baseline-rb 0.1.0

data/lib/baseline/parsers/hillstone.rb

@@ -0,0 +1,278 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "../hillstone_document"
+
+module Baseline
+  module Parsers
+    # StoneOS 管理端点与原生主机允许列表不同于路由器 VTY。
+    class Hillstone < Base
+      MANAGEMENT_SERVICES = %w[ssh telnet http https ftp snmp].freeze
+      HOST_PROTOCOLS = %w[ssh telnet http https netconf any].freeze
+
+      private
+
+      # 选择适合当前平台语法的文档词法解析器。
+      def configuration_document_class = HillstoneDocument
+
+      # 解析管理访问暴露检查使用的有序 ACL 定义。
+      def access_lists
+        @tokens = {}
+      end
+
+      # 已配置主机 ACL 本身不能证明管理监听服务已启用。
+      def management
+        interfaces = sections(/\Ainterface\s+/)
+        states = interfaces.map do |section|
+          matching(/\A(?:no )?manage\s+/, section.children).each_with_object({}) do |entry, values|
+            parts = tokens(entry)
+            negative = parts.first == "no"
+            parts = parts.drop(1) if negative
+            next unless MANAGEMENT_SERVICES.include?(parts[1])
+            if parts.size == 2
+              values[parts[1]] = analyze(entry) { !negative }
+            else
+              values[parts[1]] = nil
+            end
+          end
+        end
+        services = MANAGEMENT_SERVICES.to_h do |name|
+          values = states.map { |state| state[name] }
+          enabled = values.include?(true) ? true : values.any? && values.all?(false) ? false : nil
+          [ name, enabled ]
+        end
+        record("ssh.enabled", services["ssh"])
+        record("services", services.slice("telnet", "http", "https", "ftp"))
+        management_sources
+      end
+
+      # 信任主机可使用 CIDR、掩码、区间或 any；跨协议按保守并集处理。
+      def management_sources
+        entries = matching(/\A(?:no )?admin host\b/)
+        sources = entries.flat_map do |entry|
+          parts = tokens(entry)
+          raise ArgumentError unless parts.take(2) == %w[admin host] && HOST_PROTOCOLS.include?(parts.last)
+          analyze(entry) { host_networks(parts[2...-1]) }
+        rescue ArgumentError, IPAddr::Error
+          unknown("management.acl", [ entry ], code: :unsupported_trusted_host)
+          nil
+        end
+        if entries.empty?
+          return unless @facts.complete?
+          # 未显式配置受信任主机时，不能据此证明来源访问受限。
+          @facts.direct_acl(fact: "management.acl", sources: nil, bound: false)
+        else
+          @facts.direct_acl(fact: "management.acl", sources: sources.include?(nil) ? nil : sources,
+            bound: true, lines: entries.map(&:line))
+        end
+      end
+
+      # 采集明确启用或禁用的管理服务。
+      def services
+        ntp
+        syslog
+        snmp
+      end
+
+      # 提取时间同步服务器及相关认证配置。
+      def ntp
+        entries = matching(/\Antp server\b/)
+        sources = []
+        servers = entries.filter_map do |entry|
+          parts = tokens(entry)
+          unless server_address?(parts[2])
+            unknown("ntp", [ entry ])
+            next
+          end
+          options = pairs(parts.drop(3), flags: [ "prefer" ], keys: %w[key source vrouter])
+          unless options && (!options["key"] || /\A[1-9]\d*\z/.match?(options["key"]))
+            unknown("ntp", [ entry ])
+            next
+          end
+          sources << options["source"]
+          analyze(entry) { parts[2] }
+        end
+        record("ntp.servers", servers.uniq, entries)
+        record("ntp.authentication", state(/\Antp authentication\z/, /\Ano ntp authentication\z/))
+        record("ntp.source", sources.first) if sources.any? && sources.first && sources.uniq.one?
+        unknown("ntp", matching(/\Ano ntp server\b/)) if matching(/\Ano ntp server\b/).any?
+      end
+
+      # 同一目标可供多个日志类别使用，统计时只计一次。
+      def syslog
+        entries = matching(/\Alogging syslog\b/)
+        sources = []
+        servers = entries.filter_map do |entry|
+          parts = tokens(entry)
+          options = parts.drop(3)
+          source = nil
+          if %w[vrouter source-interface].include?(options.first)
+            source = options[1] if options.first == "source-interface"
+            options = options.drop(2)
+          end
+          valid = server_address?(parts[2]) && %w[tcp udp secure-tcp].include?(options[0]) && service_port(options[1])&.positive?
+          tail = options.drop(2)
+          tail = tail.drop(1) if options[0] == "secure-tcp" && tail.first == "server-cert-check-disable"
+          valid &&= tail.empty? || tail.first == "type" && tail.size >= 2
+          unless valid
+            unknown("syslog", [ entry ])
+            next
+          end
+          sources << source
+          analyze(entry) { parts[2] }
+        end
+        record("syslog.servers", servers.uniq, entries)
+        record("syslog.source", sources.first) if sources.any? && sources.first && sources.uniq.one?
+        unknown("syslog", matching(/\Ano logging syslog\b/)) if matching(/\Ano logging syslog\b/).any?
+      end
+
+      # 轮询主机权限独立于出站 Trap 接收端。
+      def snmp
+        record("snmp.enabled", state(/\Asnmp-server manager\z/, /\Ano snmp-server manager\z/))
+        entries = matching(/\Asnmp-server host\b/)
+        versions, sources, communities = [], [], []
+        entries.each do |entry|
+          parts = tokens(entry)
+          offset = parts.index("version")
+          raise ArgumentError unless offset && offset > 2
+          networks = host_networks(parts[2...offset])
+          settings = parts.drop(offset + 1)
+          if %w[1 2c].include?(settings.first) && settings[1] == "community" && !settings[2].to_s.empty? &&
+              (settings.size == 3 || settings.size == 4 && %w[ro rw].include?(settings[3]))
+            credential("snmp-community", "snmp", secret_format(settings[2]), settings[2], entry)
+            versions << (settings.first == "1" ? "v1" : "v2c")
+            communities << { write: settings[3] == "rw", line: entry.line }
+            sources.concat(networks)
+          elsif settings == [ "3" ]
+            versions << "v3"
+            sources.concat(networks)
+            analyze(entry) { true }
+          else
+            raise ArgumentError
+          end
+        rescue ArgumentError, IPAddr::Error
+          unknown_snmp_access([ entry ], code: :unsupported_snmp_host)
+        end
+        record("snmp.versions", versions.uniq, entries)
+        unsupported = matching(/\A(?:snmp-server (?:user|group)\b|no snmp-server (?:host|user|group)\b)/)
+        unknown_snmp_access(unsupported, code: :unsupported_snmp_security) if unsupported.any? || versions.include?("v3")
+        @facts.snmp(communities: communities, users: [])
+        @facts.direct_acl(fact: "snmp.acl", sources: sources, bound: true, lines: entries.map(&:line)) if entries.any?
+      end
+
+      # 分别记录 TACACS 定义与管理认证引用。
+      def authentication
+        definitions = sections(/\Aaaa-server\s+/).filter_map do |section|
+          parts = tokens(section)
+          unless parts.size == 4 && parts[2..] == %w[type tacacs+]
+            unknown("tacacs", [ section ]) if parts.include?("tacacs+")
+            next
+          end
+          endpoints = matching(/\A(?:host|backup[12])\b/, section.children)
+          servers = endpoints.filter_map do |entry|
+            values = tokens(entry)
+            if server_address?(values[1]) && (values.size == 2 || values.size == 4 && values[2] == "vrouter")
+              analyze(entry) { values[1] }
+            else
+              unknown("tacacs", [ entry ])
+              nil
+            end
+          end
+          secrets = matching(/\Asecret\b/, section.children)
+          keys = secrets.map { |entry| stored_secret("tacacs:#{parts[1]}", "tacacs", entry) }
+          [ parts[1], { servers: servers.uniq, keys_present: keys.any? && keys.all?, line: section.line,
+            declaration: section.children.empty? } ]
+        end
+        schemes = definitions.group_by(&:first).to_h do |name, entries|
+          # StoneOS 会先导出空的前向声明，再导出包含内容的服务器块。
+          populated = entries.map(&:last).reject { |entry| entry[:declaration] }
+          selected = populated.last || entries.last.last
+          @facts.unknown("tacacs", lines: populated.map { |entry| entry[:line] }, code: :duplicate_tacacs_scheme) if populated.size > 1
+          if selected[:servers].empty?
+            @facts.unknown("tacacs.servers", lines: [ selected[:line] ], code: :tacacs_server_unresolved)
+          end
+          [ name, selected.except(:declaration) ]
+        end
+        record("tacacs.schemes", schemes)
+        record("tacacs.servers", schemes.values.flat_map { |scheme| scheme[:servers] }.uniq)
+        record("tacacs.keys_present", schemes.values.all? { |scheme| scheme[:keys_present] }) if schemes.any?
+        { "authentication-server" => "login", "authorization-mode" => "authorization" }.each do |command, fact|
+          entries = matching(/\Aadmin #{command}\b/)
+          next if entries.empty?
+          parts = tokens(entries.last)
+          name = parts[3] if parts.size == 4 && parts[2] == "aaa-server"
+          if name && schemes[name] && schemes[name][:servers].any?
+            record("tacacs.#{fact}", true, entries)
+          else
+            unknown("tacacs.#{fact}", entries, code: :tacacs_scheme_unresolved)
+          end
+        end
+        sections(/\Aadmin user\s+/).each do |section|
+          owner = tokens(section)[2]
+          passwords = matching(/\Apassword\b/, section.children)
+          credential(owner, "local_user", "unknown", nil, section) if passwords.empty?
+          passwords.each { |entry| stored_secret(owner, "local_user", entry) }
+        end
+      end
+
+      # 编码格式的存储语义未经确认时保持未知，不能猜测为明文。
+      def secret_format(value) = value.start_with?("$") ? "unknown" : "plain"
+
+      # 仅记录已配置秘密值的存储属性。
+      def stored_secret(owner, kind, entry)
+        parts = tokens(entry).drop(1)
+        valid = parts.size == 1 && !%w[cipher hash plain].include?(parts.first) || parts.size == 2 && %w[cipher hash plain].include?(parts.first)
+        unless valid && !parts.last.to_s.empty?
+          @facts.incomplete!(code: :invalid_credential_statement, lines: [ entry.line ])
+          credential(owner, kind, "unknown", nil, entry)
+          return false
+        end
+        format, secret = parts.size == 2 && %w[cipher hash plain].include?(parts.first) ? parts : [ secret_format(parts.first.to_s), parts.first ]
+        credential(owner, kind, format, secret, entry)
+        true
+      end
+
+      # 切分含引号的命令值，不将其作为 Ruby 代码解释。
+      def tokens(entry)
+        @tokens[entry.index] ||= Shellwords.shellsplit(entry.text)
+      rescue ArgumentError
+        @facts.incomplete!(code: :invalid_quoted_statement, lines: [ entry.line ])
+        cursor.mark(entry.index, state: :unsupported)
+        @tokens[entry.index] = []
+      end
+
+      # 校验可选参数，避免接受任意尾随命令片段。
+      def pairs(parts, flags:, keys:)
+        values = {}
+        until parts.empty?
+          key = parts.shift
+          return if values.key?(key)
+          if flags.include?(key)
+            values[key] = true
+          elsif keys.include?(key) && parts.any?
+            values[key] = parts.shift
+          else
+            return
+          end
+        end
+        values
+      end
+
+      # 将命名主机或网络对象归一化为地址区间。
+      def host_networks(parts)
+        return [ "0.0.0.0/0" ] if parts == [ "any" ]
+        if parts.size == 3 && parts.first == "range"
+          first, last = parts.drop(1).map { |value| IPAddr.new(value) }
+          raise ArgumentError unless first.ipv4? && last.ipv4? && first.prefix == 32 && last.prefix == 32 && first.to_i <= last.to_i
+          Acl.networks([ [ first.to_i, last.to_i ] ])
+        elsif parts.size == 1 || parts.size == 2
+          value = IPAddr.new(parts.join("/"))
+          raise ArgumentError unless value.ipv4?
+          [ "#{value}/#{value.prefix}" ]
+        else
+          raise ArgumentError
+        end
+      end
+    end
+  end
+end

data/lib/baseline/parsers/huawei.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Baseline
+  module Parsers
+    # 区分 Huawei VRP 的 AAA 嵌套、模板引用与 Comware 域语法。
+    class Huawei < Comware
+      private
+
+      # 匹配当前平台显式启用 SSH 的命令。
+      def ssh_enable = /\Astelnet server enable\z/
+      # 匹配当前平台显式禁用 SSH 的命令。
+      def ssh_disable = /\A(?:undo stelnet server enable|stelnet server disable)\z/
+      # 匹配当前平台 TACACS 配置块的根语句。
+      def tacacs_section = /\Ahwtacacs-server template\s+/
+      # 匹配认证、授权或计费服务器声明。
+      def tacacs_server = /\Ahwtacacs-server (?:authentication|authorization|accounting)\s+(\S+)/
+      # 匹配已配置 TACACS 密钥的存储格式。
+      def tacacs_key = /\Ahwtacacs-server (shared)-key (cipher|simple) (.+)\z/
+      # 要求具备当前平台 TACACS 方案使用的全部密钥角色。
+      def tacacs_keys_complete?(types) = types.include?("shared")
+      # 返回当前平台修改 SNMP 监听端口的命令模式。
+      def snmp_port_command = "snmp-agent udp-port"
+      # 从实际所属配置作用域中选取 AAA 声明。
+      def aaa_entries = sections(/\Aaaa\z/).flat_map(&:children)
+      # 解析认证域引用及其服务器组。
+      def authentication_domains
+        name = last(/\Adomain\s+(\S+)\s+admin\z/)
+        unless name
+          %w[login authorization accounting].each { |kind| unknown("tacacs.#{kind}", code: :authentication_domain_unknown) }
+          return []
+        end
+        aaa_entries.select { |entry| entry.text == "domain #{name}" }
+      end
+
+      # 解析 VRP 认证域引用，避免将 VRP 语法应用到 Comware。
+      def vrp_tacacs_references(kind, domains)
+        domains.filter_map do |domain|
+          template = last(/\Ahwtacacs-server\s+(\S+)\z/, domain.children)
+          scheme = last(/\A#{kind}-scheme\s+(\S+)\z/, domain.children)
+          next unless template && scheme
+          definition = aaa_entries.find { |entry| entry.text == "#{kind}-scheme #{scheme}" }
+          unless definition
+            unknown("tacacs.#{kind == 'authentication' ? 'login' : kind}", [ domain ], code: :tacacs_scheme_unresolved)
+            next
+          end
+          template if last(/\A#{kind}-mode\s+(.+)\z/, definition.children).to_s.split.first == "hwtacacs"
+        end
+      end
+
+      # 提取本地账号角色及凭据存储属性。
+      def accounts
+        matching(/\Alocal-user\s+\S+\s+password\b/, aaa_entries).each do |entry|
+          match = /\Alocal-user\s+(\S+)\s+password\s+(cipher|irreversible-cipher|simple)\s+(.+)\z/.match(entry.text)
+          if match
+            credential(match[1], "local_user", match[2], match[3], entry)
+          else
+            credential("local-user", "local_user", "unknown", nil, entry)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/baseline/parsers/palo_alto.rb

@@ -0,0 +1,335 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "../palo_alto_document"
+
+module Baseline
+  module Parsers
+    # 将 PAN-OS set 语法归纳为与配置块平台一致的事实。
+    class PaloAlto < Base
+      MANAGEMENT_SERVICES = %w[ssh telnet http https].freeze
+      RELEVANT = /\Aset (?:deviceconfig system |network (?:profiles interface-management-profile |interface )|shared (?:server-profile tacplus |authentication-profile |authentication-sequence |log-settings syslog )|mgt-config users )/
+
+      private
+
+      # 选择适合当前平台语法的文档词法解析器。
+      def configuration_document_class = PaloAltoDocument
+      # 匹配当前平台显式声明的主机名。
+      def hostname_pattern = /\Aset deviceconfig system hostname\s+(\S+)\z/
+
+      # 仅对管理配置子集分词一次，不处理无关的安全规则。
+      def access_lists
+        @statements = roots.filter_map do |entry|
+          next unless RELEVANT.match?(entry.text)
+          { entry: entry, tokens: Shellwords.shellsplit(entry.text).drop(1) }
+        rescue ArgumentError
+          @facts.incomplete!(code: :invalid_set_statement, lines: [ entry.line ])
+          nil
+        end
+        @interface_profiles = rows("network", "profiles", "interface-management-profile").group_by { |row| row[:tokens][3] }
+        @unresolved_profile_bindings = false
+        @profile_bindings = rows("network", "interface").select do |row|
+          index = row[:tokens].index("interface-management-profile")
+          next false unless index
+          valid = row[:tokens].size == index + 2 && !row[:tokens].last.empty?
+          unless valid
+            @unresolved_profile_bindings = true
+            @facts.incomplete!(code: :invalid_management_profile_binding, lines: [ row[:entry].line ])
+          end
+          valid
+        end
+        @active_profiles = @profile_bindings.map { |row| row[:tokens].last }.uniq
+      end
+
+      # 覆盖所有已配置的管理端点，包括数据接口。
+      def management
+        services = (MANAGEMENT_SERVICES + [ "snmp" ]).to_h { |name| [ name, service_state(name) ] }
+        record("ssh.enabled", services["ssh"], service_entries([ "ssh" ]))
+        record("services", services.slice("telnet", "http", "https"), service_entries(%w[telnet http https]))
+        record("snmp.enabled", services["snmp"], service_entries([ "snmp" ]))
+        permitted_sources("management.acl", MANAGEMENT_SERVICES)
+        permitted_sources("snmp.acl", [ "snmp" ])
+      end
+
+      # MGT 服务标志缺失时保持未知；明确启用的端点可证明服务已启用。
+      def service_state(name)
+        disabled = boolean(%w[deviceconfig system service] + [ "disable-#{name}" ])
+        global = disabled.nil? ? nil : !disabled
+        values = @active_profiles.map { |profile| profile_service(profile, name) }
+        return true if global == true || values.include?(true)
+        return false if global == false && values.all?(false)
+
+        nil
+      end
+
+      # 保留参与跨端点服务事实归纳的显式声明。
+      def service_entries(names)
+        names.flat_map do |name|
+          rows(*(%w[deviceconfig system service] + [ "disable-#{name}" ])) + @active_profiles.flat_map do |profile|
+            rows("network", "profiles", "interface-management-profile", profile, name)
+          end
+        end.map { |row| row[:entry] }
+      end
+
+      # 仅解释命名接口配置文件中显式声明的服务。
+      def profile_service(profile, name)
+        return unless @interface_profiles.key?(profile)
+        prefix = [ "network", "profiles", "interface-management-profile", profile, name ]
+        value = boolean(prefix)
+        return value unless value.nil?
+        return if rows(*prefix).any?
+        return false if value.nil? && @facts.complete?
+
+        nil
+      end
+
+      # 端点的原生允许列表适用于该端点所有已启用服务。
+      def permitted_sources(fact, services)
+        global = services.map { |name| boolean(%w[deviceconfig system service] + [ "disable-#{name}" ]) }
+        prefixes = global.all?(true) ? [] : [ %w[deviceconfig system permitted-ip] ]
+        unresolved = @unresolved_profile_bindings
+        @active_profiles.each do |profile|
+          enabled = services.map { |name| profile_service(profile, name) }
+          unresolved ||= enabled.include?(nil)
+          prefixes << [ "network", "profiles", "interface-management-profile", profile, "permitted-ip" ] if enabled.include?(true)
+        end
+        entries = []
+        sources = prefixes.flat_map do |prefix|
+          matches = rows(*prefix)
+          entries.concat(matches.map { |row| row[:entry] })
+          matches.empty? ? [ "0.0.0.0/0" ] : matches.map do |row|
+            tokens = row[:tokens].drop(prefix.size)
+            unless tokens.size == 1 || tokens.size == 3 && tokens[1] == "description"
+              unresolved = true
+              next
+            end
+            network = IPAddr.new(tokens.first)
+            unless network.ipv4?
+              unresolved = true
+              next
+            end
+            analyze(row[:entry]) { "#{network}/#{network.prefix}" }
+          rescue IPAddr::Error, ArgumentError
+            unresolved = true
+            nil
+          end
+        end.compact
+        bound = !sources.include?("0.0.0.0/0")
+        @facts.direct_acl(fact: fact, sources: unresolved ? nil : sources, bound: bound, lines: entries.map(&:line))
+        unknown("#{fact}.bound", code: :management_profile_unresolved) if unresolved
+        cursor.capture_many(entries.select { |entry| cursor.parsed?(entry.index) }, data: sources, path: [ "facts", "#{fact}.sources" ]) unless unresolved
+      end
+
+      # 采集明确启用或禁用的管理服务。
+      def services
+        ntp
+        syslog
+        snmp
+      end
+
+      # 认证要求必须覆盖全部已配置服务器，不能由任意一台满足来证明。
+      def ntp
+        entries = rows("deviceconfig", "system", "ntp-servers")
+        servers = entries.group_by { |row| row[:tokens][3] }.filter_map do |name, definitions|
+          prefix = [ "deviceconfig", "system", "ntp-servers", name ]
+          address = endpoint(prefix + [ "ntp-server-address" ])
+          unless address && %w[primary-ntp-server secondary-ntp-server].include?(name)
+            unknown("ntp.servers", definitions.map { |row| row[:entry] }, code: :ntp_server_unresolved)
+            unknown("ntp.authentication", definitions.map { |row| row[:entry] }, code: :ntp_server_unresolved)
+            next
+          end
+          { address: address, authenticated: ntp_authentication(prefix) }
+        end
+        record("ntp.servers", servers.map { |server| server[:address] }.uniq, entries.map { |row| row[:entry] })
+        if servers.any? && servers.none? { |server| server[:authenticated].nil? }
+          record("ntp.authentication", servers.all? { |server| server[:authenticated] })
+        end
+        record("ntp.source", scalar(%w[deviceconfig system route service ntp source interface]))
+      end
+
+      # 仅完整的认证声明才能证明所有服务器均满足认证要求。
+      def ntp_authentication(prefix)
+        entries = rows(*(prefix + [ "authentication-type" ]))
+        options = entries.map { |row| row[:tokens].drop(prefix.size + 1) }.uniq
+        return if options.empty?
+        return false if options == [ [ "none" ] ]
+        return true if options == [ [ "autokey" ] ]
+        key = options.find { |parts| parts.take(2) == %w[symmetric-key algorithm] }
+        id = options.find { |parts| parts.take(2) == %w[symmetric-key key-id] }
+        if options.size == 2 && key && id && key.size == 5 && %w[md5 sha1 sha256 sha512].include?(key[2]) &&
+            key[3] == "authentication-key" && !key[4].empty? && id.size == 3 && /\A\d+\z/.match?(id[2]) && id[2].to_i.between?(1, 65_534)
+          return true
+        end
+        unknown("ntp.authentication", entries.map { |row| row[:entry] }, code: :unsupported_ntp_authentication)
+        nil
+      end
+
+      # 配置的采集端地址与运行时日志转发成功是两类事实。
+      def syslog
+        entries = rows("shared", "log-settings", "syslog").select { |row| row[:tokens][4] == "server" }
+        servers = entries.group_by { |row| [ row[:tokens][3], row[:tokens][5] ] }.values.filter_map do |definitions|
+          address = definitions.reverse.find { |row| row[:tokens][6] == "server" }
+          value = address && endpoint(address[:tokens].take(7))
+          unknown("syslog.servers", definitions.map { |row| row[:entry] }, code: :syslog_server_unresolved) unless value
+          value
+        end
+        record("syslog.servers", servers.uniq, entries.map { |row| row[:entry] })
+        record("syslog.source", scalar(%w[deviceconfig system route service syslog source interface]))
+      end
+
+      # 轮询用户、团体字与出站 SNMP Trap 配置相互独立。
+      def snmp
+        prefix = %w[deviceconfig system snmp-setting access-setting version]
+        versions = rows(*prefix).map { |row| row[:tokens][prefix.size] }.compact.uniq
+        record("snmp.versions", versions)
+        communities = rows(*(prefix + %w[v2c snmp-community-string])).filter_map do |row|
+          unless row[:tokens].size == prefix.size + 3 && !row[:tokens].last.empty?
+            @facts.incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
+            next
+          end
+          credential("snmp-community", "snmp", secret_format(row[:tokens].last), row[:tokens].last, row[:entry])
+          { write: false, line: row[:entry].line }
+        end
+        users_prefix = prefix + %w[v3 users]
+        users = rows(*users_prefix).group_by { |row| row[:tokens][users_prefix.size] }.filter_map do |name, entries|
+          next unless name
+          user = { name: name, auth: false, priv: false, write: false, line: entries.first[:entry].line }
+          { "authpwd" => :auth, "privpwd" => :priv }.each do |field, key|
+            row = entries.reverse.find { |entry| entry[:tokens][users_prefix.size + 1] == field }
+            next unless row
+            unless row[:tokens].size == users_prefix.size + 3 && !row[:tokens].last.empty?
+              @facts.incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
+              next
+            end
+            user[key] = !row[:tokens].last.empty?
+            credential("snmp:#{name}", "snmp_user", secret_format(row[:tokens].last), row[:tokens].last, row[:entry])
+          end
+          user
+        end
+        @facts.snmp(communities: communities, users: users)
+        if (versions - %w[v2c v3]).any? || versions.size > 1
+          unknown_snmp_access(rows(*prefix).map { |row| row[:entry] }, code: :unsupported_snmp_version)
+        end
+      end
+
+      # 将选中的登录配置或有序认证序列解析为 TACACS 服务器。
+      def authentication
+        server_rows = rows("shared", "server-profile", "tacplus")
+        schemes = server_rows.group_by { |row| row[:tokens][3] }.to_h do |name, entries|
+          servers = entries.select { |row| row[:tokens][4] == "server" }.group_by { |row| row[:tokens][5] }
+          addresses = servers.values.filter_map do |server|
+            address = server.reverse.find { |row| row[:tokens][6] == "address" }
+            value = address && endpoint(address[:tokens].take(7))
+            unknown("tacacs.servers", server.map { |row| row[:entry] }, code: :tacacs_server_unresolved) unless value
+            value
+          end
+          unknown("tacacs.servers", entries.map { |row| row[:entry] }, code: :tacacs_server_unresolved) if servers.empty?
+          keys = servers.values.map do |server|
+            secret = server.reverse.find { |row| row[:tokens][6] == "secret" }
+            value = secret && scalar(secret[:tokens].take(7))
+            credential("tacacs:#{name}", "tacacs", secret_format(value), value, secret[:entry]) if value
+            !value.to_s.empty?
+          end
+          [ name, { servers: addresses, keys_present: keys.any? && keys.all?, line: entries.first[:entry].line } ]
+        end
+        record("tacacs.schemes", schemes)
+        record("tacacs.servers", schemes.values.flat_map { |scheme| scheme[:servers] }.uniq)
+        record("tacacs.keys_present", schemes.values.all? { |scheme| scheme[:keys_present] }) if schemes.any?
+        selected = scalar(%w[deviceconfig system authentication-profile])
+        login = selected ? tacacs_profile(selected, schemes) : false
+        login.nil? ? unknown("tacacs.login", code: :tacacs_scheme_unresolved) : record("tacacs.login", login)
+        # PAN-OS 角色映射与命令计费不能套用路由器式 AAA 开关语义。
+        %w[authorization accounting].each { |kind| unknown("tacacs.#{kind}", code: :platform_semantics_unresolved) }
+        accounts
+      end
+
+      # 认证序列具有顺序；后备 TACACS 不能视为首选 TACACS 登录。
+      def tacacs_profile(name, schemes)
+        prefix = [ "shared", "authentication-profile", name, "method" ]
+        methods = rows(*prefix)
+        if methods.empty?
+          sequence = rows("shared", "authentication-sequence", name, "authentication-profiles").last
+          return unless sequence
+          names = sequence[:tokens].drop(4).reject { |token| %w[[ ]].include?(token) }
+          return if names.empty? || names.first == name
+          return tacacs_profile_definition(names.first, schemes)
+        end
+        tacacs_profile_definition(name, schemes)
+      end
+
+      # 选中的 TACACS 配置必须至少解析出一台具有地址的服务器。
+      def tacacs_profile_definition(name, schemes)
+        prefix = [ "shared", "authentication-profile", name, "method" ]
+        methods = rows(*prefix)
+        return if methods.empty?
+        kinds = methods.map { |row| row[:tokens][4] }.uniq
+        return unless kinds.one?
+        return false if %w[none local-database radius ldap kerberos saml-idp cloud].include?(kinds.first)
+        return unless kinds.first == "tacplus"
+        target = scalar(prefix + %w[tacplus server-profile])
+        return unless target && schemes[target] && schemes[target][:servers].any?
+
+        true
+      end
+
+      # 仅存储凭据元数据，导出的加密值不进入报告。
+      def accounts
+        rows("mgt-config", "users").group_by { |row| row[:tokens][2] }.each do |name, entries|
+          row = entries.reverse.find { |entry| entry[:tokens][3] == "phash" }
+          unless row
+            external_profile = scalar([ "mgt-config", "users", name, "authentication-profile" ])
+            credential(name, "local_user", "unknown", nil, entries.first[:entry]) unless external_profile && !external_profile.empty?
+            next
+          end
+          secret = scalar(row[:tokens].take(4))
+          format = if /\A\$(?:1|5|6)\$[^$]+\$[^$]+\z/.match?(secret.to_s)
+            secret.start_with?("$1$") ? "5" : "hash"
+          else
+            "unknown"
+          end
+          credential(name, "local_user", format, secret, row[:entry])
+        end
+      end
+
+      # 识别 PAN-OS 带标记的加密 set 值；其余情况保留明文风险。
+      def secret_format(value) = value.start_with?("-AQ", "-AR") ? "cipher" : "plain"
+
+      # 按词元前缀选择归一化后的 PAN-OS set 命令行。
+      def rows(*prefix)
+        @statements.select { |row| row[:tokens].take(prefix.size) == prefix }
+      end
+
+      # 地址仅接受 IP 或 DNS 名称，不接受不完整转义或任意文本。
+      def endpoint(prefix)
+        value = scalar(prefix)
+        return if value.nil?
+        return value if server_address?(value)
+
+        @facts.incomplete!(code: :invalid_server_address, lines: rows(*prefix).map { |row| row[:entry].line })
+        nil
+      end
+
+      # 显式标志格式错误时，不能用平台默认值替代。
+      def boolean(prefix)
+        value = scalar(prefix)
+        return if value.nil?
+        return value == "yes" if %w[yes no].include?(value)
+
+        @facts.incomplete!(code: :invalid_set_statement, lines: rows(*prefix).map { |row| row[:entry].line })
+        nil
+      end
+
+      # 严格校验词元数量，避免尾随内容使错误配置被误判为已知事实。
+      def scalar(prefix)
+        row = rows(*prefix).last
+        return unless row
+        unless row[:tokens].size == prefix.size + 1
+          @facts.incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
+          return
+        end
+
+        analyze(row[:entry]) { row[:tokens].last }
+      end
+    end
+  end
+end