84 lines
2.7 KiB
Go
84 lines
2.7 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package config
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestDefaultsMatchPython(t *testing.T) {
|
|
cfg := Default()
|
|
if cfg.SampleInterval != 4*time.Second || cfg.HeartbeatMaxAge != 120 {
|
|
t.Fatalf("unexpected defaults: %+v", cfg)
|
|
}
|
|
if !cfg.Enabled("deleted_exe") {
|
|
t.Fatal("deleted_exe must be enabled by default")
|
|
}
|
|
}
|
|
|
|
func TestLoadFlatTOMLAndMultilineDetectorArray(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "sentinel.toml")
|
|
raw := []byte(`
|
|
sample_interval = 1.5 # seconds
|
|
heartbeat_max_age = 45
|
|
detectors = [
|
|
"deleted_exe",
|
|
"egress",
|
|
]
|
|
input_snooper_allow_comms = ["Xorg"]
|
|
credential_access_allow_comms = ["firefox"]
|
|
credential_access_extra_paths = ["/srv/secrets/"]
|
|
interpreters = ["bash", "python3"]
|
|
egress_allow_cidrs = ["203.0.113.0/24"]
|
|
stealth_network_allow_comms = ["tcpdump"]
|
|
stealth_network_allow_kinds = ["mptcp"]
|
|
memory_obfuscation_allow_comms = ["jit-runtime"]
|
|
memory_obfuscation_allow_paths = ["/tmp/known-profiler/"]
|
|
unknown_future_key = true
|
|
`)
|
|
if err := os.WriteFile(path, raw, 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
cfg, err := Load(path)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if cfg.SampleInterval != 1500*time.Millisecond || cfg.HeartbeatMaxAge != 45 {
|
|
t.Fatalf("unexpected parsed config: %+v", cfg)
|
|
}
|
|
if !cfg.Enabled("deleted_exe") || !cfg.Enabled("egress") || cfg.Enabled("reverse_shell") {
|
|
t.Fatalf("unexpected detector set: %#v", cfg.Detectors)
|
|
}
|
|
if !cfg.InputSnooperAllowComms["Xorg"] || cfg.InputSnooperAllowComms["sway"] {
|
|
t.Fatalf("unexpected input allowlist: %#v", cfg.InputSnooperAllowComms)
|
|
}
|
|
if !cfg.CredentialAccessAllowComms["firefox"] || len(cfg.CredentialAccessExtraPaths) != 1 {
|
|
t.Fatalf("unexpected credential tuning: %#v %#v",
|
|
cfg.CredentialAccessAllowComms, cfg.CredentialAccessExtraPaths)
|
|
}
|
|
if !cfg.Interpreters["bash"] || len(cfg.EgressAllowCIDRs) != 1 {
|
|
t.Fatalf("unexpected network tuning: %#v %#v", cfg.Interpreters, cfg.EgressAllowCIDRs)
|
|
}
|
|
if !cfg.StealthNetworkAllowComms["tcpdump"] || !cfg.StealthNetworkAllowKinds["mptcp"] {
|
|
t.Fatalf("unexpected stealth tuning: %#v %#v",
|
|
cfg.StealthNetworkAllowComms, cfg.StealthNetworkAllowKinds)
|
|
}
|
|
if !cfg.MemoryObfuscationAllowComms["jit-runtime"] || len(cfg.MemoryObfuscationAllowPaths) != 1 ||
|
|
cfg.MemoryObfuscationAllowPaths[0] != "/tmp/known-profiler/" {
|
|
t.Fatalf("unexpected memory tuning: %#v %#v",
|
|
cfg.MemoryObfuscationAllowComms, cfg.MemoryObfuscationAllowPaths)
|
|
}
|
|
}
|
|
|
|
func TestMissingFileKeepsDefaults(t *testing.T) {
|
|
cfg, err := Load(filepath.Join(t.TempDir(), "missing.toml"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !cfg.Enabled("deleted_exe") {
|
|
t.Fatal("missing config should retain defaults")
|
|
}
|
|
}
|