upgrade to spicy 1.16 and fixing clang17

.github/workflows/workflow.yml

@@ -17,7 +17,7 @@ jobs:
 
       - name: Install spicyc
         run: |
-          wget https://github.com/zeek/spicy/releases/download/v1.13.1/spicy_linux_ubuntu24.deb
+          wget https://github.com/zeek/spicy/releases/download/v1.16.0/spicy_linux_ubuntu24.deb
           sudo dpkg --install spicy_linux_ubuntu24.deb
           sudo apt-get install -f -y # pulling in any missing deps
           rm spicy_linux_ubuntu24.deb
@@ -45,12 +45,12 @@ jobs:
 
       - name: Build
         env:
-          CC: clang
-          CXX: clang++
+          CC: clang-17
+          CXX: clang++-17
         run: go build -v ./...
 
       - name: Test
         env:
-          CC: clang
-          CXX: clang++
+          CC: clang-17
+          CXX: clang++-17
         run: go test -v ./...

.gitignore

@@ -42,6 +42,7 @@ poc/
 docs/engineering-guidelines.md
 docs/roadmap.md
 openspec/
+*.deb
 
 # Spicy generated files
 protocols/spicy/*.cc

CONTRIBUTING.md

@@ -21,5 +21,5 @@ See [Getting started](docs/setup.md) for the toolchain, Spicy/HILTI, and Glutton
 
 - **Format** Mirror the structure of existing handlers in `protocols/tcp/` and `protocols/udp/`.
 - **Respect the boundary:** parsing belongs in `.spicy` files, protocol logic in Go. Never commit generated parser artifacts — they're git-ignored.
-- **Test before pushing:** run `go test ./protocols/... ./rules/...` while iterating, and the full `CC=clang CXX=clang++ go test ./...` (Spicy must be installed) before opening a PR. If you changed any `.spicy` file, run `make spicy` first so tests pick up the regenerated parser.
+- **Test before pushing:** run `go test ./protocols/... ./rules/...` while iterating, and the full `CC=clang-17 CXX=clang++-17 go test ./...` (Spicy must be installed) before opening a PR. If you changed any `.spicy` file, run `make spicy` first so tests pick up the regenerated parser.
 - **Write a focused PR:** describe what changed, how you tested it, and which docs moved with it. Keep unrelated cleanup in its own PR.

Makefile

@@ -20,8 +20,9 @@ upx:
 default: build
 
 build:
-	CC=clang CXX=clang++ go build -ldflags=$(LDFLAGS) -o bin/server app/server.go
+	CC=clang-17 CXX=clang++-17 go build -ldflags=$(LDFLAGS) -o bin/server app/server.go
 
+.PHONY: spicy
 spicy:
 	cd protocols/spicy && make
 
@@ -34,9 +35,10 @@ clean:
 
 run: build
 	sudo bin/server
+
 docker:
 	docker build -t glutton .
 	docker run --rm --cap-add=NET_ADMIN -it glutton
 
-test:
+test: spicy
 	go test -v ./...

README.md

@@ -24,7 +24,7 @@ Out of the box, Glutton ships handlers that capture exploit probes targeting Cit
 
 ## Quick start
 
-Glutton requires Linux, root privileges for iptables, and a build toolchain compatible with the [CI workflow](.github/workflows/workflow.yml) — currently Go 1.23+, Spicy 1.13.1, clang 17, libpcap, iptables, and zlib1g.
+Glutton requires Linux, root privileges for iptables, and a build toolchain compatible with the [CI workflow](.github/workflows/workflow.yml) — currently Go 1.23+, Spicy 1.16.0, clang 17, libpcap, iptables, and zlib1g.
 
 ```bash
 git clone https://github.com/mushorg/glutton.git

docs/protocols/adding-a-protocol.md

@@ -130,7 +130,7 @@ Only do this for protocols that should be detected from catch-all TCP. If the pr
 
 ```bash
 export PATH=/opt/spicy/bin:$PATH
-CC=clang CXX=clang++ go test ./...
+CC=clang-17 CXX=clang++-17 go test ./...
 ```
 
 For faster iteration during development, scope to the package: `go test ./protocols/...`.

docs/setup.md

@@ -16,18 +16,20 @@ Glutton is a Linux-only Go binary that depends on iptables, libpcap, a C/C++ too
 | libpcap                         | Required by `github.com/google/gopacket/pcap`.                                                                           |
 | iptables                        | TPROXY rule management.                                                                                                  |
 | zlib + build-essential          | Spicy and cgo builds.                                                                                                    |
-| clang / clang++                 | `Makefile` uses `CC=clang CXX=clang++`; CI installs clang 17.                                                            |
-| Spicy 1.13.1 under `/opt/spicy` | The cgo flags in `protocols/spicy/parser.go` expect headers under `/opt/spicy/include` and libraries under `/opt/spicy/lib`. |
+| clang-17 / clang++-17           | `Makefile` uses `CC=clang-17 CXX=clang++-17`; CI installs clang 17. Unversioned `clang` on Ubuntu 22.04 is often too old. |
+| Spicy 1.16.0 under `/opt/spicy` | The cgo flags in `protocols/spicy/parser.go` expect headers under `/opt/spicy/include` and libraries under `/opt/spicy/lib`. |
 
 ## Build
 
-CI runs on Ubuntu. Other distros need equivalent packages.
+CI runs on Ubuntu 24.04 (`ubuntu-latest`). Other distros need equivalent packages. Install the Spicy deb that matches your host release (`spicy_linux_ubuntu22.deb` on Ubuntu 22.04 / jammy, `spicy_linux_ubuntu24.deb` on Ubuntu 24.04).
 
 ```bash
 sudo apt-get update
-sudo apt-get install -y libpcap-dev iptables zlib1g-dev build-essential clang
+sudo apt-get install -y libpcap-dev iptables zlib1g-dev build-essential clang-17
 
-wget https://github.com/zeek/spicy/releases/download/v1.13.1/spicy_linux_ubuntu24.deb
+# Pick the deb for your Ubuntu release (example: 24.04 / CI):
+wget https://github.com/zeek/spicy/releases/download/v1.16.0/spicy_linux_ubuntu24.deb
+# On Ubuntu 22.04, use spicy_linux_ubuntu22.deb instead.
 sudo dpkg --install spicy_linux_ubuntu24.deb
 sudo apt-get install -f -y
 rm spicy_linux_ubuntu24.deb

protocols/spicy/Makefile

@@ -7,7 +7,7 @@ LINKER_CC := spicy_linker.cc
 HEADERS := $(patsubst parsers/%.spicy,parsers/%.h,$(GRAMMARS))
 
 SPICY_FLAGS := -g
-CXX ?= clang++
+CXX ?= clang++-17
 CXXFLAGS += -I/opt/spicy/include -std=c++20 -fPIC -O3 -DNDEBUG -fvisibility=hidden -I$(CURDIR)/parsers
 
 .SECONDARY: $(GEN_CC) $(LINKER_CC) $(HEADERS)

protocols/spicy/bridge.cpp

@@ -6,6 +6,7 @@
 #include <mutex>
 #include <sstream>
 #include <string>
+#include <string_view>
 #include <vector>
 
 // Concrete parser modules are registered through generated Spicy linker code.
@@ -150,8 +151,10 @@ static std::string scalar_to_string(const hilti::rt::type_info::Value& v) {
     case hilti::rt::TypeInfo::Bool:
         return T.bool_->get(v) ? "true" : "false";
 
-    case hilti::rt::TypeInfo::String:
-        return T.string->get(v);
+    case hilti::rt::TypeInfo::String: {
+        auto s = T.string->get(v);
+        return std::string(static_cast<std::string_view>(s));
+    }
 
     case hilti::rt::TypeInfo::Enum:
         return std::to_string(v);
@@ -339,7 +342,7 @@ ParsedData* spicy_parse_generic(const char* parser_name, const unsigned char* da
 
     try {
         spicy::rt::Driver drv;
-        auto parser = drv.lookupParser(parser_name);
+        auto parser = drv.lookupParser(hilti::rt::String(parser_name));
 
         if (!parser) {
             res->error_message = strdup_safe("parser not found");