chore: unlock go 1.24 (#116)

eliottness · web-flow · commit 18a51e3fbbae · 2025-02-18T17:47:03.000Z
diff --git a/.github/workflows/_test_bare_metal.yml b/.github/workflows/_test_bare_metal.yml
@@ -7,7 +7,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runs-on: [ macos-15, macos-14, macos-13, ubuntu-24.04, ubuntu-22.04, ubuntu-20.04, windows-latest, arm-4core-linux ]
+        runs-on: [ macos-15, macos-14, macos-13, ubuntu-24.04, ubuntu-22.04, windows-latest, arm-4core-linux ]
         go-version: [ stable, oldstable ]
         include:
           # Test with DD_APPSEC_WAF_LOG_LEVEL (only latest go version)
diff --git a/.github/workflows/_test_containerized.yml b/.github/workflows/_test_containerized.yml
@@ -31,23 +31,14 @@ jobs:
           - golang:{0}-alpine
           - golang:{0}-bookworm
           - golang:{0}-bullseye
-          # RPM-based image
-          - amazonlinux:2 # pretty popular on AWS workloads
-          - amazonlinux:2023
         go-version:
           - ${{ needs.go-versions.outputs.stable }}
           - ${{ needs.go-versions.outputs.oldstable }}
+          - tip
         include:
           # Test with DD_APPSEC_WAF_LOG_LEVEL (only latest go, without any particular tag)
           - go-version: ${{ needs.go-versions.outputs.stable }}
             waf-log-level: TRACE
-        exclude:
-          # The amazonlinux:2 variant is only relevant for the default go version yum ships (currently 1.22)
-          - go-version: ${{ needs.go-versions.outputs.stable }}
-            image: amazonlinux:2
-          # The amazonlinux:2023 variant is only relevant for the default go version yum ships (currently 1.22)
-          - go-version: ${{ needs.go-versions.outputs.stable }}
-            image: amazonlinux:2023
     name: ${{ matrix.arch }} ${{ format(matrix.image, matrix.go-version) }} go${{ matrix.go-version }}${{ matrix.waf-log-level && format(' (DD_APPSEC_WAF_LOG_LEVEL={0})', matrix.waf-log-level) || '' }}
     # We use ARM runners when needed to avoid the performance hit of QEMU
     runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-latest' || 'arm-4core-linux' }}
diff --git a/.github/workflows/ci.sh b/.github/workflows/ci.sh
@@ -17,6 +17,10 @@ contains() {
 # Return true if the current OS is not Windows
 WAF_ENABLED=$([ "$GOOS" = "windows" ] && echo false || echo true)
 
+if $(contains "$GOVERSION" devel); then
+    WAF_ENABLED=false
+fi
+
 # run is the main function that runs the tests
 # It takes 2 arguments:
 # - $1: whether the WAF is enabled or not (true or false)
@@ -28,11 +32,6 @@ run() {
     test_tags="$2,$GOOS,$GOARCH"
     cgo=$($(contains "$2" cgo) && echo 1 || echo 0)
 
-    # Go 1.23 does not allow go version build tags
-    if $(contains "$GOVERSION" go1.23) && $(contains "$test_tags" go1); then
-        return
-    fi
-
     echo "Running matrix $test_tags where the WAF is" "$($waf_enabled && echo "supported" || echo "not supported")" "..."
     env CGO_ENABLED="$cgo" go test -shuffle=on -tags="$tags" -args -waf-build-tags="$test_tags" -waf-supported="$waf_enabled" ./...
 
@@ -41,32 +40,23 @@ run() {
     fi
 
     if [ "$cgo" = "1" ]; then
-        echo "Running again with cgocheck enabled..."
-        env "GOEXPERIMENT=cgocheck2" CGO_ENABLED=1 go test -shuffle=on -tags="$tags" -args -waf-build-tags="$test_tags" -waf-supported="$waf_enabled" ./...
+        echo "Running again with cgo options (cgocheck & race) enabled..."
+        env "GOEXPERIMENT=cgocheck2" CGO_ENABLED=1 go test -race -shuffle=on -tags="$tags" -args -waf-build-tags="$test_tags" -waf-supported="$waf_enabled" ./...
     fi
 
-    # TODO: remove condition once we have native arm64 linux runners
-    if [ "$GOARCH" = "amd64" ]; then
-        echo "Running again $nproc times in parralel"
-        env CGO_ENABLED="$cgo" go test -shuffle=on -parallel $((nproc / 4 + 1)) -count="$nproc" -tags="$tags" -args -waf-build-tags="$test_tags" -waf-supported="$waf_enabled" ./...
-    fi
+    echo "Running again $nproc times in parralel"
+    env CGO_ENABLED="$cgo" go test -shuffle=on -parallel $((nproc / 4 + 1)) -count="$nproc" -tags="$tags" -args -waf-build-tags="$test_tags" -waf-supported="$waf_enabled" ./...
 }
 
 run "$WAF_ENABLED" appsec                # WAF enabled (but not on windows)
 run false                                # CGO Disabled
-run false go1.24                         # Too recent go version (not tested)
-run false go1.24,appsec                  # CGO disabled with appsec explicitely enabled but too recent go version
 run false datadog.no_waf                 # WAF manually disabled
 run false datadog.no_waf,appsec          # CGO disabled with appsec explicitely enabled but WAF manually disabled
-run false datadog.no_waf,go1.24          # WAF manually disabled and go version to recent
-run false datadog.no_waf,go1.24,appsec   # CGO disabled, WAF manually disabled, too recent go version with appsec explicitely enabled
 
 # Check if we are running on Alpine and install the required dependencies for cgo
 if [ -f /etc/os-release ] && grep -q Alpine < /etc/os-release; then
   apk add gcc musl-dev libc6-compat
 fi
 
 run "$WAF_ENABLED" cgo                   # WAF enabled (but not on windows)
-run false go1.24,cgo                     # CGO enabled and too recent go version
 run false datadog.no_waf,cgo             # WAF manually disabled and CGO enabled
-run false datadog.no_waf,go1.24,cgo      # CGO enabled, WAF manually disabled, too recent go version
diff --git a/_tools/libddwaf-updater/update.go b/_tools/libddwaf-updater/update.go
@@ -32,7 +32,7 @@ var (
 )
 
 const (
-	goVersionUnsupported = "go1.24"
+	goVersionUnsupported = "go1.25"
 )
 
 var (
diff --git a/alignement_test.go b/alignement_test.go
@@ -4,7 +4,7 @@
 // Copyright 2016-present Datadog, Inc.
 
 // Purego only works on linux/macOS with amd64 and arm64 from now
-//go:build (linux || darwin) && (amd64 || arm64) && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build (linux || darwin) && (amd64 || arm64) && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package waf
 
diff --git a/encoder.go b/encoder.go
@@ -491,7 +491,7 @@ func depthOf(ctx context.Context, obj reflect.Value) (depth int, err error) {
 	}
 }
 
-// resovlePointer attempts to resolve a pointer while limiting the pointer depth
+// resolvePointer attempts to resolve a pointer while limiting the pointer depth
 // to be traversed, so that this is not susceptible to an infinite loop when
 // provided a self-referencing pointer.
 func resolvePointer(obj reflect.Value) (reflect.Value, reflect.Kind) {
diff --git a/encoder_decoder_test.go b/encoder_decoder_test.go
@@ -3,7 +3,7 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2016-present Datadog, Inc.
 
-//go:build (amd64 || arm64) && (linux || darwin) && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build (amd64 || arm64) && (linux || darwin) && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package waf
 
diff --git a/go.mod b/go.mod
@@ -1,9 +1,9 @@
 module github.com/DataDog/go-libddwaf/v3
 
-go 1.21
+go 1.23
 
 require (
-	github.com/ebitengine/purego v0.6.0-alpha.5
+	github.com/ebitengine/purego v0.8.2
 	github.com/pkg/errors v0.9.1
 	github.com/stretchr/testify v1.8.4
 	golang.org/x/sys v0.16.0
diff --git a/go.sum b/go.sum
@@ -1,8 +1,8 @@
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/ebitengine/purego v0.6.0-alpha.5 h1:EYID3JOAdmQ4SNZYJHu9V6IqOeRQDBYxqKAg9PyoHFY=
-github.com/ebitengine/purego v0.6.0-alpha.5/go.mod h1:ah1In8AOtksoNK6yk5z1HTJeUkC1Ez4Wk2idgGslMwQ=
+github.com/ebitengine/purego v0.8.2 h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
+github.com/ebitengine/purego v0.8.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
diff --git a/handle_test.go b/handle_test.go
@@ -3,7 +3,7 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2016-present Datadog, Inc.
 
-//go:build (amd64 || arm64) && (linux || darwin) && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build (amd64 || arm64) && (linux || darwin) && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package waf
 
diff --git a/internal/bindings/ctypes.go b/internal/bindings/ctypes.go
@@ -5,6 +5,10 @@
 
 package bindings
 
+import (
+	"structs"
+)
+
 const (
 	WafMaxStringLength   = 4096
 	WafMaxContainerDepth = 20
@@ -22,7 +26,7 @@ const (
 	WafMatch
 )
 
-// wafObjectType is an enum in C which has the size of DWORD.
+// WafObjectType is an enum in C which has the size of DWORD.
 // But DWORD is 4 bytes in amd64 and arm64 so uint32 it is.
 type WafObjectType uint32
 
@@ -39,6 +43,7 @@ const (
 )
 
 type WafObject struct {
+	_                   structs.HostLayout
 	ParameterName       uintptr
 	ParameterNameLength uint64
 	Value               uintptr
@@ -53,61 +58,65 @@ type WafObject struct {
 	// packed (apart from breaking all tracers of course)
 }
 
-// isInvalid determines whether this WAF Object has the invalid type (which is the 0-value).
+// IsInvalid determines whether this WAF Object has the invalid type (which is the 0-value).
 func (w *WafObject) IsInvalid() bool {
 	return w.Type == WafInvalidType
 }
 
-// isNil determines whether this WAF Object is nil or not.
+// IsNil determines whether this WAF Object is nil or not.
 func (w *WafObject) IsNil() bool {
 	return w.Type == WafNilType
 }
 
-// isArray determines whether this WAF Object is an array or not.
+// IsArray determines whether this WAF Object is an array or not.
 func (w *WafObject) IsArray() bool {
 	return w.Type == WafArrayType
 }
 
-// isMap determines whether this WAF Object is a map or not.
+// IsMap determines whether this WAF Object is a map or not.
 func (w *WafObject) IsMap() bool {
 	return w.Type == WafMapType
 }
 
 // IsUnusable returns true if the wafObject has no impact on the WAF execution
 // But we still need this kind of objects to forward map keys in case the value of the map is invalid
-func (wo *WafObject) IsUnusable() bool {
-	return wo.Type == WafInvalidType || wo.Type == WafNilType
+func (w *WafObject) IsUnusable() bool {
+	return w.Type == WafInvalidType || w.Type == WafNilType
 }
 
 type WafConfig struct {
+	_          structs.HostLayout
 	Limits     WafConfigLimits
 	Obfuscator WafConfigObfuscator
 	FreeFn     uintptr
 }
 
 type WafConfigLimits struct {
+	_                 structs.HostLayout
 	MaxContainerSize  uint32
 	MaxContainerDepth uint32
 	MaxStringLength   uint32
 }
 
 type WafConfigObfuscator struct {
+	_          structs.HostLayout
 	KeyRegex   uintptr // char *
 	ValueRegex uintptr // char *
 }
 
 type WafResult struct {
+	_            structs.HostLayout
 	Timeout      byte
 	Events       WafObject
 	Actions      WafObject
 	Derivatives  WafObject
 	TotalRuntime uint64
 }
 
-// wafHandle is a forward declaration in ddwaf.h header
+// WafHandle is a forward declaration in ddwaf.h header
 // We basically don't need to modify it, only to give it to the waf
 type WafHandle uintptr
 
-// wafContext is a forward declaration in ddwaf.h header
+// WafContext is a forward declaration in ddwaf.h header
 // We basically don't need to modify it, only to give it to the waf
 type WafContext uintptr
diff --git a/internal/bindings/waf_dl.go b/internal/bindings/waf_dl.go
@@ -3,7 +3,7 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2016-present Datadog, Inc.
 
-//go:build (linux || darwin) && (amd64 || arm64) && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build (linux || darwin) && (amd64 || arm64) && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package bindings
 
diff --git a/internal/bindings/waf_dl_test.go b/internal/bindings/waf_dl_test.go
@@ -3,7 +3,7 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2016-present Datadog, Inc.
 
-//go:build (linux || darwin) && (amd64 || arm64) && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build (linux || darwin) && (amd64 || arm64) && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package bindings
 
diff --git a/internal/bindings/waf_dl_unsupported.go b/internal/bindings/waf_dl_unsupported.go
@@ -4,52 +4,56 @@
 // Copyright 2016-present Datadog, Inc.
 
 // Build when the target OS or architecture are not supported
-//go:build (!linux && !darwin) || (!amd64 && !arm64) || go1.24 || datadog.no_waf || (!cgo && !appsec)
+//go:build (!linux && !darwin) || (!amd64 && !arm64) || go1.25 || datadog.no_waf || (!cgo && !appsec)
 
 package bindings
 
+import (
+	"errors"
+)
+
 type WafDl struct{}
 
-func NewWafDl() (dl *WafDl, err error) {
-	return nil, nil
+func NewWafDl() (*WafDl, error) {
+	return nil, errors.New("WAF is not supported on this platform")
 }
 
 func (waf *WafDl) WafGetVersion() string {
 	return ""
 }
 
-func (waf *WafDl) WafInit(obj *WafObject, config *WafConfig, info *WafObject) WafHandle {
+func (waf *WafDl) WafInit(*WafObject, *WafConfig, *WafObject) WafHandle {
 	return 0
 }
 
-func (waf *WafDl) WafUpdate(handle WafHandle, ruleset *WafObject, info *WafObject) WafHandle {
+func (waf *WafDl) WafUpdate(WafHandle, *WafObject, *WafObject) WafHandle {
 	return 0
 }
 
-func (waf *WafDl) WafDestroy(handle WafHandle) {
+func (waf *WafDl) WafDestroy(WafHandle) {
 }
 
-func (waf *WafDl) WafKnownAddresses(handle WafHandle) []string {
+func (waf *WafDl) WafKnownAddresses(WafHandle) []string {
 	return nil
 }
 
-func (waf *WafDl) WafKnownActions(handle WafHandle) []string {
+func (waf *WafDl) WafKnownActions(WafHandle) []string {
 	return nil
 }
 
-func (waf *WafDl) WafContextInit(handle WafHandle) WafContext {
+func (waf *WafDl) WafContextInit(WafHandle) WafContext {
 	return 0
 }
 
-func (waf *WafDl) WafContextDestroy(context WafContext) {
+func (waf *WafDl) WafContextDestroy(WafContext) {
 }
 
-func (waf *WafDl) WafResultFree(result *WafResult) {
+func (waf *WafDl) WafResultFree(*WafResult) {
 }
 
-func (waf *WafDl) WafObjectFree(obj *WafObject) {
+func (waf *WafDl) WafObjectFree(*WafObject) {
 }
 
-func (waf *WafDl) WafRun(context WafContext, persistentData, ephemeralData *WafObject, result *WafResult, timeout uint64) WafReturnCode {
+func (waf *WafDl) WafRun(WafContext, *WafObject, *WafObject, *WafResult, uint64) WafReturnCode {
 	return WafErrInternal
 }
diff --git a/internal/lib/dump_waf_darwin.go b/internal/lib/dump_waf_darwin.go
@@ -3,7 +3,7 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2016-present Datadog, Inc.
 
-//go:build darwin && (amd64 || arm64) && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build darwin && (amd64 || arm64) && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package lib
 
diff --git a/internal/lib/dump_waf_linux.go b/internal/lib/dump_waf_linux.go
@@ -3,7 +3,7 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2016-present Datadog, Inc.
 
-//go:build linux && (amd64 || arm64) && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build linux && (amd64 || arm64) && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package lib
 
diff --git a/internal/lib/lib_darwin_amd64.go b/internal/lib/lib_darwin_amd64.go
@@ -3,7 +3,7 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2016-present Datadog, Inc.
 
-//go:build darwin && amd64 && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build darwin && amd64 && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package lib
 
diff --git a/internal/lib/lib_darwin_arm64.go b/internal/lib/lib_darwin_arm64.go
@@ -3,7 +3,7 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2016-present Datadog, Inc.
 
-//go:build darwin && arm64 && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build darwin && arm64 && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package lib
 
diff --git a/internal/lib/lib_linux_amd64.go b/internal/lib/lib_linux_amd64.go
@@ -3,7 +3,7 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2016-present Datadog, Inc.
 
-//go:build linux && amd64 && !go1.24 && !datadog.no_waf && (cgo || appsec)
+//go:build linux && amd64 && !go1.25 && !datadog.no_waf && (cgo || appsec)
 
 package lib
 
diff --git a/internal/lib/lib_linux_arm64.go b/internal/lib/lib_linux_arm64.go
diff --git a/internal/log/log_purego.go b/internal/log/log_purego.go
diff --git a/internal/log/log_unsupported.go b/internal/log/log_unsupported.go
diff --git a/internal/support/waf_unsupported_go.go b/internal/support/waf_unsupported_go.go
diff --git a/internal/support/waf_unsupported_go_test.go b/internal/support/waf_unsupported_go_test.go
diff --git a/waf.go b/waf.go
diff --git a/waf_test.go b/waf_test.go

Original file line number	Diff line number	Diff line change
`@@ -32,7 +32,7 @@ var (`
`32`	`32`	`)`
`33`	`33`
`34`	`34`	`const (`
`35`		`- goVersionUnsupported = "go1.24"`
	`35`	`+ goVersionUnsupported = "go1.25"`
`36`	`36`	`)`
`37`	`37`
`38`	`38`	`var (`
Original file line number	Diff line number	Diff line change
`@@ -491,7 +491,7 @@ func depthOf(ctx context.Context, obj reflect.Value) (depth int, err error) {`
`491`	`491`	`}`
`492`	`492`	`}`
`493`	`493`
`494`		`-// resovlePointer attempts to resolve a pointer while limiting the pointer depth`
	`494`	`+// resolvePointer attempts to resolve a pointer while limiting the pointer depth`
`495`	`495`	`// to be traversed, so that this is not susceptible to an infinite loop when`
`496`	`496`	`// provided a self-referencing pointer.`
`497`	`497`	`func resolvePointer(obj reflect.Value) (reflect.Value, reflect.Kind) {`