main: add sinkhole-ip net-conn bug fix and enabled setting to protect agent from getting killed

agent.go

@@ -80,6 +80,7 @@ func Run(ctx context.Context, configFilePath string, hostDNSServer DNSServer,
 	InitGlobalFeatureFlags(config.APIURL, apiclient)
 	WriteLog("initialized global feature flags")
 	WriteLog("\n")
+	globalFlags := GetGlobalFeatureFlags()
 
 	globalBlocklistResponse, err := apiclient.getGlobalBlocklist()
 	globalBlocklist := NewGlobalBlocklist(globalBlocklistResponse)
@@ -253,6 +254,7 @@ func Run(ctx context.Context, configFilePath string, hostDNSServer DNSServer,
 			Pids:             getPidsOfInterest(),
 			Files:            []string{},
 			EnforceReadBlock: false,
+			EnforceKillBlock: !globalFlags.DisableKillEnforcement,
 			ApiConf: &armour.ApiConf{
 				APIURL:           config.APIURL,
 				Repo:             config.Repo,

global_feature_flags.go

@@ -14,6 +14,7 @@ type GlobalFeatureFlags struct {
 	AgentType                  string `json:"agent_type"`
 	EnableArmour               bool   `json:"enable_armour"`
 	EnableCustomDetectionRules bool   `json:"enable_custom_detection_rules"`
+	DisableKillEnforcement     bool   `json:"disable_kill_enforcement,omitempty"`
 }
 
 // GlobalFeatureFlagManager manages fetching and caching of global feature flags.

netmon.go

@@ -104,27 +104,32 @@ func (netMonitor *NetworkMonitor) handlePacket(attrs nflog.Attribute) {
 
 		cacheKey := fmt.Sprintf("%s:%s:%s", ipv4Address, port, status)
 		_, found := ipAddresses[cacheKey]
-		if !found {
-			ipAddresses[cacheKey] = true
+		if found {
+			netMonitor.netMutex.Unlock()
+			return
+		}
+		ipAddresses[cacheKey] = true
+		netMonitor.netMutex.Unlock()
+
+		if isSYN || isUDP {
+			if status == "Dropped" {
+
+				if ipv4Address != StepSecuritySinkHoleIPAddress { // Sinkhole IP address will be covered by DNS block
 
-			if isSYN || isUDP {
-				if status == "Dropped" {
 					netMonitor.ApiClient.sendNetConnection(netMonitor.CorrelationId, netMonitor.Repo,
 						ipv4Address, port, "", status, matchedPolicy, reason, timestamp, Tool{Name: Unknown, SHA256: Unknown})
 
 					logMessage := fmt.Sprintf("ip address dropped: %s", ipv4Address)
 					if reason != "" {
 						logMessage = fmt.Sprintf("%s, reason: %s", logMessage, reason)
 					}
+
 					go WriteLog(logMessage)
 
-					if ipv4Address != StepSecuritySinkHoleIPAddress { // Sinkhole IP address will be covered by DNS block
-						go WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Traffic to IP Address %s was blocked", ipv4Address))
-					}
+					go WriteAnnotation(fmt.Sprintf("StepSecurity Harden Runner: Traffic to IP Address %s was blocked", ipv4Address))
 				}
 			}
 		}
-		netMonitor.netMutex.Unlock()
 	}
 
 }