25 lines
977 B
Go
25 lines
977 B
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package detectors
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
func TestStealthNetworkSeverityAndAllowlist(t *testing.T) {
|
|
state := model.State{Sockets: []model.Socket{
|
|
{State: "ESTAB", Local: "10.0.0.2:5000", Peer: "8.8.8.8:4443", Comm: "hoxha", PID: intPointer(340), Kind: "sctp"},
|
|
{State: "UNCONN", Local: "*:eth0", Peer: "*", Comm: "tcpdump", PID: intPointer(341), Kind: "packet"},
|
|
{State: "ESTAB", Local: "10.0.0.2:5", Peer: "8.8.8.8:443", Comm: "curl", PID: intPointer(342), Kind: "tcp"},
|
|
}}
|
|
alerts := StealthNetwork(state, config.Default())
|
|
if len(alerts) != 1 || alerts[0].SID != 100036 || alerts[0].Severity != "HIGH" {
|
|
t.Fatalf("unexpected alerts: %#v", alerts)
|
|
}
|
|
if alerts[0].Key != "stealthnet:sctp:340:10.0.0.2:5000:8.8.8.8:4443" {
|
|
t.Fatalf("unexpected key: %s", alerts[0].Key)
|
|
}
|
|
}
|