feat(go): port socket detectors

go-agent/internal/detectors/egress.go

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package detectors
+
+import (
+	"fmt"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/netutil"
+)
+
+// Egress ports interpreter-to-public-IP detection (SID 100016).
+func Egress(state model.State, cfg config.Config) []model.Alert {
+	alerts := make([]model.Alert, 0)
+	for _, socket := range state.Sockets {
+		// Only established interpreter-owned sockets qualify. Listeners and
+		// connection setup states are handled by other detector families.
+		if socket.State != "ESTAB" || !cfg.Interpreters[socket.Comm] {
+			continue
+		}
+		host, port := netutil.SplitHostPort(socket.Peer)
+		// Private/special addresses and explicit trusted CIDRs are intentionally
+		// silent so routine local services and operator infrastructure stay quiet.
+		if !netutil.IsPublicIP(host) || netutil.IPInCIDRs(host, cfg.EgressAllowCIDRs) {
+			continue
+		}
+		alerts = append(alerts, model.Alert{
+			SID:       100016,
+			Severity:  "HIGH",
+			Signature: "egress",
+			Classtype: "c2-exfil",
+			Key:       fmt.Sprintf("egr:%s:%s", optionalPythonInt(socket.PID), host),
+			Detail: fmt.Sprintf(
+				"pid=%s comm=%s -> %s:%s (interpreter to public IP)",
+				optionalPythonInt(socket.PID), socket.Comm, host, port),
+			PIDs: alertPIDs(socket.PID),
+		})
+	}
+	return alerts
+}