.org
Subject: Re: ss command not showing raw sockets? (regression)

On Tue, 17 Aug 2021 13:54:53 -0600 David Ahern wrote:
> On 8/17/21 12:44 PM, Jakub Kicinski wrote:
> >> @kuba With PROC_NET_RAW I consider the problem is found, isn't it? So
> >> I will not download/bisect<->build or otherwise investigate the
> >> problem until one of you explicitely asks me to do so.
> >>
> >> I have now redirected invocation of command with set PROC_NET_RAW on
> >> my system, and may (try to) update to Linux 4.19.  
> > 
> > I suspect the bisection would end up at the commit which added 
> > the netlink dump support, so you can hold off for now, yes.  
> 
> agreed.
> > 
> > My best guess right now is that Knoppix has a cut-down kernel 
> > config and we don't handle that case correctly.
> >   
> 
> CONFIG_INET_RAW_DIAG (or INET_DIAG) is probably disabled. surprised the
> netlink dump does not return an error and it falls back to the proc file:
> 
>         if (!getenv("PROC_NET_RAW") && !getenv("PROC_ROOT") &&
>             inet_show_netlink(f, NULL, IPPROTO_RAW) == 0)
>                 return 0;
> 
> can you strace it?

Ah, good point, strace will show it. 

/me goes off to look at the strace Jonas sent off list.

Well this is unexpected:

sendmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=76, type=DCCPDIAG_GETSOCK, ...

--->8----------------

From: Jakub Kicinski <kuba@...nel.org>
Subject: ss: fix fallback to procfs for raw and sctp sockets

sockdiag_send() diverts to tcpdiag_send() to try the older
netlink interface. tcpdiag_send() works for TCP and DCCP
but not other protocols. Instead of rejecting unsupported
protocols (and missing RAW and SCTP) match on supported ones.

Fixes: 41fe6c34de50 ("ss: Add inet raw sockets information gathering via netlink diag interface")
Signed-off-by: Jakub Kicinski <kuba@...nel.org>
---
 misc/ss.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c
index 894ad40574f1..b39f63fe3b17 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -3404,13 +3404,13 @@ static int tcpdiag_send(int fd, int protocol, struct filter *f)
 	struct iovec iov[3];
 	int iovlen = 1;
 
-	if (protocol == IPPROTO_UDP || protocol == IPPROTO_MPTCP)
-		return -1;
-
 	if (protocol == IPPROTO_TCP)
 		req.nlh.nlmsg_type = TCPDIAG_GETSOCK;
-	else
+	else if (protocol == IPPROTO_DCCP)
 		req.nlh.nlmsg_type = DCCPDIAG_GETSOCK;
+	else
+		return -1;
+
 	if (show_mem) {
 		req.r.idiag_ext |= (1<<(INET_DIAG_MEMINFO-1));
 		req.r.idiag_ext |= (1<<(INET_DIAG_SKMEMINFO-1));
-- 
2.31.1