feat(go): port socket detectors

go-agent/internal/detectors/socket.go

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package detectors
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+func stdioSocketInode(process model.Process) *int {
+	// The Python oracle checks descriptors in 0,1,2 order and stops at the
+	// first socket. That ordering avoids a map-iteration-dependent alert.
+	for _, fd := range []string{"0", "1", "2"} {
+		target := process.FDTargets[fd]
+		if strings.HasPrefix(target, "socket:[") && strings.HasSuffix(target, "]") {
+			value, err := strconv.Atoi(target[8 : len(target)-1])
+			if err == nil {
+				return &value
+			}
+		}
+	}
+	return nil
+}
+
+func optionalPythonInt(value *int) string {
+	// Python f-strings render a missing optional integer as "None". Keys are
+	// stable machine contracts, so preserve that spelling rather than Go's
+	// default <nil> representation.
+	if value == nil {
+		return "None"
+	}
+	return strconv.Itoa(*value)
+}
+
+func optionalDisplayInt(value *int) string {
+	// Human-facing stealth-network details use "?" for unknown ownership even
+	// though the corresponding dedup key uses Python's "None" spelling.
+	if value == nil || *value == 0 {
+		return "?"
+	}
+	return strconv.Itoa(*value)
+}
+
+func alertPIDs(value *int) []int {
+	if value == nil || *value == 0 {
+		return []int{}
+	}
+	return []int{*value}
+}
+
+func truncateRunes(value string, limit int) string {
+	// Python slices Unicode code points, not UTF-8 bytes. Rune truncation keeps
+	// command details identical for non-ASCII argv values.
+	runes := []rune(value)
+	if len(runes) <= limit {
+		return value
+	}
+	return string(runes[:limit])
+}
+
+func socketKey(kind string, socket model.Socket) string {
+	return fmt.Sprintf("stealthnet:%s:%s:%s:%s",
+		kind, optionalPythonInt(socket.PID), socket.Local, socket.Peer)
+}