fix(cgroups.plugin): do not add network devices if cgroup proc is in the host net ns (#12788)

1 files changed, 27 insertions, 0 deletions

diff --git a/collectors/cgroups.plugin/cgroup-network.c b/collectors/cgroups.plugin/cgroup-network.c
index bd7822609c..ec3d814c64 100644
--- a/collectors/cgroups.plugin/cgroup-network.c
+++ b/collectors/cgroups.plugin/cgroup-network.c
@@ -27,6 +27,14 @@ struct iface {
     struct iface *next;
 };
 
+unsigned int calc_num_ifaces(struct iface *root) {
+    unsigned int num = 0;
+    for (struct iface *h = root; h; h = h->next) {
+        num++;
+    }
+    return num;
+}
+
 unsigned int read_iface_iflink(const char *prefix, const char *iface) {
     if(!prefix) prefix = "";
 
@@ -447,6 +455,25 @@ void detect_veth_interfaces(pid_t pid) {
         goto cleanup;
     }
 
+     unsigned int host_dev_num = calc_num_ifaces(host);
+     unsigned int cgroup_dev_num = calc_num_ifaces(cgroup);
+    // host ifaces == guest ifaces => we are still in the host namespace
+    // and we can't really identify which ifaces belong to the cgroup (e.g. Proxmox VM).
+    if (host_dev_num == cgroup_dev_num) {
+        unsigned int m = 0;
+        for (h = host; h; h = h->next) {
+            for (c = cgroup; c; c = c->next) {
+                if (h->ifindex == c->ifindex && h->iflink == c->iflink) {
+                    m++;
+                    break;
+                }
+            }
+        }
+        if (host_dev_num == m) {
+            goto cleanup;
+        }
+    }
+
     for(h = host; h ; h = h->next) {
         if(iface_is_eligible(h)) {
             for (c = cgroup; c; c = c->next) {