28d67a1360
Port the bash prototype to a structured, testable Python codebase while
preserving the same control loop and the seven detection signatures. The bash
implementation stays in src/ as the regression oracle.
Highlights:
- enodia_sentinel/ package (stdlib only — no runtime deps):
- detectors/ : one pure function per signature, detect(state, cfg)->Alerts
- system.py : SystemState — one cached /proc + ss snapshot per sweep,
fully injectable so detectors are unit-testable
- daemon.py : sweep loop, in-process cooldown dedup, threaded snapshot
capture, and a SUID filesystem scan moved OFF the loop
thread onto a slow background cadence
- snapshot.py: forensic text + JSON sidecar with per-signature IR guidance
- config.py : dataclass config via TOML + env overrides
- netutil.py : public-IP / CIDR logic via stdlib ipaddress
- tests/ : 25 stdlib-unittest cases (no root, no /proc, no ss needed)
- TOML config, launcher wrapper, Makefile (pip-free install), hardened
systemd unit (env-resolved ExecStart), updated PKGBUILD, rewritten README
Performance: per-sweep cost ~200 ms (shared cached state); the multi-second
SUID walk no longer blocks detection. scandir-based walk replaces os.walk.
Verified on Arch: all 7 detectors fire on red-team drills (reverse_shell,
ld_preload, deleted_exe, new_listener, new_suid confirmed live end-to-end),
no false positives on a clean sweep, 25/25 tests pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
62 lines
1.9 KiB
Python
62 lines
1.9 KiB
Python
"""Network address helpers, backed by the stdlib ``ipaddress`` module.
|
|
|
|
The bash prototype hand-rolled integer/CIDR math; here we lean on ``ipaddress``
|
|
for correct handling of private ranges, link-local, CGNAT, and IPv6.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import ipaddress
|
|
from collections.abc import Iterable
|
|
|
|
|
|
def parse_addr(addr: str) -> ipaddress._BaseAddress | None:
|
|
"""Parse an address that may carry a ``%iface`` zone or ``[..]`` brackets."""
|
|
if not addr:
|
|
return None
|
|
addr = addr.strip().strip("[]")
|
|
addr = addr.split("%", 1)[0] # drop IPv6 zone id
|
|
try:
|
|
return ipaddress.ip_address(addr)
|
|
except ValueError:
|
|
return None
|
|
|
|
|
|
def is_public_ip(addr: str) -> bool:
|
|
"""True if ``addr`` is a globally-routable address.
|
|
|
|
Excludes loopback, RFC1918 private, link-local, CGNAT (100.64/10), and
|
|
other non-global ranges — i.e. a connection to such an address is one that
|
|
actually leaves the host to the public internet.
|
|
"""
|
|
ip = parse_addr(addr)
|
|
if ip is None:
|
|
return False
|
|
return ip.is_global
|
|
|
|
|
|
def ip_in_cidrs(addr: str, cidrs: Iterable[str]) -> bool:
|
|
"""True if ``addr`` falls inside any CIDR in ``cidrs`` (the trust list)."""
|
|
ip = parse_addr(addr)
|
|
if ip is None:
|
|
return False
|
|
for cidr in cidrs:
|
|
cidr = cidr.strip()
|
|
if not cidr:
|
|
continue
|
|
try:
|
|
net = ipaddress.ip_network(cidr, strict=False)
|
|
except ValueError:
|
|
continue
|
|
if ip.version == net.version and ip in net:
|
|
return True
|
|
return False
|
|
|
|
|
|
def split_host_port(endpoint: str) -> tuple[str, str]:
|
|
"""Split an ``ss`` endpoint like ``10.0.0.2%eth0:443`` or ``[::1]:22``."""
|
|
endpoint = endpoint.strip()
|
|
if endpoint.startswith("["):
|
|
host, _, port = endpoint.partition("]")
|
|
return host.lstrip("["), port.lstrip(":")
|
|
host, _, port = endpoint.rpartition(":")
|
|
return host, port
|