baseline-rb 0.1.0

data/lib/baseline/parsers/cisco.rb

@@ -0,0 +1,324 @@
+# frozen_string_literal: true
+
+module Baseline
+  module Parsers
+    # 复用 Cisco 管理服务、IPv4 ACL、SNMP 和 AAA 的公共语法。
+    class Cisco < Base
+      SNMP_ROLE_WRITE = { "network-admin" => true, "vdc-admin" => true,
+        "network-operator" => false, "vdc-operator" => false }.freeze
+
+      private
+
+      # 解析管理访问暴露检查使用的有序 ACL 定义。
+      def access_lists
+        sections(/\Aip access-list\s+/).each do |section|
+          name = section.text.split.last
+          extended = section.text.start_with?("ip access-list extended ") || nxos?
+          register_acl(name, section.children, source: section) { |entry, index| cisco_rule(entry, index, extended: extended) }
+        end
+        matching(/\Aaccess-list\s+/).group_by { |entry| entry.text.split[1] }.each do |name, entries|
+          extended = name.to_i.between?(100, 199) || name.to_i.between?(2000, 2699)
+          register_acl(name, entries) { |entry, index| cisco_rule(entry, index, extended: extended, prefix: /\Aaccess-list\s+\S+\s+/) }
+        end
+      end
+
+      # 解析 Cisco ACL 条目，保留规则顺序及地址语义。
+      def cisco_rule(entry, index, extended:, prefix: /\A/)
+        text = entry.text.sub(prefix, "")
+        match = /\A(?:(\d+)\s+)?(permit|deny)\s+(.+)\z/.match(text)
+        return unless match
+        parts = match[3].split
+        protocol = extended ? parts.shift : "ip"
+        return unless %w[ip tcp udp icmp].include?(protocol)
+        network = source(parts)
+        return if extended && source(parts) != "0.0.0.0/0"
+        if extended && parts.first == "eq"
+          return unless %w[tcp udp].include?(protocol)
+          parts.shift
+          port = service_port(parts.shift)
+          return if port.nil?
+        end
+        return unless (parts - %w[log log-input]).empty?
+        rule = { sequence: match[1]&.to_i || index + 1, action: match[2], protocol: protocol, source: network, line: entry.line }
+        port.nil? ? rule : rule.merge(destination_port: port)
+      rescue ArgumentError, IPAddr::InvalidAddressError
+        nil
+      end
+
+      # 根据监听服务、认证方式与 ACL 绑定关系归纳管理访问事实。
+      def management
+        version = last(/\Aip ssh version\s+([12])\z/)
+        record("ssh.versions", [ version ]) if version
+        ssh = nxos? ? state(/\Afeature ssh\z/, /\Ano feature ssh\z/) : version ? true : nil
+        record("ssh.enabled", ssh, matching(/\A(?:ip ssh|(?:no )?feature ssh)/))
+        default_aaa = nxos? || state(/\Aaaa new-model\z/, /\Ano aaa new-model\z/) == true
+        vtys = sections(/\Aline vty(?:\s|\z)/).map do |section|
+          authentication = last(/\Alogin authentication\s+(\S+)\z/, section.children)
+          local = section.children.any? { |entry| entry.text == "login local" }
+          { name: section.text, protocols: last(/\Atransport input\s+(.+)\z/, section.children)&.split,
+            authentication: local ? "local" : (default_aaa ? "aaa" : nil),
+            authentication_list: authentication || (default_aaa ? "default" : nil),
+            acl: last(/\Aaccess-class\s+(\S+)\s+in(?:\s+vrf-also)?\z/, section.children), line: section.line }
+        end
+        rotary = matching(/\A(?:no )?ip ssh port(?:\s|\z)/)
+        rotary.concat(sections(/\Aline vty(?:\s|\z)/).flat_map { |section| matching(/\A(?:no )?rotary(?:\s|\z)/, section.children) })
+        unknown_listener_port("management.acl", rotary) unless rotary.empty?
+        telnet_ports = matching(/\A(?:no )?(?:ip )?telnet(?: server)? port(?:\s|\z)/)
+        unknown_listener_port("management.acl", telnet_ports) unless telnet_ports.empty?
+        @facts.management(vtys: vtys,
+          ssh_port: rotary.empty? ? listener_port("ssh port", default: 22, scope: "management.acl", negate: "no") : nil,
+          telnet_port: telnet_ports.empty? ? 23 : nil)
+        telnet = if nxos?
+          state(/\Afeature telnet\z/, /\Ano feature telnet\z/)
+        elsif vtys.any? && vtys.all? { |entry| entry[:protocols] }
+          vtys.any? { |entry| (entry[:protocols] & %w[all telnet]).any? }
+        end
+        record("services", { "telnet" => telnet, "http" => state(/\Aip http server\z/, /\Ano ip http server\z/),
+          "https" => state(/\Aip http secure-server\z/, /\Ano ip http secure-server\z/),
+          "ftp" => state(/\A(?:feature ftp-server|ftp-server enable)\z/, /\Ano (?:feature ftp-server|ftp-server enable)\z/),
+          "tftp" => state(/\A(?:feature tftp-server|tftp-server\s+.+)\z/, /\Ano (?:feature tftp-server|tftp-server\s+.+)\z/),
+          "finger" => state(/\A(?:ip finger|service finger)\z/, /\Ano (?:ip finger|service finger)\z/) })
+      end
+
+      # 采集明确启用或禁用的管理服务。
+      def services
+        record("ntp.servers", values(/\Antp server(?: vrf \S+)?\s+(\S+)/), matching(/\Antp server/))
+        record("ntp.authentication", state(/\Antp authenticate\z/, /\Ano ntp authenticate\z/))
+        record("ntp.source", last(/\Antp source(?:-interface)?\s+(\S+)\z/))
+        hosts = values(nxos? ? /\Alogging server\s+(\S+)/ : /\Alogging host(?: ipv6)?\s+(\S+)/)
+        hosts |= values(/\Alogging\s+(\d+(?:\.\d+){3})\z/) unless nxos?
+        record("syslog.servers", hosts, matching(/\Alogging (?:host|server)/))
+        record("syslog.source", last(/\Alogging source-interface\s+(\S+)\z/))
+        snmp = matching(/\Asnmp-server\b/)
+        enabled = nxos? ? state(/\Asnmp-server protocol enable\z/, /\Ano snmp-server protocol enable\z/) : nil
+        enabled = nxos? || snmp.any? if enabled.nil? && (@facts.complete? || snmp.any?)
+        record("snmp.enabled", enabled)
+        communities = {}
+        matching(/\Asnmp-server community\b/).each do |entry|
+          match = /\Asnmp-server community\s+(\S+)(?:\s+(.*))?\z/.match(entry.text)
+          unless match
+            unknown_snmp_access([ entry ])
+            next
+          end
+          settings = match[2].to_s
+          community = communities[match[1]] ||= { line: entry.line }
+          permission = settings[/\A(ro|rw)\b/i, 1]&.downcase
+          role = settings[/\bgroup\s+(\S+)/, 1]
+          community[:write] = permission == "rw" if permission
+          community[:write] = SNMP_ROLE_WRITE[role] if role
+          acl = nxos? ? settings[/\buse-ipv4acl\s+(\S+)/, 1] : settings[/\A(?:ro|rw)\s+(\S+)\z/i, 1]
+          community[:acl] = acl if acl
+          credential("snmp-community", "snmp", "plain", match[1], entry) unless @facts.credential_recorded?(community[:line])
+        end
+        versions = communities.any? ? %w[v1 v2c] : []
+        groups = snmp_groups(matching(/\Asnmp-server group\s+.+?\s+v3\b/)) do |entry|
+          name, settings = entry.text.match(/\Asnmp-server group\s+(.+?)\s+v3(?:\s+(.*))?\z/).captures
+          write = name.include?('"') ? nil : snmp_group_write(settings.to_s)
+          [ name, { acl: entry.text[/\baccess\s+(\S+)/, 1], line: entry.line, write: write } ]
+        end
+        record("snmp.groups", groups)
+        users = {}
+        matching(/\Asnmp-server user\b/).each do |entry|
+          match = /\Asnmp-server user\s+(\S+)\s+(\S+)(.*)\z/.match(entry.text)
+          unless match
+            unknown_snmp_access([ entry ])
+            next
+          end
+          if nxos? && match[2] == "use-ipv4acl"
+            user = users[match[1]] ||= { name: match[1], line: entry.line }
+            user[:acl] = match[3].strip
+            next
+          end
+          settings = match[3]
+          if /\bv[12]c?\b/.match?(settings)
+            unknown_snmp_access([ entry ], code: :unsupported_snmp_user)
+            next
+          end
+          unless nxos? || /\bv3\b/.match?(settings)
+            unknown_snmp_access([ entry ])
+            next
+          end
+          versions |= [ "v3" ]
+          user = users[match[1]] ||= { name: match[1], line: entry.line }
+          if nxos?
+            (user[:roles] ||= []) << match[2]
+            user[:roles].uniq!
+            user[:write] = Facts.write_permission(user[:roles].map { |role| SNMP_ROLE_WRITE[role] })
+            next if settings.strip.empty?
+          end
+          modes = { auth: snmp_secret(settings, "auth", algorithms: %w[md5 sha sha-224 sha-256 sha-384 sha-512]),
+            priv: snmp_secret(settings, "priv", algorithms: %w[des 3des aes aes-128 aes-192 aes-256], optional_algorithm: nxos?, aes_size: !nxos?) }
+          security = snmp_credentials("snmp:#{match[1]}", modes, entry, format: /\bencrypted\b/.match?(settings) ? "cipher" : "unknown")
+          user.merge!(security).merge!(group: match[2])
+          acl = settings[/\b(?:access|use-ipv4acl)\s+(\S+)/, 1]
+          user[:acl] = acl if acl
+        end
+        port_overrides = matching(/\A(?:no )?snmp-server (?:listen-port|udp-port|port)(?:\s|\z)/)
+        unknown_listener_port("snmp.acl", port_overrides) unless port_overrides.empty?
+        @facts.snmp(communities: communities.values, users: users.values, groups: nxos? ? nil : groups,
+          port: port_overrides.empty? ? 161 : nil)
+        nxos_snmp_coverage(users, enabled: enabled) if nxos?
+        unknown("snmp.v3_auth_priv", code: :snmp_user_unresolved) if users.values.any? { |user| !user.key?(:auth) }
+        versions |= values(/\Asnmp-server group\s+\S+\s+(v1|v2c|v3)\b/)
+        legacy_groups = matching(/\Asnmp-server group\s+\S+\s+v(?:1|2c)\b/)
+        if legacy_groups.any?
+          @facts.unknown_snmp_permission(lines: legacy_groups.map(&:line), code: :unsupported_snmp_group)
+          unknown("snmp.acl", legacy_groups, code: :unsupported_snmp_group)
+        end
+        record("snmp.versions", versions) unless versions.empty?
+      end
+
+      # NX-OS 通常会同步 CLI 与 SNMP 账号；缺少证据时不能构造虚拟用户。
+      def nxos_snmp_coverage(users, enabled:)
+        return if enabled == false
+        sync_disabled = state(/\Asnmp-server disable snmp-aaa sync\z/, /\Ano snmp-server disable snmp-aaa sync\z/)
+        return if sync_disabled == true
+
+        matching(/\Ausername\s+/).group_by { |entry| entry.text.split[1] }.each do |name, entries|
+          roles = entries.filter_map { |entry| entry.text[/\brole\s+(\S+)\s*\z/, 1] }.uniq
+          covered = users[name]&.fetch(:roles, []) || []
+          next if roles.any? && (roles - covered).empty?
+
+          @facts.unknown_snmp_permission(lines: entries.map(&:line), code: :snmp_user_sync_unconfirmed)
+        end
+      end
+
+      # IOS 默认不授予写视图；不熟悉的组配置项不能证明只读权限。
+      def snmp_group_write(settings)
+        syntax = /\A(?:auth|noauth|priv)(?:\s+(?:read|(?<write>write)|notify|context)\s+[^\s"]+|\s+match\s+(?:exact|prefix)|\s+access(?:\s+ipv6)?\s+[^\s"]+)*\z/
+        match = syntax.match(settings)
+        return unless match
+
+        !match[:write].nil?
+      end
+
+      # 解析实际生效的认证方法及外部服务器引用。
+      def authentication
+        servers, aliases, keyed = [], {}, []
+        global_key = matching(/\Atacacs-server key\s+/)
+        global_key.each { |entry| parse_key("tacacs", entry.text.sub(/\Atacacs-server key\s+/, ""), entry) }
+        matching(/\Atacacs-server host\s+/).each do |entry|
+          host = entry.text.split[2]
+          servers << host
+          key = entry.text[/\bkey\s+(.+)\z/, 1]
+          if key
+            parse_key("tacacs:#{host}", key, entry)
+            keyed << host
+          end
+        end
+        sections(/\Atacacs server\s+/).each do |section|
+          hosts = values(/\Aaddress ipv[46]\s+(\S+)/, section.children)
+          aliases[section.text.split.last] = hosts
+          servers |= hosts
+          matching(/\Akey\s+/, section.children).each do |entry|
+            parse_key("tacacs:#{section.text.split.last}", entry.text.delete_prefix("key "), entry)
+            keyed |= hosts
+          end
+        end
+        groups = sections(/\Aaaa group server tacacs\+\s+/).to_h do |section|
+          members = values(/\Aserver(?: name)?\s+(\S+)/, section.children)
+          [ section.text.split.last, members.flat_map { |member| aliases.fetch(member, [ member ]) } ]
+        end
+        record("tacacs.servers", servers.uniq)
+        record("tacacs.groups", groups)
+        tacacs_login(servers, groups)
+        patterns = { "authorization" => /\Aaaa authorization (?:exec|commands(?: \d+)?) default\s+(.+)\z/,
+          "accounting" => /\Aaaa accounting (?:(?:exec|commands(?: \d+)?) )?default\s+(.+)\z/ }
+        patterns.each do |kind, pattern|
+          references = values(pattern).flat_map { |methods| methods.scan(/\bgroup\s+(\S+)/).flatten }
+          selected = references.flat_map { |name| name == "tacacs+" ? servers : groups.fetch(name, []) }.uniq
+          unresolved = references.any? { |name| name != "radius" && name != "tacacs+" && !groups.key?(name) } || (selected - servers).any?
+          if unresolved
+            unknown("tacacs.#{kind}", matching(pattern), code: :tacacs_group_unresolved)
+          else
+            used = selected.any?
+            record("tacacs.#{kind}", used, matching(pattern)) if @facts.complete? || used
+          end
+        end
+        record("tacacs.keys_present", global_key.any? || (servers - keyed).empty?) unless servers.empty?
+        accounts
+      end
+
+      # 解析各 VTY 实际选用的登录列表，包括命名列表。
+      def tacacs_login(servers, groups)
+        pattern = /\Aaaa authentication login\s+(\S+)\s+(.+)\z/
+        lists = matching(pattern).each_with_object({}) do |entry, result|
+          name, methods = analyze(entry) { entry.text.match(pattern).captures }
+          result[name] = { methods: methods, entry: entry }
+        end
+        entries = @facts.vtys.filter_map { |vty| lists[vty[:authentication_list]]&.fetch(:entry) }.uniq
+        results = @facts.vtys.map do |vty|
+          if vty[:authentication].nil?
+            :vty_authentication_unknown
+          elsif vty[:authentication] != "aaa"
+            false
+          elsif (list = lists[vty[:authentication_list]])
+            tacacs_login_method(list[:methods], servers, groups)
+          else
+            :authentication_list_unresolved
+          end
+        end
+        results << :vty_authentication_unknown if results.empty?
+        if results.include?(false)
+          record("tacacs.login", false, entries) if @facts.complete?
+        elsif (reason = results.find { |value| value.is_a?(Symbol) })
+          unknown("tacacs.login", entries, code: reason)
+        else
+          record("tacacs.login", true, entries)
+        end
+      end
+
+      # 仅当首选认证方法引用可解析的 TACACS 组时，才确认使用 TACACS。
+      def tacacs_login_method(methods, servers, groups)
+        tokens = methods.split
+        outcomes = []
+        until tokens.empty?
+          case tokens.shift
+          when "group"
+            name = tokens.shift
+            if name == "radius"
+              outcomes << false
+              next
+            end
+            return :tacacs_group_unresolved unless name == "tacacs+" || groups.key?(name)
+            selected = name == "tacacs+" ? servers : groups.fetch(name)
+            return :tacacs_group_unresolved unless (selected - servers).empty?
+            outcomes << selected.any?
+          when "local", "local-case", "none", "enable", "line"
+            outcomes << false
+          else
+            return :unsupported_authentication_method
+          end
+        end
+        outcomes.first
+      end
+
+      # 提取已配置的凭据编码方式，不保留秘密值。
+      def parse_key(owner, text, entry)
+        match = /\A(?:(\d+)\s+)?(\S+)/.match(text)
+        credential(owner, "tacacs", match&.[](1) || "plain", match&.[](2), entry)
+      end
+
+      # 提取本地账号角色及凭据存储属性。
+      def accounts
+        matching(/\Ausername\s+/).group_by { |entry| entry.text.split[1] }.each do |name, entries|
+          passwords = entries.filter_map do |entry|
+            match = /\b(?:password|secret)\s+(?:(\d+)\s+)?(\S+)/.match(entry.text)
+            credential(name, "local_user", match[1] || "plain", match[2], entry) if match
+          end
+          credential(name, "local_user", "unknown", nil, entries.first) if passwords.empty?
+        end
+        matching(/\Aenable (?:password|secret)\s+/).each do |entry|
+          match = /\Aenable (?:password|secret)(?: level \d+)?\s+(?:(\d+)\s+)?(\S+)/.match(entry.text)
+          credential("enable", "enable", match ? match[1] || "plain" : "unknown", match&.[](2), entry)
+        end
+        sections(/\Aline\b/).each do |section|
+          matching(/\Apassword\b/, section.children).each do |entry|
+            match = /\Apassword\s+(?:(\d+)\s+)?(\S+)/.match(entry.text)
+            credential(section.text, "line", match ? match[1] || "plain" : "unknown", match&.[](2), entry)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/baseline/parsers/cisco_ios.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Baseline
+  module Parsers
+    # 解析 IOS、IOS-XE 的 VTY 协议和 AAA 登录列表。
+    class CiscoIos < Cisco
+      private
+
+      # 选择共享 Cisco 解析逻辑中的 NX-OS 分支。
+      def nxos? = false
+    end
+  end
+end

data/lib/baseline/parsers/cisco_nxos.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Baseline
+  module Parsers
+    # 解析 NX-OS 功能开关、角色权限及命名扩展 ACL。
+    class CiscoNxos < Cisco
+      private
+
+      # 选择共享 Cisco 解析逻辑中的 NX-OS 分支。
+      def nxos? = true
+    end
+  end
+end

data/lib/baseline/parsers/comware.rb

@@ -0,0 +1,216 @@
+# frozen_string_literal: true
+
+module Baseline
+  module Parsers
+    # 复用 Comware 与 VRP 结构，由厂商子类选择账号、SSH 和 TACACS 语法。
+    class Comware < Base
+      private
+
+      # 解析管理访问暴露检查使用的有序 ACL 定义。
+      def access_lists
+        sections(/\Aacl\s+/).each do |section|
+          # IPv6 ACL 不能误建为名为 ipv6 的 IPv4 ACL，也不能覆盖其别名。
+          if /\Aacl\s+ipv6\b/.match?(section.text)
+            unknown("ipv6.acls", [ section ], code: :unsupported_acl_family)
+            next
+          end
+          match = /\Aacl\s+(?:number\s+|basic\s+|advanced\s+)?(?:name\s+)?(\S+)(?:\s+name\s+(\S+))?(?:\s+.*)?\z/.match(section.text)
+          next unless match
+          register_acl(match[2] || match[1], section.children, source: section, aliases: [ match[1] ], supported: !section.text.include?("match-order auto")) do |entry, index|
+            comware_rule(entry, index)
+          end
+        end
+      end
+
+      # 解析单条有序 Comware ACL 规则及来源限制。
+      def comware_rule(entry, _index)
+        match = /\Arule\s+(\d+)\s+(permit|deny)(?:\s+(.*))?\z/.match(entry.text)
+        return unless match
+        parts = match[3].to_s.split
+        protocol = %w[ip tcp udp icmp].include?(parts.first) ? parts.shift : "ip"
+        network = if parts.first == "source"
+          parts.shift
+          source(parts)
+        else
+          "0.0.0.0/0"
+        end
+        if parts.first == "destination"
+          parts.shift
+          return unless source(parts) == "0.0.0.0/0"
+        end
+        if parts.first == "destination-port"
+          return unless %w[tcp udp].include?(protocol)
+          parts.shift
+          return unless parts.shift == "eq"
+          port = service_port(parts.shift)
+          return if port.nil?
+        end
+        return unless (parts - %w[logging counting]).empty?
+        rule = { sequence: match[1].to_i, action: match[2], protocol: protocol, source: network, line: entry.line }
+        port.nil? ? rule : rule.merge(destination_port: port)
+      rescue ArgumentError, IPAddr::InvalidAddressError
+        nil
+      end
+
+      # 根据监听服务、认证方式与 ACL 绑定关系归纳管理访问事实。
+      def management
+        record("ssh.enabled", state(ssh_enable, ssh_disable), matching(/\A(?:undo )?(?:ssh|stelnet)/))
+        compatible = state(/\Assh server compatible-ssh1x enable\z/, /\A(?:undo ssh server compatible-ssh1x enable|ssh server compatible-ssh1x disable)\z/)
+        record("ssh.versions", compatible.nil? ? nil : compatible ? [ "1", "2" ] : [ "2" ])
+        ssh_acl = last(/\Assh server acl(?: ipv4)?\s+(?:name\s+)?(\S+)\z/)
+        defaults = sections(/\Aline class vty\z/).flat_map(&:children)
+        vtys = sections(/\A(?:line|user-interface) vty\b/).map do |section|
+          entries = defaults + section.children
+          { name: section.text, protocols: last(/\Aprotocol inbound\s+(.+)\z/, entries)&.split,
+            authentication: last(/\Aauthentication-mode\s+(\S+)\z/, entries),
+            acl: last(/\Aacl\s+(?:name\s+)?(\S+)(?:\s+inbound)?\z/, entries), line: section.line }
+        end
+        @facts.management(vtys: vtys, ssh_acl: ssh_acl,
+          ssh_port: listener_port("ssh server port", default: 22, scope: "management.acl"),
+          telnet_port: listener_port("telnet server port", default: 23, scope: "management.acl"))
+        definitions = { "telnet" => "telnet server", "http" => "ip http", "https" => "ip https", "ftp" => "ftp server", "tftp" => "tftp server" }
+        record("services", definitions.to_h do |name, command|
+          [ name, state(/\A#{command} enable\z/, /\A(?:undo #{command} enable|#{command} disable)\z/) ]
+        end)
+      end
+
+      # 采集明确启用或禁用的管理服务。
+      def services
+        record("ntp.servers", values(/\Antp-service unicast-server\s+(\S+)/), matching(/\Antp-service unicast-server/))
+        record("ntp.authentication", state(/\Antp-service authentication enable\z/, /\Aundo ntp-service authentication enable\z/))
+        record("ntp.source", last(/\Antp-service source(?:-interface)?\s+(\S+)\z/))
+        # 从日志服务器中排除 source 子命令，并保留评估所需的归纳事实。
+        hosts = values(/\Ainfo-center loghost\s+(\S+)/) - [ "source" ]
+        record("syslog.servers", hosts, matching(/\Ainfo-center loghost/))
+        record("syslog.source", last(/\Ainfo-center loghost source\s+(\S+)\z/))
+        enabled = state(/\Asnmp-agent(?:\s|\z)/, /\Aundo snmp-agent\z/)
+        record("snmp.enabled", enabled.nil? && @facts.complete? ? false : enabled)
+        versions = last(/\Asnmp-agent sys-info version\s+(.+)\z/)&.split
+        versions = %w[v1 v2c v3] if versions == [ "all" ]
+        record("snmp.versions", versions)
+        communities = matching(/\Asnmp-agent community\b/).filter_map do |entry|
+          match = /\Asnmp-agent community (read|write)\s+(?:(simple|cipher)\s+)?(\S+)(.*)\z/.match(entry.text)
+          unless match
+            unknown_snmp_access([ entry ])
+            next
+          end
+          credential("snmp-community", "snmp", match[2] || "plain", match[3], entry)
+          { write: match[1] == "write", acl: match[4][/\bacl\s+(?:name\s+)?(\S+)/, 1], line: entry.line }
+        end
+        groups = snmp_groups(matching(/\Asnmp-agent group v3\s+/)) do |entry|
+          settings = entry.text.sub(/\Asnmp-agent group v3\s+\S+\s*/, "")
+          [ entry.text.split[3], { acl: entry.text[/\bacl\s+(?:name\s+)?(\S+)/, 1], line: entry.line, write: snmp_group_write(settings) } ]
+        end
+        record("snmp.groups", groups)
+        users = {}
+        matching(/\Asnmp-agent usm-user\b/).each do |entry|
+          match = /\Asnmp-agent usm-user v3\s+(\S+)(?:\s+(.*))?\z/.match(entry.text)
+          unless match
+            unknown_snmp_access([ entry ], code: :unsupported_snmp_user)
+            next
+          end
+          settings = match[2].to_s
+          user = users[match[1]] ||= { name: match[1], auth: false, priv: false, line: entry.line }
+          group = settings[/\Agroup\s+(\S+)/, 1]
+          first = settings.split.first
+          group ||= first unless %w[group authentication-mode privacy-mode acl local engineid].include?(first)
+          user[:group] = group if group
+          modes = { auth: snmp_secret(settings, "authentication-mode", algorithms: %w[md5 sha sha2-224 sha2-256 sha2-384 sha2-512]),
+            priv: snmp_secret(settings, "privacy-mode", algorithms: %w[des des56 3des aes128 aes192 aes256]) }
+          snmp_credentials("snmp:#{match[1]}", modes, entry).each { |key, value| user[key] ||= value }
+          acl = settings[/\bacl\s+(?:name\s+)?(\S+)/, 1]
+          user[:acl] = acl if acl
+        end
+        @facts.snmp(communities: communities, users: users.values, groups: groups,
+          port: listener_port(snmp_port_command, default: 161, scope: "snmp.acl"))
+      end
+
+      # Comware、VRP 必须明确授予写视图；引号或未知语法保持未解析。
+      def snmp_group_write(settings)
+        syntax = /\A(?:(?:authentication|privacy|noauthentication)(?:\s+|\z))?(?:(?:read-view|(?<write>write-view)|notify-view)\s+[^\s"]+\s*|acl(?:\s+ipv6)?(?:\s+name)?\s+[^\s"]+\s*|acl-ipv[46]\s+[^\s"]+\s*)*\z/
+        match = syntax.match(settings)
+        return unless match
+
+        !match[:write].nil?
+      end
+
+      # 解析实际生效的认证方法及外部服务器引用。
+      def authentication
+        schemes = sections(tacacs_section).to_h do |section|
+          server_types = matching(tacacs_server, section.children).group_by { |entry| entry.text.split[1] }
+            .transform_values { |entries| values(tacacs_server, entries) }
+          servers = server_types.values.flatten.uniq
+          keys = section.children.filter_map do |entry|
+            match = tacacs_key.match(entry.text)
+            next unless match
+            kind, format, secret = match.captures
+            credential("tacacs:#{section.text.split.last}", "tacacs", format, secret, entry)
+            kind
+          end
+          [ section.text.split.last, { servers: servers, server_types: server_types, key_types: keys.uniq, line: section.line } ]
+        end
+        record("tacacs.schemes", schemes)
+        record("tacacs.servers", schemes.values.flat_map { |entry| entry[:servers] }.uniq)
+        domains = authentication_domains
+        methods = domains.flat_map { |entry| entry.children }
+        %w[authentication authorization accounting].each do |kind|
+          relevant = matching(/\A#{kind}\s+login\b/, methods)
+          relevant = matching(/\A#{kind}\s+default\b/, methods) if relevant.empty?
+          refs = relevant.filter_map { |entry| entry.text[/\A#{kind}\s+(?:login|default)\s+hwtacacs-scheme\s+(\S+)/, 1] }
+          refs.concat(vrp_tacacs_references(kind, domains))
+          key = kind == "authentication" ? "login" : kind
+          if refs.any? && refs.any? { |name| !schemes.key?(name) || schemes[name][:server_types].fetch(kind, []).empty? }
+            unknown("tacacs.#{key}", relevant, code: :tacacs_scheme_unresolved)
+          else
+            used = refs.any?
+            if used && key == "login"
+              unknown("tacacs.login", code: :vty_authentication_unknown) if @facts.vtys.empty? || @facts.vtys.any? { |vty| vty[:authentication].nil? }
+              used &&= @facts.vtys.any? && @facts.vtys.all? { |vty| %w[scheme aaa].include?(vty[:authentication]) }
+            end
+            record("tacacs.#{key}", used, relevant) if @facts.complete? || used
+          end
+        end
+        record("tacacs.keys_present", schemes.values.all? { |entry| tacacs_keys_complete?(entry[:key_types]) }) unless schemes.empty?
+        accounts
+        sections(/\A(?:line|user-interface)\b/).each do |section|
+          matching(/\A(?:set authentication )?password\b/, section.children).each do |entry|
+            match = /\A(?:set authentication )?password\s+(simple|cipher|hash|irreversible-cipher)\s+(.+)\z/.match(entry.text)
+            credential(section.text, "line", match ? match[1] : "unknown", match&.[](2), entry)
+          end
+        end
+        matching(/\Asuper password\b/).each do |entry|
+          match = /\Asuper password(?: level \d+)?\s+(simple|cipher|hash)\s+(.+)\z/.match(entry.text)
+          credential("super", "enable", match ? match[1] : "unknown", match&.[](2), entry)
+        end
+      end
+
+      # 解析认证域引用及其服务器组。
+      def authentication_domains
+        name = last(/\Adomain default enable\s+(\S+)\z/)
+        unless name
+          %w[login authorization accounting].each { |kind| unknown("tacacs.#{kind}", code: :authentication_domain_unknown) }
+          return []
+        end
+        sections(/\Adomain #{Regexp.escape(name)}\z/)
+      end
+      # 解析 VRP 认证域引用，避免将 VRP 语法应用到 Comware。
+      def vrp_tacacs_references(_kind, _domains) = []
+      # 返回当前平台修改 SNMP 监听端口的命令模式。
+      def snmp_port_command = "snmp-agent port"
+
+      # 提取本地账号角色及凭据存储属性。
+      def accounts
+        sections(/\Alocal-user\s+/).each do |section|
+          next if section.text.start_with?("local-user password-")
+          name = section.text.split[1]
+          passwords = matching(/\Apassword\s+/, section.children)
+          passwords.each do |entry|
+            match = /\Apassword\s+(simple|cipher|hash|irreversible-cipher)\s+(.+)\z/.match(entry.text)
+            credential(name, "local_user", match ? match[1] : "unknown", match ? match[2] : nil, entry)
+          end
+          credential(name, "local_user", "unknown", nil, section) if passwords.empty? && @facts.complete?
+        end
+      end
+    end
+  end
+end

data/lib/baseline/parsers/h3c.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Baseline
+  module Parsers
+    # 解析 H3C Comware 的 SSH、域认证及三类 TACACS 密钥角色。
+    class H3c < Comware
+      private
+
+      # 匹配当前平台显式启用 SSH 的命令。
+      def ssh_enable = /\Assh server enable\z/
+      # 匹配当前平台显式禁用 SSH 的命令。
+      def ssh_disable = /\A(?:undo ssh server enable|ssh server disable)\z/
+      # 匹配当前平台 TACACS 配置块的根语句。
+      def tacacs_section = /\Ahwtacacs scheme\s+/
+      # 匹配认证、授权或计费服务器声明。
+      def tacacs_server = /\A(?:primary|secondary) (?:authentication|authorization|accounting)\s+(\S+)/
+      # 匹配已配置 TACACS 密钥的存储格式。
+      def tacacs_key = /\Akey (authentication|authorization|accounting) (simple|cipher) (.+)\z/
+      # 要求具备当前平台 TACACS 方案使用的全部密钥角色。
+      def tacacs_keys_complete?(types) = (%w[authentication authorization accounting] - types).empty?
+    end
+  end
+end