analyze performance upgrade

2026-09-23 08:01:49 +02:00
parent aabe35fead
commit 7f7b753350
51 changed files with 5827 additions and 1372 deletions
@@ -0,0 +1,65 @@
+"""Expected provider domains (cloud, CDN, OS, PKI).
+
+Used to lower severity, never to hide an observation. Extend with the
+ANALYZER_BENIGN_DOMAINS environment variable (comma-separated suffixes).
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Optional
+
+BENIGN_SUFFIXES: set[str] = {
+    # Apple
+    "apple.com", "aaplimg.com", "icloud.com", "apple-dns.net", "cdn-apple.com",
+    "mzstatic.com", "itunes-apple.com", "apple.map.fastly.net", "push.apple.com",
+    "ls-apple.com.akadns.net", "edge.apple", "apple-cloudkit.com",
+    # Akamai
+    "akadns.net", "akamai.net", "akamaiedge.net", "akamai.com", "akamaized.net",
+    "akamaihd.net",
+    # AWS
+    "amazonaws.com", "cloudfront.net", "awsstatic.com", "aws.dev", "amazon.com",
+    # Google / Firebase
+    "googleapis.com", "google.com", "gstatic.com", "ggpht.com", "youtube.com",
+    "crashlytics.com", "firebaseio.com", "firebase.com", "app-measurement.com",
+    "googleusercontent.com", "google-analytics.com", "doubleclick.net", "1e100.net",
+    "googlevideo.com", "gvt1.com", "gvt2.com",
+    # Apple analytics endpoint used by many apps
+    "app-analytics-services.com",
+    # CDNs
+    "fastly.net", "fbcdn.net", "cloudflare.com", "cloudflare.net",
+    "cloudflare-dns.com", "edgekey.net", "edgesuite.net", "llnwd.net", "cdn77.org",
+    "azureedge.net", "aliyuncs.com", "alicdn.com",
+    # Microsoft
+    "microsoft.com", "windows.net", "azure.com", "windowsupdate.com", "office.com",
+    "msftncsi.com", "live.com", "msftconnecttest.com", "office365.com",
+    # PKI / time
+    "digicert.com", "sectigo.com", "letsencrypt.org", "globalsign.com", "godaddy.com",
+    "ntp.org", "pool.ntp.org", "time.apple.com", "time.google.com", "time.windows.com",
+    # Reverse-DNS / special-use
+    "in-addr.arpa", "ip6.arpa", "resolver.arpa", "arpa", "local", "home.arpa",
+}
+
+
+def _load_extra() -> set[str]:
+    raw = os.environ.get("ANALYZER_BENIGN_DOMAINS", "")
+    return {s.strip().lower().lstrip(".") for s in raw.split(",") if s.strip()}
+
+
+_EXTRA = _load_extra()
+
+
+def is_benign(name: Optional[str]) -> bool:
+    """Whether a host name belongs to an expected provider."""
+    if not name:
+        return False
+    n = str(name).rstrip(".").lower()
+    return any(n == s or n.endswith("." + s) for s in BENIGN_SUFFIXES | _EXTRA)
+
+
+def benign_name_for_ip(ctx, ip: Optional[str]) -> Optional[str]:
+    """Return a benign provider name that resolved to the address, if any."""
+    for name in sorted(ctx.names_for_ip(ip)):
+        if is_benign(name):
+            return name
+    return None