net: ip, diag -- Add diag interface for raw sockets

In criu we are actively using diag interface to collect sockets present in the system when dumping applications. And while for unix, tcp, udp[lite], packet, netlink it works as expected, the raw sockets do not have. Thus add it.

v2:
- add missing sock_put calls in raw_diag_dump_one (by eric.dumazet@)
- implement @destroy for diag requests (by dsa@)

v3:
- add export of raw_abort for IPv6 (by dsa@)
- pass net-admin flag into inet_sk_diag_fill due to changes in net-next branch (by dsa@)

CC David S. Miller <[email protected]>

CC Eric Dumazet <[email protected]>

CC David Ahern <[email protected]>

CC Alexey Kuznetsov <[email protected]>

CC James Morris <[email protected]>

CC Hideaki YOSHIFUJI <[email protected]>

CC Patrick McHardy <[email protected]>

CC Andrey Vagin <[email protected]>

CC Stephen Hemminger <[email protected]>

Signed-off-by Cyrill Gorcunov <[email protected]>

---

 include/net/raw.h   |    6 +
 include/net/rawv6.h |    7 +
 net/ipv4/Kconfig    |    8 +
 net/ipv4/Makefile   |    1 
 net/ipv4/raw.c      |   21 ++++
 net/ipv4/raw_diag.c |  226 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 net/ipv6/raw.c      |    7 +
 7 files changed, 272 insertions(+), 4 deletions(-)

Index: linux-ml.git/include/net/raw.h
===================================================================

include/net/raw.h +6 -0

@@ -23,6 +23,12 @@
 
 extern struct proto raw_prot;
 
+extern struct raw_hashinfo raw_v4_hashinfo;
+struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
+			     unsigned short num, __be32 raddr,
+			     __be32 laddr, int dif);
+
+int raw_abort(struct sock *sk, int err);
 void raw_icmp_error(struct sk_buff *, int, u32);
 int raw_local_deliver(struct sk_buff *, int);
 

Index: linux-ml.git/include/net/rawv6.h
===================================================================

include/net/rawv6.h +7 -0

@@ -3,6 +3,13 @@
 
 #include <net/protocol.h>
 
+extern struct raw_hashinfo raw_v6_hashinfo;
+struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
+			     unsigned short num, const struct in6_addr *loc_addr,
+			     const struct in6_addr *rmt_addr, int dif);
+
+int raw_abort(struct sock *sk, int err);
+
 void raw6_icmp_error(struct sk_buff *, int nexthdr,
 		u8 type, u8 code, int inner_offset, __be32);
 bool raw6_local_deliver(struct sk_buff *, int);

Index: linux-ml.git/net/ipv4/Kconfig
===================================================================

net/ipv4/Kconfig +8 -0

@@ -430,6 +430,14 @@ config INET_UDP_DIAG
 	  Support for UDP socket monitoring interface used by the ss tool.
 	  If unsure, say Y.
 
+config INET_RAW_DIAG
+	tristate "RAW: socket monitoring interface"
+	depends on INET_DIAG && (IPV6 || IPV6=n)
+	default n
+	---help---
+	  Support for RAW socket monitoring interface used by the ss tool.
+	  If unsure, say Y.
+
 config INET_DIAG_DESTROY
 	bool "INET: allow privileged process to administratively close sockets"
 	depends on INET_DIAG

Index: linux-ml.git/net/ipv4/Makefile
===================================================================

net/ipv4/Makefile +1 -0

@@ -40,6 +40,7 @@ obj-$(CONFIG_NETFILTER)	+= netfilter.o n
 obj-$(CONFIG_INET_DIAG) += inet_diag.o 
 obj-$(CONFIG_INET_TCP_DIAG) += tcp_diag.o
 obj-$(CONFIG_INET_UDP_DIAG) += udp_diag.o
+obj-$(CONFIG_INET_RAW_DIAG) += raw_diag.o
 obj-$(CONFIG_NET_TCPPROBE) += tcp_probe.o
 obj-$(CONFIG_TCP_CONG_BIC) += tcp_bic.o
 obj-$(CONFIG_TCP_CONG_CDG) += tcp_cdg.o

Index: linux-ml.git/net/ipv4/raw.c
===================================================================

net/ipv4/raw.c +19 -2

@@ -89,9 +89,10 @@ struct raw_frag_vec {
 	int hlen;
 };
 
-static struct raw_hashinfo raw_v4_hashinfo = {
+struct raw_hashinfo raw_v4_hashinfo = {
 	.lock = __RW_LOCK_UNLOCKED(raw_v4_hashinfo.lock),
 };
+EXPORT_SYMBOL_GPL(raw_v4_hashinfo);
 
 int raw_hash_sk(struct sock *sk)
 {

@@ -120,7 +121,7 @@ void raw_unhash_sk(struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(raw_unhash_sk);
 
-static struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
+struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
 		unsigned short num, __be32 raddr, __be32 laddr, int dif)
 {
 	sk_for_each_from(sk) {

@@ -136,6 +137,7 @@ static struct sock *__raw_v4_lookup(stru
 found:
 	return sk;
 }
+EXPORT_SYMBOL_GPL(__raw_v4_lookup);
 
 /*
  *	0 - deliver

@@ -918,6 +920,20 @@ static int compat_raw_ioctl(struct sock
 }
 #endif
 
+int raw_abort(struct sock *sk, int err)
+{
+	lock_sock(sk);
+
+	sk->sk_err = err;
+	sk->sk_error_report(sk);
+	udp_disconnect(sk, 0);
+
+	release_sock(sk);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(raw_abort);
+
 struct proto raw_prot = {
 	.name		   = "RAW",
 	.owner		   = THIS_MODULE,

@@ -943,6 +959,7 @@ struct proto raw_prot = {
 	.compat_getsockopt = compat_raw_getsockopt,
 	.compat_ioctl	   = compat_raw_ioctl,
 #endif
+	.diag_destroy	   = raw_abort,
 };
 
 #ifdef CONFIG_PROC_FS

Index: linux-ml.git/net/ipv4/raw_diag.c
===================================================================

net/ipv4/raw_diag.c new file +13 -0

@@ -0,0 +1,226 @@
+#include <linux/module.h>
+
+#include <linux/inet_diag.h>
+#include <linux/sock_diag.h>
+
+#include <net/raw.h>
+#include <net/rawv6.h>
+
+#ifdef pr_fmt
+# undef pr_fmt
+#endif
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

net/ipv4/raw_diag.c new file +203 -0

+	} else {
+		pr_warn_once("Unexpected inet family %d\n",
+			     r->sdiag_family);
+		WARN_ON_ONCE(1);
+		return ERR_PTR(-EINVAL);
+	}
+}
+
+static struct sock *raw_lookup(struct net *net, struct sock *from,
+			       const struct inet_diag_req_v2 *r)
+{
+	struct sock *sk = NULL;
+
+	if (r->sdiag_family == AF_INET)
+		sk = __raw_v4_lookup(net, from, r->sdiag_protocol,
+				     r->id.idiag_dst[0],
+				     r->id.idiag_src[0],
+				     r->id.idiag_if);
+#if IS_ENABLED(CONFIG_IPV6)
+	else
+		sk = __raw_v6_lookup(net, from, r->sdiag_protocol,
+				     (const struct in6_addr *)r->id.idiag_src,
+				     (const struct in6_addr *)r->id.idiag_dst,
+				     r->id.idiag_if);
+#endif
+	return sk;
+}
+
+static struct sock *raw_sock_get(struct net *net, const struct inet_diag_req_v2 *r)
+{
+	struct raw_hashinfo *hashinfo = raw_get_hashinfo(r);
+	struct sock *sk = NULL, *s;
+	int slot;
+
+	if (IS_ERR(hashinfo))
+		return ERR_CAST(hashinfo);
+
+	read_lock(&hashinfo->lock);
+	for (slot = 0; slot < RAW_HTABLE_SIZE; slot++) {
+		sk_for_each(s, &hashinfo->ht[slot]) {
+			sk = raw_lookup(net, s, r);
+			if (sk)
+				break;
+		}
+	}
+	if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
+		sk = NULL;
+	read_unlock(&hashinfo->lock);
+
+	return sk ? sk : ERR_PTR(-ENOENT);
+}
+
+static int raw_diag_dump_one(struct sk_buff *in_skb,
+			     const struct nlmsghdr *nlh,
+			     const struct inet_diag_req_v2 *r)
+{
+	struct net *net = sock_net(in_skb->sk);
+	struct sk_buff *rep;
+	struct sock *sk;
+	int err;
+
+	sk = raw_sock_get(net, r);
+	if (IS_ERR(sk))
+		return PTR_ERR(sk);
+
+	rep = nlmsg_new(sizeof(struct inet_diag_msg) +
+			sizeof(struct inet_diag_meminfo) + 64,
+			GFP_KERNEL);
+	if (!rep) {
+		sock_put(sk);
+		return -ENOMEM;
+	}
+
+	err = inet_sk_diag_fill(sk, NULL, rep, r,
+				sk_user_ns(NETLINK_CB(in_skb).sk),
+				NETLINK_CB(in_skb).portid,
+				nlh->nlmsg_seq, 0, nlh,
+				netlink_net_capable(in_skb, CAP_NET_ADMIN));
+	sock_put(sk);
+
+	if (err < 0) {
+		kfree_skb(rep);
+		return err;
+	}
+
+	err = netlink_unicast(net->diag_nlsk, rep,
+			      NETLINK_CB(in_skb).portid,
+			      MSG_DONTWAIT);
+	if (err > 0)
+		err = 0;
+	return err;
+}
+
+static int sk_diag_dump(struct sock *sk, struct sk_buff *skb,
+			struct netlink_callback *cb,
+			const struct inet_diag_req_v2 *r,
+			struct nlattr *bc, bool net_admin)
+{
+	if (!inet_diag_bc_sk(bc, sk))
+		return 0;
+
+	return inet_sk_diag_fill(sk, NULL, skb, r,
+			sk_user_ns(NETLINK_CB(cb->skb).sk),
+			NETLINK_CB(cb->skb).portid,
+			cb->nlh->nlmsg_seq, NLM_F_MULTI,
+			cb->nlh, net_admin);
+}
+
+static void raw_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
+			  const struct inet_diag_req_v2 *r, struct nlattr *bc)
+{
+	bool net_admin = netlink_net_capable(cb->skb, CAP_NET_ADMIN);
+	struct raw_hashinfo *hashinfo = raw_get_hashinfo(r);
+	struct net *net = sock_net(skb->sk);
+	int num, s_num, slot, s_slot;
+	struct sock *sk = NULL;
+
+	if (IS_ERR(hashinfo))
+		return;
+
+	s_slot = cb->args[0];
+	num = s_num = cb->args[1];
+
+	read_lock(&hashinfo->lock);
+	for (slot = s_slot; slot < RAW_HTABLE_SIZE; s_num = 0, slot++) {
+		num = 0;
+
+		sk_for_each(sk, &hashinfo->ht[slot]) {
+			struct inet_sock *inet = inet_sk(sk);
+
+			if (!net_eq(sock_net(sk), net))
+				continue;
+			if (num < s_num)
+				goto next;
+			if (sk->sk_family != r->sdiag_family)
+				goto next;
+			if (r->id.idiag_sport != inet->inet_sport &&
+			    r->id.idiag_sport)
+				goto next;
+			if (r->id.idiag_dport != inet->inet_dport &&
+			    r->id.idiag_dport)
+				goto next;
+			if (sk_diag_dump(sk, skb, cb, r, bc, net_admin) < 0)
+				goto out_unlock;
+next:
+			num++;
+		}
+	}
+
+out_unlock:
+	read_unlock(&hashinfo->lock);
+
+	cb->args[0] = slot;
+	cb->args[1] = num;
+}
+
+static void raw_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
+			      void *info)
+{
+	r->idiag_rqueue = sk_rmem_alloc_get(sk);
+	r->idiag_wqueue = sk_wmem_alloc_get(sk);
+}
+
+#ifdef CONFIG_INET_DIAG_DESTROY
+static int raw_diag_destroy(struct sk_buff *in_skb,
+			    const struct inet_diag_req_v2 *r)
+{
+	struct net *net = sock_net(in_skb->sk);
+	struct sock *sk;
+
+	sk = raw_sock_get(net, r);
+	if (IS_ERR(sk))
+		return PTR_ERR(sk);
+	return sock_diag_destroy(sk, ECONNABORTED);
+}
+#endif
+
+static const struct inet_diag_handler raw_diag_handler = {
+	.dump			= raw_diag_dump,
+	.dump_one		= raw_diag_dump_one,
+	.idiag_get_info		= raw_diag_get_info,
+	.idiag_type		= IPPROTO_RAW,
+	.idiag_info_size	= 0,
+#ifdef CONFIG_INET_DIAG_DESTROY
+	.destroy		= raw_diag_destroy,
+#endif
+};
+
+static int __init raw_diag_init(void)
+{
+	return inet_diag_register(&raw_diag_handler);
+}
+
+static void __exit raw_diag_exit(void)
+{
+	inet_diag_unregister(&raw_diag_handler);
+}
+
+module_init(raw_diag_init);
+module_exit(raw_diag_exit);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 2-255 /* AF_INET - IPPROTO_RAW */);
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_SOCK_DIAG, 10-255 /* AF_INET6 - IPPROTO_RAW */);

Index: linux-ml.git/net/ipv6/raw.c
===================================================================

net/ipv6/raw.c +5 -2

@@ -65,11 +65,12 @@
 
 #define	ICMPV6_HDRLEN	4	/* ICMPv6 header, RFC 4443 Section 2.1 */
 
-static struct raw_hashinfo raw_v6_hashinfo = {
+struct raw_hashinfo raw_v6_hashinfo = {
 	.lock = __RW_LOCK_UNLOCKED(raw_v6_hashinfo.lock),
 };
+EXPORT_SYMBOL_GPL(raw_v6_hashinfo);
 
-static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
+struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
 		unsigned short num, const struct in6_addr *loc_addr,
 		const struct in6_addr *rmt_addr, int dif)
 {

@@ -102,6 +103,7 @@ static struct sock *__raw_v6_lookup(stru
 found:
 	return sk;
 }
+EXPORT_SYMBOL_GPL(__raw_v6_lookup);
 
 /*
  *	0 - deliver

@@ -1252,6 +1254,7 @@ struct proto rawv6_prot = {
 	.compat_getsockopt = compat_rawv6_getsockopt,
 	.compat_ioctl	   = compat_rawv6_ioctl,
 #endif
+	.diag_destroy	   = raw_abort,
 };
 
 #ifdef CONFIG_PROC_FS

Someday Linux will be a modern OS that just includes IPV6 and forces a config option to NOT have it.

That'll be great. All the IS_ENABLED_(CONFIG_IPV6) scattered everywhere is nuts.

</editorial comment>

Quoted 7 lines · Greg

Someday Linux will be a modern OS that just includes IPV6 and forces a config option to NOT have it.

That'll be great. All the IS_ENABLED_(CONFIG_IPV6) scattered everywhere is nuts.

</editorial comment>

Better wait until everyone at least *has* IPv6! I have yet to have IPv6 deployed on any of my employer's networks or get IPv6 service from any ISP at my home. When I was at Apple in the 90's I was told that Apple needed IPv6 by next year or "we were dead". Well Apple nearly died, but IPv6 had nothing to do with that! And I still haven't experienced an IPv6 deployment! Yeah, I have run it a bit point-to-point to resolve technical issues, but that isn't a "deployment" and not very interesting.

As much as we would like things to move faster, much of the world just doesn't. Witness the e1000 discussion today for example. Hardware doesn't vanish overnight, and I know that my ISP has a network full of CPE that doesn't do IPv6, so I'm not expecting their status to change any time soon.

It would be great though.
</pipedream>

--
Mark Rustad, Networking Division, Intel Corporation

In criu we are actively using diag interface to collect sockets present in the system when dumping applications. And while for unix, tcp, udp[lite], packet, netlink it works as expected, the raw sockets do not have. Thus add it.

v2:
- add missing sock_put calls in raw_diag_dump_one (by eric.dumazet@)
- implement @destroy for diag requests (by dsa@)

v3:
- add export of raw_abort for IPv6 (by dsa@)
- pass net-admin flag into inet_sk_diag_fill due to changes in net-next branch (by dsa@)

CC David S. Miller <[email protected]>

CC Eric Dumazet <[email protected]>

CC David Ahern <[email protected]>

CC Alexey Kuznetsov <[email protected]>

CC James Morris <[email protected]>

CC Hideaki YOSHIFUJI <[email protected]>

CC Patrick McHardy <[email protected]>

CC Andrey Vagin <[email protected]>

CC Stephen Hemminger <[email protected]>

Signed-off-by Cyrill Gorcunov <[email protected]>

---

Quoted 24 lines · Cyrill Gorcunov

In criu we are actively using diag interface to collect sockets present in the system when dumping applications. And while for unix, tcp, udp[lite], packet, netlink it works as expected, the raw sockets do not have. Thus add it.

v2:
- add missing sock_put calls in raw_diag_dump_one (by eric.dumazet@)
- implement @destroy for diag requests (by dsa@)

v3:
- add export of raw_abort for IPv6 (by dsa@)
- pass net-admin flag into inet_sk_diag_fill due to changes in net-next branch (by dsa@)

CC David S. Miller <[email protected]>

CC Eric Dumazet <[email protected]>

CC David Ahern <[email protected]>

CC Alexey Kuznetsov <[email protected]>

CC James Morris <[email protected]>

CC Hideaki YOSHIFUJI <[email protected]>

CC Patrick McHardy <[email protected]>

CC Andrey Vagin <[email protected]>

CC Stephen Hemminger <[email protected]>

Signed-off-by Cyrill Gorcunov <[email protected]>

Quoted 1 line

---

ss -K is not working. Socket lookup fails to find a match due to a protocol mismatch.

haven't had time to track down why there is a mismatch since the kill uses the socket returned from the dump. Won't have time to come back to this until early next week.

Quoted 4 lines

ss -K is not working. Socket lookup fails to find a match due to a protocol mismatch.

haven't had time to track down why there is a mismatch since the kill uses the socket returned from the dump. Won't have time to come back to this until early next week.

Have you ran iproute2 patched? I just ran ss -K and all sockets get closed (including raw ones), which actually kicked me off the testing machine sshd :/

Quoted 7 lines · Cyrill Gorcunov

Quoted 4 lines

ss -K is not working. Socket lookup fails to find a match due to a protocol mismatch.

haven't had time to track down why there is a mismatch since the kill uses the socket returned from the dump. Won't have time to come back to this until early next week.

Have you ran iproute2 patched? I just ran ss -K and all sockets get closed (including raw ones), which actually kicked me off the testing machine sshd :/

yes.

Quoted 6 lines · David Ahern

Quoted 5 lines · Cyrill Gorcunov

Quoted 4 lines

ss -K is not working. Socket lookup fails to find a match due to a protocol mismatch.

haven't had time to track down why there is a mismatch since the kill uses the socket returned from the dump. Won't have time to come back to this until early next week.

Quoted 5 lines

Quoted 2 lines

Have you ran iproute2 patched? I just ran ss -K and all sockets get closed (including raw ones), which actually kicked me off the testing machine sshd :/

yes.

And CONFIG_INET_DIAG_DESTROY is also set in your .config ?

Quoted 4 lines

ss -K is not working. Socket lookup fails to find a match due to a protocol mismatch.

haven't had time to track down why there is a mismatch since the kill uses the socket returned from the dump. Won't have time to come back to this until early next week.

Have you ran iproute2 patched? I just ran ss -K and all sockets get closed (including raw ones), which actually kicked me off the testing machine sshd :/

Quoted 8 lines · Cyrill Gorcunov

Quoted 4 lines

ss -K is not working. Socket lookup fails to find a match due to a protocol mismatch.

haven't had time to track down why there is a mismatch since the kill uses the socket returned from the dump. Won't have time to come back to this until early next week.

Have you ran iproute2 patched? I just ran ss -K and all sockets get closed (including raw ones), which actually kicked me off the testing machine sshd :/

This is the patch I applied to iproute2; the change in your goo.gl link plus a debug to confirm the kill action is initiated by ss:

misc/ss.c +4 -0

index 3b268d999426..4d98411738ea 100644
@@ -2334,6 +2334,10 @@ static int show_one_inet_sock(const struct sockaddr_nl *addr,
        if (diag_arg->f->f && run_ssfilter(diag_arg->f->f, &s) == 0)
                return 0;
 
+       if (diag_arg->f->kill) {
+printf("want to kill:\n");
+       err = inet_show_sock(h, &s, diag_arg->protocol);
+       }
        if (diag_arg->f->kill && kill_inet_sock(h, arg) != 0) {
                if (errno == EOPNOTSUPP || errno == ENOENT) {
                        /* Socket can't be closed, or is already closed. */

Here I get kicked off the server. Login back

[cyrill@uranus ~] ssh root@pcs7
Last login: Thu Sep 15 23:20:42 2016 from gateway
[root@pcs7 ~]# cd /home/iproute2/
[root@pcs7 iproute2]# misc/ss -A raw

State      Recv-Q Send-Q                                Local Address:Port                                                 Peer Address:Port                
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    

Maybe I do something wrong for testing?

Quoted 10 lines · Cyrill Gorcunov

Here I get kicked off the server. Login back

[cyrill@uranus ~] ssh root@pcs7
Last login: Thu Sep 15 23:20:42 2016 from gateway
[root@pcs7 ~]# cd /home/iproute2/
[root@pcs7 iproute2]# misc/ss -A raw

State      Recv-Q Send-Q                                Local Address:Port                                                 Peer Address:Port                
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    

Quoted 1 line

Maybe I do something wrong for testing?

If you kill your shell, maybe /root/sock is killer as well, thus its raw sockets are closed.

Try to be selective in the -K , do not kill tcp sockets ?

Quoted 2 lines

Try to be selective in the -K , do not kill tcp sockets ?

I am running
ss -aKw 'dev == red'

to kill raw sockets bound to device named 'red'.

Quoted 7 lines · David Ahern

Quoted 2 lines

Try to be selective in the -K , do not kill tcp sockets ?

I am running
ss -aKw 'dev == red'

to kill raw sockets bound to device named 'red'.

Thanks David, Eric! I'll play with this option today and report the results.

I created veth pair and bound raw socket into it.

[root@pcs7 iproute2]# misc/ss -A raw

State      Recv-Q Send-Q                                Local Address:Port                                                 Peer Address:Port                
ESTAB      0      0                                         127.0.0.1:ipproto-255                                            127.0.0.10:ipproto-9090         
UNCONN     0      0                                        127.0.0.10:ipproto-255                                                     *:*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
ESTAB      0      0                                               ::1:ipproto-255                                                   ::1:ipproto-9091         
UNCONN     0      0                                           ::1%vm1:ipproto-255                                                    :::*                    

[root@pcs7 iproute2]#

[root@pcs7 iproute2]# misc/ss -aKw 'dev == vm1'
State Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0 0 ::1%vm1:ipproto-255 :::*

[root@pcs7 iproute2]# misc/ss -A raw

State      Recv-Q Send-Q                                Local Address:Port                                                 Peer Address:Port                
ESTAB      0      0                                         127.0.0.1:ipproto-255                                            127.0.0.10:ipproto-9090         
UNCONN     0      0                                        127.0.0.10:ipproto-255                                                     *:*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
ESTAB      0      0                                               ::1:ipproto-255                                                   ::1:ipproto-9091         

so it get zapped out. Is there some other way to test it?

Quoted 8 lines

[root@pcs7 iproute2]# misc/ss -A raw

State      Recv-Q Send-Q                                Local Address:Port                                                 Peer Address:Port                
ESTAB      0      0                                         127.0.0.1:ipproto-255                                            127.0.0.10:ipproto-9090         
UNCONN     0      0                                        127.0.0.10:ipproto-255                                                     *:*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
ESTAB      0      0                                               ::1:ipproto-255                                                   ::1:ipproto-9091         

Quoted 2 lines

so it get zapped out. Is there some other way to test it?

I'm guessing you passed IPPROTO_RAW (255) as the protocol to socket(). If you pass something else (IPPROTO_ICMP for example) it won't work.

Quoted 8 lines · David Ahern

Quoted 8 lines

[root@pcs7 iproute2]# misc/ss -A raw

State      Recv-Q Send-Q                                Local Address:Port                                                 Peer Address:Port                
ESTAB      0      0                                         127.0.0.1:ipproto-255                                            127.0.0.10:ipproto-9090         
UNCONN     0      0                                        127.0.0.10:ipproto-255                                                     *:*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
UNCONN     0      0                                                :::ipv6-icmp                                                      :::*                    
ESTAB      0      0                                               ::1:ipproto-255                                                   ::1:ipproto-9091         

Quoted 5 lines

Quoted 2 lines

so it get zapped out. Is there some other way to test it?

I'm guessing you passed IPPROTO_RAW (255) as the protocol to socket(). If you pass something else (IPPROTO_ICMP for example) it won't work.

True. To support IPPROTO_ICMP it need enhancement. I thought start with plain _RAW first and then extend to support _ICMP.

Quoted 6 lines

Quoted 3 lines

I'm guessing you passed IPPROTO_RAW (255) as the protocol to socket(). If you pass something else (IPPROTO_ICMP for example) it won't work.

True. To support IPPROTO_ICMP it need enhancement. I thought start with plain _RAW first and then extend to support _ICMP.

I thought raw in this case was SOCK_RAW as in the socket type.

Since the display is showing sockets in addition to IPPROTO_RAW:

$ ss -A raw
State      Recv-Q Send-Q        Local Address:Port                         Peer Address:Port
UNCONN     0      0                    *%eth0:icmp                                    *:*

It is going to be confusing if only ipproto-255 sockets can be killed.

Quoted 11 lines · David Ahern

Quoted 6 lines

Quoted 3 lines

I'm guessing you passed IPPROTO_RAW (255) as the protocol to socket(). If you pass something else (IPPROTO_ICMP for example) it won't work.

True. To support IPPROTO_ICMP it need enhancement. I thought start with plain _RAW first and then extend to support _ICMP.

I thought raw in this case was SOCK_RAW as in the socket type.

Since the display is showing sockets in addition to IPPROTO_RAW:

Quoted 5 lines

$ ss -A raw
State      Recv-Q Send-Q        Local Address:Port                         Peer Address:Port
UNCONN     0      0                    *%eth0:icmp                                    *:*

It is going to be confusing if only ipproto-255 sockets can be killed.

OK, gimme some time to implement it. Hopefully on the weekend or monday. Thanks a huge for feedback!

Quoted 6 lines

Quoted 6 lines

Since the display is showing sockets in addition to IPPROTO_RAW:

$ ss -A raw
State      Recv-Q Send-Q        Local Address:Port                         Peer Address:Port
UNCONN     0      0                    *%eth0:icmp                                    *:*

Quoted 5 lines

Quoted 1 line

It is going to be confusing if only ipproto-255 sockets can be killed.

OK, gimme some time to implement it. Hopefully on the weekend or monday. Thanks a huge for feedback!

It may well be a ss bug / problem. As I mentioned I am always seeing 255 for the protocol which

is odd since ss does a dump and takes the matches and invokes the kill. Thanks for taking the time to do the kill piece.

Quoted 1 line

It may well be a ss bug / problem. As I mentioned I am always seeing 255 for the protocol which

It is rather not addressed in ss. I mean, look, when we send out a diag packet the kernel look ups for a handler, which for raw protocol we register as

static const struct inet_diag_handler raw_diag_handler = {
	.dump= raw_diag_dump,
	.dump_one= raw_diag_dump_one,
	.idiag_get_info= raw_diag_get_info,
	.idiag_type= IPPROTO_RAW,
	.idiag_info_size= 0,

#ifdef CONFIG_INET_DIAG_DESTROY
.destroy= raw_diag_destroy,
#endif
};

so if we patch ss and ask for IPPROTO_ICMP in netlink packet the kernel simply won't find anything. Thus I think we need (well, I need) to extend the patch and register IPPROTO_ICMP diag type, then extend ss as well. (If only I didn't miss somethin obvious).

Quoted 2 lines

is odd since ss does a dump and takes the matches and invokes the kill. Thanks for taking the time to do the kill piece.

Quoted 16 lines · Cyrill Gorcunov

Quoted 1 line

It may well be a ss bug / problem. As I mentioned I am always seeing 255 for the protocol which

It is rather not addressed in ss. I mean, look, when we send out a diag packet the kernel look ups for a handler, which for raw protocol we register as

static const struct inet_diag_handler raw_diag_handler = {
	.dump= raw_diag_dump,
	.dump_one= raw_diag_dump_one,
	.idiag_get_info= raw_diag_get_info,
	.idiag_type= IPPROTO_RAW,
	.idiag_info_size= 0,

#ifdef CONFIG_INET_DIAG_DESTROY
.destroy= raw_diag_destroy,
#endif
};

Quoted 7 lines

so if we patch ss and ask for IPPROTO_ICMP in netlink packet the kernel simply won't find anything. Thus I think we need (well, I need) to extend the patch and register IPPROTO_ICMP diag type, then extend ss as well. (If only I didn't miss somethin obvious).

Quoted 2 lines

is odd since ss does a dump and takes the matches and invokes the kill. Thanks for taking the time to do the kill piece.

Sorry for delay in reply (I got flu unexpectedly). You know, it eventually become uneasy to implement handling for sock-raw because they are special. They described as ipproto-ip in net/ipv4/af_inet.c, so it matches any protocol specified with the socket call. In turn inet-diag module handled predefined protocols only, in particular IPPROTO_RAW in our case. Thus to fecth some real protocol sitting in raw sockets hashes we need some kind of additional argument passed in the request. I guess we may use @idiag_ext field for this sake? Or require @idiag_ext to have INET_DIAG_PROTOCOL bit set and then fetch real protocol from additional attribute? Sounds ok?

include/uapi/linux/inet_diag.h 2016-09-27 01:34:08.413172394 +0300 renamed from include/uapi/linux/inet_diag.h 2016-09-11 20:56:18.191584145 +0300 +0 -0

        __u32   idiag_states;
        struct inet_diag_sockid id;
 };

and in raw-diag module we will use @sdiag_raw_protocol instead of @sdiag_protocol field. Didn't cover ss tool source code yet but I think the idea is seen. Still not sure if start using @pad here is a good idea (it's uapi), maybe beter to ask nla attribute which would come right afterh the inet_diag_req_v2 message?

include/uapi/linux/inet_diag.h 2016-09-27 01:34:08.413172394 +0300 struct inet_diag_req_v2 { · line 41

Quoted 12 lines · Cyrill Gorcunov

Something like

Index: linux-ml.git/include/uapi/linux/inet_diag.h
===================================================================

include/uapi/linux/inet_diag.h 2016-09-27 01:34:08.413172394 +0300 renamed from include/uapi/linux/inet_diag.h 2016-09-11 20:56:18.191584145 +0300 +1 -1

@@ -38,7 +38,7 @@ struct inet_diag_req_v2 {
        __u8    sdiag_family;
        __u8    sdiag_protocol;
        __u8    idiag_ext;
-       __u8    pad;
+       __u8    sdiag_raw_protocol;     /* SOCK_RAW only, @pad for others */

Seems like that should be a union to keep the API.

Quoted 6 lines

include/uapi/linux/inet_diag.h 2016-09-27 01:34:08.413172394 +0300 renamed from include/uapi/linux/inet_diag.h 2016-09-11 20:56:18.191584145 +0300 +0 -0

        __u32   idiag_states;
        struct inet_diag_sockid id;
 };

Quoted 6 lines

and in raw-diag module we will use @sdiag_raw_protocol instead of @sdiag_protocol field. Didn't cover ss tool source code yet but I think the idea is seen. Still not sure if start using @pad here is a good idea (it's uapi), maybe beter to ask nla attribute which would come right afterh the inet_diag_req_v2 message?

seems reasonable to me since 2 protocols need to be sent to the kernel.

Alternatively, sdiag_protocol could be the actual protocol and the pad union be a flag field with say bit 0 = INET_DIAG_FLAG_SOCK_RAW. Allows other overrides in the future if needed.