feat(go): advance validation sidecar toward production

go-agent/internal/detectors/first_seen_test.go

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package detectors
+
+import (
+	"testing"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+func TestFirstSeenAlertsNewDestinationAndListener(t *testing.T) {
+	pid := 42
+	cfg := config.Default()
+	alerts := FirstSeen(model.State{
+		FirstSeenInitialized:        true,
+		FirstSeenPublicDestinations: map[string][]string{"bash": {"1.1.1.1:443"}},
+		FirstSeenListenerPorts:      map[string][]string{"nc": {"22"}},
+		Sockets: []model.Socket{
+			{State: "ESTAB", Peer: "8.8.8.8:4443", Comm: "bash", PID: &pid},
+			{State: "LISTEN", Local: "0.0.0.0:31337", Comm: "nc", PID: &pid, Kind: "tcp"},
+		},
+	}, cfg)
+	if len(alerts) != 2 || alerts[0].SID != 100074 || alerts[1].SID != 100075 {
+		t.Fatalf("got %#v", alerts)
+	}
+}
+
+func TestFirstSeenUninitializedIsSilent(t *testing.T) {
+	cfg := config.Default()
+	state := model.State{
+		FirstSeenPublicDestinations: map[string][]string{},
+		FirstSeenListenerPorts:      map[string][]string{},
+		Sockets: []model.Socket{
+			{State: "ESTAB", Peer: "8.8.8.8:443", Comm: "bash"},
+			{State: "ESTAB", Peer: "8.8.8.8:443", Comm: "bash"},
+		},
+	}
+	if alerts := FirstSeen(state, cfg); len(alerts) != 0 {
+		t.Fatalf("got %#v", alerts)
+	}
+	if got := state.FirstSeenPublicDestinations["bash"]; len(got) != 1 || got[0] != "8.8.8.8:443" {
+		t.Fatalf("silent learning did not update state once: %#v", got)
+	}
+}