27 lines
938 B
Go
27 lines
938 B
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package detectors
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
func TestEgressPublicPrivateAndAllowlist(t *testing.T) {
|
|
state := model.State{Sockets: []model.Socket{
|
|
{State: "ESTAB", Peer: "8.8.8.8:443", Comm: "python3", PID: intPointer(500)},
|
|
{State: "ESTAB", Peer: "10.0.0.5:443", Comm: "python3", PID: intPointer(501)},
|
|
{State: "ESTAB", Peer: "9.9.9.9:443", Comm: "nginx", PID: intPointer(502)},
|
|
}}
|
|
alerts := Egress(state, config.Default())
|
|
if len(alerts) != 1 || alerts[0].SID != 100016 || alerts[0].Key != "egr:500:8.8.8.8" {
|
|
t.Fatalf("unexpected alerts: %#v", alerts)
|
|
}
|
|
cfg := config.Default()
|
|
cfg.EgressAllowCIDRs = []string{"8.8.8.0/24"}
|
|
if alerts := Egress(state, cfg); len(alerts) != 0 {
|
|
t.Fatalf("allowlisted egress alerted: %#v", alerts)
|
|
}
|
|
}
|