Add NAP paths to allowed directories

Makefile.tools

@@ -1,6 +1,6 @@
 OAPICODEGEN	    = github.com/deepmap/oapi-codegen/v2/cmd/oapi-codegen@v2.1.0
 LEFTHOOK	    = github.com/evilmartians/lefthook@v1.6.9
-GOLANGCILINT    = github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8
+GOLANGCILINT    = github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.2.1
 PROTOCGENGO	    = google.golang.org/protobuf/cmd/protoc-gen-go@v1.32.0
 GOFUMPT	        = mvdan.cc/gofumpt@v0.6.0
 COUNTERFEITER   = github.com/maxbrunsfeld/counterfeiter/v6@v6.8.1

go.mod

@@ -1,8 +1,8 @@
 module github.com/nginx/agent/v3
 
-go 1.23.7
+go 1.24.0
 
-toolchain go1.23.10
+toolchain go1.24.4
 
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.4-20250130201111-63bb56e20495.1

internal/collector/nginxossreceiver/factory_test.go

@@ -23,7 +23,7 @@ import (
 func TestType(t *testing.T) {
 	factory := NewFactory()
 	ft := factory.Type()
-	require.EqualValues(t, metadata.Type, ft)
+	require.Equal(t, metadata.Type, ft)
 }
 
 func TestValidConfig(t *testing.T) {

internal/collector/nginxossreceiver/internal/scraper/accesslog/operator/input/file/config_test.go

@@ -27,7 +27,7 @@ func TestNewConfig(t *testing.T) {
 	config := NewConfig()
 
 	assert.NotNil(t, config)
-	assert.Equal(t, "access_log_file_input", config.InputConfig.OperatorID)
+	assert.Equal(t, "access_log_file_input", config.OperatorID)
 }
 
 func TestConfig_Build(t *testing.T) {

internal/collector/otel_collector_plugin.go

@@ -436,7 +436,7 @@ func (oc *Collector) checkForNewReceivers(ctx context.Context, nginxConfigContex
 			reloadCollector = true
 		}
 	} else {
-		slog.Debug("NAP logs feature disabled", "enabled_features", oc.config.Features)
+		slog.DebugContext(ctx, "NAP logs feature disabled", "enabled_features", oc.config.Features)
 	}
 
 	return reloadCollector

internal/config/config_test.go

@@ -791,7 +791,7 @@ func agentConfig() *Config {
 		},
 		AllowedDirectories: []string{
 			"/etc/nginx/", "/etc/nginx-agent/", "/usr/local/etc/nginx/", "/var/run/nginx/", "/var/log/nginx/",
-			"/usr/share/nginx/modules/",
+			"/usr/share/nginx/modules/", "/opt/app_protect/", "/etc/app_protect/",
 		},
 		Collector: &Collector{
 			ConfigPath: "/etc/nginx-agent/nginx-agent-otelcol.yaml",

internal/config/defaults.go

@@ -106,6 +106,8 @@ func DefaultAllowedDirectories() []string {
 		"/usr/share/nginx/modules",
 		"/var/run/nginx",
 		"/var/log/nginx",
+		"/opt/app_protect",
+		"/etc/app_protect",
 	}
 }
 

internal/datasource/config/nginx_config_parser.go

@@ -705,11 +705,12 @@ func (ncp *NginxConfigParser) parseListenDirective(
 }
 
 func (ncp *NginxConfigParser) parseListenHostAndPort(listenHost, listenPort string) (hostname, port string) {
-	if listenHost == "*" || listenHost == "" {
+	switch listenHost {
+	case "*", "":
 		hostname = "127.0.0.1"
-	} else if listenHost == "::" || listenHost == "::1" {
+	case "::", "::1":
 		hostname = "[::1]"
-	} else {
+	default:
 		hostname = listenHost
 	}
 	port = listenPort

internal/datasource/config/nginx_config_parser_benchmark_test.go

@@ -8,7 +8,6 @@ package config
 import (
 	"context"
 	"fmt"
-	"io"
 	"log/slog"
 	"path/filepath"
 	"testing"
@@ -29,7 +28,7 @@ var configFilePaths = []string{
 
 func BenchmarkNginxConfigParser_Parse(b *testing.B) {
 	// Discard log messages
-	slog.SetDefault(slog.New(slog.NewTextHandler(io.Discard, &slog.HandlerOptions{})))
+	slog.SetDefault(slog.New(slog.DiscardHandler))
 	ctx := context.Background()
 	agentConfig := types.AgentConfig()
 
@@ -67,7 +66,7 @@ func BenchmarkNginxConfigParser_Parse(b *testing.B) {
 
 // These tests don't exercise the traversal very well, they are more to track the growth of configs in size
 func BenchmarkNginxConfigParserGeneratedConfig_Parse(b *testing.B) {
-	slog.SetDefault(slog.New(slog.NewTextHandler(io.Discard, &slog.HandlerOptions{})))
+	slog.SetDefault(slog.New(slog.DiscardHandler))
 	ctx := context.Background()
 	agentConfig := types.AgentConfig()
 

internal/datasource/config/nginx_config_parser_test.go

@@ -554,7 +554,7 @@ func TestNginxConfigParser_Parse(t *testing.T) {
 			assert.ElementsMatch(t, test.expectedConfigContext.ErrorLogs, result.ErrorLogs)
 			assert.Equal(t, test.expectedConfigContext.StubStatus, result.StubStatus)
 			assert.Equal(t, test.expectedConfigContext.InstanceID, result.InstanceID)
-			assert.Equal(t, len(test.expectedConfigContext.Files), len(result.Files))
+			assert.Len(t, result.Files, len(test.expectedConfigContext.Files))
 		})
 	}
 }

internal/file/file_manager_service.go

@@ -221,15 +221,15 @@ func (fms *FileManagerService) executeFileActions(ctx context.Context) error {
 	for _, fileAction := range fms.fileActions {
 		switch fileAction.Action {
 		case model.Delete:
-			slog.Debug("File action, deleting file", "file", fileAction.File.GetFileMeta().GetName())
+			slog.DebugContext(ctx, "File action, deleting file", "file", fileAction.File.GetFileMeta().GetName())
 			if err := os.Remove(fileAction.File.GetFileMeta().GetName()); err != nil && !os.IsNotExist(err) {
 				return fmt.Errorf("error deleting file: %s error: %w",
 					fileAction.File.GetFileMeta().GetName(), err)
 			}
 
 			continue
 		case model.Add, model.Update:
-			slog.Debug("File action, add or update file", "file", fileAction.File.GetFileMeta().GetName())
+			slog.DebugContext(ctx, "File action, add or update file", "file", fileAction.File.GetFileMeta().GetName())
 			updateErr := fms.fileUpdate(ctx, fileAction.File)
 			if updateErr != nil {
 				return updateErr

internal/file/file_service_operator.go

@@ -183,7 +183,7 @@ func (fso *FileServiceOperator) UpdateOverview(
 	slog.DebugContext(newCtx, "UpdateOverview response", "response", response)
 
 	if response.GetOverview() == nil {
-		slog.Debug("UpdateOverview response is empty")
+		slog.DebugContext(ctx, "UpdateOverview response is empty")
 		return nil
 	}
 	delta := files.ConvertToMapOfFiles(response.GetOverview().GetFiles())
@@ -211,7 +211,7 @@ func (fso *FileServiceOperator) updateFiles(
 	}
 
 	iteration++
-	slog.Info("Updating file overview after file updates", "attempt_number", iteration)
+	slog.InfoContext(ctx, "Updating file overview after file updates", "attempt_number", iteration)
 
 	return fso.UpdateOverview(ctx, instanceID, diffFiles, iteration)
 }

internal/logger/logger.go

@@ -154,7 +154,8 @@ func CorrelationIDAttr(ctx context.Context) slog.Attr {
 	value, ok := ctx.Value(CorrelationIDContextKey).(slog.Attr)
 	if !ok {
 		correlationID := GenerateCorrelationID()
-		slog.Debug(
+		slog.DebugContext(
+			ctx,
 			"Correlation ID not found in context, generating new correlation ID",
 			"correlation_id",
 			correlationID)

internal/plugin/plugin_manager_test.go

@@ -147,7 +147,7 @@ func TestLoadPlugins(t *testing.T) {
 		t.Run(test.name, func(tt *testing.T) {
 			t.Logf("running test %s", test.name)
 			result := LoadPlugins(ctx, test.input)
-			assert.Equal(tt, len(test.expected), len(result))
+			assert.Len(tt, result, len(test.expected))
 			for i, expectedPlugin := range test.expected {
 				assert.IsType(tt, expectedPlugin, result[i])
 			}

internal/resource/nginx_instance_operator.go

@@ -92,7 +92,7 @@ func (i *NginxInstanceOperator) Reload(ctx context.Context, instance *mpi.Instan
 		slog.InfoContext(ctx, "Message received in logErrorChannel", "error", logErr)
 		if logErr != nil {
 			errorsFound = errors.Join(errorsFound, logErr)
-			slog.Info("Errors Found", "", errorsFound)
+			slog.InfoContext(ctx, "Errors Found", "", errorsFound)
 		}
 	}
 

internal/resource/resource_plugin.go

@@ -228,7 +228,8 @@ func (r *Resource) handleWriteConfigSuccessful(ctx context.Context, msg *bus.Mes
 	configContext, err := r.resourceService.ApplyConfig(ctx, data.InstanceID)
 	if err != nil {
 		data.Error = err
-		slog.Error("errors found during config apply, sending error status, rolling back config", "err", err)
+		slog.ErrorContext(ctx, "errors found during config apply, "+
+			"sending error status, rolling back config", "err", err)
 		dpResponse := response.CreateDataPlaneResponse(data.CorrelationID, mpi.CommandResponse_COMMAND_STATUS_ERROR,
 			"Config apply failed, rolling back config", data.InstanceID, err.Error())
 		r.messagePipe.Process(ctx, &bus.Message{Topic: bus.DataPlaneResponseTopic, Data: dpResponse})
@@ -259,7 +260,7 @@ func (r *Resource) handleRollbackWrite(ctx context.Context, msg *bus.Message) {
 	}
 	_, err := r.resourceService.ApplyConfig(ctx, data.InstanceID)
 	if err != nil {
-		slog.Error("errors found during rollback, sending failure status", "err", err)
+		slog.ErrorContext(ctx, "errors found during rollback, sending failure status", "err", err)
 
 		rollbackResponse := response.CreateDataPlaneResponse(data.CorrelationID,
 			mpi.CommandResponse_COMMAND_STATUS_ERROR, "Rollback failed", data.InstanceID, err.Error())

internal/resource/resource_plugin_test.go

@@ -879,7 +879,7 @@ func TestResource_Process_Rollback(t *testing.T) {
 				return messagePipe.Messages()[i].Topic < messagePipe.Messages()[j].Topic
 			})
 
-			assert.Equal(tt, len(test.topic), len(messagePipe.Messages()))
+			assert.Len(tt, messagePipe.Messages(), len(test.topic))
 
 			assert.Equal(t, test.topic[0], messagePipe.Messages()[0].Topic)
 

internal/resource/resource_service.go

@@ -227,7 +227,7 @@ func (r *ResourceService) GetHTTPUpstreamServers(ctx context.Context, instance *
 
 	servers, getServersErr := plusClient.GetHTTPServers(ctx, upstream)
 
-	slog.Warn("Error returned from NGINX Plus client, GetHTTPUpstreamServers", "err", getServersErr)
+	slog.WarnContext(ctx, "Error returned from NGINX Plus client, GetHTTPUpstreamServers", "err", getServersErr)
 
 	return servers, createPlusAPIError(getServersErr)
 }
@@ -242,7 +242,7 @@ func (r *ResourceService) GetUpstreams(ctx context.Context, instance *mpi.Instan
 
 	servers, getUpstreamsErr := plusClient.GetUpstreams(ctx)
 
-	slog.Warn("Error returned from NGINX Plus client, GetUpstreams", "err", getUpstreamsErr)
+	slog.WarnContext(ctx, "Error returned from NGINX Plus client, GetUpstreams", "err", getUpstreamsErr)
 
 	return servers, createPlusAPIError(getUpstreamsErr)
 }
@@ -257,7 +257,7 @@ func (r *ResourceService) GetStreamUpstreams(ctx context.Context, instance *mpi.
 
 	streamUpstreams, getServersErr := plusClient.GetStreamUpstreams(ctx)
 
-	slog.Warn("Error returned from NGINX Plus client, GetStreamUpstreams", "err", getServersErr)
+	slog.WarnContext(ctx, "Error returned from NGINX Plus client, GetStreamUpstreams", "err", getServersErr)
 
 	return streamUpstreams, createPlusAPIError(getServersErr)
 }
@@ -277,7 +277,7 @@ func (r *ResourceService) UpdateStreamServers(ctx context.Context, instance *mpi
 
 	added, updated, deleted, updateError := plusClient.UpdateStreamServers(ctx, upstream, servers)
 
-	slog.Warn("Error returned from NGINX Plus client, UpdateStreamServers", "err", updateError)
+	slog.WarnContext(ctx, "Error returned from NGINX Plus client, UpdateStreamServers", "err", updateError)
 
 	return added, updated, deleted, createPlusAPIError(updateError)
 }
@@ -298,7 +298,7 @@ func (r *ResourceService) UpdateHTTPUpstreamServers(ctx context.Context, instanc
 	added, updated, deleted, updateError := plusClient.UpdateHTTPServers(ctx, upstream, servers)
 
 	if updateError != nil {
-		slog.Warn("Error returned from NGINX Plus client, UpdateHTTPUpstreamServers", "err", updateError)
+		slog.WarnContext(ctx, "Error returned from NGINX Plus client, UpdateHTTPUpstreamServers", "err", updateError)
 	}
 
 	return added, updated, deleted, createPlusAPIError(updateError)

internal/watcher/instance/instance_watcher_service.go

@@ -115,7 +115,7 @@ func (iw *InstanceWatcherService) Watch(
 			if iw.enabled.Load() {
 				iw.checkForUpdates(ctx)
 			} else {
-				slog.Debug("Skipping check for instance updates, instance watcher is disabled")
+				slog.DebugContext(ctx, "Skipping check for instance updates, instance watcher is disabled")
 			}
 		}
 	}

internal/watcher/instance/nginx-app-protect-instance-watcher.go

@@ -136,16 +136,16 @@ func (w *NginxAppProtectInstanceWatcher) addWatcher(ctx context.Context, version
 }
 
 func (w *NginxAppProtectInstanceWatcher) readVersionFile(ctx context.Context, versionFile string) {
-	switch {
-	case versionFile == versionFilePath:
+	switch versionFile {
+	case versionFilePath:
 		w.version = w.readFile(ctx, versionFilePath)
-	case versionFile == releaseFilePath:
+	case releaseFilePath:
 		w.release = w.readFile(ctx, releaseFilePath)
-	case versionFile == threatCampaignVersionFilePath:
+	case threatCampaignVersionFilePath:
 		w.threatCampaignVersion = w.readFile(ctx, threatCampaignVersionFilePath)
-	case versionFile == enforcerEngineVersionFilePath:
+	case enforcerEngineVersionFilePath:
 		w.enforcerEngineVersion = w.readFile(ctx, enforcerEngineVersionFilePath)
-	case versionFile == attackSignatureVersionFilePath:
+	case attackSignatureVersionFilePath:
 		w.attackSignatureVersion = w.readFile(ctx, attackSignatureVersionFilePath)
 	}
 }
@@ -231,9 +231,6 @@ func (w *NginxAppProtectInstanceWatcher) createInstance(ctx context.Context) {
 			InstanceChildren: make([]*mpi.InstanceChild, 0),
 		},
 	}
-
-	slog.InfoContext(ctx, "Discovered a new NGINX App Protect instance")
-
 	w.instancesChannel <- InstanceUpdatesMessage{
 		CorrelationID: logger.CorrelationIDAttr(ctx),
 		InstanceUpdates: InstanceUpdates{

internal/watcher/instance/nginx-app-protect-instance-watcher_test.go

@@ -112,7 +112,6 @@ func TestNginxAppProtectInstanceWatcher_Watch(t *testing.T) {
 			t.Fatalf("Timed out waiting for instance updates")
 		}
 	})
-
 	t.Run("Test 2: Update instance", func(t *testing.T) {
 		_, err = enforcerEngineVersionFile.WriteAt([]byte("6.113.0"), 0)
 		require.NoError(t, err)

internal/watcher/instance/nginx_process_parser_test.go

@@ -185,7 +185,7 @@ func TestNginxProcessParser_Parse(t *testing.T) {
 				}
 			}
 
-			assert.Equal(tt, len(test.expected), len(result))
+			assert.Len(tt, result, len(test.expected))
 		})
 	}
 }
@@ -391,7 +391,7 @@ func TestNginxProcessParser_Parse_Processes(t *testing.T) {
 				assert.True(tt, proto.Equal(test.expected[id], instance))
 			}
 
-			assert.Equal(tt, len(test.expected), len(result))
+			assert.Len(tt, result, len(test.expected))
 		})
 	}
 }
@@ -622,8 +622,8 @@ func TestGetConfigPathFromCommand(t *testing.T) {
 	assert.Equal(t, "/tmp/nginx.conf", result)
 
 	result = confPathFromCommand("nginx: master process nginx -c")
-	assert.Equal(t, "", result)
+	assert.Empty(t, result)
 
 	result = confPathFromCommand("")
-	assert.Equal(t, "", result)
+	assert.Empty(t, result)
 }

pkg/id/uuid.go

@@ -28,8 +28,14 @@ import (
 //
 //	A string representation of the generated UUID.
 func Generate(format string, a ...interface{}) string {
+	// need to set a default to avoid non-constant format string in call
+	f := ""
+	if format != "" {
+		f = format
+	}
+
 	h := sha256.New()
-	s := fmt.Sprintf(format, a...)
+	s := fmt.Sprintf(f, a...)
 	_, _ = h.Write([]byte(s))
 	id := fmt.Sprintf("%x", h.Sum(nil))
 

scripts/packages/packager/Dockerfile

@@ -1,6 +1,6 @@
 ARG package_type
 
-FROM docker.io/golang:1.23-bullseye AS base
+FROM docker.io/golang:1.24-bullseye AS base
 
 ARG PKG_VER="1.17.5"
 ARG PKG_DIR="/tmp/pkg"

scripts/packages/upgrade-agent-config.sh

@@ -52,7 +52,9 @@ for config_dir in $config_dirs; do
 done
 
 allowed_directories="${allowed_directories}\n  - /var/log/nginx"
-
+allowed_directories="${allowed_directories}\n  - /opt/app_protect"
+allowed_directories="${allowed_directories}\n  - /etc/app_protect"
+
 v3_config_contents="
 #
 # /etc/nginx-agent/nginx-agent.conf

test/helpers/go_utils_test.go

@@ -13,7 +13,7 @@ import (
 )
 
 func TestGoVersion(t *testing.T) {
-	expected := "1.23.0"
+	expected := "1.24.0"
 
 	actual, err := GoVersion(t, 2)
 

test/helpers/os_utils_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-// nolint: stylecheck
+// nolint: staticcheck
 func TestRemoveASCIIControlSignals(t *testing.T) {
 	tests := []struct {
 		name     string