luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port socket detectors

Browse source
This commit is contained in:
Luna 2026-07-10 17:29:07 -07:00
parent fc9b5f0448
commit c6f7219de8
23 changed files with 693 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

27
go-agent/internal/detectors/egress_test.go Normal file
View file

@ -0,0 +1,27 @@
// SPDX-License-Identifier: GPL-3.0-or-later
package detectors
import (
"testing"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)
func TestEgressPublicPrivateAndAllowlist(t *testing.T) {
state := model.State{Sockets: []model.Socket{
{State: "ESTAB", Peer: "8.8.8.8:443", Comm: "python3", PID: intPointer(500)},
{State: "ESTAB", Peer: "10.0.0.5:443", Comm: "python3", PID: intPointer(501)},
{State: "ESTAB", Peer: "9.9.9.9:443", Comm: "nginx", PID: intPointer(502)},
}}
alerts := Egress(state, config.Default())
if len(alerts) != 1 || alerts[0].SID != 100016 || alerts[0].Key != "egr:500:8.8.8.8" {
t.Fatalf("unexpected alerts: %#v", alerts)
}
cfg := config.Default()
cfg.EgressAllowCIDRs = []string{"8.8.8.0/24"}
if alerts := Egress(state, cfg); len(alerts) != 0 {
t.Fatalf("allowlisted egress alerted: %#v", alerts)
}
}