noctra/iproute2-next
1
0
Fork 0
Code Issues Pull Requests Releases Activity

ss: print MD5 signature keys configured on TCP sockets

Browse Source 
These keys are reported by kernel 4.14 and later under the
INET_DIAG_MD5SIG attribute, when INET_DIAG_INFO is requested (ss -i)
and we have CAP_NET_ADMIN. The additional output looks like:

	md5keys:fe80::/64=signing_key,10.1.2.0/24=foobar,::1/128=Test

Signed-off-by: Ivan Delalande <colona@arista.com>
This commit is contained in:
Ivan Delalande
2017-10-06 16:48:20 -07:00
committed by Stephen Hemminger
parent 7c72df5a95
commit da9cc6ab90
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
misc/ss.c
View File

@@ -2153,6 +2153,16 @@ static void print_skmeminfo(struct rtattr *tb[], int attrtype)
printf(")");
}
static void print_md5sig(struct tcp_diag_md5sig *sig)
{
printf("%s/%d=",
format_host(sig->tcpm_family,
sig->tcpm_family == AF_INET6 ? 16 : 4,
&sig->tcpm_addr),
sig->tcpm_prefixlen);
print_escape_buf(sig->tcpm_key, sig->tcpm_keylen, " ,");
}
#define TCPI_HAS_OPT(info, opt) !!(info->tcpi_options & (opt))
static void tcp_show_info(const struct nlmsghdr *nlh, struct inet_diag_msg *r,
@@ -2289,6 +2299,17 @@ static void tcp_show_info(const struct nlmsghdr *nlh, struct inet_diag_msg *r,
free(s.dctcp);
free(s.bbr_info);
}
if (tb[INET_DIAG_MD5SIG]) {
struct tcp_diag_md5sig *sig = RTA_DATA(tb[INET_DIAG_MD5SIG]);
int len = RTA_PAYLOAD(tb[INET_DIAG_MD5SIG]);
printf(" md5keys:");
print_md5sig(sig++);
for (len -= sizeof(*sig); len > 0; len -= sizeof(*sig)) {
printf(",");
print_md5sig(sig++);
}
}
}
static const char *format_host_sa(struct sockaddr_storage *sa)