filebeat/input/udp - Fix panic in linux input metrics (#35068)

A panic occurred while parsing /proc/net/udp and reaching the final empty line.
This occurred on Linux when the desired socket was not found in the list.

Fixes #35064

Author: andrewkroh

CHANGELOG.next.asciidoc

@@ -106,6 +106,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 - Fix the ignore_inactive option being ignored in Filebeat's filestream input {pull}34770[34770]
 - Fix TestMultiEventForEOFRetryHandlerInput unit test of CometD input {pull}34903[34903]
 - Add input instance id to request trace filename for httpjson and cel inputs {pull}35024[35024]
+- Fix panic in UDP input on Linux when collecting socket metrics from OS. {issue}35064[35064]
 
 *Heartbeat*
 

filebeat/input/udp/input.go

@@ -239,7 +239,7 @@ func (m *inputMetrics) poll(addr []string, each time.Duration, log *logp.Logger)
 	for {
 		select {
 		case <-t.C:
-			rx, drops, err := procNetUDP(addr)
+			rx, drops, err := procNetUDP("/proc/net/udp", addr)
 			if err != nil {
 				log.Warnf("failed to get udp stats from /proc: %v", err)
 				continue
@@ -257,8 +257,8 @@ func (m *inputMetrics) poll(addr []string, each time.Duration, log *logp.Logger)
 // for the socket on the provided address formatted in hex, xxxxxxxx:xxxx.
 // This function is only useful on linux due to its dependence on the /proc
 // filesystem, but is kept in this file for simplicity.
-func procNetUDP(addr []string) (rx, drops int64, err error) {
-	b, err := os.ReadFile("/proc/net/udp")
+func procNetUDP(path string, addr []string) (rx, drops int64, err error) {
+	b, err := os.ReadFile(path)
 	if err != nil {
 		return 0, 0, err
 	}
@@ -268,7 +268,7 @@ func procNetUDP(addr []string) (rx, drops int64, err error) {
 	}
 	for _, l := range lines[1:] {
 		f := bytes.Fields(l)
-		if contains(f[1], addr) {
+		if len(f) > 12 && contains(f[1], addr) {
 			_, r, ok := bytes.Cut(f[4], []byte(":"))
 			if !ok {
 				return 0, 0, errors.New("no rx_queue field " + string(f[4]))

filebeat/input/udp/input_test.go

@@ -0,0 +1,42 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package udp
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestProcNetUDP(t *testing.T) {
+	t.Run("with_match", func(t *testing.T) {
+		rx, drops, err := procNetUDP("testdata/proc_net_udp.txt", []string{"2508640A:1BBE"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		assert.EqualValues(t, 1, rx)
+		assert.EqualValues(t, 2, drops)
+	})
+
+	t.Run("without_match", func(t *testing.T) {
+		_, _, err := procNetUDP("testdata/proc_net_udp.txt", []string{"FOO:BAR", "BAR:BAZ"})
+		if assert.Error(t, err) {
+			assert.Contains(t, err.Error(), "entry not found")
+		}
+	})
+}

filebeat/input/udp/testdata/proc_net_udp.txt

@@ -0,0 +1,21 @@
+   sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode ref pointer drops
+  420: 3500007F:0035 00000000:0000 07 00000000:00000000 00:00000000 00000000   101        0 14260 2 0000000000000000 0
+  435: 2508640A:0044 2208640A:0043 01 00000000:00000000 00:00000000 00000000     0        0 23710 2 0000000000000000 0
+  476: 2508640A:206D 00000000:0000 07 00000000:00000000 00:00000000 00000000   998        0 25078 2 0000000000000000 0
+  478: 00000000:006F 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 1564 2 0000000000000000 0
+  490: 010011AC:007B 00000000:0000 07 00000000:00000000 00:00000000 00000000   114        0 104819785 2 0000000000000000 0
+  490: 2508640A:007B 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 23875 2 0000000000000000 0
+  490: 0100007F:007B 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 23873 2 0000000000000000 0
+  490: 00000000:007B 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 23869 2 0000000000000000 0
+  660: 2508640A:6925 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 105796790 2 0000000000000000 0
+  676: 2508640A:B135 2208640A:0035 01 00000000:00000000 00:00000000 00000000     0        0 104819411 2 0000000000000000 0
+  751: 2508640A:5980 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 110038458 2 0000000000000000 0
+  775: 0100007F:2198 00000000:0000 07 00000000:00000000 00:00000000 00000000   998        0 25079 2 0000000000000000 0
+ 1041: 2508640A:7AA2 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 105793171 2 0000000000000000 0
+ 1324: 2508640A:1BBD 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 104833818 2 0000000000000000 0
+ 1325: 2508640A:1BBE 00000000:0000 07 00000000:00000001 00:00000000 00000000     0        0 104836465 2 0000000000000000 2
+ 1326: 2508640A:1BBF 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 104833801 2 0000000000000000 0
+ 1327: 2508640A:1BC0 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 104833775 2 0000000000000000 0
+ 1570: 2508640A:6CB3 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 104819249 2 0000000000000000 0
+ 1694: 2508640A:D52F 2208640A:0035 01 00000000:00000000 00:00000000 00000000     0        0 112991224 2 0000000000000000 0
+ 1938: 2508640A:5E23 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 104833716 2 0000000000000000 0