baseline-rb 0.1.0 → 0.2.1

data/lib/baseline/{parsers/cisco_ios.rb → cisco_ios/parser.rb}

@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
+require_relative "../cisco/parser"
+
 module Baseline
-  module Parsers
+  module CiscoIos
     # 解析 IOS、IOS-XE 的 VTY 协议和 AAA 登录列表。
-    class CiscoIos < Cisco
+    class Parser < Cisco::Parser
       private
 
       # 选择共享 Cisco 解析逻辑中的 NX-OS 分支。

data/lib/baseline/{parsers/cisco_nxos.rb → cisco_nxos/parser.rb}

@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
+require_relative "../cisco/parser"
+
 module Baseline
-  module Parsers
+  module CiscoNxos
     # 解析 NX-OS 功能开关、角色权限及命名扩展 ACL。
-    class CiscoNxos < Cisco
+    class Parser < Cisco::Parser
       private
 
       # 选择共享 Cisco 解析逻辑中的 NX-OS 分支。

data/lib/baseline/{parsers/comware.rb → comware/parser.rb}

@@ -1,14 +1,16 @@
 # frozen_string_literal: true
 
+require_relative "../parser"
+
 module Baseline
-  module Parsers
+  module Comware
     # 复用 Comware 与 VRP 结构，由厂商子类选择账号、SSH 和 TACACS 语法。
-    class Comware < Base
+    class Parser < Baseline::Parser
       private
 
       # 解析管理访问暴露检查使用的有序 ACL 定义。
       def access_lists
-        sections(/\Aacl\s+/).each do |section|
+        matching_blocks(/\Aacl\s+/).each do |section|
           # IPv6 ACL 不能误建为名为 ipv6 的 IPv4 ACL，也不能覆盖其别名。
           if /\Aacl\s+ipv6\b/.match?(section.text)
             unknown("ipv6.acls", [ section ], code: :unsupported_acl_family)
@@ -30,13 +32,13 @@ module Baseline
         protocol = %w[ip tcp udp icmp].include?(parts.first) ? parts.shift : "ip"
         network = if parts.first == "source"
           parts.shift
-          source(parts)
+          acl_source_network(parts)
         else
           "0.0.0.0/0"
         end
         if parts.first == "destination"
           parts.shift
-          return unless source(parts) == "0.0.0.0/0"
+          return unless acl_source_network(parts) == "0.0.0.0/0"
         end
         if parts.first == "destination-port"
           return unless %w[tcp udp].include?(protocol)
@@ -54,56 +56,56 @@ module Baseline
 
       # 根据监听服务、认证方式与 ACL 绑定关系归纳管理访问事实。
       def management
-        record("ssh.enabled", state(ssh_enable, ssh_disable), matching(/\A(?:undo )?(?:ssh|stelnet)/))
-        compatible = state(/\Assh server compatible-ssh1x enable\z/, /\A(?:undo ssh server compatible-ssh1x enable|ssh server compatible-ssh1x disable)\z/)
+        record("ssh.enabled", configured_state(ssh_enable, ssh_disable), matching_blocks(/\A(?:undo )?(?:ssh|stelnet)/))
+        compatible = configured_state(/\Assh server compatible-ssh1x enable\z/, /\A(?:undo ssh server compatible-ssh1x enable|ssh server compatible-ssh1x disable)\z/)
         record("ssh.versions", compatible.nil? ? nil : compatible ? [ "1", "2" ] : [ "2" ])
-        ssh_acl = last(/\Assh server acl(?: ipv4)?\s+(?:name\s+)?(\S+)\z/)
-        defaults = sections(/\Aline class vty\z/).flat_map(&:children)
-        vtys = sections(/\A(?:line|user-interface) vty\b/).map do |section|
+        ssh_acl = last_configured_value(/\Assh server acl(?: ipv4)?\s+(?:name\s+)?(\S+)\z/)
+        defaults = matching_blocks(/\Aline class vty\z/).flat_map(&:children)
+        vtys = matching_blocks(/\A(?:line|user-interface) vty\b/).map do |section|
           entries = defaults + section.children
-          { name: section.text, protocols: last(/\Aprotocol inbound\s+(.+)\z/, entries)&.split,
-            authentication: last(/\Aauthentication-mode\s+(\S+)\z/, entries),
-            acl: last(/\Aacl\s+(?:name\s+)?(\S+)(?:\s+inbound)?\z/, entries), line: section.line }
+          { name: section.text, protocols: last_configured_value(/\Aprotocol inbound\s+(.+)\z/, entries)&.split,
+            authentication: last_configured_value(/\Aauthentication-mode\s+(\S+)\z/, entries),
+            acl: last_configured_value(/\Aacl\s+(?:name\s+)?(\S+)(?:\s+inbound)?\z/, entries), line: section.line }
         end
         @facts.management(vtys: vtys, ssh_acl: ssh_acl,
           ssh_port: listener_port("ssh server port", default: 22, scope: "management.acl"),
           telnet_port: listener_port("telnet server port", default: 23, scope: "management.acl"))
         definitions = { "telnet" => "telnet server", "http" => "ip http", "https" => "ip https", "ftp" => "ftp server", "tftp" => "tftp server" }
         record("services", definitions.to_h do |name, command|
-          [ name, state(/\A#{command} enable\z/, /\A(?:undo #{command} enable|#{command} disable)\z/) ]
+          [ name, configured_state(/\A#{command} enable\z/, /\A(?:undo #{command} enable|#{command} disable)\z/) ]
         end)
       end
 
       # 采集明确启用或禁用的管理服务。
       def services
-        record("ntp.servers", values(/\Antp-service unicast-server\s+(\S+)/), matching(/\Antp-service unicast-server/))
-        record("ntp.authentication", state(/\Antp-service authentication enable\z/, /\Aundo ntp-service authentication enable\z/))
-        record("ntp.source", last(/\Antp-service source(?:-interface)?\s+(\S+)\z/))
+        record("ntp.servers", configured_values(/\Antp-service unicast-server\s+(\S+)/), matching_blocks(/\Antp-service unicast-server/))
+        record_configured_state("ntp.authentication", /\Antp-service authentication enable\z/, /\Aundo ntp-service authentication enable\z/)
+        record_configured_value("ntp.source", /\Antp-service source(?:-interface)?\s+(\S+)\z/)
         # 从日志服务器中排除 source 子命令，并保留评估所需的归纳事实。
-        hosts = values(/\Ainfo-center loghost\s+(\S+)/) - [ "source" ]
-        record("syslog.servers", hosts, matching(/\Ainfo-center loghost/))
-        record("syslog.source", last(/\Ainfo-center loghost source\s+(\S+)\z/))
-        enabled = state(/\Asnmp-agent(?:\s|\z)/, /\Aundo snmp-agent\z/)
+        hosts = configured_values(/\Ainfo-center loghost\s+(\S+)/) - [ "source" ]
+        record("syslog.servers", hosts, matching_blocks(/\Ainfo-center loghost/))
+        record_configured_value("syslog.source", /\Ainfo-center loghost source\s+(\S+)\z/)
+        enabled = configured_state(/\Asnmp-agent(?:\s|\z)/, /\Aundo snmp-agent\z/)
         record("snmp.enabled", enabled.nil? && @facts.complete? ? false : enabled)
-        versions = last(/\Asnmp-agent sys-info version\s+(.+)\z/)&.split
+        versions = last_configured_value(/\Asnmp-agent sys-info version\s+(.+)\z/)&.split
         versions = %w[v1 v2c v3] if versions == [ "all" ]
         record("snmp.versions", versions)
-        communities = matching(/\Asnmp-agent community\b/).filter_map do |entry|
+        communities = matching_blocks(/\Asnmp-agent community\b/).filter_map do |entry|
           match = /\Asnmp-agent community (read|write)\s+(?:(simple|cipher)\s+)?(\S+)(.*)\z/.match(entry.text)
           unless match
             unknown_snmp_access([ entry ])
             next
           end
-          credential("snmp-community", "snmp", match[2] || "plain", match[3], entry)
+          record_credential("snmp-community", "snmp", match[2] || "plain", match[3], entry)
           { write: match[1] == "write", acl: match[4][/\bacl\s+(?:name\s+)?(\S+)/, 1], line: entry.line }
         end
-        groups = snmp_groups(matching(/\Asnmp-agent group v3\s+/)) do |entry|
+        groups = snmp_groups(matching_blocks(/\Asnmp-agent group v3\s+/)) do |entry|
           settings = entry.text.sub(/\Asnmp-agent group v3\s+\S+\s*/, "")
           [ entry.text.split[3], { acl: entry.text[/\bacl\s+(?:name\s+)?(\S+)/, 1], line: entry.line, write: snmp_group_write(settings) } ]
         end
         record("snmp.groups", groups)
         users = {}
-        matching(/\Asnmp-agent usm-user\b/).each do |entry|
+        matching_blocks(/\Asnmp-agent usm-user\b/).each do |entry|
           match = /\Asnmp-agent usm-user v3\s+(\S+)(?:\s+(.*))?\z/.match(entry.text)
           unless match
             unknown_snmp_access([ entry ], code: :unsupported_snmp_user)
@@ -136,15 +138,15 @@ module Baseline
 
       # 解析实际生效的认证方法及外部服务器引用。
       def authentication
-        schemes = sections(tacacs_section).to_h do |section|
-          server_types = matching(tacacs_server, section.children).group_by { |entry| entry.text.split[1] }
-            .transform_values { |entries| values(tacacs_server, entries) }
+        schemes = matching_blocks(tacacs_section).to_h do |section|
+          server_types = matching_blocks(tacacs_server, section.children).group_by { |entry| entry.text.split[1] }
+            .transform_values { |entries| configured_values(tacacs_server, entries) }
           servers = server_types.values.flatten.uniq
           keys = section.children.filter_map do |entry|
             match = tacacs_key.match(entry.text)
             next unless match
             kind, format, secret = match.captures
-            credential("tacacs:#{section.text.split.last}", "tacacs", format, secret, entry)
+            record_credential("tacacs:#{section.text.split.last}", "tacacs", format, secret, entry)
             kind
           end
           [ section.text.split.last, { servers: servers, server_types: server_types, key_types: keys.uniq, line: section.line } ]
@@ -154,8 +156,8 @@ module Baseline
         domains = authentication_domains
         methods = domains.flat_map { |entry| entry.children }
         %w[authentication authorization accounting].each do |kind|
-          relevant = matching(/\A#{kind}\s+login\b/, methods)
-          relevant = matching(/\A#{kind}\s+default\b/, methods) if relevant.empty?
+          relevant = matching_blocks(/\A#{kind}\s+login\b/, methods)
+          relevant = matching_blocks(/\A#{kind}\s+default\b/, methods) if relevant.empty?
           refs = relevant.filter_map { |entry| entry.text[/\A#{kind}\s+(?:login|default)\s+hwtacacs-scheme\s+(\S+)/, 1] }
           refs.concat(vrp_tacacs_references(kind, domains))
           key = kind == "authentication" ? "login" : kind
@@ -172,26 +174,26 @@ module Baseline
         end
         record("tacacs.keys_present", schemes.values.all? { |entry| tacacs_keys_complete?(entry[:key_types]) }) unless schemes.empty?
         accounts
-        sections(/\A(?:line|user-interface)\b/).each do |section|
-          matching(/\A(?:set authentication )?password\b/, section.children).each do |entry|
+        matching_blocks(/\A(?:line|user-interface)\b/).each do |section|
+          matching_blocks(/\A(?:set authentication )?password\b/, section.children).each do |entry|
             match = /\A(?:set authentication )?password\s+(simple|cipher|hash|irreversible-cipher)\s+(.+)\z/.match(entry.text)
-            credential(section.text, "line", match ? match[1] : "unknown", match&.[](2), entry)
+            record_credential(section.text, "line", match ? match[1] : "unknown", match&.[](2), entry)
           end
         end
-        matching(/\Asuper password\b/).each do |entry|
+        matching_blocks(/\Asuper password\b/).each do |entry|
           match = /\Asuper password(?: level \d+)?\s+(simple|cipher|hash)\s+(.+)\z/.match(entry.text)
-          credential("super", "enable", match ? match[1] : "unknown", match&.[](2), entry)
+          record_credential("super", "enable", match ? match[1] : "unknown", match&.[](2), entry)
         end
       end
 
       # 解析认证域引用及其服务器组。
       def authentication_domains
-        name = last(/\Adomain default enable\s+(\S+)\z/)
+        name = last_configured_value(/\Adomain default enable\s+(\S+)\z/)
         unless name
           %w[login authorization accounting].each { |kind| unknown("tacacs.#{kind}", code: :authentication_domain_unknown) }
           return []
         end
-        sections(/\Adomain #{Regexp.escape(name)}\z/)
+        matching_blocks(/\Adomain #{Regexp.escape(name)}\z/)
       end
       # 解析 VRP 认证域引用，避免将 VRP 语法应用到 Comware。
       def vrp_tacacs_references(_kind, _domains) = []
@@ -200,15 +202,15 @@ module Baseline
 
       # 提取本地账号角色及凭据存储属性。
       def accounts
-        sections(/\Alocal-user\s+/).each do |section|
+        matching_blocks(/\Alocal-user\s+/).each do |section|
           next if section.text.start_with?("local-user password-")
           name = section.text.split[1]
-          passwords = matching(/\Apassword\s+/, section.children)
+          passwords = matching_blocks(/\Apassword\s+/, section.children)
           passwords.each do |entry|
             match = /\Apassword\s+(simple|cipher|hash|irreversible-cipher)\s+(.+)\z/.match(entry.text)
-            credential(name, "local_user", match ? match[1] : "unknown", match ? match[2] : nil, entry)
+            record_credential(name, "local_user", match ? match[1] : "unknown", match ? match[2] : nil, entry)
           end
-          credential(name, "local_user", "unknown", nil, section) if passwords.empty? && @facts.complete?
+          record_credential(name, "local_user", "unknown", nil, section) if passwords.empty? && @facts.complete?
         end
       end
     end

data/lib/baseline/configuration.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ctx_parser/immutable"
+
 module Baseline
   # 在归一化配置中区分输入完整性、已知事实与局部不支持的语法。
   class Configuration
@@ -8,17 +10,22 @@ module Baseline
     attr_reader :platform, :sha256, :status, :facts, :sources, :issues
 
     # 冻结配置事实及其平台、来源身份。
-    def initialize(platform:, sha256:, result:)
+    def initialize(platform:, sha256:, result:, input_complete: result.status == :complete)
+      raise ArgumentError, "Input completeness must be boolean" unless input_complete == true || input_complete == false
+      @input_complete = input_complete
       @platform, @sha256, @status = platform.dup.freeze, sha256.dup.freeze, result.status
       record = result.records.first || {}
-      @facts = Baseline.immutable(record.fetch("facts", {}))
-      @sources = Baseline.immutable(record.fetch("sources", {}))
-      @issues = Baseline.immutable(result.issues)
+      @facts = CtxParser::Immutable.copy(record.fetch("facts", {}))
+      @sources = CtxParser::Immutable.copy(record.fetch("sources", {}))
+      @issues = CtxParser::Immutable.copy(result.issues)
       freeze
     end
 
+    # 仅记录调用方是否确认完整接收；局部解析不支持仍会降低 complete?。
+    def input_complete? = @input_complete
+
     # 判断配置采集与解析是否均已完成。
-    def complete? = status == :complete
+    def complete? = input_complete? && status == :complete
     # 读取已知值，同时保留事实缺失或未知的区别。
     def value(path) = facts[path]
 
@@ -41,7 +48,7 @@ module Baseline
 
     # 返回公开的数据结构，并保留状态与诊断信息。
     def to_h
-      { platform: platform, sha256: sha256, status: status, facts: facts, sources: sources, issues: issues }
+      { platform: platform, sha256: sha256, status: status, input_complete: input_complete?, facts: facts, sources: sources, issues: issues }
     end
 
     # 展示对象身份与状态，避免泄露原始回显或凭据。

data/lib/baseline/credential.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ctx_parser/immutable"
+
 module Baseline
   # 仅在构造时分析凭据，不保留明文、密文或可枚举的摘要。
   class Credential
@@ -20,7 +22,7 @@ module Baseline
         values.merge!(length: text.length, character_classes: [ /[a-z]/, /[A-Z]/, /\d/, /[^a-zA-Z\d]/ ].count { |pattern| pattern.match?(text) },
           common: COMMON.include?(text.downcase) || text.downcase == owner.to_s.downcase || /\A(.)\1+\z/.match?(text))
       end
-      @attributes = Baseline.immutable(values)
+      @attributes = CtxParser::Immutable.copy(values)
       freeze
     end
 

data/lib/baseline/evaluator.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require_relative "policy"
+require_relative "report"
+
 module Baseline
   # 根据策略评估归一化事实；厂商语法差异由解析器负责。
   class Evaluator
@@ -12,6 +15,9 @@ module Baseline
     # 评估适用基线规则，分别报告合规结果与证据覆盖率。
     def call(configuration:, context: {})
       raise ArgumentError, "Invalid baseline context" unless context.is_a?(Hash)
+      unless context.keys.all? { |key| key.is_a?(String) || key.is_a?(Symbol) } && context.keys.map(&:to_s).uniq.size == context.size
+        raise ArgumentError, "Ambiguous baseline context"
+      end
       context = context.transform_keys(&:to_s).merge("vendor" => configuration.platform)
       unless (context.keys - Policy::SCOPES).empty? && context.values.all? { |value| value.is_a?(String) && !value.strip.empty? }
         raise ArgumentError, "Invalid baseline context"
@@ -43,7 +49,7 @@ module Baseline
       attributes[:actual] = actual
       status, reason = compare(rule.operator, actual, expected)
       # 不完整输入不能证明通过；仅保留补充记录也无法推翻的明确违规。
-      if !configuration.complete? && (status == :pass || status == :fail && !partial_failure?(rule, actual, expected))
+      if !configuration.complete? && (status == :pass || status == :fail && !conclusive_violation?(rule, actual, expected, configuration))
         status, reason = :unknown, :input_incomplete
       end
       if status == :fail
@@ -55,9 +61,10 @@ module Baseline
     end
 
     # 采集尚未完成时，仅报告后续缺失记录也无法推翻的明确违规。
-    def partial_failure?(rule, actual, expected)
+    def conclusive_violation?(rule, actual, expected, configuration)
       case rule.operator
-      when :all_disabled, :subset, :networks_within, :password_strength then true
+      when :all_disabled, :subset, :password_strength then true
+      when :networks_within then configuration.input_complete?
       when :set_equals then (actual - expected).any?
       when :equals
         rule.fact == "snmp.write_enabled" && actual == true && expected == false ||
@@ -81,7 +88,7 @@ module Baseline
       when :set_equals then { missing: expected - actual, unexpected: actual - expected }
       when :subset then { unexpected: actual - expected }
       when :count_at_least then { minimum: expected, actual_count: actual.size }
-      when :networks_within then { outside_approved: actual.reject { |network| Acl.within?([ network ], expected) } }
+      when :networks_within then { outside_approved: Acl.unapproved_networks(actual, expected) }
       when :all_disabled then { enabled: expected.select { |name| actual[name] == true } }
       else {}
       end
@@ -128,7 +135,7 @@ module Baseline
         when :subset then (actual - expected).empty?
         when :set_equals then actual.sort == expected.sort
         when :count_at_least then actual.size >= expected
-        when :networks_within then Acl.within?(actual, expected)
+        when :networks_within then Acl.networks_within?(actual, expected)
         end
       end
       [ passed ? :pass : :fail, passed ? nil : :deviation ]

data/lib/baseline/facts.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require_relative "acl"
+require_relative "credential"
+
 require "ctx_parser/result"
 
 module Baseline
@@ -13,6 +16,7 @@ module Baseline
       @complete = complete && issues.empty?
       @values, @sources, @issues, @acls = {}, {}, issues.dup, {}
       @vtys, @communities, @snmp_users, @credentials = [], [], [], []
+      @credential_lines = {}
       @snmp_groups = {}
       @snmp_permission_issues = []
       @ssh_acl = nil
@@ -36,7 +40,7 @@ module Baseline
           (sources.nil? || sources.is_a?(Array))
         raise ArgumentError, "Direct access requires a known scope, binding state and source networks"
       end
-      networks = sources && Acl.networks(sources.map { |source| Acl.range(source) })
+      networks = sources && Acl.network_prefixes(sources.map { |source| Acl.address_range(source) })
       @direct_acls[fact] = true
       record("#{fact}.bound", bound, lines: lines)
       if networks
@@ -51,7 +55,7 @@ module Baseline
     def record(path, value, lines: [])
       return false if value.nil? || (!complete? && value.respond_to?(:empty?) && value.empty?)
 
-      @values[path] = Baseline.immutable(value)
+      @values[path] = CtxParser::Immutable.copy(value)
       @sources[path] = lines.uniq unless lines.empty?
       true
     end
@@ -72,15 +76,15 @@ module Baseline
 
     # 根据监听服务、认证方式与 ACL 绑定关系归纳管理访问事实。
     def management(vtys:, ssh_acl: nil, ssh_port: 22, telnet_port: 23)
-      @vtys, @ssh_acl = Baseline.immutable(vtys), ssh_acl
+      @vtys, @ssh_acl = CtxParser::Immutable.copy(vtys), CtxParser::Immutable.copy(ssh_acl)
       @management_ports = { "ssh" => ssh_port, "stelnet" => ssh_port, "telnet" => telnet_port }
     end
 
     # 根据用户、组和团体字归纳 SNMP 暴露面及凭据事实。
     def snmp(communities:, users:, groups: nil, port: 161)
       @snmp_port = port
-      @communities = Baseline.immutable(communities)
-      @snmp_groups = Baseline.immutable(groups || {})
+      @communities = CtxParser::Immutable.copy(communities)
+      @snmp_groups = CtxParser::Immutable.copy(groups || {})
       @snmp_users = users.map do |user|
         if groups && user[:group]
           if groups.key?(user[:group])
@@ -94,7 +98,7 @@ module Baseline
             unknown("snmp.acl", code: :snmp_group_unresolved)
           end
         end
-        Baseline.immutable(user)
+        CtxParser::Immutable.copy(user)
       end
     end
 
@@ -112,12 +116,14 @@ module Baseline
     end
 
     # 检查此来源行是否已经产生凭据事实。
-    def credential_recorded?(line) = @credentials.any? { |entry| entry[:line] == line }
+    def credential_recorded?(line) = @credential_lines.key?(line)
 
     # 记录凭据属性，不保留凭据秘密值。
-    def credential(credential)
+    def record_credential(credential)
       index = @credentials.size
-      @credentials << credential.to_h
+      attributes = credential.to_h
+      @credentials << attributes
+      @credential_lines[attributes[:line]] = true
       index
     end
 
@@ -131,7 +137,7 @@ module Baseline
       @issues << { code: :input_not_confirmed_complete } unless @confirmed_complete
       status = complete? && @values.key?("hostname") ? :complete : :partial
       CtxParser::Result.new(status: status,
-        records: Baseline.immutable([ { "facts" => @values, "sources" => @sources } ]), issues: Baseline.immutable(@issues.uniq))
+        records: CtxParser::Immutable.copy([ { "facts" => @values, "sources" => @sources } ]), issues: CtxParser::Immutable.copy(@issues.uniq))
     end
 
     # 展示对象身份与状态，避免泄露原始回显或凭据。
@@ -212,7 +218,7 @@ module Baseline
         acl = @acls[name]
         duplicate = @issues.any? { |issue| issue[:fact] == "acls.#{name}" }
         next if !acl || duplicate
-        sources = (binding[:ports] || [ nil ]).map { |port| acl.sources(protocol: protocol, port: port) }
+        sources = (binding[:ports] || [ nil ]).map { |port| acl.permitted_source_networks(protocol: protocol, port: port) }
         sources.flatten unless sources.any?(&:nil?)
       end
       if resolved.any?(&:nil?)
@@ -220,7 +226,7 @@ module Baseline
         unknown("#{fact}.restricted", code: :acl_unresolved)
         return
       end
-      sources = Acl.networks(resolved.flatten.uniq.map { |cidr| Acl.range(cidr) })
+      sources = Acl.network_prefixes(resolved.flatten.uniq.map { |cidr| Acl.address_range(cidr) })
       record("#{fact}.sources", sources)
       record("#{fact}.restricted", !sources.include?("0.0.0.0/0"))
       lines = names.uniq.flat_map { |name| @acls.fetch(name).rules.map { |rule| rule[:line] } }.compact.uniq

data/lib/baseline/{parsers/h3c.rb → h3c/parser.rb}

@@ -1,9 +1,11 @@
 # frozen_string_literal: true
 
+require_relative "../comware/parser"
+
 module Baseline
-  module Parsers
+  module H3c
     # 解析 H3C Comware 的 SSH、域认证及三类 TACACS 密钥角色。
-    class H3c < Comware
+    class Parser < Comware::Parser
       private
 
       # 匹配当前平台显式启用 SSH 的命令。

data/lib/baseline/hillstone/document.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require_relative "../quoted_document"
+
+module Baseline
+  module Hillstone
+    # StoneOS 导出内容可能包含命令回显、显式退出及引号包裹的界面状态。
+    class Document < QuotedDocument
+      protected
+
+      # 区分配置结构行与引号、横幅中的文本内容。
+      def classify(line)
+        unless @quote
+          return :ignored if line.text.match?(/\A(?:show (?:configuration|config)|Running configuration|Version\b|[\w.():-]+#\s*\z)/)
+          return :ignored if line.text == "exit"
+          return :boundary if line.text == "End"
+        end
+        super
+      end
+
+      # 识别配置值可能跨行延续的语句。
+      def multiline_fact?(text)
+        text.match?(/\A(?:hostname|admin host|snmp-server|ntp|logging syslog|password|secret|host|backup[12])\b/)
+      end
+    end
+  end
+end