baseline-rb 0.1.0 → 0.2.0

data/lib/baseline/rule.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+require_relative "acl"
+
+require "ctx_parser/immutable"
+
 module Baseline
   # 规则声明事实、比较方式和批准值类型；厂商语法仅由解析器负责。
   class Rule
@@ -7,15 +11,15 @@ module Baseline
     Definition = Data.define(:title, :fact, :operator, :value_type, :allowed_values) do
       # 冻结规则目录条目的事实、比较方式及批准值类型。
       def initialize(title:, fact:, operator:, value_type:, allowed_values: nil)
-        super(title: Baseline.immutable(title), fact: Baseline.immutable(fact), operator: Baseline.immutable(operator),
-          value_type: Baseline.immutable(value_type), allowed_values: Baseline.immutable(allowed_values))
+        super(title: CtxParser::Immutable.copy(title), fact: CtxParser::Immutable.copy(fact), operator: CtxParser::Immutable.copy(operator),
+          value_type: CtxParser::Immutable.copy(value_type), allowed_values: CtxParser::Immutable.copy(allowed_values))
       end
     end
 
     DEFINITIONS = {
       "snmp.enabled" => Definition.new(title: "SNMP 配置", fact: "snmp.enabled", operator: :equals, value_type: :boolean),
       "snmp.versions" => Definition.new(title: "SNMP 允许版本", fact: "snmp.versions", operator: :subset, value_type: :enum_set, allowed_values: %w[v1 v2c v3]),
-      "snmp.read_only" => Definition.new(title: "SNMP 禁止写权限", fact: "snmp.write_enabled", operator: :equals, value_type: :boolean),
+      "snmp.write_enabled" => Definition.new(title: "SNMP 写权限", fact: "snmp.write_enabled", operator: :equals, value_type: :boolean),
       "snmp.auth_priv" => Definition.new(title: "SNMPv3 认证与加密", fact: "snmp.v3_auth_priv", operator: :equals, value_type: :boolean),
       "snmp.acl_bound" => Definition.new(title: "SNMP 来源 ACL 引用", fact: "snmp.acl.bound", operator: :equals, value_type: :boolean),
       "snmp.acl_restricted" => Definition.new(title: "SNMP 来源 ACL 限制", fact: "snmp.acl.restricted", operator: :equals, value_type: :boolean),
@@ -35,7 +39,7 @@ module Baseline
       "management.acl_restricted" => Definition.new(title: "管理来源 ACL 限制", fact: "management.acl.restricted", operator: :equals, value_type: :boolean),
       "management.sources" => Definition.new(title: "管理批准来源", fact: "management.acl.sources", operator: :networks_within, value_type: :network_set),
       "services.disabled" => Definition.new(title: "关闭非必要服务", fact: "services", operator: :all_disabled, value_type: :enum_set, allowed_values: %w[telnet http https ftp tftp finger]),
-      "credentials.storage" => Definition.new(title: "凭据存储方式", fact: "credentials.storage_safe", operator: :equals, value_type: :boolean),
+      "credentials.storage" => Definition.new(title: "凭据安全存储", fact: "credentials.storage_safe", operator: :equals, value_type: :boolean),
       "credentials.strength" => Definition.new(title: "可观察口令强度", fact: "credentials.records", operator: :password_strength, value_type: :password_strength),
       "tacacs.minimum_servers" => Definition.new(title: "TACACS 服务器数量", fact: "tacacs.servers", operator: :count_at_least, value_type: :positive_integer),
       "tacacs.servers" => Definition.new(title: "TACACS 批准服务器", fact: "tacacs.servers", operator: :set_equals, value_type: :string_set),
@@ -60,12 +64,12 @@ module Baseline
           %w[low medium high critical].include?(options.fetch("severity", "medium"))
         raise ArgumentError, "Invalid baseline rule options"
       end
-      @id = Baseline.immutable(id)
+      @id = CtxParser::Immutable.copy(id)
       @title, @fact, @operator = definition.title, definition.fact, definition.operator
       @value_type, @allowed_values = definition.value_type, definition.allowed_values
-      @expected = Baseline.immutable(options["expected"])
-      @enabled, @severity = options.fetch("enabled", true), Baseline.immutable(options.fetch("severity", "medium"))
-      @applies_to = Baseline.immutable(options.fetch("applies_to", {}))
+      @expected = CtxParser::Immutable.copy(options["expected"])
+      @enabled, @severity = options.fetch("enabled", true), CtxParser::Immutable.copy(options.fetch("severity", "medium"))
+      @applies_to = CtxParser::Immutable.copy(options.fetch("applies_to", {}))
       validate_applicability!
       freeze
     end
@@ -86,7 +90,7 @@ module Baseline
       when :string_set, :network_set then string_set?(value)
       end
       raise ArgumentError, "Invalid baseline expected value for #{id}" unless valid
-      value.each { |network| Acl.range(network) } if value_type == :network_set
+      value.each { |network| Acl.address_range(network) } if value_type == :network_set
     end
 
     # 展示对象身份与状态，避免泄露原始回显或凭据。

data/lib/baseline/version.rb

@@ -2,5 +2,5 @@
 
 module Baseline
   # 公开包版本，供 RubyGems 元数据和运行时调用方共用。
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/baseline.rb

@@ -1,34 +1,4 @@
 # frozen_string_literal: true
 
 require_relative "baseline/version"
-
-require "ctx_parser/immutable"
-
-module Baseline
-  # 复制并冻结可序列化的基线事实，避免调用方修改策略或报告状态。
-  def self.immutable(value)
-    CtxParser::Immutable.copy(value)
-  rescue ArgumentError
-    raise ArgumentError, "Baseline values must be plain data"
-  end
-end
-
-require_relative "baseline/configuration"
-require_relative "baseline/document"
-require_relative "baseline/acl"
-require_relative "baseline/credential"
-require_relative "baseline/facts"
-require_relative "baseline/parsers/base"
-require_relative "baseline/parsers/comware"
-require_relative "baseline/parsers/h3c"
-require_relative "baseline/parsers/huawei"
-require_relative "baseline/parsers/cisco"
-require_relative "baseline/parsers/cisco_ios"
-require_relative "baseline/parsers/cisco_nxos"
-require_relative "baseline/parsers/hillstone"
-require_relative "baseline/parsers/palo_alto"
-require_relative "baseline/rule"
-require_relative "baseline/policy"
-require_relative "baseline/report"
-require_relative "baseline/evaluator"
 require_relative "baseline/audit"

data/policy.yml

@@ -5,7 +5,7 @@ version: 1
 checks:
   snmp.enabled: {expected: true}
   snmp.versions: {expected: [v3], severity: high}
-  snmp.read_only:
+  snmp.write_enabled:
     expected: false
     severity: high
     applies_to: {facts: {snmp.enabled: true}}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: baseline-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Gatework contributors
@@ -13,16 +13,16 @@ dependencies:
   name: ctx_parser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.2.0
 - !ruby/object:Gem::Dependency
   name: digest
   requirement: !ruby/object:Gem::Requirement
@@ -109,22 +109,22 @@ files:
 - lib/baseline.rb
 - lib/baseline/acl.rb
 - lib/baseline/audit.rb
+- lib/baseline/cisco/parser.rb
+- lib/baseline/cisco_ios/parser.rb
+- lib/baseline/cisco_nxos/parser.rb
+- lib/baseline/comware/parser.rb
 - lib/baseline/configuration.rb
 - lib/baseline/credential.rb
 - lib/baseline/document.rb
 - lib/baseline/evaluator.rb
 - lib/baseline/facts.rb
-- lib/baseline/hillstone_document.rb
-- lib/baseline/palo_alto_document.rb
-- lib/baseline/parsers/base.rb
-- lib/baseline/parsers/cisco.rb
-- lib/baseline/parsers/cisco_ios.rb
-- lib/baseline/parsers/cisco_nxos.rb
-- lib/baseline/parsers/comware.rb
-- lib/baseline/parsers/h3c.rb
-- lib/baseline/parsers/hillstone.rb
-- lib/baseline/parsers/huawei.rb
-- lib/baseline/parsers/palo_alto.rb
+- lib/baseline/h3c/parser.rb
+- lib/baseline/hillstone/document.rb
+- lib/baseline/hillstone/parser.rb
+- lib/baseline/huawei/parser.rb
+- lib/baseline/palo_alto/document.rb
+- lib/baseline/palo_alto/parser.rb
+- lib/baseline/parser.rb
 - lib/baseline/policy.rb
 - lib/baseline/quoted_document.rb
 - lib/baseline/report.rb

data/lib/baseline/hillstone_document.rb

@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "quoted_document"
-
-module Baseline
-  # StoneOS 导出内容可能包含命令回显、显式退出及引号包裹的界面状态。
-  class HillstoneDocument < QuotedDocument
-    protected
-
-    # 区分配置结构行与引号、横幅中的文本内容。
-    def classify(line)
-      unless @quote
-        return :ignored if line.text.match?(/\A(?:show (?:configuration|config)|Running configuration|Version\b|[\w.():-]+#\s*\z)/)
-        return :ignored if line.text == "exit"
-        return :boundary if line.text == "End"
-      end
-      super
-    end
-
-    # 识别配置值可能跨行延续的语句。
-    def multiline_fact?(text)
-      text.match?(/\A(?:hostname|admin host|snmp-server|ntp|logging syslog|password|secret|host|backup[12])\b/)
-    end
-  end
-end

data/lib/baseline/palo_alto_document.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "quoted_document"
-
-module Baseline
-  # PAN-OS 的 set 导出可能包含引号包裹的多行证书与描述。
-  class PaloAltoDocument < QuotedDocument
-    protected
-
-    # 已建模的多行值不能被误判为配置缺失；证书正文不参与语义分析。
-    def multiline_fact?(text)
-      /\Aset (?:deviceconfig system (?:hostname|service|permitted-ip|ntp-servers|snmp-setting|authentication-profile|route service)\b|shared (?:server-profile tacplus|authentication-profile|authentication-sequence|log-settings syslog)\b|mgt-config users\b|network profiles interface-management-profile\b)/.match?(text)
-    end
-  end
-end

data/lib/baseline/parsers/base.rb

@@ -1,256 +0,0 @@
-# frozen_string_literal: true
-
-require "ctx_parser/configuration_parser"
-require "ctx_parser/input"
-require_relative "../document"
-
-module Baseline
-  module Parsers
-    # 共享输入与提取边界；CtxParser 跟踪来源，Facts 归纳领域证据。
-    class Base < CtxParser::ConfigurationParser
-      SERVICE_PORTS = { "ssh" => 22, "telnet" => 23, "snmp" => 161, "snmptrap" => 162 }.freeze
-      SNMP_OPTIONS = %w[auth priv authentication-mode privacy-mode acl access use-ipv4acl group local engineid engineID
-        encrypted localizedkey localizedV2key remote udp-port].freeze
-
-      private
-
-      # 解释当前命令回显，保留不支持或格式错误的证据。
-      def parse_output(text, complete:)
-        begin
-          text = CtxParser::Input.text(text, encoding: :utf8, max_bytes: 16 * 1024 * 1024)
-        rescue ArgumentError, EncodingError
-          return CtxParser::Result.new(status: :failed, issues: [ { code: :invalid_configuration } ])
-        end
-        read_configuration(text, document_class: configuration_document_class)
-        issues = document.issues.dup
-        if (!complete || issues.any?) && exclude_incomplete_final_line
-          issues << { code: :incomplete_final_line, line: cursor.lines.last.number }
-        end
-        @source_issues = issues
-        @facts = Facts.new(complete: complete, issues: issues)
-        if roots.empty?
-          return CtxParser::Result.new(status: :failed, issues: issues + [ { code: :empty_configuration } ])
-        end
-        if (hostname = matching(hostname_pattern).last)
-          name = analyze(hostname) { hostname.text[hostname_pattern, 1] }
-          record("hostname", name)
-          capture(hostname, name, [ "facts", "hostname" ])
-        end
-        access_lists
-        management
-        services
-        authentication
-        @facts.result
-      end
-
-      # 返回本次解析的根配置块。
-      def roots = @blocks
-      # 选择适合当前平台语法的文档词法解析器。
-      def configuration_document_class = Document
-      # 匹配当前平台显式声明的主机名。
-      def hostname_pattern = /\A(?:hostname|sysname)\s+(\S+)\z/
-      # 选择符合目标命令语法的根配置块。
-      def sections(pattern) = roots.select { |entry| pattern.match?(entry.text) }
-
-      # 保留原始文本，但不将可能截断的词元纳入事实构建树。
-      def exclude_incomplete_final_line
-        line = cursor.lines.last
-        return false unless line && !line.raw.end_with?("\n", "\r") && cursor.state(line.index) != :ignored
-
-        entries, ancestors = roots, []
-        while (entry = entries.last)
-          if entry.index == line.index
-            retained = entries[0...-1].freeze
-            ancestors.reverse_each do |siblings, parent|
-              block = CtxParser::Block.new(cursor: cursor, header: parent.header, children: retained, last_index: parent.last_index)
-              retained = (siblings[0...-1] + [ block ]).freeze
-            end
-            @blocks = retained
-            cursor.mark(line.index, state: :unsupported)
-            return true
-          end
-          ancestors << [ entries, entry ]
-          entries = entry.children
-        end
-        false
-      end
-
-      # 筛选匹配已支持命令模式的来源条目。
-      def matching(pattern, entries = roots) = entries.select { |entry| pattern.match?(entry.text) }
-      # 提取匹配值，并关联对应的来源条目。
-      def values(pattern, entries = roots)
-        entries.filter_map do |entry|
-          value = entry.text[pattern, 1]
-          analyze(entry) { value } unless value.nil?
-        end.uniq
-      end
-
-      # 按配置顺序选取最后一条匹配声明。
-      def last(pattern, entries = roots)
-        entry = entries.reverse.find { |candidate| !candidate.text[pattern, 1].nil? }
-        return unless entry
-
-        analyze(entry) { entry.text[pattern, 1] }
-      end
-
-      # 保存归一化事实及其来源证据。
-      def record(path, value, entries = [])
-        return unless @facts.record(path, value, lines: entries.map(&:line))
-
-        # 来源块中尚未解释的命令不能标记为解析成功。
-        cursor.capture_many(entries.select { |entry| cursor.parsed?(entry.index) }, data: value, path: [ "facts", path ])
-      end
-
-      # 记录事实不可用的原因，并保留对应的来源行。
-      def unknown(path, entries = [], code: :unsupported_syntax)
-        @facts.unknown(path, lines: entries.map(&:line), code: code)
-        entries.each { |entry| cursor.mark(entry.index, state: :unsupported) }
-      end
-
-      # 未解析的访问声明不能抹除其他已确认的写权限。
-      def unknown_snmp_access(entries, code: :unsupported_syntax)
-        @facts.unknown_snmp_permission(lines: entries.map(&:line), code: code)
-        %w[snmp.communities snmp.community_present snmp.users snmp.versions snmp.v3_auth_priv snmp.acl].each do |path|
-          unknown(path, entries, code: code)
-        end
-      end
-
-      # 按来源顺序确定最终生效的显式启用或禁用声明。
-      def state(on, off, entries = roots)
-        entries.reduce(nil) do |value, entry|
-          if off.match?(entry.text)
-            analyze(entry) { false }
-          elsif on.match?(entry.text)
-            analyze(entry) { true }
-          else
-            value
-          end
-        end
-      end
-
-      # 记录凭据属性，不保留凭据秘密值。
-      def credential(owner, kind, format, secret, entry)
-        value = analyze(entry) { Credential.new(owner: owner, kind: kind, format: format, secret: secret, line: entry.line) }
-        index = @facts.credential(value)
-        capture(entry, value.to_h, [ "facts", "credentials.records", index ])
-      end
-
-      # 注册有序 ACL 规则与别名，同时保留不支持的语法。
-      def register_acl(name, entries, aliases: [], supported: true, source: nil, &block)
-        commands = entries.reject { |entry| /\A(?:\d+\s+)?(?:description|remark|step|statistics|hardware-count)\b/.match?(entry.text) }
-        parsed = commands.map.with_index do |entry, index|
-          value = analyze(entry) { block.call(entry, index) }
-          cursor.mark(entry.index, state: :unsupported) unless value
-          value
-        end
-        damaged = @source_issues.any? do |issue|
-          line = issue[:line]
-          next false unless line
-
-          source ? source.line_range.cover?(line) : damaged_numbered_acl?(cursor.lines.fetch(line - 1).text, name)
-        end
-        acl = Acl.new(name: name, line: entries.first&.line, rules: parsed.compact,
-          supported: supported && !damaged && parsed.none?(&:nil?))
-        if @facts.register_acl(acl, aliases: aliases, lines: entries.map(&:line)).any?
-          entries.each { |entry| cursor.mark(entry.index, state: :unsupported) }
-        end
-      end
-
-      # 名称被分页截断时，所有匹配其前缀的编号 ACL 都不能声明完整。
-      def damaged_numbered_acl?(text, name)
-        prefix = text.split(/--\s*More\s*--|\e\[/i, 2).first
-        match = /\Aaccess-list(?:\s+(\S*))?(.*)\z/.match(prefix)
-        return false unless match
-
-        identity, suffix = match.captures
-        identity.to_s.empty? || (suffix.empty? ? name.start_with?(identity) : name == identity)
-      end
-
-      # 归一化 ACL 来源地址；不推测不支持语法的含义。
-      def source(parts)
-        token = parts.shift
-        return "0.0.0.0/0" if token == "any"
-        token = parts.shift if token == "host"
-        wildcard = parts.shift if parts.first&.match?(/\A(?:\d+(?:\.\d+){3}|0)\z/)
-        Acl.source(token, wildcard)
-      end
-
-      # 显式端口名称仅属于配置语法，不代表组织批准值。
-      def service_port(token)
-        return SERVICE_PORTS[token] unless token&.match?(/\A\d+\z/)
-        value = token.to_i
-        value if value.between?(0, 65_535)
-      end
-
-      # 服务器目标只接受 IP 地址或 DNS 名称，不接受网段或空词元。
-      def server_address?(value)
-        return false unless value.is_a?(String) && !value.empty?
-        IPAddr.new(value)
-        !value.include?("/")
-      rescue IPAddr::Error
-        value.bytesize <= 253 && !/\A[\d.]+\z/.match?(value) && value.delete_suffix(".").split(".", -1).all? do |label|
-          /\A[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\z/i.match?(label)
-        end
-      end
-
-      # 配置的监听端口仅替代当前服务的默认端口。
-      def listener_port(command, default:, scope:, negate: "undo")
-        prefix = Regexp.escape(command)
-        entries = matching(/\A(?:#{negate} )?#{prefix}(?:\s|\z)/)
-        return default if entries.empty?
-        entry = entries.last
-        return analyze(entry) { default } if entry.text == "#{negate} #{command}"
-        token = entry.text[/\A#{prefix}\s+(\d+)\z/, 1]
-        port = service_port(token)
-        return analyze(entry) { port } if port && port.positive?
-        unknown_listener_port(scope, entries)
-        nil
-      end
-
-      # 监听端口无法解析时，将依赖该端口的事实保留为未知。
-      def unknown_listener_port(scope, entries)
-        %w[sources restricted].each { |field| unknown("#{scope}.#{field}", entries, code: :unsupported_service_port) }
-      end
-
-      # 区分模式未声明、格式无效及包含完整算法与秘密值的声明。
-      def snmp_secret(settings, keyword, algorithms:, optional_algorithm: false, aes_size: false)
-        tokens = settings.split
-        index = tokens.index(keyword)
-        return false unless index
-        return if tokens.count(keyword) > 1
-        parameters = tokens.drop(index + 1).take_while { |token| !SNMP_OPTIONS.include?(token) }
-        if algorithms.include?(parameters.first)
-          algorithm = parameters.shift
-        elsif !optional_algorithm || parameters.size != 1 || %w[aes des md5 sha].include?(parameters.first)
-          return
-        end
-        return if algorithm == "aes" && aes_size && !%w[128 192 256].include?(parameters.shift)
-        format = parameters.shift if %w[cipher simple].include?(parameters.first)
-        return unless parameters.size == 1
-        [ format, parameters.first ]
-      end
-
-      # 提取 SNMP 凭据属性，不持久化秘密值。
-      def snmp_credentials(owner, modes, entry, format: nil)
-        modes.each_value do |value|
-          next if value == false
-          stored_format, secret = value || [ "unknown", nil ]
-          credential(owner, "snmp_user", stored_format || format || "unknown", secret, entry)
-        end
-        unknown("snmp.v3_auth_priv", [ entry ], code: :invalid_snmp_security) if modes.value?(nil)
-        modes.transform_values { |value| value ? true : value }
-      end
-
-      # 同名组可出现在不同安全级别；后续只读声明不能消除已有写权限。
-      def snmp_groups(entries)
-        entries.map { |entry| yield(entry) }.group_by(&:first).transform_values do |definitions|
-          records = definitions.map(&:last)
-          acls = records.map { |record| record[:acl] }.uniq
-          { acl: acls.one? ? acls.first : nil, acl_ambiguous: acls.size > 1,
-            write: Facts.write_permission(records.map { |record| record[:write] }),
-            line: records.first[:line], lines: records.map { |record| record[:line] } }
-        end
-      end
-    end
-  end
-end