[net][linux]: prevent incorrect deduplication of unnamed UNIX sockets

The existing dedup logic used only (sockType, src, dst, status) as the
key, which caused all unnamed UNIX sockets (empty address) to collapse
into a single entry when querying system-wide connections.

Include pid and fd in the dedup key for AF_UNIX sockets so that each
socket is correctly preserved. Inet socket dedup is unchanged.

Extract connectionDedupKey() and add unit tests.

Fixes #2030

Author: shirou

net/net_linux.go

@@ -348,6 +348,7 @@ type connTmp struct {
 	pid      int32
 	boundPid int32
 	path     string
+	inode    string
 }
 
 func ConnectionsWithContext(ctx context.Context, kind string) ([]ConnectionStat, error) {
@@ -405,14 +406,26 @@ func connectionsPidMaxWithoutUidsWithContext(ctx context.Context, kind string, p
 	return statsFromInodesWithContext(ctx, root, pid, tmap, inodes, skipUids)
 }
 
+// connectionDedupKey builds a key to deduplicate connections.
+// For inet sockets, the tuple (type, src, dst, status) is sufficient.
+// For unix sockets, unnamed sockets share the same empty address,
+// so pid, fd, and inode must be included to avoid incorrect deduplication.
+// The inode is especially important when pid/fd are unavailable (e.g.,
+// unprivileged queries where inode-to-pid mapping fails).
+func connectionDedupKey(family uint32, c connTmp) string {
+	if family == syscall.AF_UNIX {
+		return fmt.Sprintf("%d-%d-%s-%d-%s:%d-%s:%d-%s", c.pid, c.fd, c.inode, c.sockType, c.laddr.IP, c.laddr.Port, c.raddr.IP, c.raddr.Port, c.status)
+	}
+	return fmt.Sprintf("%d-%s:%d-%s:%d-%s", c.sockType, c.laddr.IP, c.laddr.Port, c.raddr.IP, c.raddr.Port, c.status)
+}
+
 func statsFromInodesWithContext(ctx context.Context, root string, pid int32, tmap []netConnectionKindType, inodes map[string][]inodeMap, skipUids bool) ([]ConnectionStat, error) {
 	dupCheckMap := make(map[string]struct{})
 	var ret []ConnectionStat
 
 	var err error
 	for _, t := range tmap {
 		var path string
-		var connKey string
 		var ls []connTmp
 		if pid == 0 {
 			path = fmt.Sprintf("%s/net/%s", root, t.filename)
@@ -429,10 +442,7 @@ func statsFromInodesWithContext(ctx context.Context, root string, pid int32, tma
 			return nil, err
 		}
 		for _, c := range ls {
-			// Build TCP key to id the connection uniquely
-			// socket type, src ip, src port, dst ip, dst port and state should be enough
-			// to prevent duplications.
-			connKey = fmt.Sprintf("%d-%s:%d-%s:%d-%s", c.sockType, c.laddr.IP, c.laddr.Port, c.raddr.IP, c.raddr.Port, c.status)
+			connKey := connectionDedupKey(t.family, c)
 			if _, ok := dupCheckMap[connKey]; ok {
 				continue
 			}
@@ -728,6 +738,7 @@ func processInet(file string, kind netConnectionKindType, inodes map[string][]in
 			raddr:    ra,
 			status:   status,
 			pid:      pid,
+			inode:    inode,
 		})
 	}
 
@@ -785,6 +796,7 @@ func processUnix(file string, kind netConnectionKindType, inodes map[string][]in
 				pid:    pair.pid,
 				status: "NONE",
 				path:   path,
+				inode:  inode,
 			})
 		}
 	}

net/net_linux_test.go

@@ -189,6 +189,114 @@ func TestDecodeAddress(t *testing.T) {
 	}
 }
 
+func TestConnectionDedupKey(t *testing.T) {
+	// Two unnamed UNIX sockets with different pid/fd should have different keys
+	c1 := connTmp{
+		fd:       3,
+		family:   syscall.AF_UNIX,
+		sockType: syscall.SOCK_STREAM,
+		laddr:    Addr{},
+		raddr:    Addr{},
+		status:   "NONE",
+		pid:      100,
+	}
+	c2 := connTmp{
+		fd:       4,
+		family:   syscall.AF_UNIX,
+		sockType: syscall.SOCK_STREAM,
+		laddr:    Addr{},
+		raddr:    Addr{},
+		status:   "NONE",
+		pid:      100,
+	}
+	c3 := connTmp{
+		fd:       3,
+		family:   syscall.AF_UNIX,
+		sockType: syscall.SOCK_STREAM,
+		laddr:    Addr{},
+		raddr:    Addr{},
+		status:   "NONE",
+		pid:      200,
+	}
+
+	k1 := connectionDedupKey(syscall.AF_UNIX, c1)
+	k2 := connectionDedupKey(syscall.AF_UNIX, c2)
+	k3 := connectionDedupKey(syscall.AF_UNIX, c3)
+
+	assert.NotEqual(t, k1, k2, "different fd same pid should produce different keys")
+	assert.NotEqual(t, k1, k3, "same fd different pid should produce different keys")
+
+	// Same unnamed UNIX socket should produce the same key
+	assert.Equal(t, k1, connectionDedupKey(syscall.AF_UNIX, c1))
+
+	// Named UNIX sockets with different paths should have different keys
+	c4 := connTmp{
+		fd:       3,
+		family:   syscall.AF_UNIX,
+		sockType: syscall.SOCK_STREAM,
+		laddr:    Addr{IP: "/var/run/a.sock"},
+		raddr:    Addr{},
+		status:   "NONE",
+		pid:      100,
+	}
+	c5 := connTmp{
+		fd:       3,
+		family:   syscall.AF_UNIX,
+		sockType: syscall.SOCK_STREAM,
+		laddr:    Addr{IP: "/var/run/b.sock"},
+		raddr:    Addr{},
+		status:   "NONE",
+		pid:      100,
+	}
+	assert.NotEqual(t, connectionDedupKey(syscall.AF_UNIX, c4), connectionDedupKey(syscall.AF_UNIX, c5))
+
+	// Inet sockets: same tuple should produce the same key regardless of pid/fd
+	c6 := connTmp{
+		fd:       3,
+		family:   syscall.AF_INET,
+		sockType: syscall.SOCK_STREAM,
+		laddr:    Addr{IP: "127.0.0.1", Port: 8080},
+		raddr:    Addr{IP: "10.0.0.1", Port: 443},
+		status:   "ESTABLISHED",
+		pid:      100,
+	}
+	c7 := connTmp{
+		fd:       5,
+		family:   syscall.AF_INET,
+		sockType: syscall.SOCK_STREAM,
+		laddr:    Addr{IP: "127.0.0.1", Port: 8080},
+		raddr:    Addr{IP: "10.0.0.1", Port: 443},
+		status:   "ESTABLISHED",
+		pid:      200,
+	}
+	assert.Equal(t, connectionDedupKey(syscall.AF_INET, c6), connectionDedupKey(syscall.AF_INET, c7),
+		"inet sockets with same tuple should dedup regardless of pid/fd")
+
+	// When pid/fd are unknown (0/0), inode should distinguish sockets
+	c8 := connTmp{
+		fd:       0,
+		family:   syscall.AF_UNIX,
+		sockType: syscall.SOCK_STREAM,
+		laddr:    Addr{},
+		raddr:    Addr{},
+		status:   "NONE",
+		pid:      0,
+		inode:    "111",
+	}
+	c9 := connTmp{
+		fd:       0,
+		family:   syscall.AF_UNIX,
+		sockType: syscall.SOCK_STREAM,
+		laddr:    Addr{},
+		raddr:    Addr{},
+		status:   "NONE",
+		pid:      0,
+		inode:    "222",
+	}
+	assert.NotEqual(t, connectionDedupKey(syscall.AF_UNIX, c8), connectionDedupKey(syscall.AF_UNIX, c9),
+		"unnamed unix sockets with unknown pid/fd should use inode in dedup key")
+}
+
 func TestReverse(t *testing.T) {
 	src := []byte{0x01, 0x02, 0x03}
 	assert.Equal(t, []byte{0x03, 0x02, 0x01}, Reverse(src))