"$ ss -a" incorrectly displays raw sockets as udp sockets

Hi!

I hope this is the right place to reports bugs. I apologize if it isn't.

I have written a C program (see below for source code) that opens a raw socket on CentOS 7.1 Linux and binds it to some address (it doesn't use the port that I supplied, but that is not the point here). The "netstat" program correctly recognizes the socket as "raw", while "ss" program says it is "udp". Here are the relevant lines from the ss and netstat commands:

$ netstat -an
raw        0      0 127.0.0.1:6             0.0.0.0:* 7

$ ./ss -an
udp    UNCONN     21569  0      127.0.0.1:6 *:*

Here is the version information

$ netstat --version  # From CentOS 7.1.
net-tools 2.10-alpha

$ ./ss --version  # Built from git.
ss utility, iproute2-ss150626

C source follows. If you store it in "main.c", then compile it with "$ gcc main.c -o main" and then run it by executing "$ sudo ./main".

#include <arpa/inet.h>
#include <assert.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>

int main(void)

{
    // Create a raw socket.
    int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (sock == -1) { perror(NULL); goto exc_cleanup; }

    // Bind socket to an address.
    struct sockaddr_in addr;
    addr.sin_family = AF_INET;
    inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
    addr.sin_port = htons(27183);

    int rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
    if (rc != 0) { perror(NULL); goto exc_cleanup; }

    // Wait until user presses <ENTER>.
    printf("\nPress <ENTER> to quit the program.\n");
    getchar();

exc_cleanup:

    assert(!close(sock));
}

Best regards,
Miha

Quoted 49 lines · Miha Marolt

Hi!

I hope this is the right place to reports bugs. I apologize if it isn't.

I have written a C program (see below for source code) that opens a raw socket on CentOS 7.1 Linux and binds it to some address (it doesn't use the port that I supplied, but that is not the point here). The "netstat" program correctly recognizes the socket as "raw", while "ss" program says it is "udp". Here are the relevant lines from the ss and netstat commands:

$ netstat -an
raw        0      0 127.0.0.1:6             0.0.0.0:* 7

$ ./ss -an
udp    UNCONN     21569  0      127.0.0.1:6 *:*

Here is the version information

$ netstat --version  # From CentOS 7.1.
net-tools 2.10-alpha

$ ./ss --version  # Built from git.
ss utility, iproute2-ss150626

C source follows. If you store it in "main.c", then compile it with "$ gcc main.c -o main" and then run it by executing "$ sudo ./main".

#include <arpa/inet.h>
#include <assert.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>

int main(void)

{
    // Create a raw socket.
    int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (sock == -1) { perror(NULL); goto exc_cleanup; }

    // Bind socket to an address.
    struct sockaddr_in addr;
    addr.sin_family = AF_INET;
    inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
    addr.sin_port = htons(27183);

    int rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
    if (rc != 0) { perror(NULL); goto exc_cleanup; }

    // Wait until user presses <ENTER>.
    printf("\nPress <ENTER> to quit the program.\n");
    getchar();

Quoted 7 lines

exc_cleanup:

    assert(!close(sock));
}

Best regards,
Miha

Hi,
I think this was changed by commit:
8250bc9ff4e5 ("ss: Unify inet sockets output")
Because dgram_show_line() is used for both UDP and RAW sockets IPPROTO_UDP is used for both now and proto_name() returns "udp". CCed the patch author and attached a possible solution.

Cheers,
Nik

misc/ss.c +2 -0

index 870cad185341..4de77e92c319 100644
@@ -1554,6 +1554,8 @@ out:
 static char *proto_name(int protocol)
 {
 	switch (protocol) {
+	case IPPROTO_RAW:
+		return "raw";
 	case IPPROTO_UDP:
 		return "udp";
 	case IPPROTO_TCP:

Quoted 86 lines · Nikolay Aleksandrov

Quoted 49 lines · Miha Marolt

Hi!

I hope this is the right place to reports bugs. I apologize if it isn't.

I have written a C program (see below for source code) that opens a raw socket on CentOS 7.1 Linux and binds it to some address (it doesn't use the port that I supplied, but that is not the point here). The "netstat" program correctly recognizes the socket as "raw", while "ss" program says it is "udp". Here are the relevant lines from the ss and netstat commands:

$ netstat -an
raw        0      0 127.0.0.1:6             0.0.0.0:* 7

$ ./ss -an
udp    UNCONN     21569  0      127.0.0.1:6 *:*

Here is the version information

$ netstat --version  # From CentOS 7.1.
net-tools 2.10-alpha

$ ./ss --version  # Built from git.
ss utility, iproute2-ss150626

C source follows. If you store it in "main.c", then compile it with "$ gcc main.c -o main" and then run it by executing "$ sudo ./main".

#include <arpa/inet.h>
#include <assert.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>

int main(void)

{
    // Create a raw socket.
    int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (sock == -1) { perror(NULL); goto exc_cleanup; }

    // Bind socket to an address.
    struct sockaddr_in addr;
    addr.sin_family = AF_INET;
    inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
    addr.sin_port = htons(27183);

    int rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
    if (rc != 0) { perror(NULL); goto exc_cleanup; }

    // Wait until user presses <ENTER>.
    printf("\nPress <ENTER> to quit the program.\n");
    getchar();

Quoted 7 lines

exc_cleanup:

    assert(!close(sock));
}

Best regards,
Miha

Hi,
I think this was changed by commit:
8250bc9ff4e5 ("ss: Unify inet sockets output")
Because dgram_show_line() is used for both UDP and RAW sockets IPPROTO_UDP is used for both now and proto_name() returns "udp". CCed the patch author and attached a possible solution.

Cheers,
Nik

misc/ss.c +2 -0

index 870cad185341..4de77e92c319 100644
@@ -1554,6 +1554,8 @@ out:
 static char *proto_name(int protocol)
 {
 	switch (protocol) {
+	case IPPROTO_RAW:
+		return "raw";
 	case IPPROTO_UDP:
 		return "udp";
 	case IPPROTO_TCP:

@@ -2398,7 +2400,7 @@ static int dgram_show_line(char *line, const struct filter *f, int family)
 	if (n < 9)
 		opt[0] = 0;
 

misc/ss.c static int dgram_show_line(char *line, const struct filter *f, int family) · line 2406

Quoted 5 lines

misc/ss.c +1 -1

-	inet_stats_print(&s, IPPROTO_UDP);
+	inet_stats_print(&s, dg_proto == UDP_PROTO ? IPPROTO_UDP : IPPROTO_RAW);
 
 	if (show_details && opt[0])
 		printf(" opt:\"%s\"", opt);

Yeah, it fixed the issue, just tested the fix.

Quoted 88 lines · Vadim Kochan

Quoted 87 lines · Nikolay Aleksandrov

Quoted 49 lines · Miha Marolt

Hi!

I hope this is the right place to reports bugs. I apologize if it isn't.

I have written a C program (see below for source code) that opens a raw socket on CentOS 7.1 Linux and binds it to some address (it doesn't use the port that I supplied, but that is not the point here). The "netstat" program correctly recognizes the socket as "raw", while "ss" program says it is "udp". Here are the relevant lines from the ss and netstat commands:

$ netstat -an
raw        0      0 127.0.0.1:6             0.0.0.0:* 7

$ ./ss -an
udp    UNCONN     21569  0      127.0.0.1:6 *:*

Here is the version information

$ netstat --version  # From CentOS 7.1.
net-tools 2.10-alpha

$ ./ss --version  # Built from git.
ss utility, iproute2-ss150626

C source follows. If you store it in "main.c", then compile it with "$ gcc main.c -o main" and then run it by executing "$ sudo ./main".

#include <arpa/inet.h>
#include <assert.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>

int main(void)

{
     // Create a raw socket.
     int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
     if (sock == -1) { perror(NULL); goto exc_cleanup; }

     // Bind socket to an address.
     struct sockaddr_in addr;
     addr.sin_family = AF_INET;
     inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
     addr.sin_port = htons(27183);

     int rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
     if (rc != 0) { perror(NULL); goto exc_cleanup; }

     // Wait until user presses <ENTER>.
     printf("\nPress <ENTER> to quit the program.\n");
     getchar();

Quoted 7 lines

exc_cleanup:

     assert(!close(sock));
}

Best regards,
Miha

Hi,
I think this was changed by commit:
8250bc9ff4e5 ("ss: Unify inet sockets output")
Because dgram_show_line() is used for both UDP and RAW sockets IPPROTO_UDP is used for both now and proto_name() returns "udp". CCed the patch author and attached a possible solution.

Cheers,
Nik

misc/ss.c +3 -1

index 870cad185341..4de77e92c319 100644
@@ -1554,6 +1554,8 @@ out:
  static char *proto_name(int protocol)
  {
  	switch (protocol) {
+	case IPPROTO_RAW:
+		return "raw";
  	case IPPROTO_UDP:
  		return "udp";
  	case IPPROTO_TCP:

@@ -2398,7 +2400,7 @@ static int dgram_show_line(char *line, const struct filter *f, int family)
  	if (n < 9)
  		opt[0] = 0;
 
-	inet_stats_print(&s, IPPROTO_UDP);
+	inet_stats_print(&s, dg_proto == UDP_PROTO ? IPPROTO_UDP : IPPROTO_RAW);
 

Quoted 4 lines

misc/ss.c static int dgram_show_line(char *line, const struct filter *f, int family) · line 2406

Quoted 2 lines

misc/ss.c +0 -0

  	if (show_details && opt[0])
  		printf(" opt:\"%s\"", opt);

Yeah, it fixed the issue, just tested the fix.

Great, I'll submit it in a minute.
Thanks for testing!

Hi!

I hope this is the right place to reports bugs. I apologize if it isn't.

I have written a C program (see below for source code) that opens a raw socket on CentOS 7.1 Linux and binds it to some address (it doesn't use the port that I supplied, but that is not the point here). The "netstat" program correctly recognizes the socket as "raw", while "ss" program says it is "udp". Here are the relevant lines from the ss and netstat commands:

$ netstat -an
raw        0      0 127.0.0.1:6             0.0.0.0:* 7

$ ./ss -an
udp    UNCONN     21569  0      127.0.0.1:6 *:*

Here is the version information

$ netstat --version  # From CentOS 7.1.
net-tools 2.10-alpha

$ ./ss --version  # Built from git.
ss utility, iproute2-ss150626

C source follows. If you store it in "main.c", then compile it with "$ gcc main.c -o main" and then run it by executing "$ sudo ./main".

#include <arpa/inet.h>
#include <assert.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>

int main(void)

{
     // Create a raw socket.
     int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
     if (sock == -1) { perror(NULL); goto exc_cleanup; }

     // Bind socket to an address.
     struct sockaddr_in addr;
     addr.sin_family = AF_INET;
     inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
     addr.sin_port = htons(27183);

     int rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
     if (rc != 0) { perror(NULL); goto exc_cleanup; }

     // Wait until user presses <ENTER>.
     printf("\nPress <ENTER> to quit the program.\n");
     getchar();

exc_cleanup:

     assert(!close(sock));
}

Quoted 91 lines · Nikolay Aleksandrov

Quoted 81 lines · Vadim Kochan

Quoted 80 lines · Nikolay Aleksandrov

Quoted 49 lines · Miha Marolt

Hi!

I hope this is the right place to reports bugs. I apologize if it isn't.

I have written a C program (see below for source code) that opens a raw socket on CentOS 7.1 Linux and binds it to some address (it doesn't use the port that I supplied, but that is not the point here). The "netstat" program correctly recognizes the socket as "raw", while "ss" program says it is "udp". Here are the relevant lines from the ss and netstat commands:

$ netstat -an
raw        0      0 127.0.0.1:6             0.0.0.0:* 7

$ ./ss -an
udp    UNCONN     21569  0      127.0.0.1:6 *:*

Here is the version information

$ netstat --version  # From CentOS 7.1.
net-tools 2.10-alpha

$ ./ss --version  # Built from git.
ss utility, iproute2-ss150626

C source follows. If you store it in "main.c", then compile it with "$ gcc main.c -o main" and then run it by executing "$ sudo ./main".

#include <arpa/inet.h>
#include <assert.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>

int main(void)

{
    // Create a raw socket.
    int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (sock == -1) { perror(NULL); goto exc_cleanup; }

    // Bind socket to an address.
    struct sockaddr_in addr;
    addr.sin_family = AF_INET;
    inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
    addr.sin_port = htons(27183);

    int rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
    if (rc != 0) { perror(NULL); goto exc_cleanup; }

    // Wait until user presses <ENTER>.
    printf("\nPress <ENTER> to quit the program.\n");
    getchar();

Quoted 7 lines

exc_cleanup:

    assert(!close(sock));
}

Best regards,
Miha

Hi,
I think this was changed by commit:
8250bc9ff4e5 ("ss: Unify inet sockets output")
Because dgram_show_line() is used for both UDP and RAW sockets IPPROTO_UDP is used for both now and proto_name() returns "udp". CCed the patch author and attached a possible solution.

Cheers,
Nik

misc/ss.c +2 -0

index 870cad185341..4de77e92c319 100644
@@ -1554,6 +1554,8 @@ out:
 static char *proto_name(int protocol)
 {
 	switch (protocol) {
+	case IPPROTO_RAW:
+		return "raw";
 	case IPPROTO_UDP:
 		return "udp";
 	case IPPROTO_TCP:

Quoted 9 lines

misc/ss.c static int dgram_show_line(char *line, const struct filter *f, int family) · line 2404

Quoted 7 lines

misc/ss.c +1 -1

@@ -2398,7 +2400,7 @@ static int dgram_show_line(char *line, const struct filter *f, int family)
 	if (n < 9)
 		opt[0] = 0;
-	inet_stats_print(&s, IPPROTO_UDP);
+	inet_stats_print(&s, dg_proto == UDP_PROTO ? IPPROTO_UDP : IPPROTO_RAW);
 	if (show_details && opt[0])
 		printf(" opt:\"%s\"", opt);

Yeah, it fixed the issue, just tested the fix.

Quoted 2 lines

Great, I'll submit it in a minute.
Thanks for testing!

Thank you very much for the fast fix!

I've found another bug: command "$ ss" doesn't display only tcp sockets as the man page ss(8) says (file man/man8/ss.8 in iproute2 git repo). It also displays e.g. unix sockets. The man page says "When no option is used ss displays a list of open non-listening TCP sockets that have established connection.".

Regards,
Miha

If I checkout iproute2 tree to db08bdb816d337102c5486744008db9c9faa43bf (before buggy commit) we indeed had this result :

# ./ss -an | grep 127.0.0.1
raw    UNCONN     213486 0      127.0.0.1:6                     *:*                  

Quoted 6 lines · Eric Dumazet

If I checkout iproute2 tree to db08bdb816d337102c5486744008db9c9faa43bf (before buggy commit) we indeed had this result :

# ./ss -an | grep 127.0.0.1
raw    UNCONN     213486 0      127.0.0.1:6                     *:*                  

Maybe following patch would fix the issue.

misc/ss.c +2 -0

index 03f92fa69270..9b7dad00290c 100644
@@ -1552,6 +1552,8 @@ out:
 static char *proto_name(int protocol)
 {
 	switch (protocol) {
+	case 0:
+		return "raw";
 	case IPPROTO_UDP:
 		return "udp";
 	case IPPROTO_TCP:

Quoted 31 lines · Eric Dumazet

Quoted 6 lines · Eric Dumazet

If I checkout iproute2 tree to db08bdb816d337102c5486744008db9c9faa43bf (before buggy commit) we indeed had this result :

# ./ss -an | grep 127.0.0.1
raw    UNCONN     213486 0      127.0.0.1:6                     *:*                  

Maybe following patch would fix the issue.

misc/ss.c +3 -1

index 03f92fa69270..9b7dad00290c 100644
@@ -1552,6 +1552,8 @@ out:
 static char *proto_name(int protocol)
 {
 	switch (protocol) {
+	case 0:
+		return "raw";
 	case IPPROTO_UDP:
 		return "udp";
 	case IPPROTO_TCP:

@@ -2416,7 +2418,7 @@ static int dgram_show_line(char *line, const struct filter *f, int family)
 	if (n < 9)
 		opt[0] = 0;
 
-	inet_stats_print(&s, IPPROTO_UDP);
+	inet_stats_print(&s, 0);
 

misc/ss.c static int dgram_show_line(char *line, const struct filter *f, int family) · line 2424

Quoted 4 lines

misc/ss.c +0 -0

 	if (show_details && opt[0])
 		printf(" opt:\"%s\"", opt);

Yes, it fixes the issue too.

Quoted 103 lines · Miha Marolt

Quoted 90 lines · Nikolay Aleksandrov

Quoted 80 lines · Vadim Kochan

Quoted 79 lines · Nikolay Aleksandrov

Quoted 49 lines · Miha Marolt

Hi!

I hope this is the right place to reports bugs. I apologize if it isn't.

I have written a C program (see below for source code) that opens a raw socket on CentOS 7.1 Linux and binds it to some address (it doesn't use the port that I supplied, but that is not the point here). The "netstat" program correctly recognizes the socket as "raw", while "ss" program says it is "udp". Here are the relevant lines from the ss and netstat commands:

$ netstat -an
raw        0      0 127.0.0.1:6             0.0.0.0:* 7

$ ./ss -an
udp    UNCONN     21569  0      127.0.0.1:6 *:*

Here is the version information

$ netstat --version  # From CentOS 7.1.
net-tools 2.10-alpha

$ ./ss --version  # Built from git.
ss utility, iproute2-ss150626

C source follows. If you store it in "main.c", then compile it with "$ gcc main.c -o main" and then run it by executing "$ sudo ./main".

#include <arpa/inet.h>
#include <assert.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>

int main(void)

{
     // Create a raw socket.
     int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
     if (sock == -1) { perror(NULL); goto exc_cleanup; }

     // Bind socket to an address.
     struct sockaddr_in addr;
     addr.sin_family = AF_INET;
     inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
     addr.sin_port = htons(27183);

     int rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
     if (rc != 0) { perror(NULL); goto exc_cleanup; }

     // Wait until user presses <ENTER>.
     printf("\nPress <ENTER> to quit the program.\n");
     getchar();

Quoted 7 lines

exc_cleanup:

     assert(!close(sock));
}

Best regards,
Miha

Hi,
I think this was changed by commit:
8250bc9ff4e5 ("ss: Unify inet sockets output")
Because dgram_show_line() is used for both UDP and RAW sockets IPPROTO_UDP is used for both now and proto_name() returns "udp". CCed the patch author and attached a possible solution.

Cheers,
Nik

misc/ss.c +2 -0

index 870cad185341..4de77e92c319 100644
@@ -1554,6 +1554,8 @@ out:
  static char *proto_name(int protocol)
  {
  	switch (protocol) {
+	case IPPROTO_RAW:
+		return "raw";
  	case IPPROTO_UDP:
  		return "udp";
  	case IPPROTO_TCP:

Quoted 9 lines

misc/ss.c static int dgram_show_line(char *line, const struct filter *f, int family) · line 2404

Quoted 7 lines

misc/ss.c +1 -1

@@ -2398,7 +2400,7 @@ static int dgram_show_line(char *line, const struct filter *f, int family)
  	if (n < 9)
  		opt[0] = 0;
-	inet_stats_print(&s, IPPROTO_UDP);
+	inet_stats_print(&s, dg_proto == UDP_PROTO ? IPPROTO_UDP : IPPROTO_RAW);
  	if (show_details && opt[0])
  		printf(" opt:\"%s\"", opt);

Yeah, it fixed the issue, just tested the fix.

Quoted 2 lines

Great, I'll submit it in a minute.
Thanks for testing!

Thank you very much for the fast fix!

I've found another bug: command "$ ss" doesn't display only tcp sockets as the man page ss(8) says (file man/man8/ss.8 in iproute2 git repo). It also displays e.g. unix sockets. The man page says "When no option is used ss displays a list of open non-listening TCP sockets that have established connection.".

Quoted 2 lines

Regards,
Miha

That seems OK, I see that unix stream sockets are displayed which are connection oriented, and UDP can also have established state.

Quoted 106 lines · Vadim Kochan

Quoted 105 lines · Miha Marolt

Quoted 90 lines · Nikolay Aleksandrov

Quoted 80 lines · Vadim Kochan

Quoted 79 lines · Nikolay Aleksandrov

Quoted 49 lines · Miha Marolt

Hi!

I hope this is the right place to reports bugs. I apologize if it isn't.

I have written a C program (see below for source code) that opens a raw socket on CentOS 7.1 Linux and binds it to some address (it doesn't use the port that I supplied, but that is not the point here). The "netstat" program correctly recognizes the socket as "raw", while "ss" program says it is "udp". Here are the relevant lines from the ss and netstat commands:

$ netstat -an
raw        0      0 127.0.0.1:6             0.0.0.0:* 7

$ ./ss -an
udp    UNCONN     21569  0      127.0.0.1:6 *:*

Here is the version information

$ netstat --version  # From CentOS 7.1.
net-tools 2.10-alpha

$ ./ss --version  # Built from git.
ss utility, iproute2-ss150626

C source follows. If you store it in "main.c", then compile it with "$ gcc main.c -o main" and then run it by executing "$ sudo ./main".

#include <arpa/inet.h>
#include <assert.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>

int main(void)

{
    // Create a raw socket.
    int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
    if (sock == -1) { perror(NULL); goto exc_cleanup; }

    // Bind socket to an address.
    struct sockaddr_in addr;
    addr.sin_family = AF_INET;
    inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
    addr.sin_port = htons(27183);

    int rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
    if (rc != 0) { perror(NULL); goto exc_cleanup; }

    // Wait until user presses <ENTER>.
    printf("\nPress <ENTER> to quit the program.\n");
    getchar();

Quoted 7 lines

exc_cleanup:

    assert(!close(sock));
}

Best regards,
Miha

Hi,
I think this was changed by commit:
8250bc9ff4e5 ("ss: Unify inet sockets output")
Because dgram_show_line() is used for both UDP and RAW sockets IPPROTO_UDP is used for both now and proto_name() returns "udp". CCed the patch author and attached a possible solution.

Cheers,
Nik

misc/ss.c +2 -0

index 870cad185341..4de77e92c319 100644
@@ -1554,6 +1554,8 @@ out:
 static char *proto_name(int protocol)
 {
 	switch (protocol) {
+	case IPPROTO_RAW:
+		return "raw";
 	case IPPROTO_UDP:
 		return "udp";
 	case IPPROTO_TCP:

Quoted 9 lines

misc/ss.c static int dgram_show_line(char *line, const struct filter *f, int family) · line 2404

Quoted 7 lines

misc/ss.c +1 -1

@@ -2398,7 +2400,7 @@ static int dgram_show_line(char *line, const struct filter *f, int family)
 	if (n < 9)
 		opt[0] = 0;
-	inet_stats_print(&s, IPPROTO_UDP);
+	inet_stats_print(&s, dg_proto == UDP_PROTO ? IPPROTO_UDP : IPPROTO_RAW);
 	if (show_details && opt[0])
 		printf(" opt:\"%s\"", opt);

Yeah, it fixed the issue, just tested the fix.

Quoted 2 lines

Great, I'll submit it in a minute.
Thanks for testing!

Thank you very much for the fast fix!

I've found another bug: command "$ ss" doesn't display only tcp sockets as the man page ss(8) says (file man/man8/ss.8 in iproute2 git repo). It also displays e.g. unix sockets. The man page says "When no option is used ss displays a list of open non-listening TCP sockets that have established connection.".

Regards,
Miha

Quoted 2 lines

That seems OK, I see that unix stream sockets are displayed which are connection oriented, and UDP can also have established state.

According to the man page, **only** TCP sockets should be listed by "$ ss". In reality, also Unix and UDP sockets are listed, so there is a discrepancy between what man page says and what actually happens.

Quoted 107 lines · Miha Marolt

Quoted 105 lines · Vadim Kochan

Quoted 104 lines · Miha Marolt

Quoted 90 lines · Nikolay Aleksandrov

Quoted 80 lines · Vadim Kochan

Quoted 79 lines · Nikolay Aleksandrov

Quoted 49 lines · Miha Marolt

Hi!

I hope this is the right place to reports bugs. I apologize if it isn't.

I have written a C program (see below for source code) that opens a raw socket on CentOS 7.1 Linux and binds it to some address (it doesn't use the port that I supplied, but that is not the point here). The "netstat" program correctly recognizes the socket as "raw", while "ss" program says it is "udp". Here are the relevant lines from the ss and netstat commands:

$ netstat -an
raw        0      0 127.0.0.1:6             0.0.0.0:* 7

$ ./ss -an
udp    UNCONN     21569  0      127.0.0.1:6 *:*

Here is the version information

$ netstat --version  # From CentOS 7.1.
net-tools 2.10-alpha

$ ./ss --version  # Built from git.
ss utility, iproute2-ss150626

C source follows. If you store it in "main.c", then compile it with "$ gcc main.c -o main" and then run it by executing "$ sudo ./main".

#include <arpa/inet.h>
#include <assert.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>

int main(void)

{
     // Create a raw socket.
     int sock = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
     if (sock == -1) { perror(NULL); goto exc_cleanup; }

     // Bind socket to an address.
     struct sockaddr_in addr;
     addr.sin_family = AF_INET;
     inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
     addr.sin_port = htons(27183);

     int rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
     if (rc != 0) { perror(NULL); goto exc_cleanup; }

     // Wait until user presses <ENTER>.
     printf("\nPress <ENTER> to quit the program.\n");
     getchar();

Quoted 7 lines

exc_cleanup:

     assert(!close(sock));
}

Best regards,
Miha

Hi,
I think this was changed by commit:
8250bc9ff4e5 ("ss: Unify inet sockets output")
Because dgram_show_line() is used for both UDP and RAW sockets IPPROTO_UDP is used for both now and proto_name() returns "udp". CCed the patch author and attached a possible solution.

Cheers,
Nik

misc/ss.c +2 -0

index 870cad185341..4de77e92c319 100644
@@ -1554,6 +1554,8 @@ out:
  static char *proto_name(int protocol)
  {
  	switch (protocol) {
+	case IPPROTO_RAW:
+		return "raw";
  	case IPPROTO_UDP:
  		return "udp";
  	case IPPROTO_TCP:

Quoted 9 lines

misc/ss.c static int dgram_show_line(char *line, const struct filter *f, int family) · line 2404

Quoted 7 lines

misc/ss.c +1 -1

@@ -2398,7 +2400,7 @@ static int dgram_show_line(char *line, const struct filter *f, int family)
  	if (n < 9)
  		opt[0] = 0;
-	inet_stats_print(&s, IPPROTO_UDP);
+	inet_stats_print(&s, dg_proto == UDP_PROTO ? IPPROTO_UDP : IPPROTO_RAW);
  	if (show_details && opt[0])
  		printf(" opt:\"%s\"", opt);

Yeah, it fixed the issue, just tested the fix.

Quoted 2 lines

Great, I'll submit it in a minute.
Thanks for testing!

Thank you very much for the fast fix!

I've found another bug: command "$ ss" doesn't display only tcp sockets as the man page ss(8) says (file man/man8/ss.8 in iproute2 git repo). It also displays e.g. unix sockets. The man page says "When no option is used ss displays a list of open non-listening TCP sockets that have established connection.".

Regards,
Miha

Quoted 5 lines

Quoted 2 lines

That seems OK, I see that unix stream sockets are displayed which are connection oriented, and UDP can also have established state.

According to the man page, **only** TCP sockets should be listed by "$ ss". In reality, also Unix and UDP sockets are listed, so there is a discrepancy between what man page says and what actually happens.

Yes, you are right man page says so, but seems such behaviour is for a long time and may be it is better to change man page rather than change the default behaviour.

After commit 8250bc9ff4e5 ("ss: Unify inet sockets output") raw sockets are displayed as udp because dgram_show_line() is used for both and thus IPPROTO_UDP is used for both so proto_name() returns "udp". Fix this by checking dg_proto which is set according to the caller of dgram_show_line().

Reported-by Miha Marolt <[email protected]>

Signed-off-by Nikolay Aleksandrov <[email protected]>

---
note: use 0 instead of IPPROTO_RAW like Eric suggested

 misc/ss.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)