99 lines
3 KiB
Go
99 lines
3 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package agent
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
"time"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
func intPointer(value int) *int { return &value }
|
|
|
|
func TestRunOnceEmitsAlertAndStatusEnvelopes(t *testing.T) {
|
|
agent := New(config.Default(), func() (model.State, error) {
|
|
return model.State{Processes: []model.Process{
|
|
{PID: 42, Comm: "dropper", Exe: "/tmp/dropper (deleted)"},
|
|
}}, nil
|
|
})
|
|
agent.Host = func() (string, error) { return "host-a", nil }
|
|
agent.Now = func() time.Time {
|
|
return time.Date(2026, 7, 10, 0, 0, 0, 0, time.FixedZone("PDT", -7*3600))
|
|
}
|
|
var events []map[string]any
|
|
err := agent.Run(context.Background(), true, func(event map[string]any) error {
|
|
events = append(events, event)
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(events) != 2 || events[0]["event_type"] != "alert" || events[1]["event_type"] != "status" {
|
|
t.Fatalf("unexpected events: %#v", events)
|
|
}
|
|
alert := events[0]["alert"].(model.Alert)
|
|
if alert.SID != 100012 || alert.Detail != "pid=42 comm=dropper exe=[/tmp/dropper (deleted)]" {
|
|
t.Fatalf("unexpected alert payload: %#v", alert)
|
|
}
|
|
}
|
|
|
|
func TestDisabledDetectorEmitsStatusOnly(t *testing.T) {
|
|
cfg := config.Default()
|
|
cfg.Detectors = map[string]bool{}
|
|
agent := New(cfg, func() (model.State, error) {
|
|
return model.State{Processes: []model.Process{{PID: 42, Exe: "/tmp/x (deleted)"}}}, nil
|
|
})
|
|
events, err := agent.Sweep()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(events) != 1 || events[0]["event_type"] != "status" {
|
|
t.Fatalf("unexpected events: %#v", events)
|
|
}
|
|
}
|
|
|
|
func TestSweepPreservesPythonDetectorOrder(t *testing.T) {
|
|
agent := New(config.Default(), func() (model.State, error) {
|
|
return model.State{
|
|
LDPreload: "/tmp/global.so",
|
|
Processes: []model.Process{
|
|
{
|
|
PID: 42,
|
|
Comm: "dropper",
|
|
Exe: "/tmp/dropper (deleted)",
|
|
FDTargets: map[string]string{"4": "/etc/shadow", "7": "/dev/input/event3"},
|
|
},
|
|
{
|
|
PID: 100,
|
|
Comm: "bash",
|
|
Cmdline: "bash -i",
|
|
FDTargets: map[string]string{"0": "socket:[999]"},
|
|
},
|
|
},
|
|
Sockets: []model.Socket{
|
|
{State: "ESTAB", Local: "127.0.0.1:55", Peer: "9.9.9.9:443", Inode: intPointer(999), Comm: "bash", PID: intPointer(100), Kind: "tcp"},
|
|
{State: "ESTAB", Local: "10.0.0.2:5000", Peer: "8.8.8.8:4443", Comm: "hoxha", PID: intPointer(340), Kind: "sctp"},
|
|
},
|
|
}, nil
|
|
})
|
|
events, err := agent.Sweep()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
want := []string{
|
|
"reverse_shell", "ld_preload", "deleted_exe", "input_snooper",
|
|
"credential_access", "stealth_network", "egress",
|
|
}
|
|
if len(events) != len(want)+1 {
|
|
t.Fatalf("unexpected events: %#v", events)
|
|
}
|
|
for index, signature := range want {
|
|
alert := events[index]["alert"].(model.Alert)
|
|
if alert.Signature != signature {
|
|
t.Fatalf("event %d: got %s, want %s", index, alert.Signature, signature)
|
|
}
|
|
}
|
|
}
|