baseline-rb 0.1.0

data/lib/baseline/facts.rb

@@ -0,0 +1,230 @@
+# frozen_string_literal: true
+
+require "ctx_parser/result"
+
+module Baseline
+  # 归并跨命令引用及未知状态，不依赖厂商语法或解析游标。
+  class Facts
+    attr_reader :vtys
+
+    # 初始化带来源信息的事实存储，并显式记录证据完整性。
+    def initialize(complete:, issues: [])
+      @confirmed_complete = complete
+      @complete = complete && issues.empty?
+      @values, @sources, @issues, @acls = {}, {}, issues.dup, {}
+      @vtys, @communities, @snmp_users, @credentials = [], [], [], []
+      @snmp_groups = {}
+      @snmp_permission_issues = []
+      @ssh_acl = nil
+      @management_ports = { "ssh" => 22, "stelnet" => 22, "telnet" => 23 }
+      @snmp_port = 161
+      @direct_acls = {}
+    end
+
+    # 判断所有已选事实是否都有完整证据支持。
+    def complete? = @complete
+
+    # 相关配置语句格式错误时，不能继续依据配置缺失推导结论。
+    def incomplete!(code:, lines: [])
+      @complete = false
+      @issues << { code: code, lines: lines.uniq }
+    end
+
+    # 防火墙可直接声明来源网段，不要求一定引用路由器式命名 ACL。
+    def direct_acl(fact:, sources:, bound:, lines: [])
+      unless %w[management.acl snmp.acl].include?(fact) && [ true, false ].include?(bound) &&
+          (sources.nil? || sources.is_a?(Array))
+        raise ArgumentError, "Direct access requires a known scope, binding state and source networks"
+      end
+      networks = sources && Acl.networks(sources.map { |source| Acl.range(source) })
+      @direct_acls[fact] = true
+      record("#{fact}.bound", bound, lines: lines)
+      if networks
+        record("#{fact}.sources", networks, lines: lines)
+        record("#{fact}.restricted", !networks.include?("0.0.0.0/0"), lines: lines)
+      else
+        %w[sources restricted].each { |key| unknown("#{fact}.#{key}", lines: lines, code: :acl_unresolved) }
+      end
+    end
+
+    # 将 false 保留为已知事实；输入不完整时，不接受 nil 或空集作为确定值。
+    def record(path, value, lines: [])
+      return false if value.nil? || (!complete? && value.respond_to?(:empty?) && value.empty?)
+
+      @values[path] = Baseline.immutable(value)
+      @sources[path] = lines.uniq unless lines.empty?
+      true
+    end
+
+    # 记录事实不可用的原因，并保留对应的来源行。
+    def unknown(path, lines: [], code: :unsupported_syntax)
+      @issues << { code: code, fact: path, lines: lines.uniq }
+    end
+
+    # 将别名关联到同一 ACL；保留定义冲突，避免后续定义静默覆盖。
+    def register_acl(acl, aliases: [], lines: [])
+      keys = ([ acl.name ] + aliases).uniq
+      duplicates = keys.select { |key| @acls.key?(key) }
+      duplicates.each { |key| unknown("acls.#{key}", lines: lines, code: :duplicate_acl) }
+      keys.each { |key| @acls[key] = acl }
+      duplicates
+    end
+
+    # 根据监听服务、认证方式与 ACL 绑定关系归纳管理访问事实。
+    def management(vtys:, ssh_acl: nil, ssh_port: 22, telnet_port: 23)
+      @vtys, @ssh_acl = Baseline.immutable(vtys), ssh_acl
+      @management_ports = { "ssh" => ssh_port, "stelnet" => ssh_port, "telnet" => telnet_port }
+    end
+
+    # 根据用户、组和团体字归纳 SNMP 暴露面及凭据事实。
+    def snmp(communities:, users:, groups: nil, port: 161)
+      @snmp_port = port
+      @communities = Baseline.immutable(communities)
+      @snmp_groups = Baseline.immutable(groups || {})
+      @snmp_users = users.map do |user|
+        if groups && user[:group]
+          if groups.key?(user[:group])
+            group = groups.fetch(user[:group])
+            user = user.merge(write: group[:write])
+            unless user[:acl]
+              user = user.merge(acl: group[:acl])
+              unknown("snmp.acl", code: :snmp_group_ambiguous) if group[:acl_ambiguous]
+            end
+          elsif !user[:acl]
+            unknown("snmp.acl", code: :snmp_group_unresolved)
+          end
+        end
+        Baseline.immutable(user)
+      end
+    end
+
+    # 即使其他权限尚未解析，已确认的写权限仍属于违规证据。
+    def self.write_permission(permissions)
+      return true if permissions.include?(true)
+      return false if permissions.all?(false)
+
+      nil
+    end
+
+    # 暂存不完整的访问证据，优先保留已确认的权限授予事实。
+    def unknown_snmp_permission(lines: [], code: :snmp_permission_unresolved)
+      @snmp_permission_issues << { code: code, fact: "snmp.write_enabled", lines: lines.uniq }
+    end
+
+    # 检查此来源行是否已经产生凭据事实。
+    def credential_recorded?(line) = @credentials.any? { |entry| entry[:line] == line }
+
+    # 记录凭据属性，不保留凭据秘密值。
+    def credential(credential)
+      index = @credentials.size
+      @credentials << credential.to_h
+      index
+    end
+
+    # 汇总事实与诊断，并保留证据完整性状态。
+    def result
+      record("acls", @acls.values.uniq.map(&:to_h))
+      management_facts
+      snmp_facts
+      credential_facts
+      @issues << { code: :hostname_missing } unless @values.key?("hostname")
+      @issues << { code: :input_not_confirmed_complete } unless @confirmed_complete
+      status = complete? && @values.key?("hostname") ? :complete : :partial
+      CtxParser::Result.new(status: status,
+        records: Baseline.immutable([ { "facts" => @values, "sources" => @sources } ]), issues: Baseline.immutable(@issues.uniq))
+    end
+
+    # 展示对象身份与状态，避免泄露原始回显或凭据。
+    def inspect = "#<#{self.class} complete=#{complete?} facts=#{@values.size}>"
+
+    private
+
+    # 归纳管理服务监听端点及其实际生效的访问限制。
+    def management_facts
+      record("ssh.vty", vtys)
+      if vtys.any? && vtys.all? { |entry| entry[:protocols] }
+        protocols = vtys.flat_map { |entry| entry[:protocols] }.uniq
+        record("ssh.vty_ssh_only", protocols.any? && (protocols - %w[ssh stelnet]).empty?)
+      end
+      if vtys.any? && vtys.all? { |entry| entry[:authentication] }
+        record("ssh.vty_aaa", vtys.all? { |entry| %w[scheme aaa local].include?(entry[:authentication]) })
+      end
+      # 全局 SSH ACL 仅覆盖明确限制为 SSH 的管理监听端点。
+      bindings = if @ssh_acl && @values["ssh.vty_ssh_only"] == true
+        [ { name: @ssh_acl, ports: management_ports([ "ssh" ]) } ]
+      else
+        vtys.map { |entry| { name: entry[:acl], ports: management_ports(entry[:protocols]) } }
+      end
+      acl_sources(bindings, protocol: "tcp", fact: "management.acl") unless @direct_acls["management.acl"]
+      if vtys.any?
+        %w[ssh.vty_ssh_only ssh.vty_aaa management.acl.bound].each { |path| @sources[path] = vtys.map { |entry| entry[:line] } }
+      end
+    end
+
+    # 归纳 SNMP 监听、团体字及用户的安全属性。
+    def snmp_facts
+      record("snmp.communities", @communities)
+      record("snmp.community_present", @communities.any?) if complete? || @communities.any?
+      access = @communities + @snmp_users + @snmp_groups.values
+      permissions = access.map { |entry| entry[:write] }
+      permissions << nil unless @snmp_permission_issues.empty?
+      writable = self.class.write_permission(permissions)
+      record("snmp.write_enabled", writable, lines: access.flat_map { |entry| entry[:lines] || [ entry[:line] ] }.compact)
+      if writable.nil?
+        unknown("snmp.write_enabled", code: :snmp_permission_unresolved)
+        @issues.concat(@snmp_permission_issues)
+      end
+      record("snmp.users", @snmp_users)
+      record("snmp.v3_auth_priv", @snmp_users.all? { |entry| entry[:auth] && entry[:priv] }) if @snmp_users.any?
+      bindings = (@communities + @snmp_users).map { |entry| { name: entry[:acl], ports: @snmp_port ? [ @snmp_port ] : nil } }
+      acl_sources(bindings, protocol: "udp", fact: "snmp.acl") unless @direct_acls["snmp.acl"]
+    end
+
+    # 汇总凭据存储方式及可度量的强度属性。
+    def credential_facts
+      record("credentials.records", @credentials)
+      record("credentials.present", @credentials.any?) if complete? || @credentials.any?
+      return if @credentials.empty?
+
+      storage = @credentials.map { |entry| entry[:storage] }
+      safe = storage.any? { |value| %w[plaintext legacy].include?(value) } ? false : storage.include?("unknown") ? nil : true
+      record("credentials.storage_safe", safe)
+      %w[credentials.records credentials.storage_safe].each { |path| @sources[path] = @credentials.map { |entry| entry[:line] }.uniq }
+    end
+
+    # 确定所选管理协议使用的监听端口。
+    def management_ports(protocols)
+      return if !protocols || protocols.empty? || (protocols - @management_ports.keys).any?
+      ports = protocols.map { |name| @management_ports.fetch(name) }.uniq
+      ports unless ports.include?(nil)
+    end
+
+    # 解析已绑定 ACL 的来源范围，并保留不支持的证据。
+    def acl_sources(bindings, protocol:, fact:)
+      names = bindings.map { |binding| binding[:name] }
+      if names.empty? || names.any? { |name| name.nil? || name.empty? }
+        record("#{fact}.bound", false) if complete?
+        return
+      end
+      record("#{fact}.bound", true)
+      resolved = bindings.uniq.map do |binding|
+        name = binding[:name]
+        acl = @acls[name]
+        duplicate = @issues.any? { |issue| issue[:fact] == "acls.#{name}" }
+        next if !acl || duplicate
+        sources = (binding[:ports] || [ nil ]).map { |port| acl.sources(protocol: protocol, port: port) }
+        sources.flatten unless sources.any?(&:nil?)
+      end
+      if resolved.any?(&:nil?)
+        unknown("#{fact}.sources", code: :acl_unresolved)
+        unknown("#{fact}.restricted", code: :acl_unresolved)
+        return
+      end
+      sources = Acl.networks(resolved.flatten.uniq.map { |cidr| Acl.range(cidr) })
+      record("#{fact}.sources", sources)
+      record("#{fact}.restricted", !sources.include?("0.0.0.0/0"))
+      lines = names.uniq.flat_map { |name| @acls.fetch(name).rules.map { |rule| rule[:line] } }.compact.uniq
+      %w[sources restricted].each { |field| @sources["#{fact}.#{field}"] = lines }
+    end
+  end
+end

data/lib/baseline/hillstone_document.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require_relative "quoted_document"
+
+module Baseline
+  # StoneOS 导出内容可能包含命令回显、显式退出及引号包裹的界面状态。
+  class HillstoneDocument < QuotedDocument
+    protected
+
+    # 区分配置结构行与引号、横幅中的文本内容。
+    def classify(line)
+      unless @quote
+        return :ignored if line.text.match?(/\A(?:show (?:configuration|config)|Running configuration|Version\b|[\w.():-]+#\s*\z)/)
+        return :ignored if line.text == "exit"
+        return :boundary if line.text == "End"
+      end
+      super
+    end
+
+    # 识别配置值可能跨行延续的语句。
+    def multiline_fact?(text)
+      text.match?(/\A(?:hostname|admin host|snmp-server|ntp|logging syslog|password|secret|host|backup[12])\b/)
+    end
+  end
+end

data/lib/baseline/palo_alto_document.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require_relative "quoted_document"
+
+module Baseline
+  # PAN-OS 的 set 导出可能包含引号包裹的多行证书与描述。
+  class PaloAltoDocument < QuotedDocument
+    protected
+
+    # 已建模的多行值不能被误判为配置缺失；证书正文不参与语义分析。
+    def multiline_fact?(text)
+      /\Aset (?:deviceconfig system (?:hostname|service|permitted-ip|ntp-servers|snmp-setting|authentication-profile|route service)\b|shared (?:server-profile tacplus|authentication-profile|authentication-sequence|log-settings syslog)\b|mgt-config users\b|network profiles interface-management-profile\b)/.match?(text)
+    end
+  end
+end

data/lib/baseline/parsers/base.rb

@@ -0,0 +1,256 @@
+# frozen_string_literal: true
+
+require "ctx_parser/configuration_parser"
+require "ctx_parser/input"
+require_relative "../document"
+
+module Baseline
+  module Parsers
+    # 共享输入与提取边界；CtxParser 跟踪来源，Facts 归纳领域证据。
+    class Base < CtxParser::ConfigurationParser
+      SERVICE_PORTS = { "ssh" => 22, "telnet" => 23, "snmp" => 161, "snmptrap" => 162 }.freeze
+      SNMP_OPTIONS = %w[auth priv authentication-mode privacy-mode acl access use-ipv4acl group local engineid engineID
+        encrypted localizedkey localizedV2key remote udp-port].freeze
+
+      private
+
+      # 解释当前命令回显，保留不支持或格式错误的证据。
+      def parse_output(text, complete:)
+        begin
+          text = CtxParser::Input.text(text, encoding: :utf8, max_bytes: 16 * 1024 * 1024)
+        rescue ArgumentError, EncodingError
+          return CtxParser::Result.new(status: :failed, issues: [ { code: :invalid_configuration } ])
+        end
+        read_configuration(text, document_class: configuration_document_class)
+        issues = document.issues.dup
+        if (!complete || issues.any?) && exclude_incomplete_final_line
+          issues << { code: :incomplete_final_line, line: cursor.lines.last.number }
+        end
+        @source_issues = issues
+        @facts = Facts.new(complete: complete, issues: issues)
+        if roots.empty?
+          return CtxParser::Result.new(status: :failed, issues: issues + [ { code: :empty_configuration } ])
+        end
+        if (hostname = matching(hostname_pattern).last)
+          name = analyze(hostname) { hostname.text[hostname_pattern, 1] }
+          record("hostname", name)
+          capture(hostname, name, [ "facts", "hostname" ])
+        end
+        access_lists
+        management
+        services
+        authentication
+        @facts.result
+      end
+
+      # 返回本次解析的根配置块。
+      def roots = @blocks
+      # 选择适合当前平台语法的文档词法解析器。
+      def configuration_document_class = Document
+      # 匹配当前平台显式声明的主机名。
+      def hostname_pattern = /\A(?:hostname|sysname)\s+(\S+)\z/
+      # 选择符合目标命令语法的根配置块。
+      def sections(pattern) = roots.select { |entry| pattern.match?(entry.text) }
+
+      # 保留原始文本，但不将可能截断的词元纳入事实构建树。
+      def exclude_incomplete_final_line
+        line = cursor.lines.last
+        return false unless line && !line.raw.end_with?("\n", "\r") && cursor.state(line.index) != :ignored
+
+        entries, ancestors = roots, []
+        while (entry = entries.last)
+          if entry.index == line.index
+            retained = entries[0...-1].freeze
+            ancestors.reverse_each do |siblings, parent|
+              block = CtxParser::Block.new(cursor: cursor, header: parent.header, children: retained, last_index: parent.last_index)
+              retained = (siblings[0...-1] + [ block ]).freeze
+            end
+            @blocks = retained
+            cursor.mark(line.index, state: :unsupported)
+            return true
+          end
+          ancestors << [ entries, entry ]
+          entries = entry.children
+        end
+        false
+      end
+
+      # 筛选匹配已支持命令模式的来源条目。
+      def matching(pattern, entries = roots) = entries.select { |entry| pattern.match?(entry.text) }
+      # 提取匹配值，并关联对应的来源条目。
+      def values(pattern, entries = roots)
+        entries.filter_map do |entry|
+          value = entry.text[pattern, 1]
+          analyze(entry) { value } unless value.nil?
+        end.uniq
+      end
+
+      # 按配置顺序选取最后一条匹配声明。
+      def last(pattern, entries = roots)
+        entry = entries.reverse.find { |candidate| !candidate.text[pattern, 1].nil? }
+        return unless entry
+
+        analyze(entry) { entry.text[pattern, 1] }
+      end
+
+      # 保存归一化事实及其来源证据。
+      def record(path, value, entries = [])
+        return unless @facts.record(path, value, lines: entries.map(&:line))
+
+        # 来源块中尚未解释的命令不能标记为解析成功。
+        cursor.capture_many(entries.select { |entry| cursor.parsed?(entry.index) }, data: value, path: [ "facts", path ])
+      end
+
+      # 记录事实不可用的原因，并保留对应的来源行。
+      def unknown(path, entries = [], code: :unsupported_syntax)
+        @facts.unknown(path, lines: entries.map(&:line), code: code)
+        entries.each { |entry| cursor.mark(entry.index, state: :unsupported) }
+      end
+
+      # 未解析的访问声明不能抹除其他已确认的写权限。
+      def unknown_snmp_access(entries, code: :unsupported_syntax)
+        @facts.unknown_snmp_permission(lines: entries.map(&:line), code: code)
+        %w[snmp.communities snmp.community_present snmp.users snmp.versions snmp.v3_auth_priv snmp.acl].each do |path|
+          unknown(path, entries, code: code)
+        end
+      end
+
+      # 按来源顺序确定最终生效的显式启用或禁用声明。
+      def state(on, off, entries = roots)
+        entries.reduce(nil) do |value, entry|
+          if off.match?(entry.text)
+            analyze(entry) { false }
+          elsif on.match?(entry.text)
+            analyze(entry) { true }
+          else
+            value
+          end
+        end
+      end
+
+      # 记录凭据属性，不保留凭据秘密值。
+      def credential(owner, kind, format, secret, entry)
+        value = analyze(entry) { Credential.new(owner: owner, kind: kind, format: format, secret: secret, line: entry.line) }
+        index = @facts.credential(value)
+        capture(entry, value.to_h, [ "facts", "credentials.records", index ])
+      end
+
+      # 注册有序 ACL 规则与别名，同时保留不支持的语法。
+      def register_acl(name, entries, aliases: [], supported: true, source: nil, &block)
+        commands = entries.reject { |entry| /\A(?:\d+\s+)?(?:description|remark|step|statistics|hardware-count)\b/.match?(entry.text) }
+        parsed = commands.map.with_index do |entry, index|
+          value = analyze(entry) { block.call(entry, index) }
+          cursor.mark(entry.index, state: :unsupported) unless value
+          value
+        end
+        damaged = @source_issues.any? do |issue|
+          line = issue[:line]
+          next false unless line
+
+          source ? source.line_range.cover?(line) : damaged_numbered_acl?(cursor.lines.fetch(line - 1).text, name)
+        end
+        acl = Acl.new(name: name, line: entries.first&.line, rules: parsed.compact,
+          supported: supported && !damaged && parsed.none?(&:nil?))
+        if @facts.register_acl(acl, aliases: aliases, lines: entries.map(&:line)).any?
+          entries.each { |entry| cursor.mark(entry.index, state: :unsupported) }
+        end
+      end
+
+      # 名称被分页截断时，所有匹配其前缀的编号 ACL 都不能声明完整。
+      def damaged_numbered_acl?(text, name)
+        prefix = text.split(/--\s*More\s*--|\e\[/i, 2).first
+        match = /\Aaccess-list(?:\s+(\S*))?(.*)\z/.match(prefix)
+        return false unless match
+
+        identity, suffix = match.captures
+        identity.to_s.empty? || (suffix.empty? ? name.start_with?(identity) : name == identity)
+      end
+
+      # 归一化 ACL 来源地址；不推测不支持语法的含义。
+      def source(parts)
+        token = parts.shift
+        return "0.0.0.0/0" if token == "any"
+        token = parts.shift if token == "host"
+        wildcard = parts.shift if parts.first&.match?(/\A(?:\d+(?:\.\d+){3}|0)\z/)
+        Acl.source(token, wildcard)
+      end
+
+      # 显式端口名称仅属于配置语法，不代表组织批准值。
+      def service_port(token)
+        return SERVICE_PORTS[token] unless token&.match?(/\A\d+\z/)
+        value = token.to_i
+        value if value.between?(0, 65_535)
+      end
+
+      # 服务器目标只接受 IP 地址或 DNS 名称，不接受网段或空词元。
+      def server_address?(value)
+        return false unless value.is_a?(String) && !value.empty?
+        IPAddr.new(value)
+        !value.include?("/")
+      rescue IPAddr::Error
+        value.bytesize <= 253 && !/\A[\d.]+\z/.match?(value) && value.delete_suffix(".").split(".", -1).all? do |label|
+          /\A[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\z/i.match?(label)
+        end
+      end
+
+      # 配置的监听端口仅替代当前服务的默认端口。
+      def listener_port(command, default:, scope:, negate: "undo")
+        prefix = Regexp.escape(command)
+        entries = matching(/\A(?:#{negate} )?#{prefix}(?:\s|\z)/)
+        return default if entries.empty?
+        entry = entries.last
+        return analyze(entry) { default } if entry.text == "#{negate} #{command}"
+        token = entry.text[/\A#{prefix}\s+(\d+)\z/, 1]
+        port = service_port(token)
+        return analyze(entry) { port } if port && port.positive?
+        unknown_listener_port(scope, entries)
+        nil
+      end
+
+      # 监听端口无法解析时，将依赖该端口的事实保留为未知。
+      def unknown_listener_port(scope, entries)
+        %w[sources restricted].each { |field| unknown("#{scope}.#{field}", entries, code: :unsupported_service_port) }
+      end
+
+      # 区分模式未声明、格式无效及包含完整算法与秘密值的声明。
+      def snmp_secret(settings, keyword, algorithms:, optional_algorithm: false, aes_size: false)
+        tokens = settings.split
+        index = tokens.index(keyword)
+        return false unless index
+        return if tokens.count(keyword) > 1
+        parameters = tokens.drop(index + 1).take_while { |token| !SNMP_OPTIONS.include?(token) }
+        if algorithms.include?(parameters.first)
+          algorithm = parameters.shift
+        elsif !optional_algorithm || parameters.size != 1 || %w[aes des md5 sha].include?(parameters.first)
+          return
+        end
+        return if algorithm == "aes" && aes_size && !%w[128 192 256].include?(parameters.shift)
+        format = parameters.shift if %w[cipher simple].include?(parameters.first)
+        return unless parameters.size == 1
+        [ format, parameters.first ]
+      end
+
+      # 提取 SNMP 凭据属性，不持久化秘密值。
+      def snmp_credentials(owner, modes, entry, format: nil)
+        modes.each_value do |value|
+          next if value == false
+          stored_format, secret = value || [ "unknown", nil ]
+          credential(owner, "snmp_user", stored_format || format || "unknown", secret, entry)
+        end
+        unknown("snmp.v3_auth_priv", [ entry ], code: :invalid_snmp_security) if modes.value?(nil)
+        modes.transform_values { |value| value ? true : value }
+      end
+
+      # 同名组可出现在不同安全级别；后续只读声明不能消除已有写权限。
+      def snmp_groups(entries)
+        entries.map { |entry| yield(entry) }.group_by(&:first).transform_values do |definitions|
+          records = definitions.map(&:last)
+          acls = records.map { |record| record[:acl] }.uniq
+          { acl: acls.one? ? acls.first : nil, acl_ambiguous: acls.size > 1,
+            write: Facts.write_permission(records.map { |record| record[:write] }),
+            line: records.first[:line], lines: records.map { |record| record[:line] } }
+        end
+      end
+    end
+  end
+end