baseline-rb 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd8f1c556c5d833d33eba1f4d54c9a8ce7dea4ee1f95eef35bf6065c135f55f8
-  data.tar.gz: c7ed62903830c46fc8dcf1abb781cc2a5fdf3542e46b77e2b946cd5d637234ea
+  metadata.gz: 2386adb307215040a989dccfcba29d403bd31f28d400cbb6ba9f34215c13e7bb
+  data.tar.gz: 975bc0b9e0136528a8af240d21fe623068ec334c3f444746ce84dcbc25e097e6
 SHA512:
-  metadata.gz: 1f762bc4f539ec4c8793138b300b5b218173e9334e0499cff4c18f5ffe4a89c5cc0cc6c0f51dc1bcb2482f36197b695428dfc7841559a1e392a29d9aa6629d7f
-  data.tar.gz: 7de1e45690c5c3dd8369aee56b9af939670866ebbef859c434a6efc75617808d2658398c4c6ec570437ea0da6ff731d4ba5c33e842274f6d22f84fc27b7909f4
+  metadata.gz: 81a940f8b6b82df076c2c1f541ee6b5f7e95154095ca3ccffc2b70580d129388d5ec40c6c6f9a926c30f813c31d5cc39f669f2c7f487dda94718954707e5f5f9
+  data.tar.gz: cc66c2181c786de9341533ae65caf8214d0e8d28d40628c7b22b9161e3189174144a38cb58f8599dd2b0848cc511b3ebb31a5634e807b957ef074201eee1624e

data/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Changes to the public contract are recorded here. Versions follow Semantic Versioning.
 
+## 0.2.1 (2026-10-17)
+
+- Reject duplicate normalized context keys before policy selection; preserve source lines and cursor captures for scalar NTP and Syslog configuration facts.
+
 ## 0.2.0 (2026-10-17)
 
 ### Changed

data/README-zh.md

@@ -73,6 +73,8 @@ puts report.to_text
 
 解析辅助方法直接描述提取意图：`matching_blocks`、`configured_values`、`last_configured_value`、`configured_state` 和 `acl_source_network`。SNMP 写权限规则统一为 `snmp.write_enabled`，禁止写入时配置 `expected: false`。自定义策略需迁移旧键 `snmp.read_only`；旧类名与规则键不保留兼容别名。
 
+上下文允许字符串或符号键，但归一化后重复的键会抛出 `ArgumentError`，避免依赖插入顺序选择设备策略。
+
 `complete: true` 表示调用方提供了完整快照。报告通过 `input_complete` 保留这项声明，与解析状态分别记录。不完整的有序 ACL 可能缺少更早的 deny，因此不能仅根据已见 permit 判断来源越界，此时保持 `unknown`。
 
 ## 开发与测试

data/README.md

@@ -73,6 +73,8 @@ Vendor-specific code lives in a vendor namespace: `Baseline::Hillstone::Parser`
 
 Parser helpers describe the evidence they extract: `matching_blocks`, `configured_values`, `last_configured_value`, `configured_state`, and `acl_source_network`. SNMP write permission uses the policy key `snmp.write_enabled` (`expected: false` to prohibit writes). Update custom policies that used `snmp.read_only`; old class names and rule keys have no compatibility aliases.
 
+Context accepts string or symbol keys, but rejects duplicate keys after normalization with `ArgumentError` rather than selecting a device policy by insertion order.
+
 `complete: true` asserts that the caller supplied the entire snapshot. Reports retain that assertion as `input_complete`, separately from parser status. A partial ordered ACL cannot prove an out-of-policy source: an unseen earlier deny may change its meaning, so the finding stays `unknown`.
 
 ## Development and tests

data/lib/baseline/cisco/parser.rb

@@ -85,12 +85,12 @@ module Baseline
       # 采集明确启用或禁用的管理服务。
       def services
         record("ntp.servers", configured_values(/\Antp server(?: vrf \S+)?\s+(\S+)/), matching_blocks(/\Antp server/))
-        record("ntp.authentication", configured_state(/\Antp authenticate\z/, /\Ano ntp authenticate\z/))
-        record("ntp.source", last_configured_value(/\Antp source(?:-interface)?\s+(\S+)\z/))
+        record_configured_state("ntp.authentication", /\Antp authenticate\z/, /\Ano ntp authenticate\z/)
+        record_configured_value("ntp.source", /\Antp source(?:-interface)?\s+(\S+)\z/)
         hosts = configured_values(nxos? ? /\Alogging server\s+(\S+)/ : /\Alogging host(?: ipv6)?\s+(\S+)/)
         hosts |= configured_values(/\Alogging\s+(\d+(?:\.\d+){3})\z/) unless nxos?
         record("syslog.servers", hosts, matching_blocks(/\Alogging (?:host|server)/))
-        record("syslog.source", last_configured_value(/\Alogging source-interface\s+(\S+)\z/))
+        record_configured_value("syslog.source", /\Alogging source-interface\s+(\S+)\z/)
         snmp = matching_blocks(/\Asnmp-server\b/)
         enabled = nxos? ? configured_state(/\Asnmp-server protocol enable\z/, /\Ano snmp-server protocol enable\z/) : nil
         enabled = nxos? || snmp.any? if enabled.nil? && (@facts.complete? || snmp.any?)

data/lib/baseline/comware/parser.rb

@@ -79,12 +79,12 @@ module Baseline
       # 采集明确启用或禁用的管理服务。
       def services
         record("ntp.servers", configured_values(/\Antp-service unicast-server\s+(\S+)/), matching_blocks(/\Antp-service unicast-server/))
-        record("ntp.authentication", configured_state(/\Antp-service authentication enable\z/, /\Aundo ntp-service authentication enable\z/))
-        record("ntp.source", last_configured_value(/\Antp-service source(?:-interface)?\s+(\S+)\z/))
+        record_configured_state("ntp.authentication", /\Antp-service authentication enable\z/, /\Aundo ntp-service authentication enable\z/)
+        record_configured_value("ntp.source", /\Antp-service source(?:-interface)?\s+(\S+)\z/)
         # 从日志服务器中排除 source 子命令，并保留评估所需的归纳事实。
         hosts = configured_values(/\Ainfo-center loghost\s+(\S+)/) - [ "source" ]
         record("syslog.servers", hosts, matching_blocks(/\Ainfo-center loghost/))
-        record("syslog.source", last_configured_value(/\Ainfo-center loghost source\s+(\S+)\z/))
+        record_configured_value("syslog.source", /\Ainfo-center loghost source\s+(\S+)\z/)
         enabled = configured_state(/\Asnmp-agent(?:\s|\z)/, /\Aundo snmp-agent\z/)
         record("snmp.enabled", enabled.nil? && @facts.complete? ? false : enabled)
         versions = last_configured_value(/\Asnmp-agent sys-info version\s+(.+)\z/)&.split

data/lib/baseline/evaluator.rb

@@ -15,6 +15,9 @@ module Baseline
     # 评估适用基线规则，分别报告合规结果与证据覆盖率。
     def call(configuration:, context: {})
       raise ArgumentError, "Invalid baseline context" unless context.is_a?(Hash)
+      unless context.keys.all? { |key| key.is_a?(String) || key.is_a?(Symbol) } && context.keys.map(&:to_s).uniq.size == context.size
+        raise ArgumentError, "Ambiguous baseline context"
+      end
       context = context.transform_keys(&:to_s).merge("vendor" => configuration.platform)
       unless (context.keys - Policy::SCOPES).empty? && context.values.all? { |value| value.is_a?(String) && !value.strip.empty? }
         raise ArgumentError, "Invalid baseline context"

data/lib/baseline/hillstone/parser.rb

@@ -95,8 +95,8 @@ module Baseline
           analyze(entry) { parts[2] }
         end
         record("ntp.servers", servers.uniq, entries)
-        record("ntp.authentication", configured_state(/\Antp authentication\z/, /\Ano ntp authentication\z/))
-        record("ntp.source", sources.first) if sources.any? && sources.first && sources.uniq.one?
+        record_configured_state("ntp.authentication", /\Antp authentication\z/, /\Ano ntp authentication\z/)
+        record("ntp.source", sources.first, entries) if sources.any? && sources.first && sources.uniq.one?
         unknown("ntp", matching_blocks(/\Ano ntp server\b/)) if matching_blocks(/\Ano ntp server\b/).any?
       end
 
@@ -124,13 +124,13 @@ module Baseline
           analyze(entry) { parts[2] }
         end
         record("syslog.servers", servers.uniq, entries)
-        record("syslog.source", sources.first) if sources.any? && sources.first && sources.uniq.one?
+        record("syslog.source", sources.first, entries) if sources.any? && sources.first && sources.uniq.one?
         unknown("syslog", matching_blocks(/\Ano logging syslog\b/)) if matching_blocks(/\Ano logging syslog\b/).any?
       end
 
       # 轮询主机权限独立于出站 Trap 接收端。
       def snmp
-        record("snmp.enabled", configured_state(/\Asnmp-server manager\z/, /\Ano snmp-server manager\z/))
+        record_configured_state("snmp.enabled", /\Asnmp-server manager\z/, /\Ano snmp-server manager\z/)
         entries = matching_blocks(/\Asnmp-server host\b/)
         versions, sources, communities = [], [], []
         entries.each do |entry|

data/lib/baseline/palo_alto/parser.rb

@@ -144,9 +144,9 @@ module Baseline
         end
         record("ntp.servers", servers.map { |server| server[:address] }.uniq, entries.map { |row| row[:entry] })
         if servers.any? && servers.none? { |server| server[:authenticated].nil? }
-          record("ntp.authentication", servers.all? { |server| server[:authenticated] })
+          record("ntp.authentication", servers.all? { |server| server[:authenticated] }, entries.map { |row| row[:entry] })
         end
-        record("ntp.source", scalar(%w[deviceconfig system route service ntp source interface]))
+        record_scalar("ntp.source", %w[deviceconfig system route service ntp source interface])
       end
 
       # 仅完整的认证声明才能证明所有服务器均满足认证要求。
@@ -176,7 +176,7 @@ module Baseline
           value
         end
         record("syslog.servers", servers.uniq, entries.map { |row| row[:entry] })
-        record("syslog.source", scalar(%w[deviceconfig system route service syslog source interface]))
+        record_scalar("syslog.source", %w[deviceconfig system route service syslog source interface])
       end
 
       # 轮询用户、团体字与出站 SNMP Trap 配置相互独立。
@@ -321,6 +321,12 @@ module Baseline
         nil
       end
 
+      # 标量语法与事实来源共享同一条最终声明。
+      def record_scalar(path, prefix)
+        row = rows(*prefix).last
+        record(path, scalar(prefix), row ? [ row[:entry] ] : [])
+      end
+
       # 严格校验词元数量，避免尾随内容使错误配置被误判为已知事实。
       def scalar(prefix)
         row = rows(*prefix).last

data/lib/baseline/parser.rb

@@ -98,6 +98,20 @@ module Baseline
       analyze(entry) { entry.text[pattern, 1] }
     end
 
+    # 保存最后生效的标量声明及对应来源，不将被覆盖的声明作为当前证据。
+    def record_configured_value(path, pattern, entries = roots)
+      entry = entries.reverse.find { |candidate| !candidate.text[pattern, 1].nil? }
+      return unless entry
+
+      record(path, analyze(entry) { entry.text[pattern, 1] }, [ entry ])
+    end
+
+    # 启用状态可能由正向或撤销声明决定，保留所有参与归约的来源。
+    def record_configured_state(path, on, off)
+      entries = roots.select { |entry| on.match?(entry.text) || off.match?(entry.text) }
+      record(path, configured_state(on, off, entries), entries)
+    end
+
     # 保存归一化事实及其来源证据。
     def record(path, value, entries = [])
       return unless @facts.record(path, value, lines: entries.map(&:line))

data/lib/baseline/version.rb

@@ -2,5 +2,5 @@
 
 module Baseline
   # 公开包版本，供 RubyGems 元数据和运行时调用方共用。
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: baseline-rb
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Gatework contributors