luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): advance validation sidecar toward production

Browse source
This commit is contained in:
Luna 2026-07-22 01:52:19 -07:00
parent 6a06eba255
commit f85c2e831a
No known key found for this signature in database
92 changed files with 8881 additions and 91 deletions
Download patch file Download diff file Expand all files Collapse all files

202
go-agent/internal/config/config.go
View file

@ -53,18 +53,33 @@ var defaultMemoryObfuscationAllowComms = []string{
// Config mirrors the Phase 1 settings consumed by the Go sweep loop. More
// fields are added as their detectors are ported.
type Config struct {
SampleInterval time.Duration
HeartbeatMaxAge int
Detectors map[string]bool
InputSnooperAllowComms map[string]bool
CredentialAccessAllowComms map[string]bool
CredentialAccessExtraPaths []string
Interpreters map[string]bool
EgressAllowCIDRs []string
StealthNetworkAllowComms map[string]bool
StealthNetworkAllowKinds map[string]bool
MemoryObfuscationAllowComms map[string]bool
MemoryObfuscationAllowPaths []string
SampleInterval time.Duration
Cooldown time.Duration
BaselineGrace time.Duration
SUIDRefresh time.Duration
SUIDScanInterval time.Duration
HeartbeatMaxAge int
MaxSnapshots int
MaxSnapshotAgeDays int
Detectors map[string]bool
InputSnooperAllowComms map[string]bool
CredentialAccessAllowComms map[string]bool
CredentialAccessExtraPaths []string
Interpreters map[string]bool
EgressAllowCIDRs []string
ListenerAllowPorts map[string]bool
ListenerAllowComms map[string]bool
SuppressPackageOwnedListeners bool
FirstSeenEnabled bool
SUIDHotDirs []string
SUIDScanExtraDirs []string
WatchPersistence []string
StealthNetworkAllowComms map[string]bool
StealthNetworkAllowKinds map[string]bool
MemoryObfuscationAllowComms map[string]bool
MemoryObfuscationAllowPaths []string
ExecRulesFile string
LogDir string
}
// Default returns Python-compatible defaults for the fields currently used.
@ -74,23 +89,46 @@ func Default() Config {
detectors[name] = true
}
return Config{
SampleInterval: 4 * time.Second,
HeartbeatMaxAge: 120,
Detectors: detectors,
InputSnooperAllowComms: stringSet(defaultInputSnooperAllowComms),
CredentialAccessAllowComms: stringSet(defaultCredentialAccessAllowComms),
CredentialAccessExtraPaths: []string{},
Interpreters: stringSet(defaultInterpreters),
EgressAllowCIDRs: []string{},
SampleInterval: 4 * time.Second,
Cooldown: 60 * time.Second,
BaselineGrace: 10 * time.Second,
SUIDRefresh: time.Hour,
SUIDScanInterval: time.Minute,
HeartbeatMaxAge: 120,
MaxSnapshots: 300,
MaxSnapshotAgeDays: 60,
Detectors: detectors,
InputSnooperAllowComms: stringSet(defaultInputSnooperAllowComms),
CredentialAccessAllowComms: stringSet(defaultCredentialAccessAllowComms),
CredentialAccessExtraPaths: []string{},
Interpreters: stringSet(defaultInterpreters),
EgressAllowCIDRs: []string{},
ListenerAllowPorts: map[string]bool{},
ListenerAllowComms: map[string]bool{},
SuppressPackageOwnedListeners: false,
FirstSeenEnabled: true,
SUIDHotDirs: []string{"/tmp", "/dev/shm", "/var/tmp", "/home", "/run/user"},
SUIDScanExtraDirs: []string{"/tmp", "/dev/shm", "/var/tmp", "/run/user"},
WatchPersistence: []string{
"/etc/cron.d", "/etc/crontab", "/etc/cron.daily", "/etc/cron.hourly",
"/etc/cron.weekly", "/var/spool/cron", "/etc/systemd/system",
"/etc/ld.so.preload", "/etc/passwd", "/etc/sudoers", "/etc/sudoers.d",
"/root/.ssh/authorized_keys", "/root/.bashrc", "/root/.profile",
},
StealthNetworkAllowComms: stringSet(defaultStealthNetworkAllowComms),
StealthNetworkAllowKinds: map[string]bool{},
MemoryObfuscationAllowComms: stringSet(defaultMemoryObfuscationAllowComms),
MemoryObfuscationAllowPaths: []string{},
ExecRulesFile: "",
LogDir: envOrDefault("ENODIA_LOG_DIR", "/var/log/enodia-sentinel"),
}
}
// Enabled reports whether a detector is enabled by configuration.
func (c Config) Enabled(name string) bool {
if name == "first_seen" && !c.FirstSeenEnabled {
return false
}
return c.Detectors[name]
}
@ -124,12 +162,48 @@ func Load(path string) (Config, error) {
return Config{}, fmt.Errorf("sample_interval must be positive: %q", value)
}
cfg.SampleInterval = time.Duration(seconds * float64(time.Second))
case "cooldown":
duration, err := nonNegativeSeconds(value)
if err != nil {
return Config{}, fmt.Errorf("cooldown: %w", err)
}
cfg.Cooldown = duration
case "baseline_grace":
duration, err := nonNegativeSeconds(value)
if err != nil {
return Config{}, fmt.Errorf("baseline_grace: %w", err)
}
cfg.BaselineGrace = duration
case "suid_refresh":
duration, err := positiveSeconds(value)
if err != nil {
return Config{}, fmt.Errorf("suid_refresh: %w", err)
}
cfg.SUIDRefresh = duration
case "suid_scan_interval":
duration, err := positiveSeconds(value)
if err != nil {
return Config{}, fmt.Errorf("suid_scan_interval: %w", err)
}
cfg.SUIDScanInterval = duration
case "heartbeat_max_age":
age, err := strconv.Atoi(value)
if err != nil || age < 0 {
return Config{}, fmt.Errorf("heartbeat_max_age must be non-negative: %q", value)
}
cfg.HeartbeatMaxAge = age
case "max_snapshots":
count, err := strconv.Atoi(value)
if err != nil || count < 0 {
return Config{}, fmt.Errorf("max_snapshots must be non-negative: %q", value)
}
cfg.MaxSnapshots = count
case "max_snapshot_age_days":
days, err := strconv.Atoi(value)
if err != nil || days < 0 {
return Config{}, fmt.Errorf("max_snapshot_age_days must be non-negative: %q", value)
}
cfg.MaxSnapshotAgeDays = days
case "detectors":
names, err := stringArray(value)
if err != nil {
@ -171,6 +245,48 @@ func Load(path string) (Config, error) {
return Config{}, fmt.Errorf("egress_allow_cidrs: %w", err)
}
cfg.EgressAllowCIDRs = cidrs
case "listener_allow_ports":
ports, err := stringArray(value)
if err != nil {
return Config{}, fmt.Errorf("listener_allow_ports: %w", err)
}
cfg.ListenerAllowPorts = stringSet(ports)
case "listener_allow_comms":
comms, err := stringArray(value)
if err != nil {
return Config{}, fmt.Errorf("listener_allow_comms: %w", err)
}
cfg.ListenerAllowComms = stringSet(comms)
case "suppress_package_owned_listeners":
enabled, err := boolean(value)
if err != nil {
return Config{}, fmt.Errorf("suppress_package_owned_listeners: %w", err)
}
cfg.SuppressPackageOwnedListeners = enabled
case "first_seen_enabled":
enabled, err := boolean(value)
if err != nil {
return Config{}, fmt.Errorf("first_seen_enabled: %w", err)
}
cfg.FirstSeenEnabled = enabled
case "suid_hot_dirs":
dirs, err := stringArray(value)
if err != nil {
return Config{}, fmt.Errorf("suid_hot_dirs: %w", err)
}
cfg.SUIDHotDirs = dirs
case "suid_scan_extra_dirs":
dirs, err := stringArray(value)
if err != nil {
return Config{}, fmt.Errorf("suid_scan_extra_dirs: %w", err)
}
cfg.SUIDScanExtraDirs = dirs
case "watch_persistence":
paths, err := stringArray(value)
if err != nil {
return Config{}, fmt.Errorf("watch_persistence: %w", err)
}
cfg.WatchPersistence = paths
case "stealth_network_allow_comms":
names, err := stringArray(value)
if err != nil {
@ -195,11 +311,57 @@ func Load(path string) (Config, error) {
return Config{}, fmt.Errorf("memory_obfuscation_allow_paths: %w", err)
}
cfg.MemoryObfuscationAllowPaths = paths
case "exec_rules_file":
path, err := strconv.Unquote(value)
if err != nil {
return Config{}, fmt.Errorf("exec_rules_file must be a string: %q", value)
}
cfg.ExecRulesFile = path
case "log_dir":
path, err := strconv.Unquote(value)
if err != nil || path == "" {
return Config{}, fmt.Errorf("log_dir must be a non-empty string: %q", value)
}
cfg.LogDir = path
}
}
return cfg, nil
}
func envOrDefault(name, fallback string) string {
if value := os.Getenv(name); value != "" {
return value
}
return fallback
}
func positiveSeconds(value string) (time.Duration, error) {
seconds, err := strconv.ParseFloat(value, 64)
if err != nil || seconds <= 0 {
return 0, fmt.Errorf("must be positive: %q", value)
}
return time.Duration(seconds * float64(time.Second)), nil
}
func nonNegativeSeconds(value string) (time.Duration, error) {
seconds, err := strconv.ParseFloat(value, 64)
if err != nil || seconds < 0 {
return 0, fmt.Errorf("must be non-negative: %q", value)
}
return time.Duration(seconds * float64(time.Second)), nil
}
func boolean(value string) (bool, error) {
switch value {
case "true":
return true, nil
case "false":
return false, nil
default:
return false, fmt.Errorf("must be true or false: %q", value)
}
}
func stringSet(values []string) map[string]bool {
result := make(map[string]bool, len(values))
for _, value := range values {

34
go-agent/internal/config/config_test.go
View file

@ -11,7 +11,11 @@ import (
func TestDefaultsMatchPython(t *testing.T) {
cfg := Default()
if cfg.SampleInterval != 4*time.Second || cfg.HeartbeatMaxAge != 120 {
if cfg.SampleInterval != 4*time.Second || cfg.Cooldown != 60*time.Second ||
cfg.BaselineGrace != 10*time.Second ||
cfg.SUIDRefresh != time.Hour || cfg.SUIDScanInterval != time.Minute ||
cfg.HeartbeatMaxAge != 120 || cfg.MaxSnapshots != 300 ||
cfg.MaxSnapshotAgeDays != 60 || !cfg.FirstSeenEnabled {
t.Fatalf("unexpected defaults: %+v", cfg)
}
if !cfg.Enabled("deleted_exe") {
@ -23,7 +27,13 @@ func TestLoadFlatTOMLAndMultilineDetectorArray(t *testing.T) {
path := filepath.Join(t.TempDir(), "sentinel.toml")
raw := []byte(`
sample_interval = 1.5 # seconds
cooldown = 30
baseline_grace = 2.5
suid_refresh = 120
suid_scan_interval = 15
heartbeat_max_age = 45
max_snapshots = 25
max_snapshot_age_days = 7
detectors = [
"deleted_exe",
"egress",
@ -33,10 +43,18 @@ credential_access_allow_comms = ["firefox"]
credential_access_extra_paths = ["/srv/secrets/"]
interpreters = ["bash", "python3"]
egress_allow_cidrs = ["203.0.113.0/24"]
listener_allow_ports = ["22"]
listener_allow_comms = ["syncthing"]
suppress_package_owned_listeners = true
first_seen_enabled = false
suid_hot_dirs = ["/tmp"]
suid_scan_extra_dirs = ["/dev/shm"]
watch_persistence = ["/etc/cron.d"]
stealth_network_allow_comms = ["tcpdump"]
stealth_network_allow_kinds = ["mptcp"]
memory_obfuscation_allow_comms = ["jit-runtime"]
memory_obfuscation_allow_paths = ["/tmp/known-profiler/"]
exec_rules_file = "/etc/enodia-extra-rules.toml"
unknown_future_key = true
`)
if err := os.WriteFile(path, raw, 0o600); err != nil {
@ -46,7 +64,10 @@ unknown_future_key = true
if err != nil {
t.Fatal(err)
}
if cfg.SampleInterval != 1500*time.Millisecond || cfg.HeartbeatMaxAge != 45 {
if cfg.SampleInterval != 1500*time.Millisecond || cfg.Cooldown != 30*time.Second ||
cfg.BaselineGrace != 2500*time.Millisecond ||
cfg.SUIDRefresh != 2*time.Minute || cfg.SUIDScanInterval != 15*time.Second ||
cfg.HeartbeatMaxAge != 45 || cfg.MaxSnapshots != 25 || cfg.MaxSnapshotAgeDays != 7 {
t.Fatalf("unexpected parsed config: %+v", cfg)
}
if !cfg.Enabled("deleted_exe") || !cfg.Enabled("egress") || cfg.Enabled("reverse_shell") {
@ -62,12 +83,19 @@ unknown_future_key = true
if !cfg.Interpreters["bash"] || len(cfg.EgressAllowCIDRs) != 1 {
t.Fatalf("unexpected network tuning: %#v %#v", cfg.Interpreters, cfg.EgressAllowCIDRs)
}
if !cfg.ListenerAllowPorts["22"] || !cfg.ListenerAllowComms["syncthing"] ||
!cfg.SuppressPackageOwnedListeners || cfg.FirstSeenEnabled || cfg.Enabled("first_seen") ||
len(cfg.SUIDHotDirs) != 1 || len(cfg.SUIDScanExtraDirs) != 1 ||
len(cfg.WatchPersistence) != 1 {
t.Fatalf("unexpected baseline tuning: %+v", cfg)
}
if !cfg.StealthNetworkAllowComms["tcpdump"] || !cfg.StealthNetworkAllowKinds["mptcp"] {
t.Fatalf("unexpected stealth tuning: %#v %#v",
cfg.StealthNetworkAllowComms, cfg.StealthNetworkAllowKinds)
}
if !cfg.MemoryObfuscationAllowComms["jit-runtime"] || len(cfg.MemoryObfuscationAllowPaths) != 1 ||
cfg.MemoryObfuscationAllowPaths[0] != "/tmp/known-profiler/" {
cfg.MemoryObfuscationAllowPaths[0] != "/tmp/known-profiler/" ||
cfg.ExecRulesFile != "/etc/enodia-extra-rules.toml" {
t.Fatalf("unexpected memory tuning: %#v %#v",
cfg.MemoryObfuscationAllowComms, cfg.MemoryObfuscationAllowPaths)
}