feat(go): port socket detectors

go-agent/internal/detectors/reverse_shell_test.go

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package detectors
+
+import (
+	"testing"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+func intPointer(value int) *int { return &value }
+
+func TestReverseShellRequiresInterpreterAndNetworkInode(t *testing.T) {
+	state := model.State{
+		Processes: []model.Process{
+			{PID: 100, Comm: "bash", Cmdline: "bash -i", FDTargets: map[string]string{"0": "socket:[999]"}},
+			{PID: 101, Comm: "nginx", FDTargets: map[string]string{"0": "socket:[999]"}},
+			{PID: 102, Comm: "bash", FDTargets: map[string]string{"0": "socket:[777]"}},
+		},
+		Sockets: []model.Socket{{
+			State: "ESTAB", Local: "127.0.0.1:55", Peer: "9.9.9.9:443",
+			Inode: intPointer(999), Comm: "bash", PID: intPointer(100), Kind: "tcp",
+		}},
+	}
+	alerts := ReverseShell(state, config.Default())
+	if len(alerts) != 1 || alerts[0].SID != 100010 || alerts[0].Key != "rsh:100" {
+		t.Fatalf("unexpected alerts: %#v", alerts)
+	}
+	want := "pid=100 comm=bash stdio=net-socket peer=[127.0.0.1:55 -> 9.9.9.9:443] cmd=[bash -i]"
+	if alerts[0].Detail != want {
+		t.Fatalf("unexpected detail: %q", alerts[0].Detail)
+	}
+}