logpile/internal/privacy/rules.go

package privacy

import (
	"net"
	"regexp"
	"strings"

	"git.mchus.pro/mchus/logpile/internal/models"
)

const (
	severityHigh   = "high"
	severityMedium = "medium"
	severityLow    = "low"

	catDomain        = "domain"
	catResolv        = "resolv"
	catADLDAP        = "ad_ldap"
	catTimezone      = "timezone"
	catEmail         = "email"
	catPublicIP      = "public_ip"
	catCollector     = "collector"
	catCert          = "cert"
	catFRULocation   = "fru_location"
	catHostname      = "hostname"
	catDHCP          = "dhcp"
	catNSUpdate      = "nsupdate"
	catMgmtSubdomain = "mgmt_subdomain"
)

// tableRule is a simple line-regexp rule. group is the submatch index used as
// the reported token (0 = whole match).
type tableRule struct {
	category string
	severity string
	re       *regexp.Regexp
	group    int
	hint     string
}

var (
	// Match any dotted name ending in a 2-24 char alpha label; plausibleFQDN
	// then decides whether that final label is a real TLD.
	reFQDN         = regexp.MustCompile(`(?i)\b((?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,24})\b`)
	mgmtLabels     = map[string]struct{}{"mgmt": {}, "oob": {}, "ipmi": {}, "drac": {}, "idrac": {}, "ilo": {}, "bmc": {}}
	reIPv4         = regexp.MustCompile(`\b((?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3})\b`)
	reEmail        = regexp.MustCompile(`(?i)\b([a-z0-9._%+\-]+@[a-z0-9.\-]+\.[a-z]{2,})\b`)
	reSyslogTarget = regexp.MustCompile(`@((?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}:[0-9]{1,5})`)
	reTZName       = regexp.MustCompile(`\b((?:Africa|America|Antarctica|Asia|Atlantic|Australia|Europe|Indian|Pacific)/[A-Za-z_]+(?:/[A-Za-z_]+)?)\b`)
	reTZAbbr       = regexp.MustCompile(`\b(MSK|MSD|EEST|EET|MDST|CEST|CET|WEST|WET)\b\s+20\d\d`)
	// Kernel ring-buffer line: "[   12.345678] ..." or "[ 12.34][ T1] ...".
	// These carry driver/copyright strings (emails, versions), never customer id.
	reKernelTimestamp = regexp.MustCompile(`^\[\s*\d+\.\d+\]`)
	// Go panic / stack-trace lines: module-cache paths and "file.go:123" frames.
	reGoRuntime = regexp.MustCompile(`/go-mod/|\bgoroutine \d|\.go:\d+`)
	// A dotted quad sitting on a line that is talking about a version or a spec
	// clause, not a host.
	reVersionContext = regexp.MustCompile(`(?i)(\bversion|\bver\.?\b|_ver\b|fw[_ ]?ver|\brevision|vbios|firmware|\bbios\b|microcode|ucode|\bbuild\b|x\.?org|xserver|ieee|\bstd\b|clause|section|\brfc\b)`)
	// A TLD label written Title-case ("OS.It", "Rodolfo.Cn") is prose or mojibake,
	// not a real domain (real ones are lower- or all-upper-case).
	reTitlecaseTail = regexp.MustCompile(`\.[A-Z][a-z]+$`)

	tableRules = []tableRule{
		{catResolv, severityHigh, regexp.MustCompile(`(?i)^\s*(?:domain|search)\s+([a-z0-9][a-z0-9.\-]*\.[a-z0-9\-]+)`), 1,
			"resolv.conf DNS suffix - replace with example.local"},
		{catADLDAP, severityHigh, regexp.MustCompile(`(?i)\b(racdomain|adfilterdc[0-9]|rolegroup[0-9](?:name|domain))\s*=\s*(\S+)`), 2,
			"activedir.conf - AD domain / DC address / role-group name"},
		{catADLDAP, severityHigh, regexp.MustCompile(`(?i)\b(binddn|bindpw)\s*=\s*(\S+)`), 2,
			"ldap.conf - directory service-account bind"},
		{catTimezone, severityMedium, regexp.MustCompile(`(?i)\b(TimeZone|SELTimeUTCOffset)\s*=\s*(\S+)`), 2,
			"timezone reveals region - set Etc/UTC / offset 0"},
		{catCollector, severityMedium, regexp.MustCompile(`(?i)\b(SyslogHostname)\s*=\s*(\S+)`), 2,
			"customer syslog collector"},
		{catCollector, severityMedium, regexp.MustCompile(`(?i)"Destination"\s*:\s*"([^"]+)"`), 1,
			"SNMP trap / event destination"},
		{catFRULocation, severityMedium, regexp.MustCompile(`(?i)\b(Asset Tag|Product Location|Chassis Location|Board Extra)\b\s*[:=]\s*(.+)`), 2,
			"FRU site / inventory field"},
		{catNSUpdate, severityHigh, regexp.MustCompile(`(?i)\bupdate\s+(?:add|delete)\s+(\S+\.\S+)\s+.*\b(?:A|AAAA|PTR|CNAME)\b`), 1,
			"DDNS update - host FQDN + BMC record"},
		{catDHCP, severityMedium, regexp.MustCompile(`(?i)option\s+domain-name\s+"?([^";]+)`), 1,
			"domain-name handed out by customer DHCP"},
	}

	certLineRules = []tableRule{
		{catCert, severityHigh, regexp.MustCompile(`(?i)^\s*(?:Subject|Issuer):\s*(.+)`), 1, "TLS cert subject/issuer"},
		{catCert, severityHigh, regexp.MustCompile(`(?i)\bCN\s*=\s*([^,/]+)`), 1, "TLS cert common name"},
		{catCert, severityHigh, regexp.MustCompile(`(?i)\bDNS:\s*([a-z0-9.\-*]+)`), 1, "TLS cert SAN"},
	}
)

func scanLine(path, line string, ln int, certFile bool, emit func(models.PrivacyFinding)) {
	var local []models.PrivacyFinding
	specific := map[string]struct{}{} // matches from categories more precise than a bare FQDN
	noiseLine := reKernelTimestamp.MatchString(line) || reGoRuntime.MatchString(line)

	add := func(cat, sev, match, hint string) {
		match = strings.Trim(strings.TrimSpace(match), `"',;:`)
		if len(match) < 2 || !strings.ContainsFunc(match, isAlnum) || isAllowlistedValue(match) {
			return
		}
		if ip := net.ParseIP(match); ip != nil && !isSensitiveIP(match) {
			return
		}
		if cat == catFRULocation && !usefulFRUValue(match) {
			return
		}
		if cat != catDomain && cat != catEmail && cat != catPublicIP {
			specific[strings.ToLower(match)] = struct{}{}
		}
		local = append(local, models.PrivacyFinding{
			Category: cat, Severity: sev, Path: path, Line: ln,
			Match: match, Excerpt: excerpt(line), Hint: hint,
		})
	}

	for _, r := range tableRules {
		for _, m := range r.re.FindAllStringSubmatch(line, -1) {
			if r.group < len(m) {
				add(r.category, r.severity, m[r.group], r.hint)
			}
		}
	}

	if certFile {
		for _, r := range certLineRules {
			for _, m := range r.re.FindAllStringSubmatch(line, -1) {
				if r.group < len(m) {
					add(r.category, r.severity, m[r.group], r.hint)
				}
			}
		}
	}

	if !noiseLine {
		for _, idx := range reFQDN.FindAllStringSubmatchIndex(line, -1) {
			s, e := idx[2], idx[3]
			if !cleanTokenBoundary(line, s, e) {
				continue
			}
			fqdn := line[s:e]
			if isAllowlistedDomain(fqdn) || !plausibleFQDN(fqdn) || reTitlecaseTail.MatchString(fqdn) {
				continue
			}
			labels := strings.Split(strings.ToLower(fqdn), ".")
			cat, sev, hint := catDomain, severityLow, "domain / FQDN in the logs"
			if len(labels) >= 3 {
				sev = severityMedium // a real subdomain, not a stray two-word token
			}
			for _, lbl := range labels {
				if _, ok := mgmtLabels[lbl]; ok {
					cat, sev, hint = catMgmtSubdomain, severityHigh, "management-network subdomain"
					break
				}
			}
			add(cat, sev, fqdn, hint)
		}
	}
	if !noiseLine {
		for _, m := range reEmail.FindAllStringSubmatch(line, -1) {
			host := m[1][strings.IndexByte(m[1], '@')+1:]
			if isAllowlistedDomain(host) || !looksLikeMailHost(host) {
				continue
			}
			add(catEmail, severityMedium, m[1], "e-mail address")
		}
	}
	for _, m := range reSyslogTarget.FindAllStringSubmatch(line, -1) {
		add(catCollector, severityMedium, m[1], "remote syslog target")
	}
	commentLine := strings.HasPrefix(strings.TrimSpace(line), "#") || strings.HasPrefix(strings.TrimSpace(line), ";")
	if !noiseLine && !commentLine && !reVersionContext.MatchString(line) {
		for _, loc := range reIPv4.FindAllStringIndex(line, -1) {
			if inDottedNumberRun(line, loc[0], loc[1]) {
				continue // part of a longer version string like "18:6.1.4.5"
			}
			ip := line[loc[0]:loc[1]]
			if strings.HasSuffix(ip, ".0") || strings.HasPrefix(ip, "0.") || strings.HasPrefix(ip, "1.") {
				continue // network address, or a 0./1. version-style quad
			}
			if !isSensitiveIP(ip) {
				continue
			}
			add(catPublicIP, severityMedium, ip, "public IP reveals provider / site")
		}
	}
	if ll := strings.ToLower(line); strings.Contains(ll, "timezone") || strings.Contains(ll, "zoneinfo") || strings.Contains(ll, "localtime") || strings.Contains(ll, "tz=") {
		for _, m := range reTZName.FindAllStringSubmatch(line, -1) {
			if isAllowlistedValue(m[1]) {
				continue
			}
			add(catTimezone, severityMedium, m[1], "timezone reveals region - set Etc/UTC")
		}
	}
	for _, m := range reTZAbbr.FindAllStringSubmatch(line, -1) {
		add(catTimezone, severityLow, m[1], "localized timestamp reveals region")
	}

	for _, f := range local {
		if (f.Category == catDomain || f.Category == catEmail) && matchCoveredBySpecific(f.Match, specific) {
			continue
		}
		emit(f)
	}
}

func isAlnum(r rune) bool {
	return (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9')
}

// cleanTokenBoundary reports whether line[s:e] stands as its own token - not
// glued to surrounding identifier characters ("auth.backend.gssapi.store-creds",
// "mountall.sh [start]" is fine, "96.00.CF.00" is not) - so it reads as a
// hostname rather than a fragment of code, a path tail, or a version string.
func cleanTokenBoundary(line string, s, e int) bool {
	if s > 0 {
		switch c := line[s-1]; c {
		case ' ', '\t', '"', '\'', '(', '<', '=', ',', '@':
		case '/', ':':
			// ok (URL / "server = host:port"), but not a bare path segment
		default:
			return false
		}
	}
	if e < len(line) {
		switch line[e] {
		case ' ', '\t', '"', '\'', ')', '>', ',', ';', ':', '/', '\\', '?', '!':
		default:
			return false // trailing '.', '-', letter, digit -> mid-identifier
		}
	}
	return true
}

// inDottedNumberRun reports whether line[start:end] (a dotted quad) is embedded
// in a longer version-like run - "18:6.1.4.5", "v1.2.3.4", "1.2.3.4.5",
// "go1.25.0.linux" - rather than a standalone address.
func inDottedNumberRun(line string, start, end int) bool {
	if start > 0 {
		switch c := line[start-1]; {
		case c == '.', c == '-':
			return true
		case c == ':' && start >= 2 && line[start-2] >= '0' && line[start-2] <= '9':
			return true
		case c == 'v' || c == 'V':
			return true
		}
	}
	if end < len(line) && (line[end] == '.' || line[end] == '-') {
		return true
	}
	return false
}

// usefulFRUValue drops FRU asset/location values that carry no site information:
// the field name echoed back, an all-digit manufacturing code, or a string that
// is just the chassis serial (already in the archive name).
func usefulFRUValue(v string) bool {
	lv := strings.ToLower(strings.ReplaceAll(v, " ", ""))
	if strings.Contains(lv, "assettag") || strings.Contains(lv, "serialnumber") {
		return false
	}
	if len(v) < 4 {
		return false
	}
	digits, upperAlnum := 0, 0
	for _, r := range v {
		if r >= '0' && r <= '9' {
			digits++
		}
		if (r >= '0' && r <= '9') || (r >= 'A' && r <= 'Z') {
			upperAlnum++
		}
	}
	if digits == len(v) {
		return false // pure number: date/manufacturing code
	}
	if upperAlnum == len(v) && digits >= 4 {
		return false // looks like a serial number (7J..., 21D634070)
	}
	return true
}

// looksLikeMailHost rejects the many "local@identifier.token" strings that are
// not e-mail: OData/Redfish JSON annotations (Members@odata.count), SSH
// cipher/kex names (aes256-gcm@openssh.com is handled by the domain allowlist,
// but the shape is the same).
func looksLikeMailHost(host string) bool {
	h := strings.ToLower(host)
	if strings.Contains(h, "odata") || strings.Contains(h, "redfish") || strings.Contains(h, "message.") {
		return false
	}
	// systemd templated units ("serial-getty@ttyAMA0.service"), Go toolchain
	// pseudo-versions ("toolchain@v0.0.1-go1.25.0.linux") and the like all fail
	// the real-TLD check.
	return plausibleFQDN(h)
}

// matchCoveredBySpecific reports whether a bare FQDN/e-mail finding is already
// represented by a more precise finding on the same line (e.g. the resolv.conf
// "domain corp.acme.ru" line yields both a resolv and a domain hit).
func matchCoveredBySpecific(match string, specific map[string]struct{}) bool {
	m := strings.ToLower(match)
	if _, ok := specific[m]; ok {
		return true
	}
	if at := strings.IndexByte(m, '@'); at >= 0 {
		if _, ok := specific[m[at+1:]]; ok {
			return true
		}
	}
	return false
}