[PATCH iproute2 v2 0/2] ss: fix vsock port filtering

[Luigi Leonardi <leonardi@redhat.com>]

Vsock port filtering is broken for ports in [1, 2^31−1] (i.e. any port
whose u32 representation has bit 31 clear, which includes all ordinarily
assigned vsock ports).

To reproduce:

    ncat -l --vsock -p 27354
    ss --vsock -l src :27354   # shows nothing

    # Without the filter the socket is visible:
    ss --vsock -l

Ports in [2^31, UINT_MAX−1] are not affected by accident.

aafilter.port was extended to 8 bytes to support unix socket inode
numbers larger than INT_MAX (see 012cb515). The vsock parsing path
initialises a.port to -1L and then calls get_u32() via a cast to write
the user-supplied port into it. get_u32() only writes 4 bytes, leaving
the upper 32 bits as 0xFFFFFFFF. For ports < 2^31 this produces a
mismatch with sockstat.lport.
For ports >= 2^31 the int-to-long sign extension also fills
the upper 32 bits with 0xFFFFFFFF, accidentally matching the corrupted
a.port and hiding the bug.

Commit 1 switches from int to long for sockstat.lport/rport
Commit 2 fixes a bug in the parsing of the filter port, that didn't
clear the upper bits.

Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
---
Changes in v2:
- Expanded lport and rport in sockstat from int to long [Stefano]
- Applied suggestion from Stephen for port filtering.
- Link to v1: https://lore.kernel.org/all/20260421-fix_vsock-v1-1-812c80a76c1a@redhat.com

---
Luigi Leonardi (2):
      ss: move lport and rport in struct sockstat from int to long
      ss: fix vsock port filter

 misc/ss.c | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)
---
base-commit: da2ccdf862cb1eab45de082cc71fcb4e5d712e78
change-id: 20260817-fix_vsock-f7b374d5cadd

Best regards,
-- 
Luigi Leonardi <leonardi@redhat.com>