Re: ss command not showing raw sockets? (regression)

On Tue, 17 Aug 2021 20:21:35 +0200 Jonas Bechtel wrote:

On Tue, 17 Aug 2021 08:04:51 -0700
Jakub Kicinski [off-list ref] wrote with subject

quoted

I had a look, I don't see anything out of the ordinary. I checked with
v4.6, I don't have a 4.4 box handy. It seems ss got support for
dumping over netlink in the 4.9. On a 4.4 kernel it should fall back
to using procfs tho, raw_show() calls inet_show_netlink() which
should fails and therefore the code should fall through to the old
procfs stuff.

No idea why that doesn't happen for you. Is this vanilla 4.4 or does
it have backports? Is there a /sys/module/raw_diag/ directory on your
system after you run those commands?  

It's was Knoppix distributed package. I don't know about the exact
contents, there's also no hint in package description. I just know
that it works without initrd, as it directly mounts the root disk.

No, there's /sys/module but no /sys/module/raw_diag/ neither before
nor after running those commands.

Hm. Could you share the config for that kernel? I don't know Knoppix
but there should be a /boot/config-* or /proc/config.gz, hopefully.

quoted

Does setting PROC_NET_RAW make the newer iproute version work for
you?

$ PROC_NET_RAW=/proc/net/raw ss -awp  

Yes, this did the trick. (And again I was thinking programs were
doing something "magical", but in the end it's just a file they
access)


Furthermore I checked with Linux 4.19.0 amd64 RT (Debian package;
from package description: "This kernel includes the PREEMPT_RT
realtime patch set."). With this kernel there was no need for
PROC_NET_RAW. All iproute versions worked out of the box and showed
even command name, pid and fd number (that's why ss traverses all
/proc/[pids]/fd/ directories?).


See attached log file, with kernel versions and iproute2 versions
printed.


@kuba With PROC_NET_RAW I consider the problem is found, isn't it? So
I will not download/bisect<->build or otherwise investigate the
problem until one of you explicitely asks me to do so.

I have now redirected invocation of command with set PROC_NET_RAW on
my system, and may (try to) update to Linux 4.19.

I suspect the bisection would end up at the commit which added 
the netlink dump support, so you can hold off for now, yes.

My best guess right now is that Knoppix has a cut-down kernel 
config and we don't handle that case correctly.