baseline-rb 0.1.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 53a9b192c6ad23a797b8079d847ec57b6decd1ea74bea3d0219658977dc52b53
-  data.tar.gz: b0a2a43555dec3c0567944ceef523efec372425f72fff529005f9e967b731ebf
+  metadata.gz: 2386adb307215040a989dccfcba29d403bd31f28d400cbb6ba9f34215c13e7bb
+  data.tar.gz: 975bc0b9e0136528a8af240d21fe623068ec334c3f444746ce84dcbc25e097e6
 SHA512:
-  metadata.gz: f78aab76915e2594de7bc858f773611746946a5ad3ecfdc4c5a994f9dec86d8953e8ec1eae1c53adbd01925902d484bb2236a20a3ba92ca603f01da8088d1e93
-  data.tar.gz: d1dabf597eb164f6bf720a65cf7d0086171e98c23d29d94c364445af5513403fc2cf983650123e0737124eebf7687ef889472ff2fc9ea6f6791d70cc912b2aff
+  metadata.gz: 81a940f8b6b82df076c2c1f541ee6b5f7e95154095ca3ccffc2b70580d129388d5ec40c6c6f9a926c30f813c31d5cc39f669f2c7f487dda94718954707e5f5f9
+  data.tar.gz: cc66c2181c786de9341533ae65caf8214d0e8d28d40628c7b22b9161e3189174144a38cb58f8599dd2b0848cc511b3ebb31a5634e807b957ef074201eee1624e

data/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 Changes to the public contract are recorded here. Versions follow Semantic Versioning.
 
+## 0.2.1 (2026-10-17)
+
+- Reject duplicate normalized context keys before policy selection; preserve source lines and cursor captures for scalar NTP and Syslog configuration facts.
+
+## 0.2.0 (2026-10-17)
+
+### Changed
+
+- Organize vendor parsers as `Baseline::<Vendor>::Parser`, with Hillstone and Palo Alto `Document` classes beside their parsers. Shared parsing uses `Baseline::Parser`, `Comware::Parser`, and `Cisco::Parser`; platform entry points load independently.
+- Rename extraction helpers and ACL/credential APIs to describe their purpose: `permitted_source_networks`, `source_network`, `address_range`, `network_prefixes`, `networks_within?`, and `record_credential`. Remove redundant immutable-data and range-subtraction wrappers.
+- Replace `snmp.read_only` with `snmp.write_enabled`. Set `expected: false` to prohibit writes. Old class names, methods, and rule keys have no compatibility aliases; update custom callers and policies.
+- Require `ctx_parser ~> 0.2.0` for the shared configuration API.
+
+### Fixed
+
+- Keep out-of-policy source findings unknown for incomplete ordered ACL input: an unseen earlier deny can change the permitted sources. Report caller input completeness separately from parser status.
+- Copy ACL names and management bindings without freezing or borrowing caller-owned strings.
+- Preserve NTP source and source-interface command recognition across the shared Cisco and Comware parser families.
+
+### Performance and verification
+
+- Compare IPv4 network unions and rejected sources with sorted scans, and index credential source lines to avoid quadratic lookups.
+- Add regression coverage, independent platform loading checks, and synthetic benchmarks. Verify installed default policy and compliance behavior outside the checkout.
+
 ## 0.1.0 (2026-10-16)
 
 ### Added

data/README-zh.md

@@ -21,7 +21,7 @@ gem "baseline-rb", require: "baseline"
 
 然后执行 `bundle install`；也可直接执行 `gem install baseline-rb`。Ruby 加载入口为 `baseline`，公开命名空间为 `Baseline`；gem 包名与 Ruby 命名空间分别维护。
 
-模块运行依赖：[`ctx_parser`](https://github.com/gatework/ctx_parser)。 gemspec 的运行依赖不添加版本约束；应用应提交自己的 `Gemfile.lock`，保持部署可复现。使用本库不需要启动 Rails 或配置兄弟模块的本地路径。
+模块运行依赖：[`ctx_parser`](https://github.com/gatework/ctx_parser)。 gemspec 要求 `ctx_parser ~> 0.2.0`，以使用共享配置解析 API；应用应提交自己的 `Gemfile.lock`，保持部署可复现。使用本库不需要启动 Rails 或配置兄弟模块的本地路径。
 
 发布产物和校验值见 [GitHub Releases](https://github.com/gatework/baseline-rb/releases)，已发布版本以 [RubyGems](https://rubygems.org/gems/baseline-rb) 为准。
 
@@ -65,8 +65,22 @@ puts report.to_text
 
 详细厂商语义、历史验证记录和 Motor 专用集成说明保留在[架构参考](docs/architecture-zh.md)。其中宿主集成代码需要 Motor，不属于独立 gem API。适配层位于 [Motor 仓库](https://github.com/gatework/motor/tree/main/backend/lib) 的 `backend/lib/baseline`、`backend/lib/vxlan` 和 `backend/lib/wireless`。
 
+## 领域术语
+
+`Facts` 汇总配置证据，`Policy` 提供批准值，`Evaluator` 生成合规判定。`Acl#permitted_source_networks` 按有序规则、协议和目标端口计算允许的 IPv4 来源网段：`nil` 表示证据未解决，`[]` 表示没有允许来源。`Facts#record_credential` 记录安全的凭据属性。部分证据可以证明确定违规，但不能证明合规。
+
+厂商代码按命名空间组织：`Baseline::Hillstone::Parser` 和 `Baseline::Hillstone::Document` 同放在 `baseline/hillstone/`；Palo Alto 使用相同布局。六个平台解析器复用 `Baseline::Parser`、`Comware::Parser` 或 `Cisco::Parser`。单个平台可用 `require "baseline/hillstone/parser"` 独立加载；完整评估入口仍为 `require "baseline"`。
+
+解析辅助方法直接描述提取意图：`matching_blocks`、`configured_values`、`last_configured_value`、`configured_state` 和 `acl_source_network`。SNMP 写权限规则统一为 `snmp.write_enabled`，禁止写入时配置 `expected: false`。自定义策略需迁移旧键 `snmp.read_only`；旧类名与规则键不保留兼容别名。
+
+上下文允许字符串或符号键，但归一化后重复的键会抛出 `ArgumentError`，避免依赖插入顺序选择设备策略。
+
+`complete: true` 表示调用方提供了完整快照。报告通过 `input_complete` 保留这项声明，与解析状态分别记录。不完整的有序 ACL 可能缺少更早的 deny，因此不能仅根据已见 permit 判断来源越界，此时保持 `unknown`。
+
 ## 开发与测试
 
+共享类按实际职责命名，平台信息放在命名空间中。直接对应设备命令的解析器保留文件名和类名。
+
 ```sh
 bundle install
 bundle exec rake
@@ -76,6 +90,8 @@ bundle exec rake build
 
 `bundle exec rake` 执行 RSpec、RuboCop 及离线示例。测试放在 `spec/`，沿用项目 RSpec 约定；样例采用合成或脱敏证据。新增解析格式时补充成功、不完整、不支持及非法输入回归。离线测试不代表所有设备版本均通过实机验证。
 
+运行 `bundle exec ruby -Ilib script/benchmark.rb` 可测量合成 ACL 覆盖比较、凭据来源行查询及越界来源报告；脚本报告三次运行的中位数，请在同一机器和 Ruby 版本下比较不同修订。
+
 使用声明的最低 Ruby 版本检查兼容性。方法用途统一使用简明中文注释；复杂实现还需说明业务规则、实现思路及关键分支。保持公开返回值与错误契约。真实回显和凭据不可进入示例、fixture、日志或发布包。
 
 ## 发布

data/README.md

@@ -21,7 +21,7 @@ gem "baseline-rb", require: "baseline"
 
 Then run `bundle install`, or install directly with `gem install baseline-rb`. The require path is `baseline` and the public namespace is `Baseline`; package names and Ruby namespaces are intentionally separate.
 
-Internal runtime dependencies: [`ctx_parser`](https://github.com/gatework/ctx_parser). The gemspec declares runtime dependencies without version constraints. Applications should commit their own `Gemfile.lock` to make deployments reproducible. No Rails boot or sibling checkout paths are required.
+Internal runtime dependencies: [`ctx_parser`](https://github.com/gatework/ctx_parser). The gemspec requires `ctx_parser ~> 0.2.0` for the shared configuration API. Applications should commit their own `Gemfile.lock` to make deployments reproducible. No Rails boot or sibling checkout paths are required.
 
 Release artifacts and checksums are available from [GitHub Releases](https://github.com/gatework/baseline-rb/releases). Check [RubyGems](https://rubygems.org/gems/baseline-rb) for published versions.
 
@@ -65,8 +65,22 @@ The library performs no device access, backup collection, remediation, or databa
 
 Detailed vendor behavior, historical validation notes, and Motor-only integration are preserved in [the architecture reference](docs/architecture-zh.md). Host integration examples in that reference require Motor; they are not standalone gem APIs. Motor adapters live under `backend/lib/baseline`, `backend/lib/vxlan`, and `backend/lib/wireless` in the [Motor repository](https://github.com/gatework/motor/tree/main/backend/lib).
 
+## Domain vocabulary
+
+`Facts` assembles configuration evidence; `Policy` supplies approved values; `Evaluator` produces compliance findings. `Acl#permitted_source_networks` returns the IPv4 networks permitted by ordered rules for a protocol and destination port: `nil` means unresolved evidence, while `[]` means no permitted sources. `Facts#record_credential` records safe credential attributes. Partial evidence may establish a conclusive violation, but cannot establish compliance.
+
+Vendor-specific code lives in a vendor namespace: `Baseline::Hillstone::Parser` and `Baseline::Hillstone::Document` reside in `baseline/hillstone/`; Palo Alto uses the same layout. The six platform parsers inherit shared behavior from `Baseline::Parser`, `Comware::Parser`, or `Cisco::Parser`. Load only one platform with `require "baseline/hillstone/parser"`, or load the assessment API with `require "baseline"`.
+
+Parser helpers describe the evidence they extract: `matching_blocks`, `configured_values`, `last_configured_value`, `configured_state`, and `acl_source_network`. SNMP write permission uses the policy key `snmp.write_enabled` (`expected: false` to prohibit writes). Update custom policies that used `snmp.read_only`; old class names and rule keys have no compatibility aliases.
+
+Context accepts string or symbol keys, but rejects duplicate keys after normalization with `ArgumentError` rather than selecting a device policy by insertion order.
+
+`complete: true` asserts that the caller supplied the entire snapshot. Reports retain that assertion as `input_complete`, separately from parser status. A partial ordered ACL cannot prove an out-of-policy source: an unseen earlier deny may change its meaning, so the finding stays `unknown`.
+
 ## Development and tests
 
+Name shared classes by their responsibility and use the namespace for platform context. Preserve filenames and class names that directly match device commands.
+
 ```sh
 bundle install
 bundle exec rake
@@ -76,6 +90,8 @@ bundle exec rake build
 
 `bundle exec rake` runs RSpec, RuboCop, and the offline examples. Tests live in `spec/`, following the existing project's RSpec convention; fixtures use synthetic or sanitized evidence. Add regression cases for successful, incomplete, unsupported, and malformed inputs when extending a parser. Offline tests do not certify all device versions or replace live integration checks.
 
+Run `bundle exec ruby -Ilib script/benchmark.rb` for synthetic network-coverage, credential-lookup, and rejected-source report timings. It reports the median of three runs at two input sizes; compare revisions on the same runtime and machine.
+
 Use the declared minimum Ruby version for compatibility checks. Document source methods and non-obvious business logic in concise Chinese, preserve public return/error contracts, and never add raw device captures or credentials to examples, fixtures, logs, or release archives.
 
 ## Release

data/docs/architecture-zh.md

@@ -27,11 +27,11 @@ flowchart LR
 | 对象 | 职责 |
 | --- | --- |
 | `Audit` | 纯文本入口，选择厂商解析器并组织判定 |
-| `Parsers::Base < CtxParser::ConfigurationParser` | 输入边界、语法提取；通过公共 `analyze` / `capture` 管理逐行状态和来源 |
-| `Parsers::Comware` / `Parsers::Cisco` | 分别共享 Comware/VRP 与 IOS/NX-OS 的语法族 |
-| `Parsers::H3c` / `Huawei` / `CiscoIos` / `CiscoNxos` / `Hillstone` / `PaloAlto` | 厂商差异，不把厂商分支散落到规则求值中 |
+| `Parser < CtxParser::Configuration` | 输入边界、语法提取；通过公共 `analyze` / `capture` 管理逐行状态和来源 |
+| `Comware::Parser` / `Cisco::Parser` | 分别共享 Comware/VRP 与 IOS/NX-OS 的语法族 |
+| `H3c::Parser` / `Huawei::Parser` / `CiscoIos::Parser` / `CiscoNxos::Parser` / `Hillstone::Parser` / `PaloAlto::Parser` | 厂商差异，不把厂商分支散落到规则求值中 |
 | `Document < CtxParser::Document` | 使用公共游标和缩进树，隔离 banner、接口子配置及不完整输入 |
-| `QuotedDocument` / `HillstoneDocument` / `PaloAltoDocument` | 隔离跨行字符串、证书和 UI 数据，保留厂商命令边界；注释和 banner 不参与字符串扫描 |
+| `QuotedDocument` / `Hillstone::Document` / `PaloAlto::Document` | 隔离跨行字符串、证书和 UI 数据，保留厂商命令边界；注释和 banner 不参与字符串扫描 |
 | `Facts` | 每次解析独享的事实集合，归约 VTY、SNMP 组引用、命名 ACL 与原生来源列表、凭据；输出独立的结果快照 |
 | `Configuration` | 不可变事实、输入指纹、完整性和局部解析诊断 |
 | `Acl` | IPv4 地址区间与有序规则，按首次匹配计算允许来源 |
@@ -43,9 +43,9 @@ flowchart LR
 
 独立 Ruby 调用只需加载 `baseline`；`Check` 由 Rails 自动加载。持久化使用 `baseline_assessments` 表；纯文本分析不依赖数据库。没有新增外部依赖、HTTP 接口或后台任务。
 
-厂商解析器把命令转换为普通 Ruby 值及 `Acl` / `Credential` 对象；`Facts` 不读取命令文本，也不操作游标。语法解释成功后由 `ConfigurationParser#analyze` 标记当前行，`capture` 关联脱敏数据与来源；未解释的子命令保留原状态。事实中的行号用于判定报告，游标中的捕获用于显式溯源，两者不将原文带入持久化结果。
+厂商解析器把命令转换为普通 Ruby 值及 `Acl` / `Credential` 对象；`Facts` 不读取命令文本，也不操作游标。语法解释成功后由 `Configuration#analyze` 标记当前行，`capture` 关联脱敏数据与来源；未解释的子命令保留原状态。事实中的行号用于判定报告，游标中的捕获用于显式溯源，两者不将原文带入持久化结果。
 
-新增厂商时，有相同语法族才继承 `Comware` 或 `Cisco`；防火墙直接继承 `Base`，独立解释本机管理语法。新增跨厂商归约逻辑放入 `Facts` 或已有领域对象，批准值仍声明在策略 YAML 中。不要在厂商类中重复维护事实字典、诊断列表或引用解析状态。`Facts#direct_acl` 对原生允许来源统一归一化，区分 `nil`（未确认）、`[]`（明确没有允许来源）与 `0.0.0.0/0`（全网）；`incomplete!` 使破损声明无法证明合规的缺省状态。
+新增厂商时，有相同语法族才继承 `Comware::Parser` 或 `Cisco::Parser`；防火墙直接继承 `Baseline::Parser`，独立解释本机管理语法。新增跨厂商归约逻辑放入 `Facts` 或已有领域对象，批准值仍声明在策略 YAML 中。不要在厂商类中重复维护事实字典、诊断列表或引用解析状态。`Facts#direct_acl` 对原生允许来源统一归一化，区分 `nil`（未确认）、`[]`（明确没有允许来源）与 `0.0.0.0/0`（全网）；`incomplete!` 使破损声明无法证明合规的缺省状态。
 
 ## 事实与检查
 
@@ -66,7 +66,7 @@ flowchart LR
 
 `complete: true` 是调用方对**完整配置快照**的声明，不代表每个事实都可识别。分页残留、错误回显、未闭合 banner、无 hostname/sysname、非法编码会阻止合规结论。接口或 banner 内看似合法的全局命令不会变成全局事实。
 
-部分配置可以保留已确认且不依赖未见记录的违规：禁用服务开启、意外集合成员、越界管理来源、弱明文凭据、SNMP 写授权及不安全凭据存储。
+部分配置可以保留已确认且不依赖未见记录的违规：禁用服务开启、意外集合成员、完整输入中可确认的越界管理来源、弱明文凭据、SNMP 写授权及不安全凭据存储。
 缺少批准成员、数量不足、其他标量比较仍保持 unknown；部分证据不会产生 pass，报告仍不完整。
 明确的上下文不匹配先返回 not_applicable；部分集合的“全部满足/不存在”不能用来判定策略适用范围。
 部分输入或分页输入的无终止末行，以及内联分页/错误污染行不进入事实，避免截断密码/地址被当作有效配置；
@@ -104,7 +104,7 @@ PAN-OS 管理 profile 未指定 permitted IP 时没有来源限制，因此必
 
 ### SNMP 写权限证据
 
-`snmp.read_only` 检查的是配置授予的写权限：任一已知写授权会得到 `fail`；所有授权均明确只读才会通过；缺失组引用、未知角色或不能完整解释的组语法保持 `unknown`。一个授权未知不会抹掉另一个已确认的写授权，也不会阻断 SSH 等无关检查。写视图声明不等于已经成功执行 SNMP SET，MIB 对象可写性、网络可达性和运行时认证需要另行验证。
+`snmp.write_enabled` 检查的是配置授予的写权限：任一已知写授权会得到 `fail`；所有授权均明确只读才会通过；缺失组引用、未知角色或不能完整解释的组语法保持 `unknown`。一个授权未知不会抹掉另一个已确认的写授权，也不会阻断 SSH 等无关检查。写视图声明不等于已经成功执行 SNMP SET，MIB 对象可写性、网络可达性和运行时认证需要另行验证。
 
 默认策略在 `snmp.enabled: true` 时执行写权限检查，因此纯 SNMPv3 配置也纳入检查，不能仅以 community 是否存在决定规则范围。
 

data/lib/baseline/acl.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ctx_parser/immutable"
+
 require "ipaddr"
 
 module Baseline
@@ -9,12 +11,12 @@ module Baseline
 
     # 冻结有序 ACL 规则及其来源、支持状态。
     def initialize(name:, rules:, line:, supported: true)
-      @name, @rules, @line, @supported = name.freeze, Baseline.immutable(rules), line, supported
+      @name, @rules, @line, @supported = CtxParser::Immutable.copy(name), CtxParser::Immutable.copy(rules), line, supported
       freeze
     end
 
     # 按 ACL 顺序匹配语义计算允许访问的来源范围。
-    def sources(protocol:, port: nil)
+    def permitted_source_networks(protocol:, port: nil)
       return unless supported && rules.any?
       selected = rules.sort_by { |rule| rule.fetch(:sequence) }.select do |rule|
         next unless [ "ip", protocol ].include?(rule.fetch(:protocol))
@@ -24,7 +26,7 @@ module Baseline
         end
         true
       end
-      self.class.networks(permitted_ranges(selected))
+      self.class.network_prefixes(permitted_ranges(selected))
     end
 
     # 返回公开的数据结构，并保留状态与诊断信息。
@@ -33,7 +35,7 @@ module Baseline
     def inspect = "#<#{self.class} name=#{name} rules=#{rules.size} supported=#{supported}>"
 
     # 归一化 ACL 来源地址；不推测不支持语法的含义。
-    def self.source(address, wildcard = nil)
+    def self.source_network(address, wildcard = nil)
       return "0.0.0.0/0" if address == "any"
       ip = IPAddr.new(address)
       raise ArgumentError, "IPv4 ACL required" unless ip.ipv4?
@@ -48,40 +50,41 @@ module Baseline
     end
 
     # 将网络前缀转换为包含首尾地址的整数区间。
-    def self.range(cidr)
+    def self.address_range(cidr)
       ip = IPAddr.new(cidr)
       raise ArgumentError, "IPv4 ACL required" unless ip.ipv4?
       [ ip.to_range.first.to_i, ip.to_range.last.to_i ]
     end
 
-    # 通过地址区间相减，检查实际来源是否包含于策略批准的网段。
-    def self.subtract(ranges, removed)
-      removed.reduce(ranges) do |remaining, (left, right)|
-        remaining.flat_map do |first, last|
-          if right < first || left > last
-            [ [ first, last ] ]
-          else
-            [ ([ first, left - 1 ] if left > first), ([ right + 1, last ] if right < last) ].compact
-          end
-        end
-      end
+    # 判断所有实际来源范围是否均在允许范围内。
+    def self.networks_within?(actual, expected)
+      each_network_coverage(actual, expected) { |_index, covered| return false unless covered }
+      true
     end
 
-    # 判断所有实际来源范围是否均在允许范围内。
-    def self.within?(actual, expected)
-      subtract(actual.map { |cidr| range(cidr) }, expected.map { |cidr| range(cidr) }).empty?
+    # 批量返回未被批准范围完整覆盖的原始网段，保持报告的输入顺序。
+    def self.unapproved_networks(actual, expected)
+      indexes = []
+      each_network_coverage(actual, expected) { |index, covered| indexes << index unless covered }
+      indexes.sort.map { |index| actual.fetch(index) }
     end
 
-    # 将地址区间转换为数量最少的网络前缀。
-    def self.networks(ranges)
-      merged = ranges.sort.each_with_object([]) do |(first, last), result|
-        if result.any? && first <= result.last.last + 1
-          result.last[1] = [ result.last.last, last ].max
-        else
-          result << [ first, last ]
-        end
+    # 批准区间只解析、合并一次；实际网段按起点顺序与其线性比较。
+    def self.each_network_coverage(actual, expected)
+      approved = merge_ranges(expected.map { |cidr| address_range(cidr) })
+      networks = actual.each_with_index.map { |cidr, index| [ address_range(cidr), index ] }.sort_by(&:first)
+      approved_index = 0
+      networks.each do |(first, last), source_index|
+        approved_index += 1 while approved_index < approved.size && approved[approved_index].last < first
+        candidate = approved[approved_index]
+        yield source_index, candidate && candidate.first <= first && candidate.last >= last
       end
-      merged.flat_map do |first, last|
+    end
+    private_class_method :each_network_coverage
+
+    # 将地址区间转换为数量最少的网络前缀。
+    def self.network_prefixes(ranges)
+      merge_ranges(ranges).flat_map do |first, last|
         networks = []
         while first <= last
           aligned = first.zero? ? 32 : (first & -first).bit_length - 1
@@ -93,13 +96,25 @@ module Baseline
       end
     end
 
+    # 合并相邻或重叠区间，使覆盖比较只需顺序扫描，不反复切割整个集合。
+    def self.merge_ranges(ranges)
+      ranges.sort.each_with_object([]) do |(first, last), result|
+        if result.any? && first <= result.last.last + 1
+          result.last[1] = [ result.last.last, last ].max
+        else
+          result << [ first, last ]
+        end
+      end
+    end
+    private_class_method :merge_ranges
+
     private
 
     # 按地址边界扫描一次；每个区间由最先匹配的生效规则决定。
     def permitted_ranges(selected)
       boundaries = Hash.new { |entries, address| entries[address] = [] }
       selected.each_with_index do |rule, priority|
-        first, last = self.class.range(rule.fetch(:source))
+        first, last = self.class.address_range(rule.fetch(:source))
         boundaries[first] << [ priority, true ]
         # 将闭区间终点转为下一地址的失效事件，统一处理相邻和重叠网段。
         boundaries[last + 1] << [ priority, false ]

data/lib/baseline/audit.rb

@@ -1,13 +1,22 @@
 # frozen_string_literal: true
 
+require_relative "configuration"
+require_relative "evaluator"
+require_relative "h3c/parser"
+require_relative "huawei/parser"
+require_relative "cisco_ios/parser"
+require_relative "cisco_nxos/parser"
+require_relative "hillstone/parser"
+require_relative "palo_alto/parser"
+
 require "digest"
 
 module Baseline
   # 仅分析传入文本，不读取文件、访问数据库、连接设备或执行修复。
   class Audit
-    PARSERS = { "h3c" => Parsers::H3c, "huawei" => Parsers::Huawei,
-      "cisco_ios" => Parsers::CiscoIos, "cisco_nxos" => Parsers::CiscoNxos,
-      "hillstone" => Parsers::Hillstone, "palo_alto" => Parsers::PaloAlto }.freeze
+    PARSERS = { "h3c" => H3c::Parser, "huawei" => Huawei::Parser,
+      "cisco_ios" => CiscoIos::Parser, "cisco_nxos" => CiscoNxos::Parser,
+      "hillstone" => Hillstone::Parser, "palo_alto" => PaloAlto::Parser }.freeze
     ALIASES = { "h3c_wireless" => "h3c", "comware" => "h3c", "huawei_wireless" => "huawei", "vrp" => "huawei",
       "ios" => "cisco_ios", "iosxe" => "cisco_ios", "ios_xe" => "cisco_ios", "cisco_ios_xe" => "cisco_ios",
       "nxos" => "cisco_nxos", "nx_os" => "cisco_nxos", "stoneos" => "hillstone", "stone_os" => "hillstone",
@@ -28,7 +37,7 @@ module Baseline
       parser = PARSERS[name]
       result = parser ? parser.parse(configuration, complete: complete) :
         CtxParser::Result.new(status: :unsupported, issues: [ { code: :unsupported_platform } ])
-      facts = Configuration.new(platform: name, sha256: Digest::SHA256.hexdigest(configuration), result: result)
+      facts = Configuration.new(platform: name, sha256: Digest::SHA256.hexdigest(configuration), result: result, input_complete: complete)
       @evaluator.call(configuration: facts, context: context)
     end
 

data/lib/baseline/{parsers/cisco.rb → cisco/parser.rb}

@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
+require_relative "../parser"
+
 module Baseline
-  module Parsers
+  module Cisco
     # 复用 Cisco 管理服务、IPv4 ACL、SNMP 和 AAA 的公共语法。
-    class Cisco < Base
+    class Parser < Baseline::Parser
       SNMP_ROLE_WRITE = { "network-admin" => true, "vdc-admin" => true,
         "network-operator" => false, "vdc-operator" => false }.freeze
 
@@ -11,12 +13,12 @@ module Baseline
 
       # 解析管理访问暴露检查使用的有序 ACL 定义。
       def access_lists
-        sections(/\Aip access-list\s+/).each do |section|
+        matching_blocks(/\Aip access-list\s+/).each do |section|
           name = section.text.split.last
           extended = section.text.start_with?("ip access-list extended ") || nxos?
           register_acl(name, section.children, source: section) { |entry, index| cisco_rule(entry, index, extended: extended) }
         end
-        matching(/\Aaccess-list\s+/).group_by { |entry| entry.text.split[1] }.each do |name, entries|
+        matching_blocks(/\Aaccess-list\s+/).group_by { |entry| entry.text.split[1] }.each do |name, entries|
           extended = name.to_i.between?(100, 199) || name.to_i.between?(2000, 2699)
           register_acl(name, entries) { |entry, index| cisco_rule(entry, index, extended: extended, prefix: /\Aaccess-list\s+\S+\s+/) }
         end
@@ -30,8 +32,8 @@ module Baseline
         parts = match[3].split
         protocol = extended ? parts.shift : "ip"
         return unless %w[ip tcp udp icmp].include?(protocol)
-        network = source(parts)
-        return if extended && source(parts) != "0.0.0.0/0"
+        network = acl_source_network(parts)
+        return if extended && acl_source_network(parts) != "0.0.0.0/0"
         if extended && parts.first == "eq"
           return unless %w[tcp udp].include?(protocol)
           parts.shift
@@ -47,54 +49,54 @@ module Baseline
 
       # 根据监听服务、认证方式与 ACL 绑定关系归纳管理访问事实。
       def management
-        version = last(/\Aip ssh version\s+([12])\z/)
+        version = last_configured_value(/\Aip ssh version\s+([12])\z/)
         record("ssh.versions", [ version ]) if version
-        ssh = nxos? ? state(/\Afeature ssh\z/, /\Ano feature ssh\z/) : version ? true : nil
-        record("ssh.enabled", ssh, matching(/\A(?:ip ssh|(?:no )?feature ssh)/))
-        default_aaa = nxos? || state(/\Aaaa new-model\z/, /\Ano aaa new-model\z/) == true
-        vtys = sections(/\Aline vty(?:\s|\z)/).map do |section|
-          authentication = last(/\Alogin authentication\s+(\S+)\z/, section.children)
+        ssh = nxos? ? configured_state(/\Afeature ssh\z/, /\Ano feature ssh\z/) : version ? true : nil
+        record("ssh.enabled", ssh, matching_blocks(/\A(?:ip ssh|(?:no )?feature ssh)/))
+        default_aaa = nxos? || configured_state(/\Aaaa new-model\z/, /\Ano aaa new-model\z/) == true
+        vtys = matching_blocks(/\Aline vty(?:\s|\z)/).map do |section|
+          authentication = last_configured_value(/\Alogin authentication\s+(\S+)\z/, section.children)
           local = section.children.any? { |entry| entry.text == "login local" }
-          { name: section.text, protocols: last(/\Atransport input\s+(.+)\z/, section.children)&.split,
+          { name: section.text, protocols: last_configured_value(/\Atransport input\s+(.+)\z/, section.children)&.split,
             authentication: local ? "local" : (default_aaa ? "aaa" : nil),
             authentication_list: authentication || (default_aaa ? "default" : nil),
-            acl: last(/\Aaccess-class\s+(\S+)\s+in(?:\s+vrf-also)?\z/, section.children), line: section.line }
+            acl: last_configured_value(/\Aaccess-class\s+(\S+)\s+in(?:\s+vrf-also)?\z/, section.children), line: section.line }
         end
-        rotary = matching(/\A(?:no )?ip ssh port(?:\s|\z)/)
-        rotary.concat(sections(/\Aline vty(?:\s|\z)/).flat_map { |section| matching(/\A(?:no )?rotary(?:\s|\z)/, section.children) })
+        rotary = matching_blocks(/\A(?:no )?ip ssh port(?:\s|\z)/)
+        rotary.concat(matching_blocks(/\Aline vty(?:\s|\z)/).flat_map { |section| matching_blocks(/\A(?:no )?rotary(?:\s|\z)/, section.children) })
         unknown_listener_port("management.acl", rotary) unless rotary.empty?
-        telnet_ports = matching(/\A(?:no )?(?:ip )?telnet(?: server)? port(?:\s|\z)/)
+        telnet_ports = matching_blocks(/\A(?:no )?(?:ip )?telnet(?: server)? port(?:\s|\z)/)
         unknown_listener_port("management.acl", telnet_ports) unless telnet_ports.empty?
         @facts.management(vtys: vtys,
           ssh_port: rotary.empty? ? listener_port("ssh port", default: 22, scope: "management.acl", negate: "no") : nil,
           telnet_port: telnet_ports.empty? ? 23 : nil)
         telnet = if nxos?
-          state(/\Afeature telnet\z/, /\Ano feature telnet\z/)
+          configured_state(/\Afeature telnet\z/, /\Ano feature telnet\z/)
         elsif vtys.any? && vtys.all? { |entry| entry[:protocols] }
           vtys.any? { |entry| (entry[:protocols] & %w[all telnet]).any? }
         end
-        record("services", { "telnet" => telnet, "http" => state(/\Aip http server\z/, /\Ano ip http server\z/),
-          "https" => state(/\Aip http secure-server\z/, /\Ano ip http secure-server\z/),
-          "ftp" => state(/\A(?:feature ftp-server|ftp-server enable)\z/, /\Ano (?:feature ftp-server|ftp-server enable)\z/),
-          "tftp" => state(/\A(?:feature tftp-server|tftp-server\s+.+)\z/, /\Ano (?:feature tftp-server|tftp-server\s+.+)\z/),
-          "finger" => state(/\A(?:ip finger|service finger)\z/, /\Ano (?:ip finger|service finger)\z/) })
+        record("services", { "telnet" => telnet, "http" => configured_state(/\Aip http server\z/, /\Ano ip http server\z/),
+          "https" => configured_state(/\Aip http secure-server\z/, /\Ano ip http secure-server\z/),
+          "ftp" => configured_state(/\A(?:feature ftp-server|ftp-server enable)\z/, /\Ano (?:feature ftp-server|ftp-server enable)\z/),
+          "tftp" => configured_state(/\A(?:feature tftp-server|tftp-server\s+.+)\z/, /\Ano (?:feature tftp-server|tftp-server\s+.+)\z/),
+          "finger" => configured_state(/\A(?:ip finger|service finger)\z/, /\Ano (?:ip finger|service finger)\z/) })
       end
 
       # 采集明确启用或禁用的管理服务。
       def services
-        record("ntp.servers", values(/\Antp server(?: vrf \S+)?\s+(\S+)/), matching(/\Antp server/))
-        record("ntp.authentication", state(/\Antp authenticate\z/, /\Ano ntp authenticate\z/))
-        record("ntp.source", last(/\Antp source(?:-interface)?\s+(\S+)\z/))
-        hosts = values(nxos? ? /\Alogging server\s+(\S+)/ : /\Alogging host(?: ipv6)?\s+(\S+)/)
-        hosts |= values(/\Alogging\s+(\d+(?:\.\d+){3})\z/) unless nxos?
-        record("syslog.servers", hosts, matching(/\Alogging (?:host|server)/))
-        record("syslog.source", last(/\Alogging source-interface\s+(\S+)\z/))
-        snmp = matching(/\Asnmp-server\b/)
-        enabled = nxos? ? state(/\Asnmp-server protocol enable\z/, /\Ano snmp-server protocol enable\z/) : nil
+        record("ntp.servers", configured_values(/\Antp server(?: vrf \S+)?\s+(\S+)/), matching_blocks(/\Antp server/))
+        record_configured_state("ntp.authentication", /\Antp authenticate\z/, /\Ano ntp authenticate\z/)
+        record_configured_value("ntp.source", /\Antp source(?:-interface)?\s+(\S+)\z/)
+        hosts = configured_values(nxos? ? /\Alogging server\s+(\S+)/ : /\Alogging host(?: ipv6)?\s+(\S+)/)
+        hosts |= configured_values(/\Alogging\s+(\d+(?:\.\d+){3})\z/) unless nxos?
+        record("syslog.servers", hosts, matching_blocks(/\Alogging (?:host|server)/))
+        record_configured_value("syslog.source", /\Alogging source-interface\s+(\S+)\z/)
+        snmp = matching_blocks(/\Asnmp-server\b/)
+        enabled = nxos? ? configured_state(/\Asnmp-server protocol enable\z/, /\Ano snmp-server protocol enable\z/) : nil
         enabled = nxos? || snmp.any? if enabled.nil? && (@facts.complete? || snmp.any?)
         record("snmp.enabled", enabled)
         communities = {}
-        matching(/\Asnmp-server community\b/).each do |entry|
+        matching_blocks(/\Asnmp-server community\b/).each do |entry|
           match = /\Asnmp-server community\s+(\S+)(?:\s+(.*))?\z/.match(entry.text)
           unless match
             unknown_snmp_access([ entry ])
@@ -108,17 +110,17 @@ module Baseline
           community[:write] = SNMP_ROLE_WRITE[role] if role
           acl = nxos? ? settings[/\buse-ipv4acl\s+(\S+)/, 1] : settings[/\A(?:ro|rw)\s+(\S+)\z/i, 1]
           community[:acl] = acl if acl
-          credential("snmp-community", "snmp", "plain", match[1], entry) unless @facts.credential_recorded?(community[:line])
+          record_credential("snmp-community", "snmp", "plain", match[1], entry) unless @facts.credential_recorded?(community[:line])
         end
         versions = communities.any? ? %w[v1 v2c] : []
-        groups = snmp_groups(matching(/\Asnmp-server group\s+.+?\s+v3\b/)) do |entry|
+        groups = snmp_groups(matching_blocks(/\Asnmp-server group\s+.+?\s+v3\b/)) do |entry|
           name, settings = entry.text.match(/\Asnmp-server group\s+(.+?)\s+v3(?:\s+(.*))?\z/).captures
           write = name.include?('"') ? nil : snmp_group_write(settings.to_s)
           [ name, { acl: entry.text[/\baccess\s+(\S+)/, 1], line: entry.line, write: write } ]
         end
         record("snmp.groups", groups)
         users = {}
-        matching(/\Asnmp-server user\b/).each do |entry|
+        matching_blocks(/\Asnmp-server user\b/).each do |entry|
           match = /\Asnmp-server user\s+(\S+)\s+(\S+)(.*)\z/.match(entry.text)
           unless match
             unknown_snmp_access([ entry ])
@@ -153,14 +155,14 @@ module Baseline
           acl = settings[/\b(?:access|use-ipv4acl)\s+(\S+)/, 1]
           user[:acl] = acl if acl
         end
-        port_overrides = matching(/\A(?:no )?snmp-server (?:listen-port|udp-port|port)(?:\s|\z)/)
+        port_overrides = matching_blocks(/\A(?:no )?snmp-server (?:listen-port|udp-port|port)(?:\s|\z)/)
         unknown_listener_port("snmp.acl", port_overrides) unless port_overrides.empty?
         @facts.snmp(communities: communities.values, users: users.values, groups: nxos? ? nil : groups,
           port: port_overrides.empty? ? 161 : nil)
         nxos_snmp_coverage(users, enabled: enabled) if nxos?
         unknown("snmp.v3_auth_priv", code: :snmp_user_unresolved) if users.values.any? { |user| !user.key?(:auth) }
-        versions |= values(/\Asnmp-server group\s+\S+\s+(v1|v2c|v3)\b/)
-        legacy_groups = matching(/\Asnmp-server group\s+\S+\s+v(?:1|2c)\b/)
+        versions |= configured_values(/\Asnmp-server group\s+\S+\s+(v1|v2c|v3)\b/)
+        legacy_groups = matching_blocks(/\Asnmp-server group\s+\S+\s+v(?:1|2c)\b/)
         if legacy_groups.any?
           @facts.unknown_snmp_permission(lines: legacy_groups.map(&:line), code: :unsupported_snmp_group)
           unknown("snmp.acl", legacy_groups, code: :unsupported_snmp_group)
@@ -171,10 +173,10 @@ module Baseline
       # NX-OS 通常会同步 CLI 与 SNMP 账号；缺少证据时不能构造虚拟用户。
       def nxos_snmp_coverage(users, enabled:)
         return if enabled == false
-        sync_disabled = state(/\Asnmp-server disable snmp-aaa sync\z/, /\Ano snmp-server disable snmp-aaa sync\z/)
+        sync_disabled = configured_state(/\Asnmp-server disable snmp-aaa sync\z/, /\Ano snmp-server disable snmp-aaa sync\z/)
         return if sync_disabled == true
 
-        matching(/\Ausername\s+/).group_by { |entry| entry.text.split[1] }.each do |name, entries|
+        matching_blocks(/\Ausername\s+/).group_by { |entry| entry.text.split[1] }.each do |name, entries|
           roles = entries.filter_map { |entry| entry.text[/\brole\s+(\S+)\s*\z/, 1] }.uniq
           covered = users[name]&.fetch(:roles, []) || []
           next if roles.any? && (roles - covered).empty?
@@ -195,9 +197,9 @@ module Baseline
       # 解析实际生效的认证方法及外部服务器引用。
       def authentication
         servers, aliases, keyed = [], {}, []
-        global_key = matching(/\Atacacs-server key\s+/)
+        global_key = matching_blocks(/\Atacacs-server key\s+/)
         global_key.each { |entry| parse_key("tacacs", entry.text.sub(/\Atacacs-server key\s+/, ""), entry) }
-        matching(/\Atacacs-server host\s+/).each do |entry|
+        matching_blocks(/\Atacacs-server host\s+/).each do |entry|
           host = entry.text.split[2]
           servers << host
           key = entry.text[/\bkey\s+(.+)\z/, 1]
@@ -206,17 +208,17 @@ module Baseline
             keyed << host
           end
         end
-        sections(/\Atacacs server\s+/).each do |section|
-          hosts = values(/\Aaddress ipv[46]\s+(\S+)/, section.children)
+        matching_blocks(/\Atacacs server\s+/).each do |section|
+          hosts = configured_values(/\Aaddress ipv[46]\s+(\S+)/, section.children)
           aliases[section.text.split.last] = hosts
           servers |= hosts
-          matching(/\Akey\s+/, section.children).each do |entry|
+          matching_blocks(/\Akey\s+/, section.children).each do |entry|
             parse_key("tacacs:#{section.text.split.last}", entry.text.delete_prefix("key "), entry)
             keyed |= hosts
           end
         end
-        groups = sections(/\Aaaa group server tacacs\+\s+/).to_h do |section|
-          members = values(/\Aserver(?: name)?\s+(\S+)/, section.children)
+        groups = matching_blocks(/\Aaaa group server tacacs\+\s+/).to_h do |section|
+          members = configured_values(/\Aserver(?: name)?\s+(\S+)/, section.children)
           [ section.text.split.last, members.flat_map { |member| aliases.fetch(member, [ member ]) } ]
         end
         record("tacacs.servers", servers.uniq)
@@ -225,14 +227,14 @@ module Baseline
         patterns = { "authorization" => /\Aaaa authorization (?:exec|commands(?: \d+)?) default\s+(.+)\z/,
           "accounting" => /\Aaaa accounting (?:(?:exec|commands(?: \d+)?) )?default\s+(.+)\z/ }
         patterns.each do |kind, pattern|
-          references = values(pattern).flat_map { |methods| methods.scan(/\bgroup\s+(\S+)/).flatten }
+          references = configured_values(pattern).flat_map { |methods| methods.scan(/\bgroup\s+(\S+)/).flatten }
           selected = references.flat_map { |name| name == "tacacs+" ? servers : groups.fetch(name, []) }.uniq
           unresolved = references.any? { |name| name != "radius" && name != "tacacs+" && !groups.key?(name) } || (selected - servers).any?
           if unresolved
-            unknown("tacacs.#{kind}", matching(pattern), code: :tacacs_group_unresolved)
+            unknown("tacacs.#{kind}", matching_blocks(pattern), code: :tacacs_group_unresolved)
           else
             used = selected.any?
-            record("tacacs.#{kind}", used, matching(pattern)) if @facts.complete? || used
+            record("tacacs.#{kind}", used, matching_blocks(pattern)) if @facts.complete? || used
           end
         end
         record("tacacs.keys_present", global_key.any? || (servers - keyed).empty?) unless servers.empty?
@@ -242,7 +244,7 @@ module Baseline
       # 解析各 VTY 实际选用的登录列表，包括命名列表。
       def tacacs_login(servers, groups)
         pattern = /\Aaaa authentication login\s+(\S+)\s+(.+)\z/
-        lists = matching(pattern).each_with_object({}) do |entry, result|
+        lists = matching_blocks(pattern).each_with_object({}) do |entry, result|
           name, methods = analyze(entry) { entry.text.match(pattern).captures }
           result[name] = { methods: methods, entry: entry }
         end
@@ -296,26 +298,26 @@ module Baseline
       # 提取已配置的凭据编码方式，不保留秘密值。
       def parse_key(owner, text, entry)
         match = /\A(?:(\d+)\s+)?(\S+)/.match(text)
-        credential(owner, "tacacs", match&.[](1) || "plain", match&.[](2), entry)
+        record_credential(owner, "tacacs", match&.[](1) || "plain", match&.[](2), entry)
       end
 
       # 提取本地账号角色及凭据存储属性。
       def accounts
-        matching(/\Ausername\s+/).group_by { |entry| entry.text.split[1] }.each do |name, entries|
+        matching_blocks(/\Ausername\s+/).group_by { |entry| entry.text.split[1] }.each do |name, entries|
           passwords = entries.filter_map do |entry|
             match = /\b(?:password|secret)\s+(?:(\d+)\s+)?(\S+)/.match(entry.text)
-            credential(name, "local_user", match[1] || "plain", match[2], entry) if match
+            record_credential(name, "local_user", match[1] || "plain", match[2], entry) if match
           end
-          credential(name, "local_user", "unknown", nil, entries.first) if passwords.empty?
+          record_credential(name, "local_user", "unknown", nil, entries.first) if passwords.empty?
         end
-        matching(/\Aenable (?:password|secret)\s+/).each do |entry|
+        matching_blocks(/\Aenable (?:password|secret)\s+/).each do |entry|
           match = /\Aenable (?:password|secret)(?: level \d+)?\s+(?:(\d+)\s+)?(\S+)/.match(entry.text)
-          credential("enable", "enable", match ? match[1] || "plain" : "unknown", match&.[](2), entry)
+          record_credential("enable", "enable", match ? match[1] || "plain" : "unknown", match&.[](2), entry)
         end
-        sections(/\Aline\b/).each do |section|
-          matching(/\Apassword\b/, section.children).each do |entry|
+        matching_blocks(/\Aline\b/).each do |section|
+          matching_blocks(/\Apassword\b/, section.children).each do |entry|
             match = /\Apassword\s+(?:(\d+)\s+)?(\S+)/.match(entry.text)
-            credential(section.text, "line", match ? match[1] || "plain" : "unknown", match&.[](2), entry)
+            record_credential(section.text, "line", match ? match[1] || "plain" : "unknown", match&.[](2), entry)
           end
         end
       end