netdev - Re: ss command not showing raw sockets? (regression)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <74deda94-f14e-be9e-6925-527c7b70a563@gmail.com>
Date:   Tue, 17 Aug 2021 18:47:06 -0600
From:   David Ahern <dsahern@...il.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     Jonas Bechtel <post@...chtel.de>, netdev@...r.kernel.org
Subject: Re: ss command not showing raw sockets? (regression)

On 8/17/21 3:37 PM, Jakub Kicinski wrote:
> On Tue, 17 Aug 2021 13:54:53 -0600 David Ahern wrote:
>> On 8/17/21 12:44 PM, Jakub Kicinski wrote:
>>>> @kuba With PROC_NET_RAW I consider the problem is found, isn't it? So
>>>> I will not download/bisect<->build or otherwise investigate the
>>>> problem until one of you explicitely asks me to do so.
>>>>
>>>> I have now redirected invocation of command with set PROC_NET_RAW on
>>>> my system, and may (try to) update to Linux 4.19.  
>>>
>>> I suspect the bisection would end up at the commit which added 
>>> the netlink dump support, so you can hold off for now, yes.  
>>
>> agreed.
>>>
>>> My best guess right now is that Knoppix has a cut-down kernel 
>>> config and we don't handle that case correctly.
>>>   
>>
>> CONFIG_INET_RAW_DIAG (or INET_DIAG) is probably disabled. surprised the
>> netlink dump does not return an error and it falls back to the proc file:
>>
>>         if (!getenv("PROC_NET_RAW") && !getenv("PROC_ROOT") &&
>>             inet_show_netlink(f, NULL, IPPROTO_RAW) == 0)
>>                 return 0;
>>
>> can you strace it?
> 
> Ah, good point, strace will show it. 
> 
> /me goes off to look at the strace Jonas sent off list.
> 
> Well this is unexpected:
> 
> sendmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base={{len=76, type=DCCPDIAG_GETSOCK, ...
> 
> --->8----------------
> 
> From: Jakub Kicinski <kuba@...nel.org>
> Subject: ss: fix fallback to procfs for raw and sctp sockets
> 
> sockdiag_send() diverts to tcpdiag_send() to try the older
> netlink interface. tcpdiag_send() works for TCP and DCCP
> but not other protocols. Instead of rejecting unsupported
> protocols (and missing RAW and SCTP) match on supported ones.
> 
> Fixes: 41fe6c34de50 ("ss: Add inet raw sockets information gathering via netlink diag interface")
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>
> ---
>  misc/ss.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/misc/ss.c b/misc/ss.c
> index 894ad40574f1..b39f63fe3b17 100644
> --- a/misc/ss.c
> +++ b/misc/ss.c
> @@ -3404,13 +3404,13 @@ static int tcpdiag_send(int fd, int protocol, struct filter *f)
>  	struct iovec iov[3];
>  	int iovlen = 1;
>  
> -	if (protocol == IPPROTO_UDP || protocol == IPPROTO_MPTCP)
> -		return -1;
> -
>  	if (protocol == IPPROTO_TCP)
>  		req.nlh.nlmsg_type = TCPDIAG_GETSOCK;
> -	else
> +	else if (protocol == IPPROTO_DCCP)
>  		req.nlh.nlmsg_type = DCCPDIAG_GETSOCK;
> +	else
> +		return -1;
> +
>  	if (show_mem) {
>  		req.r.idiag_ext |= (1<<(INET_DIAG_MEMINFO-1));
>  		req.r.idiag_ext |= (1<<(INET_DIAG_SKMEMINFO-1));
> 

That looks correct to me.

Jonas: can you build iproute2 and test?