From 5877e195136b623bdcdac423345d19b8f3ebb6ea Mon Sep 17 00:00:00 2001
From: Adrian Serrano <adrisr83@gmail.com>
Date: Mon, 20 Jul 2020 10:25:40 +0200
Subject: [PATCH] Packetbeat process monitor: Ignore missing /proc/net/tcp6
 (#19945) (#20015)

This makes Packetbeat's process monitor to continue execution when
/proc/net/tcp6 is missing (ipv6 disabled in kernel).

Closes #19941

(cherry picked from commit 4ce680c62f2c9b66bba4594f4a8569965a5f22a1)
---
 CHANGELOG.next.asciidoc         |  1 +
 packetbeat/procs/procs_linux.go | 15 +++++++++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 5175e3e6d43..fe3b6a7fcc1 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -180,6 +180,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 *Packetbeat*
 
+- Fix process monitoring when ipv6 is disabled under Linux. {issue}19941[19941] {pull}19945[19945]
 
 *Winlogbeat*
 
diff --git a/packetbeat/procs/procs_linux.go b/packetbeat/procs/procs_linux.go
index 944924c88b1..cd4e81bfb8b 100644
--- a/packetbeat/procs/procs_linux.go
+++ b/packetbeat/procs/procs_linux.go
@@ -30,6 +30,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 
 	"github.com/elastic/beats/v7/libbeat/logp"
 	"github.com/elastic/beats/v7/packetbeat/protos/applayer"
@@ -51,6 +52,8 @@ var procFiles = map[applayer.Transport]struct {
 	applayer.TransportTCP: {"/proc/net/tcp", "/proc/net/tcp6"},
 }
 
+var warnIPv6Once sync.Once
+
 // GetLocalPortToPIDMapping returns the list of local port numbers and the PID
 // that owns them.
 func (proc *ProcessesWatcher) GetLocalPortToPIDMapping(transport applayer.Transport) (ports map[endpoint]int, err error) {
@@ -68,10 +71,18 @@ func (proc *ProcessesWatcher) GetLocalPortToPIDMapping(transport applayer.Transp
 		logp.Err("GetLocalPortToPIDMapping: parsing '%s': %s", sourceFiles.ipv4, err)
 		return nil, err
 	}
+
 	ipv6socks, err := socketsFromProc(sourceFiles.ipv6, true)
+	// Ignore the error when /proc/net/tcp6 doesn't exists (ipv6 disabled).
 	if err != nil {
-		logp.Err("GetLocalPortToPIDMapping: parsing '%s': %s", sourceFiles.ipv6, err)
-		return nil, err
+		if os.IsNotExist(err) {
+			warnIPv6Once.Do(func() {
+				logp.Warn("No IPv6 socket info reported by the kernel. Process monitor won't enrich IPv6 events")
+			})
+		} else {
+			logp.Err("GetLocalPortToPIDMapping: parsing '%s': %s", sourceFiles.ipv6, err)
+			return nil, err
+		}
 	}
 	socksMap := map[uint64]*socketInfo{}
 	for _, s := range ipv4socks {