[Core] integrate go-fuzz tests

[pkillarjun]

Proposed commit message

Integrating go-fuzz fuzz tests.

• WHY: the rationale/motivation for the changes

I reported multiple bugs on HackerOne in December 2024.

To my surprise, it's still on hold.

I used this method to find those bugs. My current plan for beats is to first get this PR merged, then integrate beats into oss-fuzz.

Where are the bug reports and patch?

I won't be reporting bugs here. Well, because I need my bounty.

Hackerone Report-id: 2875630 2880503 2874081 2874291

Checklist

• [ ] My code follows the style guidelines of this project
• [x] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files
• [ ] I have added tests that prove my fix is effective or that my feature works
• [ ] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

How to test this PR locally

# Install libpcap-dev / libpcap-devel.
 
make test-fuzz

Use cases

Find panics (integer overflow, invalid memory access, null pointer), CPU spikes and memory leaks while parsing data.

With this, I found a lot of them in your network stack.

[cla-checker-service[bot]]

💚 CLA has been signed

[github-actions[bot]]

:robot: GitHub comments

Expand to view the GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify[bot]]

This pull request does not have a backport label. If this is a bug or security fix, could you label this PR @pkillarjun? 🙏. For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[pkillarjun]

❌ Author of the following commits did not sign a Contributor Agreement: 6b29847, c6125ab, 22bc4ae, a499d7a, 41b0545

Please, read and sign the above mentioned agreement if you want to contribute to this project

Done, BTW I love modern web.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[pkillarjun]

https://github.com/elastic/beats/pull/45525#discussion_r2228247983 https://github.com/elastic/beats/pull/45525#discussion_r2228248662 https://github.com/elastic/beats/pull/45525#discussion_r2228249188

If I get this correctly, patch for filebeat should be reverted.

Patch: Revert changes in filebeat

edit: I can do a git edit right now or we can wait until the review is completed.

[rdner]

If I get this correctly, patch for filebeat should be reverted.

@pkillarjun not sure I follow.

You addressed my comments in https://github.com/elastic/beats/pull/45525/commits/39c08d6eae526c570c2a406e459901091f91bda8

It's all good now.

However, a lot of changes in this PR involve parts of the code owned by multiple other teams. I'll let the code owners review this PR first before we run the CI and prepare it for merging.

Thanks again for your contribution!

[elasticmachine]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[pierrehilbert]

cc @nfritts @qcorporation @lalit-satapathy

[mergify[bot]]

This pull request is now in conflicts. Could you fix it? 🙏 To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b hackerone upstream/hackerone
git merge upstream/main
git push upstream hackerone

[pkillarjun]

This pull request is now in conflicts. Could you fix it? 🙏 To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b hackerone upstream/hackerone
git merge upstream/main
git push upstream hackerone

We will do it at the end, with squash.

[rdner]

/test

[pkillarjun]

/test

Done https://github.com/elastic/beats/pull/45525/commits/30303b4f4c0f10df9bdb03fa60e4d44d1fdefb45

I have fixed the error in my changes; I won't be updating beat's code base for obvious reasons.

[pierrehilbert]

/test

[rdner]

/test

[pierrehilbert]

@ishleenk17 could you please take a look here?

[pierrehilbert]

@lalit-satapathy we need someone from your team to review here

[ishleenk17]

The script sets fuzz tests with -fuzztime=600s (i.e., 10 minutes) each. While good for local dev, that could be heavy in CI. These would be run as part of CI as well ?

[mergify[bot]]

This pull request is now in conflicts. Could you fix it? 🙏 To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b hackerone upstream/hackerone
git merge upstream/main
git push upstream hackerone