baseline-rb 0.1.0 → 0.2.0

data/lib/baseline/{parsers/hillstone.rb → hillstone/parser.rb}

@@ -1,30 +1,32 @@
 # frozen_string_literal: true
 
+require_relative "../parser"
+
 require "shellwords"
-require_relative "../hillstone_document"
+require_relative "document"
 
 module Baseline
-  module Parsers
+  module Hillstone
     # StoneOS 管理端点与原生主机允许列表不同于路由器 VTY。
-    class Hillstone < Base
+    class Parser < Baseline::Parser
       MANAGEMENT_SERVICES = %w[ssh telnet http https ftp snmp].freeze
       HOST_PROTOCOLS = %w[ssh telnet http https netconf any].freeze
 
       private
 
       # 选择适合当前平台语法的文档词法解析器。
-      def configuration_document_class = HillstoneDocument
+      def document_class = Document
 
-      # 解析管理访问暴露检查使用的有序 ACL 定义。
-      def access_lists
+      # 初始化当前配置的词元缓存，供各领域解析阶段共享。
+      def prepare_configuration
         @tokens = {}
       end
 
       # 已配置主机 ACL 本身不能证明管理监听服务已启用。
       def management
-        interfaces = sections(/\Ainterface\s+/)
+        interfaces = matching_blocks(/\Ainterface\s+/)
         states = interfaces.map do |section|
-          matching(/\A(?:no )?manage\s+/, section.children).each_with_object({}) do |entry, values|
+          matching_blocks(/\A(?:no )?manage\s+/, section.children).each_with_object({}) do |entry, values|
             parts = tokens(entry)
             negative = parts.first == "no"
             parts = parts.drop(1) if negative
@@ -48,7 +50,7 @@ module Baseline
 
       # 信任主机可使用 CIDR、掩码、区间或 any；跨协议按保守并集处理。
       def management_sources
-        entries = matching(/\A(?:no )?admin host\b/)
+        entries = matching_blocks(/\A(?:no )?admin host\b/)
         sources = entries.flat_map do |entry|
           parts = tokens(entry)
           raise ArgumentError unless parts.take(2) == %w[admin host] && HOST_PROTOCOLS.include?(parts.last)
@@ -76,7 +78,7 @@ module Baseline
 
       # 提取时间同步服务器及相关认证配置。
       def ntp
-        entries = matching(/\Antp server\b/)
+        entries = matching_blocks(/\Antp server\b/)
         sources = []
         servers = entries.filter_map do |entry|
           parts = tokens(entry)
@@ -93,14 +95,14 @@ module Baseline
           analyze(entry) { parts[2] }
         end
         record("ntp.servers", servers.uniq, entries)
-        record("ntp.authentication", state(/\Antp authentication\z/, /\Ano ntp authentication\z/))
+        record("ntp.authentication", configured_state(/\Antp authentication\z/, /\Ano ntp authentication\z/))
         record("ntp.source", sources.first) if sources.any? && sources.first && sources.uniq.one?
-        unknown("ntp", matching(/\Ano ntp server\b/)) if matching(/\Ano ntp server\b/).any?
+        unknown("ntp", matching_blocks(/\Ano ntp server\b/)) if matching_blocks(/\Ano ntp server\b/).any?
       end
 
       # 同一目标可供多个日志类别使用，统计时只计一次。
       def syslog
-        entries = matching(/\Alogging syslog\b/)
+        entries = matching_blocks(/\Alogging syslog\b/)
         sources = []
         servers = entries.filter_map do |entry|
           parts = tokens(entry)
@@ -123,13 +125,13 @@ module Baseline
         end
         record("syslog.servers", servers.uniq, entries)
         record("syslog.source", sources.first) if sources.any? && sources.first && sources.uniq.one?
-        unknown("syslog", matching(/\Ano logging syslog\b/)) if matching(/\Ano logging syslog\b/).any?
+        unknown("syslog", matching_blocks(/\Ano logging syslog\b/)) if matching_blocks(/\Ano logging syslog\b/).any?
       end
 
       # 轮询主机权限独立于出站 Trap 接收端。
       def snmp
-        record("snmp.enabled", state(/\Asnmp-server manager\z/, /\Ano snmp-server manager\z/))
-        entries = matching(/\Asnmp-server host\b/)
+        record("snmp.enabled", configured_state(/\Asnmp-server manager\z/, /\Ano snmp-server manager\z/))
+        entries = matching_blocks(/\Asnmp-server host\b/)
         versions, sources, communities = [], [], []
         entries.each do |entry|
           parts = tokens(entry)
@@ -139,7 +141,7 @@ module Baseline
           settings = parts.drop(offset + 1)
           if %w[1 2c].include?(settings.first) && settings[1] == "community" && !settings[2].to_s.empty? &&
               (settings.size == 3 || settings.size == 4 && %w[ro rw].include?(settings[3]))
-            credential("snmp-community", "snmp", secret_format(settings[2]), settings[2], entry)
+            record_credential("snmp-community", "snmp", secret_format(settings[2]), settings[2], entry)
             versions << (settings.first == "1" ? "v1" : "v2c")
             communities << { write: settings[3] == "rw", line: entry.line }
             sources.concat(networks)
@@ -154,7 +156,7 @@ module Baseline
           unknown_snmp_access([ entry ], code: :unsupported_snmp_host)
         end
         record("snmp.versions", versions.uniq, entries)
-        unsupported = matching(/\A(?:snmp-server (?:user|group)\b|no snmp-server (?:host|user|group)\b)/)
+        unsupported = matching_blocks(/\A(?:snmp-server (?:user|group)\b|no snmp-server (?:host|user|group)\b)/)
         unknown_snmp_access(unsupported, code: :unsupported_snmp_security) if unsupported.any? || versions.include?("v3")
         @facts.snmp(communities: communities, users: [])
         @facts.direct_acl(fact: "snmp.acl", sources: sources, bound: true, lines: entries.map(&:line)) if entries.any?
@@ -162,13 +164,13 @@ module Baseline
 
       # 分别记录 TACACS 定义与管理认证引用。
       def authentication
-        definitions = sections(/\Aaaa-server\s+/).filter_map do |section|
+        definitions = matching_blocks(/\Aaaa-server\s+/).filter_map do |section|
           parts = tokens(section)
           unless parts.size == 4 && parts[2..] == %w[type tacacs+]
             unknown("tacacs", [ section ]) if parts.include?("tacacs+")
             next
           end
-          endpoints = matching(/\A(?:host|backup[12])\b/, section.children)
+          endpoints = matching_blocks(/\A(?:host|backup[12])\b/, section.children)
           servers = endpoints.filter_map do |entry|
             values = tokens(entry)
             if server_address?(values[1]) && (values.size == 2 || values.size == 4 && values[2] == "vrouter")
@@ -178,7 +180,7 @@ module Baseline
               nil
             end
           end
-          secrets = matching(/\Asecret\b/, section.children)
+          secrets = matching_blocks(/\Asecret\b/, section.children)
           keys = secrets.map { |entry| stored_secret("tacacs:#{parts[1]}", "tacacs", entry) }
           [ parts[1], { servers: servers.uniq, keys_present: keys.any? && keys.all?, line: section.line,
             declaration: section.children.empty? } ]
@@ -197,7 +199,7 @@ module Baseline
         record("tacacs.servers", schemes.values.flat_map { |scheme| scheme[:servers] }.uniq)
         record("tacacs.keys_present", schemes.values.all? { |scheme| scheme[:keys_present] }) if schemes.any?
         { "authentication-server" => "login", "authorization-mode" => "authorization" }.each do |command, fact|
-          entries = matching(/\Aadmin #{command}\b/)
+          entries = matching_blocks(/\Aadmin #{command}\b/)
           next if entries.empty?
           parts = tokens(entries.last)
           name = parts[3] if parts.size == 4 && parts[2] == "aaa-server"
@@ -207,10 +209,10 @@ module Baseline
             unknown("tacacs.#{fact}", entries, code: :tacacs_scheme_unresolved)
           end
         end
-        sections(/\Aadmin user\s+/).each do |section|
+        matching_blocks(/\Aadmin user\s+/).each do |section|
           owner = tokens(section)[2]
-          passwords = matching(/\Apassword\b/, section.children)
-          credential(owner, "local_user", "unknown", nil, section) if passwords.empty?
+          passwords = matching_blocks(/\Apassword\b/, section.children)
+          record_credential(owner, "local_user", "unknown", nil, section) if passwords.empty?
           passwords.each { |entry| stored_secret(owner, "local_user", entry) }
         end
       end
@@ -224,11 +226,11 @@ module Baseline
         valid = parts.size == 1 && !%w[cipher hash plain].include?(parts.first) || parts.size == 2 && %w[cipher hash plain].include?(parts.first)
         unless valid && !parts.last.to_s.empty?
           @facts.incomplete!(code: :invalid_credential_statement, lines: [ entry.line ])
-          credential(owner, kind, "unknown", nil, entry)
+          record_credential(owner, kind, "unknown", nil, entry)
           return false
         end
         format, secret = parts.size == 2 && %w[cipher hash plain].include?(parts.first) ? parts : [ secret_format(parts.first.to_s), parts.first ]
-        credential(owner, kind, format, secret, entry)
+        record_credential(owner, kind, format, secret, entry)
         true
       end
 
@@ -264,7 +266,7 @@ module Baseline
         if parts.size == 3 && parts.first == "range"
           first, last = parts.drop(1).map { |value| IPAddr.new(value) }
           raise ArgumentError unless first.ipv4? && last.ipv4? && first.prefix == 32 && last.prefix == 32 && first.to_i <= last.to_i
-          Acl.networks([ [ first.to_i, last.to_i ] ])
+          Acl.network_prefixes([ [ first.to_i, last.to_i ] ])
         elsif parts.size == 1 || parts.size == 2
           value = IPAddr.new(parts.join("/"))
           raise ArgumentError unless value.ipv4?

data/lib/baseline/{parsers/huawei.rb → huawei/parser.rb}

@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
+require_relative "../comware/parser"
+
 module Baseline
-  module Parsers
+  module Huawei
     # 区分 Huawei VRP 的 AAA 嵌套、模板引用与 Comware 域语法。
-    class Huawei < Comware
+    class Parser < Comware::Parser
       private
 
       # 匹配当前平台显式启用 SSH 的命令。
@@ -21,10 +23,10 @@ module Baseline
       # 返回当前平台修改 SNMP 监听端口的命令模式。
       def snmp_port_command = "snmp-agent udp-port"
       # 从实际所属配置作用域中选取 AAA 声明。
-      def aaa_entries = sections(/\Aaaa\z/).flat_map(&:children)
+      def aaa_entries = matching_blocks(/\Aaaa\z/).flat_map(&:children)
       # 解析认证域引用及其服务器组。
       def authentication_domains
-        name = last(/\Adomain\s+(\S+)\s+admin\z/)
+        name = last_configured_value(/\Adomain\s+(\S+)\s+admin\z/)
         unless name
           %w[login authorization accounting].each { |kind| unknown("tacacs.#{kind}", code: :authentication_domain_unknown) }
           return []
@@ -35,26 +37,26 @@ module Baseline
       # 解析 VRP 认证域引用，避免将 VRP 语法应用到 Comware。
       def vrp_tacacs_references(kind, domains)
         domains.filter_map do |domain|
-          template = last(/\Ahwtacacs-server\s+(\S+)\z/, domain.children)
-          scheme = last(/\A#{kind}-scheme\s+(\S+)\z/, domain.children)
+          template = last_configured_value(/\Ahwtacacs-server\s+(\S+)\z/, domain.children)
+          scheme = last_configured_value(/\A#{kind}-scheme\s+(\S+)\z/, domain.children)
           next unless template && scheme
           definition = aaa_entries.find { |entry| entry.text == "#{kind}-scheme #{scheme}" }
           unless definition
             unknown("tacacs.#{kind == 'authentication' ? 'login' : kind}", [ domain ], code: :tacacs_scheme_unresolved)
             next
           end
-          template if last(/\A#{kind}-mode\s+(.+)\z/, definition.children).to_s.split.first == "hwtacacs"
+          template if last_configured_value(/\A#{kind}-mode\s+(.+)\z/, definition.children).to_s.split.first == "hwtacacs"
         end
       end
 
       # 提取本地账号角色及凭据存储属性。
       def accounts
-        matching(/\Alocal-user\s+\S+\s+password\b/, aaa_entries).each do |entry|
+        matching_blocks(/\Alocal-user\s+\S+\s+password\b/, aaa_entries).each do |entry|
           match = /\Alocal-user\s+(\S+)\s+password\s+(cipher|irreversible-cipher|simple)\s+(.+)\z/.match(entry.text)
           if match
-            credential(match[1], "local_user", match[2], match[3], entry)
+            record_credential(match[1], "local_user", match[2], match[3], entry)
           else
-            credential("local-user", "local_user", "unknown", nil, entry)
+            record_credential("local-user", "local_user", "unknown", nil, entry)
           end
         end
       end

data/lib/baseline/palo_alto/document.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require_relative "../quoted_document"
+
+module Baseline
+  module PaloAlto
+    # PAN-OS 的 set 导出可能包含引号包裹的多行证书与描述。
+    class Document < QuotedDocument
+      protected
+
+      # 已建模的多行值不能被误判为配置缺失；证书正文不参与语义分析。
+      def multiline_fact?(text)
+        /\Aset (?:deviceconfig system (?:hostname|service|permitted-ip|ntp-servers|snmp-setting|authentication-profile|route service)\b|shared (?:server-profile tacplus|authentication-profile|authentication-sequence|log-settings syslog)\b|mgt-config users\b|network profiles interface-management-profile\b)/.match?(text)
+      end
+    end
+  end
+end

data/lib/baseline/{parsers/palo_alto.rb → palo_alto/parser.rb}

@@ -1,24 +1,26 @@
 # frozen_string_literal: true
 
+require_relative "../parser"
+
 require "shellwords"
-require_relative "../palo_alto_document"
+require_relative "document"
 
 module Baseline
-  module Parsers
+  module PaloAlto
     # 将 PAN-OS set 语法归纳为与配置块平台一致的事实。
-    class PaloAlto < Base
+    class Parser < Baseline::Parser
       MANAGEMENT_SERVICES = %w[ssh telnet http https].freeze
       RELEVANT = /\Aset (?:deviceconfig system |network (?:profiles interface-management-profile |interface )|shared (?:server-profile tacplus |authentication-profile |authentication-sequence |log-settings syslog )|mgt-config users )/
 
       private
 
       # 选择适合当前平台语法的文档词法解析器。
-      def configuration_document_class = PaloAltoDocument
+      def document_class = Document
       # 匹配当前平台显式声明的主机名。
       def hostname_pattern = /\Aset deviceconfig system hostname\s+(\S+)\z/
 
       # 仅对管理配置子集分词一次，不处理无关的安全规则。
-      def access_lists
+      def prepare_configuration
         @statements = roots.filter_map do |entry|
           next unless RELEVANT.match?(entry.text)
           { entry: entry, tokens: Shellwords.shellsplit(entry.text).drop(1) }
@@ -187,7 +189,7 @@ module Baseline
             @facts.incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
             next
           end
-          credential("snmp-community", "snmp", secret_format(row[:tokens].last), row[:tokens].last, row[:entry])
+          record_credential("snmp-community", "snmp", secret_format(row[:tokens].last), row[:tokens].last, row[:entry])
           { write: false, line: row[:entry].line }
         end
         users_prefix = prefix + %w[v3 users]
@@ -202,7 +204,7 @@ module Baseline
               next
             end
             user[key] = !row[:tokens].last.empty?
-            credential("snmp:#{name}", "snmp_user", secret_format(row[:tokens].last), row[:tokens].last, row[:entry])
+            record_credential("snmp:#{name}", "snmp_user", secret_format(row[:tokens].last), row[:tokens].last, row[:entry])
           end
           user
         end
@@ -227,7 +229,7 @@ module Baseline
           keys = servers.values.map do |server|
             secret = server.reverse.find { |row| row[:tokens][6] == "secret" }
             value = secret && scalar(secret[:tokens].take(7))
-            credential("tacacs:#{name}", "tacacs", secret_format(value), value, secret[:entry]) if value
+            record_credential("tacacs:#{name}", "tacacs", secret_format(value), value, secret[:entry]) if value
             !value.to_s.empty?
           end
           [ name, { servers: addresses, keys_present: keys.any? && keys.all?, line: entries.first[:entry].line } ]
@@ -278,7 +280,7 @@ module Baseline
           row = entries.reverse.find { |entry| entry[:tokens][3] == "phash" }
           unless row
             external_profile = scalar([ "mgt-config", "users", name, "authentication-profile" ])
-            credential(name, "local_user", "unknown", nil, entries.first[:entry]) unless external_profile && !external_profile.empty?
+            record_credential(name, "local_user", "unknown", nil, entries.first[:entry]) unless external_profile && !external_profile.empty?
             next
           end
           secret = scalar(row[:tokens].take(4))
@@ -287,7 +289,7 @@ module Baseline
           else
             "unknown"
           end
-          credential(name, "local_user", format, secret, row[:entry])
+          record_credential(name, "local_user", format, secret, row[:entry])
         end
       end
 

data/lib/baseline/parser.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+require "ctx_parser/configuration"
+require "ctx_parser/input"
+require_relative "document"
+require_relative "facts"
+require_relative "credential"
+
+module Baseline
+  # 共享输入与提取边界；CtxParser 跟踪来源，Facts 归纳领域证据。
+  class Parser < CtxParser::Configuration
+    SERVICE_PORTS = { "ssh" => 22, "telnet" => 23, "snmp" => 161, "snmptrap" => 162 }.freeze
+    SNMP_OPTIONS = %w[auth priv authentication-mode privacy-mode acl access use-ipv4acl group local engineid engineID
+      encrypted localizedkey localizedV2key remote udp-port].freeze
+
+    private
+
+    # 解释当前命令回显，保留不支持或格式错误的证据。
+    def parse_output(text, complete:)
+      begin
+        text = CtxParser::Input.text(text, encoding: :utf8, max_bytes: 16 * 1024 * 1024)
+      rescue ArgumentError, EncodingError
+        return CtxParser::Result.new(status: :failed, issues: [ { code: :invalid_configuration } ])
+      end
+      read_configuration(text, document_class: document_class)
+      issues = document.issues.dup
+      if (!complete || issues.any?) && exclude_incomplete_final_line
+        issues << { code: :incomplete_final_line, line: cursor.lines.last.number }
+      end
+      @source_issues = issues
+      @facts = Facts.new(complete: complete, issues: issues)
+      if roots.empty?
+        return CtxParser::Result.new(status: :failed, issues: issues + [ { code: :empty_configuration } ])
+      end
+      prepare_configuration
+      if (hostname = matching_blocks(hostname_pattern).last)
+        name = analyze(hostname) { hostname.text[hostname_pattern, 1] }
+        record("hostname", name)
+        capture(hostname, name, [ "facts", "hostname" ])
+      end
+      access_lists
+      management
+      services
+      authentication
+      @facts.result
+    end
+
+    # 在领域解析前准备当前配置的词元和引用索引。
+    def prepare_configuration; end
+
+    # 不使用命名 ACL 的平台由原生管理来源声明提供事实。
+    def access_lists; end
+
+    # 返回本次解析的根配置块。
+    def roots = @blocks
+    # 选择适合当前平台语法的文档词法解析器。
+    def document_class = Document
+    # 匹配当前平台显式声明的主机名。
+    def hostname_pattern = /\A(?:hostname|sysname)\s+(\S+)\z/
+    # 保留原始文本，但不将可能截断的词元纳入事实构建树。
+    def exclude_incomplete_final_line
+      line = cursor.lines.last
+      return false unless line && !line.raw.end_with?("\n", "\r") && cursor.state(line.index) != :ignored
+
+      entries, ancestors = roots, []
+      while (entry = entries.last)
+        if entry.index == line.index
+          retained = entries[0...-1].freeze
+          ancestors.reverse_each do |siblings, parent|
+            block = CtxParser::Block.new(cursor: cursor, header: parent.header, children: retained, last_index: parent.last_index)
+            retained = (siblings[0...-1] + [ block ]).freeze
+          end
+          @blocks = retained
+          cursor.mark(line.index, state: :unsupported)
+          return true
+        end
+        ancestors << [ entries, entry ]
+        entries = entry.children
+      end
+      false
+    end
+
+    # 筛选匹配已支持命令模式的来源条目。
+    def matching_blocks(pattern, entries = roots) = entries.select { |entry| pattern.match?(entry.text) }
+    # 提取匹配值，并关联对应的来源条目。
+    def configured_values(pattern, entries = roots)
+      entries.filter_map do |entry|
+        value = entry.text[pattern, 1]
+        analyze(entry) { value } unless value.nil?
+      end.uniq
+    end
+
+    # 按配置顺序选取最后一条匹配声明。
+    def last_configured_value(pattern, entries = roots)
+      entry = entries.reverse.find { |candidate| !candidate.text[pattern, 1].nil? }
+      return unless entry
+
+      analyze(entry) { entry.text[pattern, 1] }
+    end
+
+    # 保存归一化事实及其来源证据。
+    def record(path, value, entries = [])
+      return unless @facts.record(path, value, lines: entries.map(&:line))
+
+      # 来源块中尚未解释的命令不能标记为解析成功。
+      cursor.capture_many(entries.select { |entry| cursor.parsed?(entry.index) }, data: value, path: [ "facts", path ])
+    end
+
+    # 记录事实不可用的原因，并保留对应的来源行。
+    def unknown(path, entries = [], code: :unsupported_syntax)
+      @facts.unknown(path, lines: entries.map(&:line), code: code)
+      entries.each { |entry| cursor.mark(entry.index, state: :unsupported) }
+    end
+
+    # 未解析的访问声明不能抹除其他已确认的写权限。
+    def unknown_snmp_access(entries, code: :unsupported_syntax)
+      @facts.unknown_snmp_permission(lines: entries.map(&:line), code: code)
+      %w[snmp.communities snmp.community_present snmp.users snmp.versions snmp.v3_auth_priv snmp.acl].each do |path|
+        unknown(path, entries, code: code)
+      end
+    end
+
+    # 按来源顺序确定最终生效的显式启用或禁用声明。
+    def configured_state(on, off, entries = roots)
+      entries.reduce(nil) do |value, entry|
+        if off.match?(entry.text)
+          analyze(entry) { false }
+        elsif on.match?(entry.text)
+          analyze(entry) { true }
+        else
+          value
+        end
+      end
+    end
+
+    # 记录凭据属性，不保留凭据秘密值。
+    def record_credential(owner, kind, format, secret, entry)
+      value = analyze(entry) { Credential.new(owner: owner, kind: kind, format: format, secret: secret, line: entry.line) }
+      index = @facts.record_credential(value)
+      capture(entry, value.to_h, [ "facts", "credentials.records", index ])
+    end
+
+    # 注册有序 ACL 规则与别名，同时保留不支持的语法。
+    def register_acl(name, entries, aliases: [], supported: true, source: nil, &block)
+      commands = entries.reject { |entry| /\A(?:\d+\s+)?(?:description|remark|step|statistics|hardware-count)\b/.match?(entry.text) }
+      parsed = commands.map.with_index do |entry, index|
+        value = analyze(entry) { block.call(entry, index) }
+        cursor.mark(entry.index, state: :unsupported) unless value
+        value
+      end
+      damaged = @source_issues.any? do |issue|
+        line = issue[:line]
+        next false unless line
+
+        source ? source.line_range.cover?(line) : damaged_numbered_acl?(cursor.lines.fetch(line - 1).text, name)
+      end
+      acl = Acl.new(name: name, line: entries.first&.line, rules: parsed.compact,
+        supported: supported && !damaged && parsed.none?(&:nil?))
+      if @facts.register_acl(acl, aliases: aliases, lines: entries.map(&:line)).any?
+        entries.each { |entry| cursor.mark(entry.index, state: :unsupported) }
+      end
+    end
+
+    # 名称被分页截断时，所有匹配其前缀的编号 ACL 都不能声明完整。
+    def damaged_numbered_acl?(text, name)
+      prefix = text.split(/--\s*More\s*--|\e\[/i, 2).first
+      match = /\Aaccess-list(?:\s+(\S*))?(.*)\z/.match(prefix)
+      return false unless match
+
+      identity, suffix = match.captures
+      identity.to_s.empty? || (suffix.empty? ? name.start_with?(identity) : name == identity)
+    end
+
+    # 归一化 ACL 来源地址；不推测不支持语法的含义。
+    def acl_source_network(parts)
+      token = parts.shift
+      return "0.0.0.0/0" if token == "any"
+      token = parts.shift if token == "host"
+      wildcard = parts.shift if parts.first&.match?(/\A(?:\d+(?:\.\d+){3}|0)\z/)
+      Acl.source_network(token, wildcard)
+    end
+
+    # 显式端口名称仅属于配置语法，不代表组织批准值。
+    def service_port(token)
+      return SERVICE_PORTS[token] unless token&.match?(/\A\d+\z/)
+      value = token.to_i
+      value if value.between?(0, 65_535)
+    end
+
+    # 服务器目标只接受 IP 地址或 DNS 名称，不接受网段或空词元。
+    def server_address?(value)
+      return false unless value.is_a?(String) && !value.empty?
+      IPAddr.new(value)
+      !value.include?("/")
+    rescue IPAddr::Error
+      value.bytesize <= 253 && !/\A[\d.]+\z/.match?(value) && value.delete_suffix(".").split(".", -1).all? do |label|
+        /\A[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\z/i.match?(label)
+      end
+    end
+
+    # 配置的监听端口仅替代当前服务的默认端口。
+    def listener_port(command, default:, scope:, negate: "undo")
+      prefix = Regexp.escape(command)
+      entries = matching_blocks(/\A(?:#{negate} )?#{prefix}(?:\s|\z)/)
+      return default if entries.empty?
+      entry = entries.last
+      return analyze(entry) { default } if entry.text == "#{negate} #{command}"
+      token = entry.text[/\A#{prefix}\s+(\d+)\z/, 1]
+      port = service_port(token)
+      return analyze(entry) { port } if port && port.positive?
+      unknown_listener_port(scope, entries)
+      nil
+    end
+
+    # 监听端口无法解析时，将依赖该端口的事实保留为未知。
+    def unknown_listener_port(scope, entries)
+      %w[sources restricted].each { |field| unknown("#{scope}.#{field}", entries, code: :unsupported_service_port) }
+    end
+
+    # 区分模式未声明、格式无效及包含完整算法与秘密值的声明。
+    def snmp_secret(settings, keyword, algorithms:, optional_algorithm: false, aes_size: false)
+      tokens = settings.split
+      index = tokens.index(keyword)
+      return false unless index
+      return if tokens.count(keyword) > 1
+      parameters = tokens.drop(index + 1).take_while { |token| !SNMP_OPTIONS.include?(token) }
+      if algorithms.include?(parameters.first)
+        algorithm = parameters.shift
+      elsif !optional_algorithm || parameters.size != 1 || %w[aes des md5 sha].include?(parameters.first)
+        return
+      end
+      return if algorithm == "aes" && aes_size && !%w[128 192 256].include?(parameters.shift)
+      format = parameters.shift if %w[cipher simple].include?(parameters.first)
+      return unless parameters.size == 1
+      [ format, parameters.first ]
+    end
+
+    # 提取 SNMP 凭据属性，不持久化秘密值。
+    def snmp_credentials(owner, modes, entry, format: nil)
+      modes.each_value do |value|
+        next if value == false
+        stored_format, secret = value || [ "unknown", nil ]
+        record_credential(owner, "snmp_user", stored_format || format || "unknown", secret, entry)
+      end
+      unknown("snmp.v3_auth_priv", [ entry ], code: :invalid_snmp_security) if modes.value?(nil)
+      modes.transform_values { |value| value ? true : value }
+    end
+
+    # 同名组可出现在不同安全级别；后续只读声明不能消除已有写权限。
+    def snmp_groups(entries)
+      entries.map { |entry| yield(entry) }.group_by(&:first).transform_values do |definitions|
+        records = definitions.map(&:last)
+        acls = records.map { |record| record[:acl] }.uniq
+        { acl: acls.one? ? acls.first : nil, acl_ambiguous: acls.size > 1,
+          write: Facts.write_permission(records.map { |record| record[:write] }),
+          line: records.first[:line], lines: records.map { |record| record[:line] } }
+      end
+    end
+  end
+end

data/lib/baseline/policy.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "rule"
+
 require "yaml"
 require "digest"
 require "json"
@@ -8,11 +10,11 @@ module Baseline
   # 按主机、型号、站点、角色或厂商选择批准值；缺少批准值时不回退到当前配置。
   class Policy
     SCOPES = Rule::CONTEXT_FIELDS
-    SELECTORS = Baseline.immutable(SCOPES.map { |scope| "by_#{scope}" } + [ "default" ])
+    SELECTORS = CtxParser::Immutable.copy(SCOPES.map { |scope| "by_#{scope}" } + [ "default" ])
     Resolution = Data.define(:value, :reason, :path) do
       # 冻结解析后的批准值、原因及策略选择路径。
       def initialize(value:, reason:, path:)
-        super(value: Baseline.immutable(value), reason: Baseline.immutable(reason), path: Baseline.immutable(path))
+        super(value: CtxParser::Immutable.copy(value), reason: CtxParser::Immutable.copy(reason), path: CtxParser::Immutable.copy(path))
       end
     end
     attr_reader :rules, :sha256

data/lib/baseline/report.rb

@@ -1,5 +1,10 @@
 # frozen_string_literal: true
 
+require_relative "configuration"
+
+require "ctx_parser/immutable"
+require "json"
+
 module Baseline
   # 分别报告评估结果与输入覆盖率；未知项不计分，也不视为合规。
   class Report
@@ -16,7 +21,7 @@ module Baseline
     Finding = Data.define(:id, :title, :severity, :status, :reason, :actual, :expected, :lines, :policy_path, :diagnostics, :details) do
       # 冻结单条检查结果的策略路径、诊断和支持细节。
       def initialize(policy_path: [], diagnostics: [], details: {}, **attributes)
-        super(**Baseline.immutable(attributes.merge(policy_path: policy_path, diagnostics: diagnostics, details: details)))
+        super(**CtxParser::Immutable.copy(attributes.merge(policy_path: policy_path, diagnostics: diagnostics, details: details)))
       end
 
       # 将稳定的结果原因代码转换为易读说明。
@@ -35,7 +40,7 @@ module Baseline
     def initialize(configuration:, policy_sha256:, findings:, context:)
       @configuration, @policy_sha256 = configuration, policy_sha256
       @findings = findings.dup.freeze
-      @context = Baseline.immutable(context)
+      @context = CtxParser::Immutable.copy(context)
       @counts = @findings.map(&:status).tally.freeze
       @applicable = @findings.reject { |finding| finding.status == :not_applicable }.freeze
       freeze
@@ -72,7 +77,7 @@ module Baseline
 
     # 限制摘要大小；完整事实由 to_h 提供，避免 ACL 或账号数量膨胀元数据。
     def summary
-      metadata.merge(configuration: { platform: configuration.platform, sha256: configuration.sha256, status: configuration.status,
+      metadata.merge(configuration: { platform: configuration.platform, sha256: configuration.sha256, status: configuration.status, input_complete: configuration.input_complete?,
         issue_counts: configuration.issues.map { |issue| issue[:code] }.tally },
         findings: findings.map(&:summary))
     end