fix: remove inactive connections' IP addresses from tcp_connection_remote metric

pkg/plugin/linuxutil/netstat_stats_linux.go

@@ -184,6 +184,16 @@ func (nr *NetstatReader) readSockStats() error {
 		return err
 	} else {
 		sockStats := processSocks(socks)
+		// Compare existing tcp socket connections with updated ones, remove the ones that are not seen in the new sockStats map
+		for remoteAddr := range nr.connStats.TcpSockets.socketByRemoteAddr {
+			addr, port := getAddrAndPort(remoteAddr)
+			// Check if the remote address is in the new sockStats map
+			if _, ok := sockStats.socketByRemoteAddr[remoteAddr]; !ok {
+				// If not, set the value to 0
+				metrics.TCPConnectionRemoteGauge.WithLabelValues(addr, port).Set(0)
+			}
+		}
+
 		nr.connStats.TcpSockets = *sockStats
 	}
 
@@ -231,15 +241,7 @@ func (nr *NetstatReader) updateMetrics() {
 	}
 
 	for remoteAddr, v := range nr.connStats.TcpSockets.socketByRemoteAddr {
-		addr := ""
-		port := ""
-		splitAddr := strings.Split(remoteAddr, ":")
-		if len(splitAddr) == 2 {
-			addr = splitAddr[0]
-			port = splitAddr[1]
-		} else {
-			addr = remoteAddr
-		}
+		addr, port := getAddrAndPort(remoteAddr)
 		if !validateRemoteAddr(addr) {
 			continue
 		}
@@ -251,6 +253,19 @@ func (nr *NetstatReader) updateMetrics() {
 	metrics.UDPConnectionStats.WithLabelValues(utils.Active).Set(float64(nr.connStats.UdpSockets.totalActiveSockets))
 }
 
+func getAddrAndPort(remoteAddr string) (addr, port string) {
+	splitAddr := strings.Split(remoteAddr, ":")
+	// Check if the remote address is in the format of addr:port
+	if len(splitAddr) == 2 { // nolint:gomnd // magic number is sufficiently explained
+		addr = splitAddr[0]
+		port = splitAddr[1]
+	} else {
+		addr = remoteAddr
+	}
+
+	return addr, port
+}
+
 func validateRemoteAddr(addr string) bool {
 	if addr == "" {
 		return false

pkg/plugin/linuxutil/netstat_stats_linux_test.go

@@ -9,8 +9,10 @@ import (
 
 	"github.com/cakturk/go-netstat/netstat"
 	"github.com/microsoft/retina/pkg/log"
+	"github.com/microsoft/retina/pkg/metrics"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	gomock "go.uber.org/mock/gomock"
 )
 
@@ -335,3 +337,40 @@ func TestReadSockStats(t *testing.T) {
 
 	nr.updateMetrics()
 }
+
+// Test IP that belongs to a closed connection being removed from the metrics
+func TestReadSockStatsRemoveClosedConnection(t *testing.T) {
+	_, err := log.SetupZapLogger(log.GetDefaultLogOpts())
+	require.NoError(t, err)
+	opts := &NetstatOpts{
+		CuratedKeys: false,
+		AddZeroVal:  false,
+		ListenSock:  false,
+	}
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	ns := NewMockNetstatInterface(ctrl)
+	nr := NewNetstatReader(opts, ns)
+	InitalizeMetricsForTesting(ctrl)
+
+	testmetric := prometheus.NewGauge(prometheus.GaugeOpts{
+		Name: "testmetric",
+		Help: "testmetric",
+	})
+	// We are expecting the gauge to be called twice, once for the initial set and once for the removal (set to 0)
+	MockGaugeVec.EXPECT().WithLabelValues("127.0.0.1", "80").Return(testmetric).Times(2)
+
+	// Initial value
+	metrics.TCPConnectionRemoteGauge.WithLabelValues("127.0.0.1", "80").Set(float64(1))
+	nr.connStats.TcpSockets.socketByRemoteAddr = map[string]int{"127.0.0.1:80": 1}
+
+	ns.EXPECT().TCPSocks(gomock.Any()).Return([]netstat.SockTabEntry{}, nil).Times(1)
+	ns.EXPECT().UDPSocks(gomock.Any()).Return([]netstat.SockTabEntry{}, nil).Times(1)
+	assert.NotNil(t, nr)
+	err = nr.readSockStats()
+	require.NoError(t, err)
+
+	assert.Empty(t, nr.connStats.TcpSockets.socketByRemoteAddr)
+}