luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port socket detectors

Browse source
This commit is contained in:
Luna 2026-07-10 17:29:07 -07:00
parent fc9b5f0448
commit c6f7219de8
23 changed files with 693 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

31
go-agent/internal/agent/agent_test.go
View file

@ -11,6 +11,8 @@ import (
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)
func intPointer(value int) *int { return &value }
func TestRunOnceEmitsAlertAndStatusEnvelopes(t *testing.T) {
agent := New(config.Default(), func() (model.State, error) {
return model.State{Processes: []model.Process{
@ -57,19 +59,34 @@ func TestSweepPreservesPythonDetectorOrder(t *testing.T) {
agent := New(config.Default(), func() (model.State, error) {
return model.State{
LDPreload: "/tmp/global.so",
Processes: []model.Process{{
PID: 42,
Comm: "dropper",
Exe: "/tmp/dropper (deleted)",
FDTargets: map[string]string{"4": "/etc/shadow", "7": "/dev/input/event3"},
}},
Processes: []model.Process{
{
PID: 42,
Comm: "dropper",
Exe: "/tmp/dropper (deleted)",
FDTargets: map[string]string{"4": "/etc/shadow", "7": "/dev/input/event3"},
},
{
PID: 100,
Comm: "bash",
Cmdline: "bash -i",
FDTargets: map[string]string{"0": "socket:[999]"},
},
},
Sockets: []model.Socket{
{State: "ESTAB", Local: "127.0.0.1:55", Peer: "9.9.9.9:443", Inode: intPointer(999), Comm: "bash", PID: intPointer(100), Kind: "tcp"},
{State: "ESTAB", Local: "10.0.0.2:5000", Peer: "8.8.8.8:4443", Comm: "hoxha", PID: intPointer(340), Kind: "sctp"},
},
}, nil
})
events, err := agent.Sweep()
if err != nil {
t.Fatal(err)
}
want := []string{"ld_preload", "deleted_exe", "input_snooper", "credential_access"}
want := []string{
"reverse_shell", "ld_preload", "deleted_exe", "input_snooper",
"credential_access", "stealth_network", "egress",
}
if len(events) != len(want)+1 {
t.Fatalf("unexpected events: %#v", events)
}