enodia-sentinal/go-agent/internal/config/config_test.go

112 lines
3.9 KiB
Go

// SPDX-License-Identifier: GPL-3.0-or-later
package config
import (
"os"
"path/filepath"
"testing"
"time"
)
func TestDefaultsMatchPython(t *testing.T) {
cfg := Default()
if cfg.SampleInterval != 4*time.Second || cfg.Cooldown != 60*time.Second ||
cfg.BaselineGrace != 10*time.Second ||
cfg.SUIDRefresh != time.Hour || cfg.SUIDScanInterval != time.Minute ||
cfg.HeartbeatMaxAge != 120 || cfg.MaxSnapshots != 300 ||
cfg.MaxSnapshotAgeDays != 60 || !cfg.FirstSeenEnabled {
t.Fatalf("unexpected defaults: %+v", cfg)
}
if !cfg.Enabled("deleted_exe") {
t.Fatal("deleted_exe must be enabled by default")
}
}
func TestLoadFlatTOMLAndMultilineDetectorArray(t *testing.T) {
path := filepath.Join(t.TempDir(), "sentinel.toml")
raw := []byte(`
sample_interval = 1.5 # seconds
cooldown = 30
baseline_grace = 2.5
suid_refresh = 120
suid_scan_interval = 15
heartbeat_max_age = 45
max_snapshots = 25
max_snapshot_age_days = 7
detectors = [
"deleted_exe",
"egress",
]
input_snooper_allow_comms = ["Xorg"]
credential_access_allow_comms = ["firefox"]
credential_access_extra_paths = ["/srv/secrets/"]
interpreters = ["bash", "python3"]
egress_allow_cidrs = ["203.0.113.0/24"]
listener_allow_ports = ["22"]
listener_allow_comms = ["syncthing"]
suppress_package_owned_listeners = true
first_seen_enabled = false
suid_hot_dirs = ["/tmp"]
suid_scan_extra_dirs = ["/dev/shm"]
watch_persistence = ["/etc/cron.d"]
stealth_network_allow_comms = ["tcpdump"]
stealth_network_allow_kinds = ["mptcp"]
memory_obfuscation_allow_comms = ["jit-runtime"]
memory_obfuscation_allow_paths = ["/tmp/known-profiler/"]
exec_rules_file = "/etc/enodia-extra-rules.toml"
unknown_future_key = true
`)
if err := os.WriteFile(path, raw, 0o600); err != nil {
t.Fatal(err)
}
cfg, err := Load(path)
if err != nil {
t.Fatal(err)
}
if cfg.SampleInterval != 1500*time.Millisecond || cfg.Cooldown != 30*time.Second ||
cfg.BaselineGrace != 2500*time.Millisecond ||
cfg.SUIDRefresh != 2*time.Minute || cfg.SUIDScanInterval != 15*time.Second ||
cfg.HeartbeatMaxAge != 45 || cfg.MaxSnapshots != 25 || cfg.MaxSnapshotAgeDays != 7 {
t.Fatalf("unexpected parsed config: %+v", cfg)
}
if !cfg.Enabled("deleted_exe") || !cfg.Enabled("egress") || cfg.Enabled("reverse_shell") {
t.Fatalf("unexpected detector set: %#v", cfg.Detectors)
}
if !cfg.InputSnooperAllowComms["Xorg"] || cfg.InputSnooperAllowComms["sway"] {
t.Fatalf("unexpected input allowlist: %#v", cfg.InputSnooperAllowComms)
}
if !cfg.CredentialAccessAllowComms["firefox"] || len(cfg.CredentialAccessExtraPaths) != 1 {
t.Fatalf("unexpected credential tuning: %#v %#v",
cfg.CredentialAccessAllowComms, cfg.CredentialAccessExtraPaths)
}
if !cfg.Interpreters["bash"] || len(cfg.EgressAllowCIDRs) != 1 {
t.Fatalf("unexpected network tuning: %#v %#v", cfg.Interpreters, cfg.EgressAllowCIDRs)
}
if !cfg.ListenerAllowPorts["22"] || !cfg.ListenerAllowComms["syncthing"] ||
!cfg.SuppressPackageOwnedListeners || cfg.FirstSeenEnabled || cfg.Enabled("first_seen") ||
len(cfg.SUIDHotDirs) != 1 || len(cfg.SUIDScanExtraDirs) != 1 ||
len(cfg.WatchPersistence) != 1 {
t.Fatalf("unexpected baseline tuning: %+v", cfg)
}
if !cfg.StealthNetworkAllowComms["tcpdump"] || !cfg.StealthNetworkAllowKinds["mptcp"] {
t.Fatalf("unexpected stealth tuning: %#v %#v",
cfg.StealthNetworkAllowComms, cfg.StealthNetworkAllowKinds)
}
if !cfg.MemoryObfuscationAllowComms["jit-runtime"] || len(cfg.MemoryObfuscationAllowPaths) != 1 ||
cfg.MemoryObfuscationAllowPaths[0] != "/tmp/known-profiler/" ||
cfg.ExecRulesFile != "/etc/enodia-extra-rules.toml" {
t.Fatalf("unexpected memory tuning: %#v %#v",
cfg.MemoryObfuscationAllowComms, cfg.MemoryObfuscationAllowPaths)
}
}
func TestMissingFileKeepsDefaults(t *testing.T) {
cfg, err := Load(filepath.Join(t.TempDir(), "missing.toml"))
if err != nil {
t.Fatal(err)
}
if !cfg.Enabled("deleted_exe") {
t.Fatal("missing config should retain defaults")
}
}