Socket hiding does not work with the ss command

[corefx]

Hi, I noticed that socket hiding does not work with the ss command. Tested on Debian 9.

[mempodippy]

Could you post the output of what is shown when running this through ltrace please?

[corefx]

Ltrace output:

getopt_long(2, 0x7fff316e63c8, "dhaletuwxnro460spbEf:miA:D:F:vVz"..., 0x55f5df826500, nil) = 116 getopt_long(2, 0x7fff316e63c8, "dhaletuwxnro460spbEf:miA:D:F:vVz"..., 0x55f5df826500, nil) = -1 isatty(1) = 1 ioctl(1, 21523, 0x7fff316e6240) = 0 printf("%-s ", 10, "State") = 11 printf("%-6s %-6s ", "Recv-Q", "Send-Q") = 14 printf("%s:%-s %s:%-s\n", 67, "Local Address", 20, "Port", 67, "Peer Address", 20, "Port"State Recv-Q Send-Q Local Address:Port Peer Address:Port
) = 178 fflush(0x7f41338bf600) = 0 getenv("TCPDIAG_FILE") = nil getenv("PROC_NET_TCP") = nil getenv("PROC_ROOT") = nil socket(16, 524291, 4) = 3 setsockopt(3, 1, 7, 0x7fff316e5f64) = 0 setsockopt(3, 1, 8, 0x55f5df827358) = 0 bind(3, 0x7fff316e6014, 12, 0x7f413360ecaa) = 0 getsockname(3, 0x7fff316e6014, 0x7fff316e5f60, 0x7f413360e7d7) = 0 time(0) = 1502523891 sendmsg(3, 0x7fff316e6090, 0, 0) = 72 recvmsg(3, 0x7fff316ddeb0, 0, 0) = 208 memset(0x7fff316ddc80, '\0', 136) = 0x7fff316ddc80 memset(0x7fff316ddac0, '\0', 136) = 0x7fff316ddac0 printf("%-s ", 10, "ESTAB") = 11 printf("%-6d %-6d ", 0, 0) = 14 inet_ntop(2, 0x7fff316ddd98, 0x55f5df831260, 256) = 0x55f5df831260 malloc(32) = 0x55f5e07c6420 getenv("PROC_IP_LOCAL_PORT_RANGE") = nil getenv("PROC_ROOT") = nil snprintf("/proc/sys/net/ipv4/ip_local_port"..., 127, "%s/%s", "/proc", "sys/net/ipv4/ip_local_port_range"...) = 38 fopen64("/proc/sys/net/ipv4/ip_local_port"..., "r") = 0x55f5e07c6450 fscanf(0x55f5e07c6450, 0x55f5df61fa0b, 0x55f5df82ad64, 0x55f5df82ad60) = 2 fclose(0x55f5e07c6450) = 0 setservent(1) = getservbyport(5632, "tcp") = 0x7f41338c24e0 __strdup(0x55f5e07c6e30, 0x7f4133689476, 0x55f5e07c6420, 0x7fff316dd5a8) = 0x55f5e07c7240 printf("%s%s%-s ", 67, "192.168.0.107", ":", 20, "ssh") = 89 inet_ntop(2, 0x7fff316dddc0, 0x55f5df831260, 256) = 0x55f5df831260 malloc(32) = 0x55f5e07c7260 getservbyport(31500, "tcp") = 0 sprintf("3195", "%u", 3195) = 4 printf("%s%s%-s ", 67, "192.168.0.105", ":", 20, "3195") = 89 putchar(10, 0, 0, 0ESTAB 0 0 192.168.0.107:ssh 192.168.0.105:3195
) = 10 memset(0x7fff316ddc80, '\0', 136) = 0x7fff316ddc80 memset(0x7fff316ddac0, '\0', 136) = 0x7fff316ddac0 printf("%-s ", 10, "ESTAB") = 11 printf("%-6d %-6d ", 0, 0) = 14 inet_ntop(2, 0x7fff316ddd98, 0x55f5df831260, 256) = 0x55f5df831260 printf("%s%s%-s ", 67, "192.168.0.107", ":", 20, "ssh") = 89 inet_ntop(2, 0x7fff316dddc0, 0x55f5df831260, 256) = 0x55f5df831260 malloc(32) = 0x55f5e07c7290 sprintf("59150", "%u", 59150) = 5 printf("%s%s%-*s ", 67, "192.168.0.105", ":", 20, "59150") = 89 putchar(10, 0, 0, 0ESTAB 0 0 192.168.0.107:ssh 192.168.0.105:59150
) = 10 recvmsg(3, 0x7fff316ddeb0, 0, 0) = 20 sendmsg(3, 0x7fff316e6090, 0, 0) = 72 recvmsg(3, 0x7fff316ddeb0, 0, 0) = 20 close(3) = 0 +++ exited (status 0) +++

[mempodippy]

Thanks. :smile: I've hooked the getservent calls responsible for grabbing the list of connections. I'll test my local changes soon and push when this is definitely fixed.

[mempodippy]

Issue fixed.

[corefx]

Thanks for fixing this. :smile: Btw I get "Cannot open netlink socket: Input/output error" when running the ss command when vlany is installed (with this fix). Is that normal?

[mempodippy]

Yes. https://github.com/mempodippy/vlany/blob/master/symbols/hiding/socket.c#L9 ... { errno = EIO; return -1; } Instead of showing socket information, an IO error is thrown. This won't happen on all boxes though, and it's better than nothing. You could play around with the errno to make it show different errors when ss is run.