in_opentelemetry: validate log protobuf depth before unpacking

[edsiper]

Validate OTLP log request nesting before protobuf-c recursively unpacks or allocates the message tree. The schema-aware preflight uses an explicit stack, treats strings/bytes/unknown fields as opaque, and rejects malformed lengths and varints.

Validation: The protobuf CTest target passed, including 99/100/101 message boundaries and malformed-wire cases, and passed focused Valgrind checks. All three log ingestion/recovery cases passed normally and under strict Valgrind. The existing large-protobuf-log scenario also passed both ways.

Focused integration commands (run against the combined validation build containing these fixes):

FLUENT_BIT_BINARY=$PWD/build/bin/fluent-bit tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/security_protobuf -q
VALGRIND=1 VALGRIND_STRICT=1 FLUENT_BIT_BINARY=$PWD/build/bin/fluent-bit tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/security_protobuf -q

Relevant internal CTest targets and focused Valgrind checks also passed. Full PR-range commit-prefix lint, DCO and whitespace checks passed against fetched master. Code and regression tests are separate commits.

Compatibility: Requests exceeding 100 schema messages in depth are rejected; the count includes protocol wrappers. Public interfaces and valid shallow requests are unchanged. Metrics/traces/profiles preflight fixes are maintained in their respective library PRs; this patch and its integration tests cover logs.

Summary by CodeRabbit

• Bug Fixes

  • OpenTelemetry protobuf requests are now validated before processing.
  • Malformed, truncated, or excessively nested payloads are rejected with an appropriate error instead of being processed.
  • The service remains available after receiving invalid or deeply nested requests.

• Tests

  • Added coverage for malformed protobuf data, nesting limits, boundary conditions, and continued daemon operation after rejected requests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 58e3e4e6-43b5-4bbe-8f06-df9dbf64d392

📥 Commits

Reviewing files that changed from the base of the PR and between a48daa6 and 29b3164.

📒 Files selected for processing (7)

• plugins/in_opentelemetry/CMakeLists.txt
• plugins/in_opentelemetry/opentelemetry_logs.c
• plugins/in_opentelemetry/opentelemetry_protobuf.c
• plugins/in_opentelemetry/opentelemetry_protobuf.h
• tests/integration/scenarios/security_protobuf/tests/test_security_protobuf.py
• tests/internal/CMakeLists.txt
• tests/internal/opentelemetry_protobuf.c

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The OpenTelemetry input plugin now validates protobuf payloads before unpacking. The validator checks wire boundaries and nested-message depth. Unit and integration tests cover malformed payloads, deep nesting, rejection, recovery, and daemon survival.

Changes

OpenTelemetry protobuf validation

Layer / File(s)	Summary
Validator contract and implementation plugins/in_opentelemetry/opentelemetry_protobuf.h, plugins/in_opentelemetry/opentelemetry_protobuf.c	Adds opentelemetry_protobuf_validate with bounded nested-message traversal and wire-format validation.
Plugin build and unpack integration plugins/in_opentelemetry/CMakeLists.txt, plugins/in_opentelemetry/opentelemetry_logs.c	Builds the validator and validates log payloads before protobuf unpacking.
Validator and runtime test coverage tests/internal/CMakeLists.txt, tests/internal/opentelemetry_protobuf.c, tests/integration/scenarios/security_protobuf/tests/test_security_protobuf.py	Tests wire boundaries, nesting limits, request rejection, recovery, and daemon survival.

Priority: ⬇️ Low

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Suggested reviewers: cosmo0920

Sequence Diagram(s)

sequenceDiagram
  participant OpenTelemetryClient
  participant FluentBit
  participant protobuf_logs_unpack
  participant opentelemetry_protobuf_validate
  participant protobuf_unpack
  OpenTelemetryClient->>FluentBit: Send OpenTelemetry protobuf request
  FluentBit->>protobuf_logs_unpack: Process request payload
  protobuf_logs_unpack->>opentelemetry_protobuf_validate: Validate payload
  opentelemetry_protobuf_validate-->>protobuf_logs_unpack: Return validation result
  protobuf_logs_unpack->>protobuf_unpack: Unpack valid payload
  protobuf_logs_unpack-->>FluentBit: Reject invalid payload or return unpacked logs

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 7.69% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 5 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: validating OpenTelemetry log protobuf nesting depth before unpacking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 7.69% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 13 functions across 5 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T15:38:44.791340Z	29b3164	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.