Mikhail ChusavitinandClaude Sonnet 5
551d8e450d
- Allowlist nvidia.com, mellanox.com, gnu.org, debian.org, ubuntu.com; the
common "not specified / not available" FRU placeholders.
- Reject matches with no alphanumeric or <2 chars (stray ":" from a dumped
resolv line), fru_location values that echo the field name ("Base Board
Asset Tag", "P1-DIMMA1_AssetTag"), IPv4 embedded in a version string
("18:6.1.4.5"), and e-mail on kernel ring-buffer lines (driver copyright).
- Customer guess: don't report a single-hit low-confidence domain at all -
"unidentified" beats guessing nvidia.com from a driver comment.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
91 lines
2.7 KiB
Go
91 lines
2.7 KiB
Go
package privacy
|
|
|
|
import (
|
|
"path"
|
|
"strings"
|
|
)
|
|
|
|
// Public infrastructure, documentation, and vendor-default values that are not
|
|
// customer leaks. These are reference data (RFC 2606 / 5737 names, well-known
|
|
// NTP pools, standards-body domains, factory defaults), not vendor-detection
|
|
// logic.
|
|
var (
|
|
allowlistedZones = []string{
|
|
"example.com", "example.net", "example.org", "example.local", "example.edu",
|
|
"foobar.edu", "issue.net",
|
|
"localhost", "localdomain", "local.lan",
|
|
"pool.ntp.org", "ntp.org", "nist.gov", "windows.com", "microsoft.com",
|
|
"dmtf.org", "iana.org", "openssl.org", "openssh.com", "openssh.org",
|
|
"libssh.org", "rsyslog.com", "adiscon.com", "redhat.com", "kernel.org",
|
|
"megarac.com", "ami.com", "commond.com",
|
|
"oasis-open.org", "w3.org", "xmlsoap.org", "purl.org", "ietf.org",
|
|
"nvidia.com", "mellanox.com", "gnu.org", "debian.org", "ubuntu.com",
|
|
"inspur.com", "inspurcloud.com", "inservice-iq.com", "ieisystem.com", "kaytus.com",
|
|
"jd.com", "jd.local", "jdcloud.com", "in-addr.arpa", "ip6.arpa", "arpa",
|
|
}
|
|
|
|
allowlistedValues = map[string]struct{}{
|
|
"asia/shanghai": {},
|
|
"etc/utc": {},
|
|
"utc": {},
|
|
"to be filled by o.e.m.": {},
|
|
"default string": {},
|
|
"unknown": {},
|
|
"n/a": {},
|
|
"none": {},
|
|
"null": {},
|
|
"0": {},
|
|
"0.0.0.0": {},
|
|
"not specified": {},
|
|
"not available": {},
|
|
"not present": {},
|
|
"unspecified": {},
|
|
"no asset tag": {},
|
|
"no asset information": {},
|
|
"empty": {},
|
|
"[empty]": {},
|
|
}
|
|
|
|
// Archive members that are vendor factory templates, not the active config.
|
|
allowlistedFilenameParts = []string{
|
|
"_tencent", "_jingdong", "_pdd", "_baidu", "_kuaishou", "_tianyiyun",
|
|
"_jd.", "syslog_jd", "snmptrapcfg", ".json_bak", "ntp_auto",
|
|
}
|
|
)
|
|
|
|
func isAllowlistedDomain(domain string) bool {
|
|
d := strings.ToLower(strings.TrimSuffix(strings.TrimSpace(domain), "."))
|
|
for _, z := range allowlistedZones {
|
|
if d == z || strings.HasSuffix(d, "."+z) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func isAllowlistedValue(v string) bool {
|
|
lv := strings.ToLower(strings.TrimSpace(v))
|
|
if _, ok := allowlistedValues[lv]; ok {
|
|
return true
|
|
}
|
|
return isAllowlistedDomain(v)
|
|
}
|
|
|
|
func isAllowlistedFilename(p string) bool {
|
|
lp := strings.ToLower(p)
|
|
for _, part := range allowlistedFilenameParts {
|
|
if strings.Contains(lp, part) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func isCertFilename(p string) bool {
|
|
switch strings.ToLower(path.Ext(p)) {
|
|
case ".pem", ".csr", ".crt", ".cer":
|
|
return true
|
|
}
|
|
return false
|
|
}
|