Mikhail ChusavitinandClaude Sonnet 5
4a4910f207
Detection-only scan (internal/privacy) attached to every AnalysisResult: a customer-domain guess plus a findings list (category, file, line, match, hint), ported from the KB grep playbook. Runs on archive uploads and the serialized Redfish tree; gated by LOGPILE_PRIVACY_SCAN (default on). Surfaced at GET /api/privacy-scan, in the "Customer data" UI panel, and as privacy_report.json in the raw-export bundle. IP policy keeps RFC1918 and example ranges out of findings; allowlist covers standards-body and vendor infrastructure domains. No customer tokens in the repo. See ADL-066 and bible-local/docs/privacy-scan.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
86 lines
2.4 KiB
Go
86 lines
2.4 KiB
Go
package ingest
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"git.mchus.pro/mchus/logpile/internal/collector"
|
|
"git.mchus.pro/mchus/logpile/internal/models"
|
|
"git.mchus.pro/mchus/logpile/internal/parser"
|
|
"git.mchus.pro/mchus/logpile/internal/privacy"
|
|
)
|
|
|
|
type Service struct{}
|
|
|
|
type RedfishSourceMetadata struct {
|
|
TargetHost string
|
|
SourceTimezone string
|
|
Filename string
|
|
}
|
|
|
|
func NewService() *Service {
|
|
return &Service{}
|
|
}
|
|
|
|
func (s *Service) AnalyzeArchivePayload(filename string, payload []byte) (*models.AnalysisResult, string, error) {
|
|
p := parser.NewBMCParser()
|
|
if err := p.ParseFromReader(bytes.NewReader(payload), filename); err != nil {
|
|
return nil, "", err
|
|
}
|
|
return p.Result(), p.DetectedVendor(), nil
|
|
}
|
|
|
|
func (s *Service) AnalyzeRedfishRawPayloads(rawPayloads map[string]any, meta RedfishSourceMetadata) (*models.AnalysisResult, string, error) {
|
|
result, err := collector.ReplayRedfishFromRawPayloads(rawPayloads, nil)
|
|
if err != nil {
|
|
return nil, "", err
|
|
}
|
|
if result == nil {
|
|
return nil, "", fmt.Errorf("redfish replay returned nil result")
|
|
}
|
|
if strings.TrimSpace(result.Protocol) == "" {
|
|
result.Protocol = "redfish"
|
|
}
|
|
if strings.TrimSpace(result.SourceType) == "" {
|
|
result.SourceType = models.SourceTypeAPI
|
|
}
|
|
if strings.TrimSpace(result.TargetHost) == "" {
|
|
result.TargetHost = strings.TrimSpace(meta.TargetHost)
|
|
}
|
|
if strings.TrimSpace(result.SourceTimezone) == "" {
|
|
result.SourceTimezone = strings.TrimSpace(meta.SourceTimezone)
|
|
}
|
|
if strings.TrimSpace(result.Filename) == "" {
|
|
if strings.TrimSpace(meta.Filename) != "" {
|
|
result.Filename = strings.TrimSpace(meta.Filename)
|
|
} else if target := strings.TrimSpace(result.TargetHost); target != "" {
|
|
result.Filename = "redfish://" + target
|
|
} else {
|
|
result.Filename = "redfish://snapshot"
|
|
}
|
|
}
|
|
if scan := scanRedfishTreePrivacy(rawPayloads); scan != nil {
|
|
result.PrivacyScan = scan
|
|
}
|
|
return result, "redfish", nil
|
|
}
|
|
|
|
// scanRedfishTreePrivacy runs the customer-data scan over the serialized Redfish
|
|
// tree (the only text corpus a live/replayed collection carries).
|
|
func scanRedfishTreePrivacy(rawPayloads map[string]any) *models.PrivacyScan {
|
|
if !parser.PrivacyScanEnabled() || rawPayloads == nil {
|
|
return nil
|
|
}
|
|
tree, ok := rawPayloads["redfish_tree"]
|
|
if !ok {
|
|
return nil
|
|
}
|
|
body, err := json.Marshal(tree)
|
|
if err != nil || len(body) == 0 {
|
|
return nil
|
|
}
|
|
return privacy.Scan([]privacy.File{{Path: "redfish_tree.json", Content: body}})
|
|
}
|