netdev - Re: ss command not showing raw sockets? (regression)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210818215738.1830fd0b@mmluhan>
Date:   Wed, 18 Aug 2021 21:57:38 +0200
From:   Jonas Bechtel <post@...chtel.de>
To:     David Ahern <dsahern@...il.com>
Cc:     Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org
Subject: Re: ss command not showing raw sockets? (regression)




On Tue, 17 Aug 2021 18:47:06 -0600
David Ahern <dsahern@...il.com> wrote with subject
"Re: ss command not showing raw sockets? (regression)":

> On 8/17/21 3:37 PM, Jakub Kicinski wrote:
> > 
> > Ah, good point, strace will show it. 
> > 
> > /me goes off to look at the strace Jonas sent off list.
> > 
> > Well this is unexpected:
> > 
> > sendmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0,
> > nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=76,
> > type=DCCPDIAG_GETSOCK, ... --->8----------------  
> > 
> > From: Jakub Kicinski <kuba@...nel.org>
> > Subject: ss: fix fallback to procfs for raw and sctp sockets
> > 
> > sockdiag_send() diverts to tcpdiag_send() to try the older
> > netlink interface. tcpdiag_send() works for TCP and DCCP
> > but not other protocols. Instead of rejecting unsupported
> > protocols (and missing RAW and SCTP) match on supported ones.
> > 
> > Fixes: 41fe6c34de50 ("ss: Add inet raw sockets information
> > gathering via netlink diag interface") Signed-off-by: Jakub
> > Kicinski <kuba@...nel.org> ---
> >  misc/ss.c | 8 ++++----
> >  1 file changed, 4 insertions(+), 4 deletions(-)
> > 
> > diff --git a/misc/ss.c b/misc/ss.c
> > index 894ad40574f1..b39f63fe3b17 100644
> > --- a/misc/ss.c
> > +++ b/misc/ss.c
> > @@ -3404,13 +3404,13 @@ static int tcpdiag_send(int fd, int
> > protocol, struct filter *f) struct iovec iov[3];
> >  	int iovlen = 1;
> >  
> > -	if (protocol == IPPROTO_UDP || protocol == IPPROTO_MPTCP)
> > -		return -1;
> > -
> >  	if (protocol == IPPROTO_TCP)
> >  		req.nlh.nlmsg_type = TCPDIAG_GETSOCK;
> > -	else
> > +	else if (protocol == IPPROTO_DCCP)
> >  		req.nlh.nlmsg_type = DCCPDIAG_GETSOCK;
> > +	else
> > +		return -1;
> > +
> >  	if (show_mem) {
> >  		req.r.idiag_ext |= (1<<(INET_DIAG_MEMINFO-1));
> >  		req.r.idiag_ext |= (1<<(INET_DIAG_SKMEMINFO-1));
> >   
> 
> That looks correct to me.
> 
> Jonas: can you build iproute2 and test?

I've cloned branch main as instructed in https://wiki.linuxfoundation.org/networking/iproute2. Most recent commit is 9b7ea92b9e3f. After building, no socket was listed in table.

Then I [manually] applied the patch and rebuilt. The patched version works well, I do see the two sockets right now.

Command was in both cases misc/ss -awp