"""egress — an interpreter holding an outbound connection to a public IP.

C2 beacons and exfil phone home. A scripting interpreter (bash/python/perl/nc…)
with an established connection to a globally-routable address — that isn't in
the operator's trust list — is worth a look.
"""
from __future__ import annotations

from collections.abc import Iterator

from ..alert import Alert, Severity
from ..config import Config
from ..netutil import ip_in_cidrs, is_public_ip, split_host_port
from ..system import SystemState


def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
    for s in state.established_sockets():
        if s.comm not in cfg.interpreters:
            continue
        host, port = split_host_port(s.peer)
        if not is_public_ip(host):
            continue
        if ip_in_cidrs(host, cfg.egress_allow_cidrs):
            continue
        yield Alert(
            severity=Severity.HIGH,
            signature="egress",
            key=f"egr:{s.pid}:{host}",
            detail=(
                f"pid={s.pid} comm={s.comm} -> {host}:{port} "
                "(interpreter to public IP)"
            ),
            pids=(s.pid,) if s.pid else (),
        )